Lokibot_IOCs_2020-02-07_14_06.txt

#Lokibot #malware #OSINT #IOC

SHA256:
1d9b668e956e75ca9edc68dd478757943d0a3f60bccb89a49b8aed84354638ae
4a1a21945f4706a5d5eb762d6e86b85ea18ebec90ed240bc2e310561e5bf4495
84e2fe66f9b37b9969358e66f3a290d5027d60a17fe3b0122cc13abb17eab5f0
f842d00e482d7451467091cc782fe4e2662427ee0db499ff44908de3846b546c
2026f257fe24b522a9768867c9d4ef832a3a3f5123fdfee64990f86c9e88e862
341a8930576cd1c73c50b5135439c69dc698489808dcac067506bb284946330d
9640cc34245c446f8aea2f9228dff29f3e25143d3d21adc7d02524f4af98b49e


IPs:
107[.]175[.]150[.]73
185[.]159[.]153[.]76
192[.]3[.]152[.]160
198[.]23[.]200[.]241
52[.]109[.]20[.]1
52[.]109[.]2[.]18
95[.]163[.]214[.]100

Domains:
batlxt[.]org
chnfsub2thdymanglobalbusinessexytwo[.]duckdns[.]org
irubix[.]ir

URL:
http://107[.]175[.]150[.]73/~giftioz/[.]kobovoih/fre[.]php
http://198[.]23[.]200[.]241/~power13/[.]sixnrpq/fre[.]php
http://batlxt[.]org/y8x/pin[.]php
http://chnfsub2thdymanglobalbusinessexytwo[.]duckdns[.]org/chfrnd2doc/regasm[.]exe
http://irubix[.]ir/wp-content/layout/fre[.]php