<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/Racco42/status/1044562743519584257

ahyanari.duckdns.org

# Reference: https://twitter.com/Racco42/status/1040353263579738113

hicham9risa.duckdns.org

# Reference: https://twitter.com/securitydoggo/status/938750437913776128

blackuser.zapto.org

# Reference: https://twitter.com/securitydoggo/status/919906367254728706

localical.duckdns.org

# Reference: https://twitter.com/alphasoc/status/905590729774309377
# Reference: https://www.hybrid-analysis.com/sample/dce8919a6c8460b43894701e86259a4291afd50530aed579ff4709de40d32d41?environmentId=100

total-virus.myq-see.com

# Reference: https://twitter.com/Racco42/status/1095739216582070274

jidennagrace.ddns.net

# Reference: https://twitter.com/Racco42/status/1097498140452810752

unknownsoft.hopto.org

# Reference: https://twitter.com/Racco42/status/1108660192407928833

172.16.17.32:8897

# Reference: https://twitter.com/securitydoggo/status/821328472945606656

baderke.hopto.org

# Reference: https://twitter.com/James_inthe_box/status/1099845879387701248

172.16.17.32:9935

# Reference: https://twitter.com/James_inthe_box/status/1113510929738547200

unknownsoft.duckdns.org

# Reference: https://www.hybrid-analysis.com/sample/c967628280e9021ad5c5da6b0174c4ba4c3b34dafc936951ce67f71d479f14a9?environmentId=100

vigo147.duckdns.org

# Reference: https://twitter.com/James_inthe_box/status/1066354476032782337

mikon.ddns.net

# Reference: https://twitter.com/HONKONE_K/status/1115138016836587521
# Reference: https://app.any.run/tasks/1e12de01-e208-48dc-890a-1767e6521fe4

firefoxsystem.sytes.net
192.168.3.11:2000

# Reference: https://twitter.com/Racco42/status/1102879193631731713

172.16.17.32:8769

# Reference: https://twitter.com/pmelson/status/1141318191483904004

soucdtevoceumcuzao.duckdns.org

# Reference: https://github.com/edchavarro/RAT_IoCs/blob/master/README.md

172.16.58.3:2000
115.duckdns.org

# Reference: https://www.virustotal.com/gui/file/1b6515d5d9a1eda84fa8446b67136a38f135202390eb48b0f2457653a75f6409/detection

172.16.31.10:3360
pro111.ddns.net

# Reference: https://www.virustotal.com/gui/file/f2f4b5810518d30c63ad4a9414f6218cb79bffa55fd7924be03aaa38523242dd/detection

money1234.duckdns.org

# Reference: https://www.virustotal.com/gui/file/32a148fe79c3725ba6d942fcf7831e3c7dc7a1ecf713d4a00e29cf16de8bb762/detection

172.16.17.32:3360
192.168.127.12:3360

# Reference: https://www.virustotal.com/gui/file/6ba459128261265c1be418c654deeafb9d8906877c7b7561003dca11d911e66c/detection

172.16.31.10:7974

# Reference: https://www.virustotal.com/gui/file/62a14d579dc19797680324b806c7b79fe0a21bc230f92a6452fc90d47127c163/detection

172.16.17.32:1116
sosclient.duckdns.org

# Reference: https://www.virustotal.com/gui/file/ec5bf201bc21e14b3b4759c2420a751f38489bfc98d3e250b26f93b279aeb812/detection

anahowaana.theworkpc.com

# Reference: https://www.virustotal.com/gui/file/9419903da3ba711c2a897b3d8a22150b0c203e8a7a6a5badfd59bb9dae03da53/detection

elinakos.kozow.com

# Reference: https://www.virustotal.com/gui/file/c1d5e335396556c6ac592e6612b7860c9c7b3d3d9d6ce340f41295848b547c69/detection

192.168.127.12:1337
papu3.ddns.net

# Reference: https://www.virustotal.com/gui/file/611e3ca28cf6c29a310c9e1151df0c8e7386d9d6accb781aa221648cf407b325/detection

