<commit_before># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: unc2628, unc2659, .rh94k, hades ransomware

# Reference: https://twitter.com/JAMESWT_MHT/status/1331588273643413505
# Reference: https://twitter.com/JAMESWT_MHT/status/1331599141877805059
# Reference: https://app.any.run/tasks/056d7a48-4e36-4b7f-a4d0-c895841b66ce/
# Reference: https://www.virustotal.com/gui/file/6d656f110246990d10fe0b0132704b1323859d4003f2b1d5d03f665c710b8fd3/detection
# Reference: https://www.virustotal.com/gui/file/afb22b1ff281c085b60052831ead0a0ed300fac0160f87851dacc67d4e158178/detection

securebestapp20.com

# Reference: https://twitter.com/petrovic082/status/1364149992101982209
# Reference: https://app.any.run/tasks/101a068a-9893-4c8b-95e5-efbb98b9128c/
# Reference: https://www.virustotal.com/gui/domain/catsdegree.com/detection
# Reference: https://www.virustotal.com/gui/file/12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975/detection

catsdegree.com
temisleyes.com

# Reference: https://app.any.run/tasks/230f18f6-ec8c-4654-8d0a-410e1e769b05/

a0525271.xsph.ru

# Reference: https://www.virustotal.com/gui/file/b6855793aebdd821a7f368585335cb132a043d30cb1f8dccceb5d2127ed4b9a4/detection

baroquetees.com
rumahsia.com

# Reference: https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
# Reference: https://otx.alienvault.com/pulse/609c0ee81a709f9d805ce108

http://172.16.58.3
http://172.16.31.10
172.16.17.32:443
172.16.58.3:443
192.168.3.11:443
athaliaoriginals.com
ctxinit.azureedge.net
darksidedxcftmqa.onion
darksidfqzcuhtk2.onion
koliz.xyz
lagrom.com
los-web.xyz
sol-doc.xyz

# Reference: https://twitter.com/darktracer_int/status/1394244644150472711

erc4xzvrchka5izw.onion

# Reference: https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted

172.16.58.3:22
darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion
542lsflqr4hgurjx.onion
Erc4xzvrchka5izw.onion
Fylszpcqfel7joif.onion
Gtmx56k4hutn3ikv.onion
Ixltdyumdlthrtgx.onion
Ru4rklde4l4sghhf.onion
hxt254aygrsziejn.onion

# Reference: https://github.com/ti-research-io/ti/blob/main/ioc_extender/BB_Darkside.json

sparkle-dallas.com

# Reference: https://www.virustotal.com/gui/file/b1fec85f2708e55f07e6301f8ac4f61457d8b5706dc72705d89a9001ee90ca5d/detection

xiiideath.com<commit_msg>Update darkside.txt<commit_after># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: unc2628, unc2659, .rh94k, hades ransomware

# Reference: https://twitter.com/JAMESWT_MHT/status/1331588273643413505
# Reference: https://twitter.com/JAMESWT_MHT/status/1331599141877805059
# Reference: https://app.any.run/tasks/056d7a48-4e36-4b7f-a4d0-c895841b66ce/
# Reference: https://www.virustotal.com/gui/file/6d656f110246990d10fe0b0132704b1323859d4003f2b1d5d03f665c710b8fd3/detection
# Reference: https://www.virustotal.com/gui/file/afb22b1ff281c085b60052831ead0a0ed300fac0160f87851dacc67d4e158178/detection

securebestapp20.com

# Reference: https://twitter.com/petrovic082/status/1364149992101982209
# Reference: https://app.any.run/tasks/101a068a-9893-4c8b-95e5-efbb98b9128c/
# Reference: https://www.virustotal.com/gui/domain/catsdegree.com/detection
# Reference: https://www.virustotal.com/gui/file/12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975/detection

catsdegree.com
temisleyes.com

# Reference: https://app.any.run/tasks/230f18f6-ec8c-4654-8d0a-410e1e769b05/

a0525271.xsph.ru

# Reference: https://www.virustotal.com/gui/file/b6855793aebdd821a7f368585335cb132a043d30cb1f8dccceb5d2127ed4b9a4/detection

baroquetees.com
rumahsia.com

# Reference: https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
# Reference: https://otx.alienvault.com/pulse/609c0ee81a709f9d805ce108

http://172.16.58.3
http://172.16.31.10
172.16.17.32:443
172.16.58.3:443
192.168.3.11:443
athaliaoriginals.com
ctxinit.azureedge.net
darksidedxcftmqa.onion
darksidfqzcuhtk2.onion
koliz.xyz
lagrom.com
los-web.xyz
sol-doc.xyz

# Reference: https://twitter.com/darktracer_int/status/1394244644150472711

erc4xzvrchka5izw.onion

# Reference: https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted

172.16.58.3:22
darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion
542lsflqr4hgurjx.onion
Erc4xzvrchka5izw.onion
Fylszpcqfel7joif.onion
Gtmx56k4hutn3ikv.onion
Ixltdyumdlthrtgx.onion
Ru4rklde4l4sghhf.onion
hxt254aygrsziejn.onion

# Reference: https://github.com/ti-research-io/ti/blob/main/ioc_extender/BB_Darkside.json

sparkle-dallas.com

# Reference: https://www.virustotal.com/gui/file/b1fec85f2708e55f07e6301f8ac4f61457d8b5706dc72705d89a9001ee90ca5d/detection

xiiideath.com

# Reference: https://tria.ge/220720-n29q4sfad4

khfsk3ffg3av3rha.onion

# Reference: https://tria.ge/220720-n2p2psfac5

m6s6axasulxjkhzh.onion

# Reference: https://tria.ge/220720-q4fl6agbbr

o76s3m7l5ogig4u5.onion
{'fraction_non_alphanumeric': 0.1171993911719939, 'fraction_numerical': 0.19425418569254185, 'mean_word_length': 6.271092669432918, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 39, 'lorem ipsum': 0, 'www.': 14, 'xml': 0}, 'pii_count': 12, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5197618', 'n_tokens_mistral': 2917, 'n_tokens_neox': 2367, 'n_words': 179}