<commit_before># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.trendmicro.com/vinfo/hk-en/security/news/virtualization-and-cloud/coinminer-ddos-bot-attack-docker-daemon-ports

kaiserfranz.cc
irc.kaiserfranz.cc

# Reference: https://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/
# Reference: https://www.virustotal.com/gui/file/1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b/detection
# Reference: https://otx.alienvault.com/pulse/5f3aa1e047a40112d69f524d

6z5yegpuwg2j4len.tor2web.su
dockerupdate.anondns.net
sayhi.bplace.net
teamtnt.red
teamtntisback.anondns.net

# Reference: https://otx.alienvault.com/pulse/5f58ff8e319f59c6e46496b1
# Reference: https://www.virustotal.com/gui/file/0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d/detection

192.168.127.12:443

# Reference: https://techcommunity.microsoft.com/t5/azure-security-center/teamtnt-activity-targets-weave-scope-deployments/ba-p/1645968
# Reference: https://otx.alienvault.com/pulse/5f5925486084399c89bda0ba
# Reference: https://www.virustotal.com/gui/domain/rhuancarlos.inforgeneses.inf.br/detection

rhuancarlos.inforgeneses.inf.br

# Reference: https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/
# Reference: https://otx.alienvault.com/pulse/5f7b7cfff93fa60ed6fd4ff4

/BLACK-T/setup/
/BLACK-T/beta
/BLACK-T/CleanUpThisBox
/BLACK-T/SetUpTheBLACK-T
/BLACK-T/SystemMod
/SetUpTheBLACK-T
/only_for_stats/dup.php

# Reference: https://twitter.com/r3dbU7z/status/1351256623814205441

sampwn.anondns.net
/SamPwn

# Reference: https://twitter.com/r3dbU7z/status/1350479393135734787
# Reference: https://www.cadosecurity.com/post/botnet-deploys-cloud-and-container-attack-techniques
# Reference: https://otx.alienvault.com/pulse/6007314fbb9b9daf8afc505c

http://192.168.3.11
borg.wtf
<commit_msg>Update elf_teamtnt.txt<commit_after># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.trendmicro.com/vinfo/hk-en/security/news/virtualization-and-cloud/coinminer-ddos-bot-attack-docker-daemon-ports
# Reference: https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool

kaiserfranz.cc
irc.kaiserfranz.cc
/ziggy_spread

# Reference: https://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/
# Reference: https://www.virustotal.com/gui/file/1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b/detection
# Reference: https://otx.alienvault.com/pulse/5f3aa1e047a40112d69f524d

6z5yegpuwg2j4len.tor2web.su
dockerupdate.anondns.net
sayhi.bplace.net
teamtnt.red
teamtntisback.anondns.net

# Reference: https://otx.alienvault.com/pulse/5f58ff8e319f59c6e46496b1
# Reference: https://www.virustotal.com/gui/file/0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d/detection

192.168.127.12:443

# Reference: https://techcommunity.microsoft.com/t5/azure-security-center/teamtnt-activity-targets-weave-scope-deployments/ba-p/1645968
# Reference: https://otx.alienvault.com/pulse/5f5925486084399c89bda0ba
# Reference: https://www.virustotal.com/gui/domain/rhuancarlos.inforgeneses.inf.br/detection

rhuancarlos.inforgeneses.inf.br

# Reference: https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/
# Reference: https://otx.alienvault.com/pulse/5f7b7cfff93fa60ed6fd4ff4

/BLACK-T/setup/
/BLACK-T/beta
/BLACK-T/CleanUpThisBox
/BLACK-T/SetUpTheBLACK-T
/BLACK-T/SystemMod
/SetUpTheBLACK-T
/only_for_stats/dup.php

# Reference: https://twitter.com/r3dbU7z/status/1351256623814205441

sampwn.anondns.net
/SamPwn

# Reference: https://twitter.com/r3dbU7z/status/1350479393135734787
# Reference: https://www.cadosecurity.com/post/botnet-deploys-cloud-and-container-attack-techniques
# Reference: https://otx.alienvault.com/pulse/6007314fbb9b9daf8afc505c

http://192.168.3.11
borg.wtf

{'fraction_non_alphanumeric': 0.13215426185212478, 'fraction_numerical': 0.11692458855318104, 'mean_word_length': 5.6644844517184945, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 33, 'lorem ipsum': 0, 'www.': 12, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3816304', 'n_tokens_mistral': 1995, 'n_tokens_neox': 1718, 'n_words': 132}