AutoHotKey Leveraged by Metamorfo/Mekotio Banking Trojan

Indicators of Compromise

Infection
Domain	IP
hxxp://priyadarsiniculturalsociety[.]com//images/?hash=%email%	51[.]81[.]75[.]131
hxxp://hothiphopbeats[.]com//images/?hash=%email%	209[.]40[.]193[.]208
hXXp://www3[.]santoandre[.]sp[.]gov[.]br/assistencia/wp-folha/TGR	189[.]1[.]163[.]21

Payload
Domain	IP
hxxp://critichotshot[.]com/loc/	162[.]255[.]118[.]194
hxxps://thaipoliticstoday[.]com/saudi-news-tq1vh/	172[.]67[.]181[.]248
hXXp://web[.]groupe-convergence[.]com/	213[.]186[.]33[.]69
hXXp://www[.]aralimp[.]com[.]br/wp-content/upgrade/TGR/SII_000492106006B8[.]zip	177[.]12[.]164[.]108
hXXp://umc24[.]club//wp-content/gallery/	217[.]160[.]0[.]235
hXXps://leopard-hunt[.]com//wp-content/userr/20AVW5RSJKV8948[.]zip	104[.]21[.]63[.]133 - 172[.]67[.]145[.]198
–	89[.]44[.]9[.]254
–	104[.]214[.]107[.]176

C2	IP
es[.]sslhermanos[.]com	45[.]147[.]229[.]128 - 45[.]147[.]231[.]119
hxxp://40[.]112[.]173[.]53/again/?oriudfjdfij88	40[.]112[.]173[.]53