2021-08-17 Lokibot IOCs

THREAT ATTRIBUTION:  LOKIBOT

SUBJECTS OBSERVED
Request For Quotation

SENDERS OBSERVED
sales@xivcompany.com

MALDOC FILE HASHES
RFQ.xlsx
002d0988a1663e6478a6ce913d8f69b0

LOKIBOT PAYLOAD DOWNLOAD URLS
http://iurd.pe/ruilopsa/ghuqacj.exe

LOKIBOT PAYLOAD FILE HASHES
ghuqacj.exe
fe770281a03e67ac21618a85c3ea5bd3

Renamed to:
97071E.exe
fe770281a03e67ac21618a85c3ea5bd3

ADDITIONAL FILE HASH
97071E.hdb
01076004fe62329509fdd43f3168249a

LOKIBOT C2
http://arkt.xyz/mrtker4/w2/fre.php