>samit_hota
Back to IOCs

Indicators of Compromise

12 INDICATORSwin.grandoreiro

Grandoreiro — Indicators of Compromise

Samit Hota·
#ioc#grandoreiro

Overview

Indicators of compromise associated with Grandoreiro. 12 indicators listed below.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port54.91.129.132:5074August 11, 202675%
ip:port54.91.129.132:41694August 11, 202675%
ip:port54.91.223.28:1065August 11, 202675%
ip:port54.91.223.28:41667August 11, 202675%
ip:port54.80.154.193:6490August 11, 202675%
ip:port54.80.154.193:19941August 11, 202675%
ip:port54.91.129.132:4403August 11, 202675%
domainvmi3474645.contaboserver.netAugust 8, 2026100%
domainvmi3462151.contaboserver.netAugust 7, 2026100%
ip:port54.80.154.193:5751August 6, 202675%
domainvmi3467394.contaboserver.netAugust 6, 2026100%
ip:port54.91.223.28:6675August 5, 202675%

Related content

IOCs

404 Keylogger — Indicators of Compromise

IOCs

5.t Downloader — Indicators of Compromise

IOCs

Aberebot — Indicators of Compromise

IOCs

ACR Stealer — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call