Grandoreiro Malware IOCs

Indicators of Compromise (IOCs)

--vbs file (1st stage)--
vbs: Torrentz5B88BC75AD1DA330A74FFA2ED717DB0B3AE71CCC.vbs
MD5: 46D601A56103BF0A623D1C937EAB41D8772DE644

-- 2nd stage ISO file --
http://192.]236.147.100:1950/Inufturiols.iso

-- Final payload --
Filename: Inufturiols.exe
MD5: 1f861de0794cd020072150db618da154
SHA1: c3f70025857ac7eca467412d35f17fc5ec10f659

-- C2-web-traffic--
104.168.190.]164
http://104.]168.190.164:9050/$rdgate?ID=B3030080574A43BE857DBE13C21D7110
http://104.]168.190.164:9050/$rdgate?ACTION=HELLO
http://104.]168.190.164:9050/$rdgate?ACTION=START&ID=B3030080574A43BE857DBE13C21D7110