192.168.3.11:3360

# Reference: https://www.virustotal.com/gui/file/f7a2611f5a564b25204e9369e5e1bd1829385eca483ef4f675550e5b3a5b5ff2/detection

172.16.17.32:7974

# Reference: https://www.virustotal.com/gui/file/f18d8ca644e9a9ef1eb3207085d1e1b1c020255ad14e0921745c3b3594c927c9/detection

172.16.31.10:7974

# Reference: https://www.virustotal.com/gui/file/cb80b7a552b846e1a7c53bbc50f96c11a1478c40d208fe62bf7b0353b04c008e/detection

172.16.58.3:7974

# Reference: https://blog.talosintelligence.com/2020/01/vivin-cryptomining-campaigns.html
# Reference: https://otx.alienvault.com/pulse/5e29b7189d749995b2d4ea71

192.168.3.11:8002
192.168.3.11:8094
winlogon.publicvm.com
spoolsv.linkpc.net
mstsc.publicvm.com
mmc.publicvm.com
lsass.publicvm.com
dwm.publicvm.com
csrss.publicvm.com
csrss.linkpc.net
m9c.net
ddl3.data.hu

# Reference: https://www.virustotal.com/gui/file/f7e36848143feafb8e7ef877f2ba4365692713d9cdc81c57b57909bb3178fbd1/detection

1192.168.3.11:7974

# Reference: https://www.virustotal.com/gui/file/2f30a7efe9ee331445aef032f5b854069ef626fd13057b1dc3293d9874b8e225/detection

172.16.17.32:515

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1223790397744390146
# Reference: https://www.virustotal.com/gui/file/ea59411c081c6fa100b6d57f1dfa06221834dd22243272e8fd450e89655b0d49/detection

172.16.31.10:6

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1227071037633945600
# Reference: https://www.virustotal.com/gui/file/f82ca18a56a4737387ef58f7fb3118f541ceb0614b51fcf167d2e7c3dc6f2323/detection

172.16.17.32:8880
seko.vipers.pw

# Reference: https://www.virustotal.com/gui/file/03571693645ff1f2b2bf934a239ab23fb180e552f41526dfdbe6e437d973b518/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/991c0f534a52bbfb98dc63e7dc586467916e5cc752587ce0e48a364859b3f614/detection

172.16.58.3:8880

# Reference: https://www.virustotal.com/gui/file/b2235c99c2db088ae60f0d33fd7223b2fcd0098331c3d1f7c62009276f30e277/detection

172.16.58.3:8880

# Reference: https://www.virustotal.com/gui/file/539646179984c441b9ca00e863e6dfcf3b72fcbeae42819b5c54932a6e1a692a/detection

172.16.58.3:8880
192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/c2ab0d81e8a1b35ff2dab1c3dcc5e4f14f4f4605f78bf1ccc529dc007644f53a/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/5837b9bd5c895ce9012432d59d2efe0e1f3c8020ccc11dac2a35af3171ca3136/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/794b3f7e0a58720c93dbb3d63ea1237dc59819e75cac70343710c7a138f5fb2a/detection

172.16.31.10:8880

# Reference: https://www.virustotal.com/gui/file/682dfa834c1f658722c6fd4ef80ce3c1cdc34ffd1dbc7467096dad6a65881fa5/detection

172.16.31.10:8880

# Reference: https://www.virustotal.com/gui/file/6a1e57b777aa56010e79408ca469c9a8c6359d8d44fe46d3c08c61710cae028b/detection

