Lokibot_IOCs_2020-02-06_11_59.txt

#Lokibot #malware #OSINT #IOC

SHA256:
01db9153811dd0e64710c8cf48660e203cb18e61b0f0d7c58d57077e0eb1e6ed
272bc9e4391e6d1d0d0ae7a5ed0206cef5a93650444aabc2457e3f88d1a589d8
58210661f5958434b885e763ece9e9ce96383e2ee7f10301402fd133af51da71
6f01863ec18a810b71e84ac739fdd4a30dc1a06aec0aa2099809f65397e45346
77e6cf28a0731590ab1cf12f1fcbb99fd45054587574c7dc4e91d311a6f514bf
7ad23e9606d9ef7e717320f211a3b18d9e2601472c4a84567bcc32f504467e2f
90f60221095cebeab0f1416c4d11beead181a96c2e31d980b360c0d84f8f6bed
bcd8fb284e878f0ca679fef3b86e8e4111642f7ef8b7b23a8fa1b7f82593f4a3
c56d87eeb958b7f1f90f7f80323b0b681bd690e5dc0f96ad0c1b55678aeb3ccc

IPs:
107[.]175[.]150[.]73
23[.]249[.]164[.]109
66[.]85[.]173[.]38
95[.]163[.]214[.]100

Domains:
batlxt[.]org
fiftint[.]com
kungmndyglobalinvestmentgooglednsaddress[.]duckdns[.]org
mikeservers[.]eu

URL:
http://107[.]175[.]150[.]73/~giftioz/[.]kolier/fre[.]php
http://batlxt[.]org/1g7/pin[.]php
http://fiftint[.]com/v-2/pin[.]php
http://kungmndyglobalinvestmentgooglednsaddress[.]duckdns[.]org/kungdoc/winlog[.]exe
http://mikeservers[.]eu/kings/five/fre[.]php