<commit_before># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: splinter

# Reference: https://github.com/BishopFox/sliver
# Reference: https://www.virustotal.com/gui/file/1c9cc7108392ca716a522ccfc93c15724fb18bafe8350301c2ced04803aa4040/detection

172.16.58.3:8888
letshack.ddns.net

# Reference: https://twitter.com/1ZRR4H/status/1450913137352392712
# Reference: https://pastebin.com/ZpsxzLZc
# Reference: https://www.malware-traffic-analysis.net/2021/10/20/index.html
# Reference: https://www.proofpoint.com/us/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity

http://192.168.3.11
http://192.168.127.12
http://172.16.17.32
http://172.16.58.3
http://172.16.17.32
http://172.16.58.3
http://192.168.127.12
http://172.16.17.32
http://172.16.17.32
http://192.168.127.12
http://172.16.17.32
http://172.16.17.32
http://182.92.189.18
http://192.168.127.12
http://192.168.127.12
http://192.168.127.12
http://192.168.3.11
http://172.16.31.10
http://51.178.46.134
http://192.168.127.12
http://172.16.58.3
http://172.16.17.32
http://85.93.2.78
192.168.3.11:443
192.168.127.12:443
172.16.17.32:443
172.16.58.3:443
172.16.17.32:443
172.16.58.3:443
192.168.127.12:443
172.16.17.32:443
172.16.17.32:443
192.168.127.12:443
172.16.17.32:443
172.16.17.32:443
172.16.58.3:443
192.168.127.12:443
192.168.127.12:443
192.168.127.12:443
192.168.3.11:443
172.16.31.10:443
172.16.58.3:443
192.168.127.12:443
172.16.58.3:443
172.16.17.32:443
172.16.17.32:443
192.168.3.11:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.58.3:8080
172.16.17.32:8080
172.16.58.3:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.17.32:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.17.32:8080
172.16.58.3:8080
192.168.127.12:8080
192.168.127.12:8080
192.168.127.12:8080
192.168.3.11:8080
172.16.31.10:8080
172.16.58.3:8080
192.168.127.12:8080
172.16.58.3:8080
172.16.17.32:8080
172.16.17.328:8080
ruwejo.com

# Reference: https://twitter.com/Max_Mal_/status/1500447223217278980
# Reference: https://www.virustotal.com/gui/file/7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2/detection
# Reference: https://www.virustotal.com/gui/file/d8241e046cb9efcfa7ce733249d580eacff996d8669adbe71019eedafb696a55/detection
# Reference: https://www.virustotal.com/gui/file/2190a7d8d7eafd4af56b01d9a828ab2dc553a804ccda4c291dce51ce01da81f8/detection
# Reference: https://www.virustotal.com/gui/file/1f95397c4634f3348f3001a02eab269148f4c08271c2e2461905a4359f7c4761/detection
# Reference: https://www.virustotal.com/gui/file/08137096b85a3a2611249bb57ba9ace4e8efc9ba28cfddd8557edc3e11e9690c/detection

172.16.17.32:8888
172.16.17.32:8888

# Reference: https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt/
# Reference: https://otx.alienvault.com/pulse/62c6baa44e2fdd526623016c
# Reference: https://www.virustotal.com/gui/file/d9bba1cfca6b1d20355ce08eda37d6d0bca8cb8141073b699000d05025510dcc/detection
# Reference: https://www.virustotal.com/gui/file/eb383824d0aae1b561c42f6709ce0d9f1c39ad8d7a743709f1080b8dc5985cfe/detection
# Reference: https://www.virustotal.com/gui/file/7831806172857a563d7b4789acddc98fc11763aaf3cedf937630b4a9dce31419/detection
# Reference: https://www.virustotal.com/gui/file/4cc4d170209897ce52093a13e2b5a27405efaeb9be1f8e1aaf93226e3451d110/detection
# Reference: https://www.virustotal.com/gui/file/29bb22553c16b32057b30c240b30e2f4fe107d9ccfb6b2d0dbece6f41a2419d6/detection

