#Agenttesla #Lokibot #Hawkeye #Opendir
http://stevecommunication.ga

#AgentTesla
	url	http://stevecommunication.ga/bebenlo/bebe.exe
	sha256	9d00792332be816feaa684ca0d31f355eb395af269fb4ed730f71bff50df2df1
	sha1	d10c0c342c9b37e93836f4d80df683b8fee9d5ee
	md5	2f6dd356eee502cdecc3fff3a37b3145

Connections
	domain	lookchem.ga
	ip	198.38.91.123

	url	http://stevecommunication.ga/bebenlo/bebelod.exe
	sha256	6a8611539b62d006beb8a7cc62ed9cd69ec45f8f060f494d9a731e5920244ff6
	sha1	b598a05d9ef29c0ab4e25a6fc98f451b5a54d461
	md5	1547cf288eadf53664b7e0953f219b67

Connections
	domain	ibis.whogohost.com
	ip	5.153.47.250

	url	http://stevecommunication.ga/bebenlo/bebzchym.exe
	sha256	63454caa6e8186f03ece8b98c9aef5ee204fa3b1427f4d598bdc6c90b7417189
	sha1	b5c6aed4693676dc14e0955373634430f210fa1e
	md5	f93fd18073a0129f6ef5f1e0f272b30e

Connections
        domain	lookchem.ga
	ip	198.38.91.123

	url	http://stevecommunication.ga/bebenlo/benblo.exe
	sha256	8b4b9a1ebac119ea313e72f2580574c298768feddcc62999563ba52e0f67835f
	sha1	710ebdbd36c99c19672f96b2e15d5e81aabfbe95
	md5	2bb30a0cd0b3d30a1a01820c8a034bd0

	url	http://stevecommunication.ga/bebenlo/benco.exe
	sha256	1b5a3902228cd5fb89f7601d5ce209454b0e88af074d0c232352d805a184ec5b
	sha1	0e1de5789e2d8f2a42f246f273c2cfbbfda3b27a
	md5	f6b8c8992d5b1c04b383e6dccfbf45fd

Connections
	ip	198.38.91.123
        domain	lookchem.ga

	url	http://stevecommunication.ga/bebenlo/bencosept.exe
	sha256	eab11951d58ce5ddefbb0f62b3896667820156d4a70393b77da1c3aa0d89f67a
	sha1	dcebca112a3c27ad5c9ba8a57a8820d038e3d329
	md5	af8176620265ea0bfd0b04d88eaa8346
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Temp\MyOtApp\MyOtApp.exe	c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

Connections
	ip	198.38.91.123
	domain	lookchem.ga

	url	http://stevecommunication.ga/bebenlo/benx.exe
	sha256	231c3e975fa4ed44c2c1a035679ccf002468b740500b1c71522dbb69465533e2
	sha1	e81d05e8f9c654bfd7ec231ed9a9f56c08d8eab6
	md5	05e7bc1507a9e8d42ab53773a574d0a8
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Temp\MyOtApp\MyOtApp.exe	c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
	sha256	C:\Users\admin\AppData\Local\Temp\OBl.exe	c2cae82e01d954e3a50feaebcd3f75de7416a851ea855d6f0e8aaac84a507ca3

Connections
	ip	5.153.47.250
        domain	ibis.whogohost.com

	url	http://stevecommunication.ga/biky/bikyifil.exe
	sha256	ca9477a41b53f2009fd061bb518fa12ff7580b3c0578778672af0734049f1797
	sha1	1a87649fe22fe3c77d72dbc97d0d106149277971
	md5	31d72dbeae3a0c064b685548c9726b4f

Connections
	ip	208.91.199.225
	domain	smtp.jessecommunication.xyz

	url	http://stevecommunication.ga/smart2/SmartTWO.exe
	sha256	fb1e54e8f323cf074cb402b7a55bbfad204df77cef32026254438bf452a502c8
	sha1	b0166f9b30c751177f089e391e6a24c7f779c4df
	md5	32d8645483ee4ae4af314714ac3bb3e6

