<commit_before># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: lorec53

# CERT-UA: UAC-0056

# Reference: https://blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader/
# Reference: https://otx.alienvault.com/pulse/6073a320686d4c625b3c94db

380222001.xyz
68468438438.xyz
name1d.site
update-0019992.ru

# Reference: https://twitter.com/ViriBack/status/1383531638785679364
# Reference: https://app.any.run/tasks/10d320aa-5591-42ac-a23a-d3301a15a3df/

bashervlmao.to
proapi.services
qzp.me

# Reference: http://report.threatbook.cn/ST.pdf

baiden00.ru
update3d.xyz

# Reference: https://cert.gov.ua/article/18273

eumr.site

# Reference: https://twitter.com/souiten/status/1491620147626328064
# Reference: https://www.virustotal.com/gui/file/e7614325ee4042c456d3170f224924905661d1f5388f9a6bbb524737c646eb23/detection

3237.site

# Reference: https://twitter.com/s1ckb017/status/1494047314792665088

flexspace.app

# Reference: https://twitter.com/angel11VR/status/1381568772419563527

gosloto.site

# Reference: https://www.virustotal.com/gui/file/461eeadbe118b5ad64a62f2991a8bd66bdcd3dd1808cd7070871e7cc02effad7/detection

1924.site

# Reference: https://www.virustotal.com/gui/file/2b15ade9de6fb993149f27c802bb5bc95ad3fc1ca5f2e86622a044cf3541a70d/detection

2330.site

# Reference: https://www.virustotal.com/gui/ip-address/172.16.58.3/relations

2055.site

# Reference: https://www.virustotal.com/gui/file/a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969/detection

1020.site

# Generic

/hvwstxaaov/index.php
/hvwstxaaov/gate.php<commit_msg>Update saintbot.txt<commit_after># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: lorec53

# CERT-UA: UAC-0056

# Reference: https://blog.malwarebytes.com/threat-analysis/2021/04/a-deep-dive-into-saint-bot-downloader/
# Reference: https://otx.alienvault.com/pulse/6073a320686d4c625b3c94db

380222001.xyz
68468438438.xyz
name1d.site
update-0019992.ru

# Reference: https://twitter.com/ViriBack/status/1383531638785679364
# Reference: https://app.any.run/tasks/10d320aa-5591-42ac-a23a-d3301a15a3df/

bashervlmao.to
proapi.services
qzp.me

# Reference: http://report.threatbook.cn/ST.pdf

baiden00.ru
update3d.xyz

# Reference: https://cert.gov.ua/article/18273

eumr.site

# Reference: https://twitter.com/souiten/status/1491620147626328064
# Reference: https://www.virustotal.com/gui/file/e7614325ee4042c456d3170f224924905661d1f5388f9a6bbb524737c646eb23/detection

3237.site

# Reference: https://twitter.com/s1ckb017/status/1494047314792665088

flexspace.app

# Reference: https://twitter.com/angel11VR/status/1381568772419563527

gosloto.site

# Reference: https://www.virustotal.com/gui/file/461eeadbe118b5ad64a62f2991a8bd66bdcd3dd1808cd7070871e7cc02effad7/detection

1924.site

# Reference: https://www.virustotal.com/gui/file/2b15ade9de6fb993149f27c802bb5bc95ad3fc1ca5f2e86622a044cf3541a70d/detection

2330.site

# Reference: https://www.virustotal.com/gui/ip-address/172.16.58.3/relations

2055.site

# Reference: https://www.virustotal.com/gui/file/a4b705baac8bb2c0d2bc111eae9735fb8586d6d1dab050f3c89fb12589470969/detection

1020.site

# Reference: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
# Reference: https://otx.alienvault.com/pulse/621ccab95c4b796eeea2ee78

1000019.xyz
1017.site
1120.site
1202.site
almamaterbook.ru
bgicovid19.com
buking.site
noch.website
orpod.ru
otrs.website
polk.website
sinoptik.site
sony-vaio.ru
superiortermpapers.org
update0019992.ru
webleads.pro

# Generic

/hvwstxaaov/index.php
/hvwstxaaov/gate.php
{'fraction_non_alphanumeric': 0.11973333333333333, 'fraction_numerical': 0.2032, 'mean_word_length': 5.592267135325132, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 30, 'lorem ipsum': 0, 'www.': 10, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6065830', 'n_tokens_mistral': 2032, 'n_tokens_neox': 1602, 'n_words': 152}