http://172.16.17.32
172.16.17.32:8001
172.16.17.32:8888

# Reference: https://twitter.com/ESETresearch/status/1547943632455364609
# Referecne: https://twitter.com/ESETresearch/status/1547944027957260292
# Reference: https://www.virustotal.com/gui/file/1f6af8e1e04288ce01039927d7f693c38af78378718138702edc68cf3fa6979c/detection
# Reference: https://www.virustotal.com/gui/file/d75d569a20442043eff9946a269ccc2a27c0e4eb33e0f0dbeac48b4ac65400c0/detection

saleforces-it.com
saleforces.s3-accelerate.amazonaws.com

# Reference: https://twitter.com/malwrhunterteam/status/1559639717146251271
# Reference: https://www.virustotal.com/gui/file/57d005ffd8d8e09f822470dd09982dabd13706580fb78c8398242626b4f97f8a/detection

sj-analytics.com

# Reference: https://www.malware-traffic-analysis.net/2022/08/30/index.html
# Reference: https://twitter.com/malware_traffic/status/1564727055304069130

192.168.127.12:8557

# Reference: https://twitter.com/fr0s7_/status/1567449023992184832
# Reference: https://www.virustotal.com/gui/file/1142ba812887fb309a6d4e8a6b14205b80eff6d95ac067d6fd807e65b343cf7d/detection

172.16.58.3:8888
vomonavopo.com

# Reference: https://twitter.com/MichalKoczwara/status/1580643176188350465

192.168.3.11:31337

# Reference: https://twitter.com/MichalKoczwara/status/1580683916939530240
# Reference: https://www.virustotal.com/gui/file/17df554651962ebb1424a549ddc43f2a7e0e25a571ddfe454393b4f413261296/detection

http://172.16.17.32

# Reference: https://twitter.com/r3dbU7z/status/1582932022859026432

dashboard.ondemand-9839.ske.psydev.eu
identity.ondemand-9839.ske.psydev.eu<commit_msg>Update sliver.txt<commit_after># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: splinter

# Reference: https://github.com/BishopFox/sliver
# Reference: https://www.virustotal.com/gui/file/1c9cc7108392ca716a522ccfc93c15724fb18bafe8350301c2ced04803aa4040/detection

172.16.58.3:8888
letshack.ddns.net

# Reference: https://twitter.com/1ZRR4H/status/1450913137352392712
# Reference: https://pastebin.com/ZpsxzLZc
# Reference: https://www.malware-traffic-analysis.net/2021/10/20/index.html
# Reference: https://www.proofpoint.com/us/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity

http://192.168.3.11
http://192.168.127.12
http://172.16.17.32
http://172.16.58.3
http://172.16.17.32
http://172.16.58.3
http://192.168.127.12
http://172.16.17.32
http://172.16.17.32
http://192.168.127.12
http://172.16.17.32
http://172.16.17.32
http://172.16.58.3
http://192.168.127.12
http://192.168.127.12
http://3.239.175.166
http://192.168.3.11
http://172.16.31.10
http://172.16.58.3
http://192.168.127.12
http://172.16.58.3
http://172.16.17.32
http://172.16.17.32
192.168.3.11:443
192.168.127.12:443
172.16.17.32:443
172.16.58.3:443
172.16.17.32:443
172.16.58.3:443
192.168.127.12:443
172.16.17.32:443
172.16.17.32:443
192.168.127.12:443
172.16.17.32:443
172.16.17.32:443
172.16.58.3:443
192.168.127.12:443
192.168.127.12:443
192.168.127.12:443
192.168.3.11:443
172.16.31.10:443
172.16.58.3:443
192.168.127.12:443
172.16.58.3:443
172.16.17.32:443
172.16.17.32:443
192.168.3.11:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.58.3:8080
172.16.17.32:8080
172.16.58.3:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.17.32:8080
192.168.127.12:8080
172.16.17.32:8080
172.16.17.32:8080
172.16.58.3:8080
192.168.127.12:8080
192.168.127.12:8080
192.168.127.12:8080
192.168.3.11:8080
172.16.31.10:8080
172.16.58.3:8080
192.168.127.12:8080
172.16.58.3:8080
172.16.17.32:8080
172.16.17.32:8080
ruwejo.com

