Skip to main content

Grandoreiro

Malware Family

867 indicators of compromise attributed to Grandoreiro across abuse.ch threat intelligence feeds.

Domains

3

IPs

5

URLs

1

Hashes

858

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
vmi3474645.contaboserver.netdomain
vmi3462151.contaboserver.netdomain
vmi3467394.contaboserver.netdomain
54.91.129.132ip
54.91.223.28ip
54.80.154.193ip
3.208.19.130ip
174.129.92.184ip
https://vmi3554101.contaboserver.net/d4ndocs/gateway.phpurl
f251a01b631d64ef9a896f83ce5bbc76b1b9abaf89f6fffca8b899132a3309c5hash
63bd37bfa964a20bb9f871f4e1ddb44d77378dbbae8a186307bbc78a409edd1ehash
2b31b70eb66392ab67c98054b86affd33fa6b79d3b605e0b2eafb28ae32296d6hash
9e1cf99f286827c3f03d4f15e81465080133589e0b75128ac19a7f961fef268ehash
385d0cce9b68285eb8cb131cd6d65dfa918c84d8bf0da745fb25042b36f566b6hash
6298c54689640ce9a35488dd44f5004519b10f8bea956a23ee4333cddc98d21ehash
ed9741866abcfd9f839d952847c43e3379b417436d9c3fc6462c981138883981hash
66640bf128157e02b20adc63ab45530b0416024bef7d8f3377ec943b89427c25hash
21de0b631e5af183cbd888714a782840322932a0d65eb5ee8a187a3e99396460hash
6df38d35a9977f9b07be98a328c1f3387e3cac1621c4231d37311126983dec88hash
7d79f2a54370c557f40147a5ad17b87202c7a2e4285d46ea5f9d694fe0ca7e9ahash
cee065a78a687c149c7c7410b734290b33ed7d665121de0283311b2c868fa117hash
9a58bc4eda32e677cd1b7fec00c1f39c2b828d05742b3a7ed4cefd44f9066746hash
c91e29d23b0def3ab87e0909976d22f2f1b0cac9fbabe17985c131e4f064e245hash
a248fd58182c2fd90be7f23b2172fb582e63ba38bc200f87b96a414a12c48cb8hash
be0dd1b8ee37599e612cb9bfaa044843533645c08a88d9f192045be004ee56cfhash
0954690f5a72e77d7e9eb6dbf13af91d4176b2de17f2d8859b3fc7d3a509f8bbhash
794ad887a11149f438ecc886b5dfc6fa0503c26b8e63f48cf0bf2dcc2cdc58bbhash
8784b2752484600ae5b6d30d59ba895bf4f48c27ce0a9d6d9bc4c82a1e37b9a7hash
981bab458980d5c4a518ea8ca809b40c152ba39774a03220c5d68b990eebaaf7hash

Another file to check? Run a file hash reputation check.