172.16.31.10:8880

# Generic trail

/Vre<commit_msg>Update vjw0rm.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/Racco42/status/1044562743519584257

ahyanari.duckdns.org

# Reference: https://twitter.com/Racco42/status/1040353263579738113

hicham9risa.duckdns.org

# Reference: https://twitter.com/securitydoggo/status/938750437913776128

blackuser.zapto.org

# Reference: https://twitter.com/securitydoggo/status/919906367254728706

localical.duckdns.org

# Reference: https://twitter.com/alphasoc/status/905590729774309377
# Reference: https://www.hybrid-analysis.com/sample/dce8919a6c8460b43894701e86259a4291afd50530aed579ff4709de40d32d41?environmentId=100

total-virus.myq-see.com

# Reference: https://twitter.com/Racco42/status/1095739216582070274

jidennagrace.ddns.net

# Reference: https://twitter.com/Racco42/status/1097498140452810752

unknownsoft.hopto.org

# Reference: https://twitter.com/Racco42/status/1108660192407928833

172.16.17.32:8897

# Reference: https://twitter.com/securitydoggo/status/821328472945606656

baderke.hopto.org

# Reference: https://twitter.com/James_inthe_box/status/1099845879387701248

172.16.17.32:9935

# Reference: https://twitter.com/James_inthe_box/status/1113510929738547200

unknownsoft.duckdns.org

# Reference: https://www.hybrid-analysis.com/sample/c967628280e9021ad5c5da6b0174c4ba4c3b34dafc936951ce67f71d479f14a9?environmentId=100

vigo147.duckdns.org

# Reference: https://twitter.com/James_inthe_box/status/1066354476032782337

mikon.ddns.net

# Reference: https://twitter.com/HONKONE_K/status/1115138016836587521
# Reference: https://app.any.run/tasks/1e12de01-e208-48dc-890a-1767e6521fe4

firefoxsystem.sytes.net
192.168.3.11:2000

# Reference: https://twitter.com/Racco42/status/1102879193631731713

172.16.17.32:8769

# Reference: https://twitter.com/pmelson/status/1141318191483904004

soucdtevoceumcuzao.duckdns.org

# Reference: https://github.com/edchavarro/RAT_IoCs/blob/master/README.md

172.16.58.3:2000
115.duckdns.org

# Reference: https://www.virustotal.com/gui/file/1b6515d5d9a1eda84fa8446b67136a38f135202390eb48b0f2457653a75f6409/detection

172.16.31.10:3360
pro111.ddns.net

# Reference: https://www.virustotal.com/gui/file/f2f4b5810518d30c63ad4a9414f6218cb79bffa55fd7924be03aaa38523242dd/detection

money1234.duckdns.org

# Reference: https://www.virustotal.com/gui/file/32a148fe79c3725ba6d942fcf7831e3c7dc7a1ecf713d4a00e29cf16de8bb762/detection

172.16.17.32:3360
192.168.127.12:3360

# Reference: https://www.virustotal.com/gui/file/6ba459128261265c1be418c654deeafb9d8906877c7b7561003dca11d911e66c/detection

172.16.31.10:7974

# Reference: https://www.virustotal.com/gui/file/62a14d579dc19797680324b806c7b79fe0a21bc230f92a6452fc90d47127c163/detection

172.16.17.32:1116
sosclient.duckdns.org

# Reference: https://www.virustotal.com/gui/file/ec5bf201bc21e14b3b4759c2420a751f38489bfc98d3e250b26f93b279aeb812/detection

anahowaana.theworkpc.com

# Reference: https://www.virustotal.com/gui/file/9419903da3ba711c2a897b3d8a22150b0c203e8a7a6a5badfd59bb9dae03da53/detection

elinakos.kozow.com

# Reference: https://www.virustotal.com/gui/file/c1d5e335396556c6ac592e6612b7860c9c7b3d3d9d6ce340f41295848b547c69/detection

192.168.127.12:1337
papu3.ddns.net

# Reference: https://www.virustotal.com/gui/file/611e3ca28cf6c29a310c9e1151df0c8e7386d9d6accb781aa221648cf407b325/detection

192.168.3.11:3360

# Reference: https://www.virustotal.com/gui/file/f7a2611f5a564b25204e9369e5e1bd1829385eca483ef4f675550e5b3a5b5ff2/detection