# Reference: https://twitter.com/Max_Mal_/status/1500447223217278980
# Reference: https://www.virustotal.com/gui/file/7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2/detection
# Reference: https://www.virustotal.com/gui/file/d8241e046cb9efcfa7ce733249d580eacff996d8669adbe71019eedafb696a55/detection
# Reference: https://www.virustotal.com/gui/file/2190a7d8d7eafd4af56b01d9a828ab2dc553a804ccda4c291dce51ce01da81f8/detection
# Reference: https://www.virustotal.com/gui/file/1f95397c4634f3348f3001a02eab269148f4c08271c2e2461905a4359f7c4761/detection
# Reference: https://www.virustotal.com/gui/file/08137096b85a3a2611249bb57ba9ace4e8efc9ba28cfddd8557edc3e11e9690c/detection

172.16.17.32:8888
172.16.17.32:8888

# Reference: https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-masquerades-as-apple-wears-face-of-apt/
# Reference: https://otx.alienvault.com/pulse/62c6baa44e2fdd526623016c
# Reference: https://www.virustotal.com/gui/file/d9bba1cfca6b1d20355ce08eda37d6d0bca8cb8141073b699000d05025510dcc/detection
# Reference: https://www.virustotal.com/gui/file/eb383824d0aae1b561c42f6709ce0d9f1c39ad8d7a743709f1080b8dc5985cfe/detection
# Reference: https://www.virustotal.com/gui/file/7831806172857a563d7b4789acddc98fc11763aaf3cedf937630b4a9dce31419/detection
# Reference: https://www.virustotal.com/gui/file/4cc4d170209897ce52093a13e2b5a27405efaeb9be1f8e1aaf93226e3451d110/detection
# Reference: https://www.virustotal.com/gui/file/29bb22553c16b32057b30c240b30e2f4fe107d9ccfb6b2d0dbece6f41a2419d6/detection

http://172.16.17.32
172.16.17.32:8001
172.16.17.32:8888

# Reference: https://twitter.com/ESETresearch/status/1547943632455364609
# Referecne: https://twitter.com/ESETresearch/status/1547944027957260292
# Reference: https://www.virustotal.com/gui/file/1f6af8e1e04288ce01039927d7f693c38af78378718138702edc68cf3fa6979c/detection
# Reference: https://www.virustotal.com/gui/file/d75d569a20442043eff9946a269ccc2a27c0e4eb33e0f0dbeac48b4ac65400c0/detection

saleforces-it.com
saleforces.s3-accelerate.amazonaws.com

# Reference: https://twitter.com/malwrhunterteam/status/1559639717146251271
# Reference: https://www.virustotal.com/gui/file/57d005ffd8d8e09f822470dd09982dabd13706580fb78c8398242626b4f97f8a/detection

sj-analytics.com

# Reference: https://www.malware-traffic-analysis.net/2022/08/30/index.html
# Reference: https://twitter.com/malware_traffic/status/1564727055304069130

192.168.127.12:8557

# Reference: https://twitter.com/fr0s7_/status/1567449023992184832
# Reference: https://www.virustotal.com/gui/file/1142ba812887fb309a6d4e8a6b14205b80eff6d95ac067d6fd807e65b343cf7d/detection

172.16.58.3:8888
vomonavopo.com

# Reference: https://twitter.com/MichalKoczwara/status/1580643176188350465

192.168.3.11:31337

# Reference: https://twitter.com/MichalKoczwara/status/1580683916939530240
# Reference: https://www.virustotal.com/gui/file/17df554651962ebb1424a549ddc43f2a7e0e25a571ddfe454393b4f413261296/detection

http://172.16.17.32

# Reference: https://twitter.com/r3dbU7z/status/1582932022859026432

ondemand-9839.ske.psydev.eu
dashboard.ondemand-9839.ske.psydev.eu
identity.ondemand-9839.ske.psydev.eu

# Reference: https://twitter.com/MichalKoczwara/status/1591050511125712897
# Reference: https://tria.ge/221111-psjzrsab4z/behavioral1

172.16.58.3:8080
{'fraction_non_alphanumeric': 0.14996650397167194, 'fraction_numerical': 0.35304813857785433, 'mean_word_length': 5.371951219512195, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 70, 'lorem ipsum': 0, 'www.': 40, 'xml': 0}, 'pii_count': 159, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3085519', 'n_tokens_mistral': 6889, 'n_tokens_neox': 4818, 'n_words': 344}