<commit_before># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html
# Reference: https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/
# Reference: https://otx.alienvault.com/pulse/5d8209f4a87bf2c8ae01f829

zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion

# Reference: https://twitter.com/fbgwls245/status/1180291089074282496
# Reference: https://app.any.run/tasks/f279fdb8-614e-4074-92c4-ddf01afbf86f/

nemty.hk

# Reference: https://twitter.com/fbgwls245/status/1206515293721387009
# Reference: https://www.virustotal.com/gui/file/06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3/detection

nemty10.hk

# Reference: https://www.bitdefender.com/files/News/CaseStudies/study/302/Bitdefender-WhitePaper-RDP-Abusers.pdf
# Reference: https://otx.alienvault.com/pulse/5dfa406c021cc56f098db797

mandevelopm.org
megabitcoin.life
mytele.ga
workpc.biz

# Reference: https://app.any.run/tasks/b8d618d7-66d8-4486-bfdd-e7d0aef82952/

nemty.top

# Reference: https://blog.talosintelligence.com/2020/02/threat-roundup-0214-0221.html (# Win.Packed.Mikey-7586709-0)

0300ssm0300.xyz

# Reference: https://twitter.com/MBThreatIntel/status/1232828557040029696

nemty11.hk

# Reference: https://app.any.run/tasks/92a980da-0cd9-4cdd-bad4-7a6f8ce12ebf/

marsdefenseandscience.com

# Reference: https://twitter.com/ffforward/status/1196343552810397696
# Reference: https://app.any.run/tasks/f882f02a-39db-4d7f-84ac-0df93a7ea397/
# Reference: https://app.any.run/tasks/3f9126b6-fbaa-4668-b965-c4b2bb927c28/

172.16.58.3:4760
4760.webhop.me
drajacoffee.com/images/produk/q

# Generic

/public/gate?data=<commit_msg>Update nemty.txt<commit_after># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html
# Reference: https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/
# Reference: https://otx.alienvault.com/pulse/5d8209f4a87bf2c8ae01f829

zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion

# Reference: https://twitter.com/fbgwls245/status/1180291089074282496
# Reference: https://app.any.run/tasks/f279fdb8-614e-4074-92c4-ddf01afbf86f/

nemty.hk

# Reference: https://twitter.com/fbgwls245/status/1206515293721387009
# Reference: https://www.virustotal.com/gui/file/06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3/detection

nemty10.hk

# Reference: https://www.bitdefender.com/files/News/CaseStudies/study/302/Bitdefender-WhitePaper-RDP-Abusers.pdf
# Reference: https://otx.alienvault.com/pulse/5dfa406c021cc56f098db797

mandevelopm.org
megabitcoin.life
mytele.ga
workpc.biz

# Reference: https://app.any.run/tasks/b8d618d7-66d8-4486-bfdd-e7d0aef82952/

nemty.top

# Reference: https://blog.talosintelligence.com/2020/02/threat-roundup-0214-0221.html (# Win.Packed.Mikey-7586709-0)

0300ssm0300.xyz

# Reference: https://twitter.com/MBThreatIntel/status/1232828557040029696

nemty11.hk

# Reference: https://app.any.run/tasks/92a980da-0cd9-4cdd-bad4-7a6f8ce12ebf/

marsdefenseandscience.com

# Reference: https://twitter.com/ffforward/status/1196343552810397696
# Reference: https://app.any.run/tasks/f882f02a-39db-4d7f-84ac-0df93a7ea397/
# Reference: https://app.any.run/tasks/3f9126b6-fbaa-4668-b965-c4b2bb927c28/

172.16.58.3:4760
4760.webhop.me
drajacoffee.com/images/produk/q

# Reference: https://www.virustotal.com/gui/file/b7c4445fc8ed51df42dced4c032ebcf4687576945679076505074503720e51f2/detection

farid19394.xyz

# Generic

/public/gate?data=
{'fraction_non_alphanumeric': 0.13410852713178295, 'fraction_numerical': 0.17157622739018089, 'mean_word_length': 5.538851351351352, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 35, 'lorem ipsum': 0, 'www.': 9, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6321998', 'n_tokens_mistral': 2056, 'n_tokens_neox': 1662, 'n_words': 129}