172.16.17.32:7974

# Reference: https://www.virustotal.com/gui/file/f18d8ca644e9a9ef1eb3207085d1e1b1c020255ad14e0921745c3b3594c927c9/detection

172.16.31.10:7974

# Reference: https://www.virustotal.com/gui/file/cb80b7a552b846e1a7c53bbc50f96c11a1478c40d208fe62bf7b0353b04c008e/detection

172.16.17.3203:7974

# Reference: https://blog.talosintelligence.com/2020/01/vivin-cryptomining-campaigns.html
# Reference: https://otx.alienvault.com/pulse/5e29b7189d749995b2d4ea71

192.168.3.11:8002
192.168.3.11:8094
winlogon.publicvm.com
spoolsv.linkpc.net
mstsc.publicvm.com
mmc.publicvm.com
lsass.publicvm.com
dwm.publicvm.com
csrss.publicvm.com
csrss.linkpc.net
m9c.net
ddl3.data.hu

# Reference: https://www.virustotal.com/gui/file/f7e36848143feafb8e7ef877f2ba4365692713d9cdc81c57b57909bb3178fbd1/detection

172.16.31.10:7974

# Reference: https://www.virustotal.com/gui/file/2f30a7efe9ee331445aef032f5b854069ef626fd13057b1dc3293d9874b8e225/detection

172.16.17.32:515

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1223790397744390146
# Reference: https://www.virustotal.com/gui/file/ea59411c081c6fa100b6d57f1dfa06221834dd22243272e8fd450e89655b0d49/detection

172.16.31.10:6

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1227071037633945600
# Reference: https://www.virustotal.com/gui/file/f82ca18a56a4737387ef58f7fb3118f541ceb0614b51fcf167d2e7c3dc6f2323/detection

172.16.17.32:8880
seko.vipers.pw

# Reference: https://www.virustotal.com/gui/file/03571693645ff1f2b2bf934a239ab23fb180e552f41526dfdbe6e437d973b518/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/991c0f534a52bbfb98dc63e7dc586467916e5cc752587ce0e48a364859b3f614/detection

172.16.58.3:8880

# Reference: https://www.virustotal.com/gui/file/b2235c99c2db088ae60f0d33fd7223b2fcd0098331c3d1f7c62009276f30e277/detection

172.16.58.3:8880

# Reference: https://www.virustotal.com/gui/file/539646179984c441b9ca00e863e6dfcf3b72fcbeae42819b5c54932a6e1a692a/detection

172.16.58.3:8880
192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/c2ab0d81e8a1b35ff2dab1c3dcc5e4f14f4f4605f78bf1ccc529dc007644f53a/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/5837b9bd5c895ce9012432d59d2efe0e1f3c8020ccc11dac2a35af3171ca3136/detection

192.168.3.11:8880

# Reference: https://www.virustotal.com/gui/file/794b3f7e0a58720c93dbb3d63ea1237dc59819e75cac70343710c7a138f5fb2a/detection

172.16.31.10:8880

# Reference: https://www.virustotal.com/gui/file/682dfa834c1f658722c6fd4ef80ce3c1cdc34ffd1dbc7467096dad6a65881fa5/detection

172.16.31.10:8880

# Reference: https://www.virustotal.com/gui/file/6a1e57b777aa56010e79408ca469c9a8c6359d8d44fe46d3c08c61710cae028b/detection

172.16.31.10:8880

# Reference: https://www.virustotal.com/gui/file/76cf11c50de23ebaac2438fb32feae89a92ec9e123b0881d96086dd8bbd207d3/detection

172.16.31.10:8880

# Generic trail

/Vre
{'fraction_non_alphanumeric': 0.11177114272315147, 'fraction_numerical': 0.3059246521807097, 'mean_word_length': 6.64336917562724, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 99, 'lorem ipsum': 0, 'www.': 55, 'xml': 0}, 'pii_count': 63, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '906939', 'n_tokens_mistral': 7993, 'n_tokens_neox': 5927, 'n_words': 353}