Lokibot_IOCs_2020-06-11_23_13.txt

#Lokibot #malware #OSINT #IOC

SHA256:
2f8ae4e9d703ab40dff6f817c1f945b4c8f219ff996016cc2fb5e83373aa0a8c
a5db1adb41c2ea72b72cc35a725a44f37c6be628bb6ce7de757b9fd5dce38d94
ac1d11b9f62df5a936d80ac7e5cf77dd593ea0e3945267b5cb4cf880f5658364
71783b84d5b281d0a29c22e88fcaefe01538bdc7d27a5e57d2ccb2042e3a2dab
df7ab8328b29bd160ea83233b9c3edbd3c5fd770485aac8c60f38cb976ee8536
e928d2bdf307f2c1c48a51980df7d3d602ed5e4855753de312f1a33996f0a516



IPs:
180[.]214[.]238[.]5
185[.]207[.]38[.]108
31[.]184[.]254[.]119
185[.]55[.]227[.]103
185[.]47[.]204[.]168
194[.]180[.]224[.]87
208[.]91[.]198[.]143
208[.]91[.]199[.]223
208[.]91[.]199[.]224
208[.]91[.]199[.]225


Domains:
admindepartment[.]ir
b2bseller[.]ga
irangoodshop[.]com
smtp[.]itanlprotec[.]com

URL:
http://180[.]214[.]238[.]5/chprvdoc/svchost[.]exe
http://admindepartment[.]ir/kenlaw/five/fre[.]php
http://b2bseller[.]ga/choolee/gate[.]php
http://irangoodshop[.]com/biaa/fre[.]php