Lokibot_IOCs_2020-04-30_04_29.txt

#Lokibot #malware #OSINT #IOC

SHA256:
14c6975973e9fb0aff97637da62210c53c51b2a291a2f4d0d199bdfdabb2811c
23245166f5cc80f533d3b50ac54e614aa646a5547ae956b9a8957113b446d42c
32be0e4b55a774d72dbc5424fa71ebc1e1291b38a0be883bc30903e2a93e1c50
362516346eff1fd0c1f1d178245f637b0fe0b5887fbe70c792b11f1cedccc04b
5277f548824b981ce73fd2257942e24413b6c9033cbff5209d9b85e3ea250f2f
5f3bf25dd33d18d2a9dde6b89e9852e215fc33abda81a85224d069a29cf979d6
9f0be5d2f26bc34037299e2dbb731a4dd16b24f91d5276cea8b51a5d99f6e8aa
a0329d74c73b55b9e6eb9fd90e2e5ea6c09822251444d2a43b7acbd9ac0e0911
d51840953f6ba82b4285527d838e0034d9ffa1dc1de94b73ed56e5e0b33e5eb5
da362c114efb6a8f52b94b4554a7dcf6594eb2408f16d22cbd3cdbc520eb86eb
eedce65a904fb3d54611ec105ee077f4219ef89d9dd8e76e7aeda87be833c4da

IPs:
104[.]237[.]252[.]50
185[.]55[.]225[.]242
213[.]108[.]241[.]164
88[.]218[.]16[.]218
88[.]218[.]16[.]57
89[.]208[.]228[.]121

Domains:
avertonbullk[.]com
iranssp[.]ir
modcloudserver[.]eu
toyo-at-jp[.]info

URL:
http://avertonbullk[.]com/ig3/fre[.]php
http://iranssp[.]ir/df/fre[.]php
http://modcloudserver[.]eu/petercody/five/fre[.]php