Connections
	ip	198.38.91.123
        domain	lookchem.ga

	url	http://stevecommunication.ga/smart2/hdkhle.exe
	sha256	2ef2efa422e2271ecf61773274ff82087988c20358f623f91c298b7888f929e5
	sha1	a5a074232c778de3efc762d9f229e2a433b611a7
	md5	319f5b21cf0901e825ea3eb10a473411

Connections
        domain	smtp.zoho.com
	ip	65.154.166.201

	url	http://stevecommunication.ga/smart/smartONE.exe
	sha256	72d1dba41f68a623dc843080c4ce8153287bb22149a74e5d73f5d5027e9c6a50
	sha1	986c8987d6e22cf4d420bd9e1c9c0126fcaf42a9
	md5	9c04a03163a04d13970b7faa5efc972b

Connections
        domain	uzojesseonline.gq
	ip	195.20.50.133

#hawkeye
	url	http://stevecommunication.ga/smart/yuoghn.exe
	sha256	c108d4d0f8213a3a4f50a95188a0ea861d7b87431e28745bb25ad7e13d9861fd
	sha1	fcc8203f86d5ce368bfc5670562eaafb2850d32c
	md5	018dd121e4d4df1455fb54f74f92031c

Connections
        domain	smtp.yandex.com
	ip	93.158.134.38

#Lokibot
	url	http://stevecommunication.ga/jeff/jefy.exe
	sha256	7c7d40b6e024d074acb2aa9b21e60e5a2e132424cdd4f23432013cfadc368392
	sha1	b8f8f255719060c601c7c1160f1c15e44398d36e
	md5	337492de5439c6d745aa3444eda4b1e6
Connections
	ip	62.108.37.205
HTTP/HTTPS requests
	url	http://62.108.37.205/jeff/five/fre.php

	url	http://stevecommunication.ga/frankbrown/frankbro.exe
	sha256	cec3eac7b09197a281063cd9abcfa35c705049c5ef1b169f4de5e71a96666e86
	sha1	ef26eb0ff38adc7cb798a7daf6a48918c07e40a1
	md5	060e540d20762c85c635a2cbee98f2fe
DNS requests
	domain	jessecloudserver.xyz
Connections
	ip	62.108.37.205
HTTP/HTTPS requests
	url	http://jessecloudserver.xyz/frankbrown/five/fre.php

	url	http://stevecommunication.ga/hommie/homie.exe
	sha256	deb5d363a4e807022565f959543703df3ed75f50a5b2151da46d1c7b98095416
	sha1	9bb4e8c81f1b59f1217f80f5065ec14d87613c97
	md5	66deb5f927d195ec920de5e373170fe0
DNS requests
	domain	modestcourierservices.xyz

	url	http://stevecommunication.ga/hommie/mehommie.exe
	sha256	7c1348b6d92fc5e1b4947798055693fdf930ca295cb13874ecf1a5b3c3273ba9
	sha1	f638fb5e15e5c31392313c8b14e6c19987bbc452
	md5	d8c3e89f32213aa8f4e7aceac4c93b52
DNS requests
	domain	modestcourierservices.xyz

	url	http://stevecommunication.ga/frank/frankies.exe
	sha256	484304d92e3ffd14dcd5afb31d9c5a20441b72837908ffa04b654b15568a63cd
	sha1	4b0f989383999404cee2aac59f30c35d6a7cea01
	md5	99d151ae242a8a798a7d0c672eda3a8c
Connections
	ip	62.108.37.205
HTTP/HTTPS requests
	url	http://62.108.37.205/frank/five/fre.php

	url	http://stevecommunication.ga/frank/profrank.exe
	sha256	2ee09e83708675f07c477f9699e9de1881d17731011088ae609212002465831a
	sha1	fddc2a59caeb1f0554eea685446956f8f8cce499
	md5	7fba196d5b1d156a98a46ad4d2ba954f
Connections
	ip	62.108.37.205
HTTP/HTTPS requests
	url	http://62.108.37.205/frank/five/fre.php

Actors:
bebenlo@lookchem.ga
bebenlo@modestcourierservices.xyz
chubysky@jessecommunication.xyz
smart2@lookchem.ga
blessing18@zoho.com
smart@uzojesseonline.gq