<commit_before># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf
# Reference: https://otx.alienvault.com/pulse/603693b42a32d06720efad59/
# Reference: https://twitter.com/h2jazi/status/1366759252757512194
# Reference: https://www.virustotal.com/gui/file/0652962c5dace16ed170a932e3ce7eb3097b34bc809343fbb96b27cf3d22a5c7/detection

iatassl-telechargementsecurity.duckdns.org
varifsecuripass.duckdns.org

# Reference: https://lab52.io/blog/very-very-lazy-lazyscripters-scripts-double-compromise-in-a-single-obfuscation/
# Reference: https://otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25
# Reference: https://www.virustotal.com/gui/ip-address/172.16.17.32/relations
# Reference: https://www.virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983110216779d2d3cefe1fc151c6bb65c3b42/detection

http://192.168.127.12
192.168.127.12:1995
gowaymevps.xyz
securessl.fit
internetexploraldon.sytes.net
milla.publicvm.com
stub.ignorelist.com
u1153246fov.ha004.t.justns.ru
bsjsiq3ytpt3efsn6wnu3pukxil6q6plty6m6dcz.duckdns.org
jbizgsvhzj22evqon9ezz8bmbupp1s6cprmriam1.duckdns.org
saqicpcgflrlgxgoxxzkbfrjuisbkozeqrmthrzo.duckdns.org
<commit_msg>Update apt_lazyscripter.txt<commit_after># Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf
# Reference: https://otx.alienvault.com/pulse/603693b42a32d06720efad59/
# Reference: https://twitter.com/h2jazi/status/1366759252757512194
# Reference: https://www.virustotal.com/gui/file/0652962c5dace16ed170a932e3ce7eb3097b34bc809343fbb96b27cf3d22a5c7/detection

iatassl-telechargementsecurity.duckdns.org
varifsecuripass.duckdns.org

# Reference: https://lab52.io/blog/very-very-lazy-lazyscripters-scripts-double-compromise-in-a-single-obfuscation/
# Reference: https://otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25
# Reference: https://www.virustotal.com/gui/ip-address/172.16.17.32/relations
# Reference: https://www.virustotal.com/gui/ip-address/185.81.157.186/relations
# Reference: https://www.virustotal.com/gui/ip-address/66.29.130.204/relations
# Reference: https://www.virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983110216779d2d3cefe1fc151c6bb65c3b42/detection

http://192.168.127.12
192.168.127.12:1995
192.168.3.11:449
gowaymevps.xyz
gowaymevpslink1.xyz
gowaymevpslink2.xyz
gowaymevpslink3.xyz
gowaymevpslink4.xyz
gowaymevpslink5.xyz
securessl.fit
internetexploraldon.sytes.net
milla.publicvm.com
smscs.publicvm.com
stub.ignorelist.com
vistacp-enhance.duckdns.org
u1153246fov.ha004.t.justns.ru
bsjsiq3ytpt3efsn6wnu3pukxil6q6plty6m6dcz.duckdns.org
jbizgsvhzj22evqon9ezz8bmbupp1s6cprmriam1.duckdns.org
saqicpcgflrlgxgoxxzkbfrjuisbkozeqrmthrzo.duckdns.org

{'fraction_non_alphanumeric': 0.11650153741031773, 'fraction_numerical': 0.15510761872224121, 'mean_word_length': 6.585492227979275, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 20, 'lorem ipsum': 0, 'www.': 8, 'xml': 0}, 'pii_count': 9, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6877341', 'n_tokens_mistral': 1545, 'n_tokens_neox': 1295, 'n_words': 99}