<commit_before># Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fortinet.com/blog/threat-research/circle-of-the-fraud-more-information-about-bitcoin-orcus-rat-campaign.html

adobe.br.com
bitcolntalk.com
bitcolntalk.org
bltcointalk.com
bltcointalk.org
bltcolntalk.com
bltcolntalk.org
githvb.com
qithub.org
qunthy.org
wcx.nz
wex.ac.nz
wex.ms

# Reference: https://twitter.com/oguzpamuk/status/1165739004974817280
# Reference: https://app.any.run/tasks/bc90ea8c-24fd-43d1-a831-2246eca40e32/

192.168.3.11:1337

# Reference: https://twitter.com/JayTHL/status/1188666712813719552
# Reference: https://www.virustotal.com/gui/ip-address/176.227.191.12/relations
# Reference: https://www.virustotal.com/gui/file/ab27de99f9af5b25c51a452734624d275be3f375acb8e2e196753f58edd7ff61/detection

192.168.127.12:1337
192.168.127.12:8080
fbkw.tk
glared.ga
kekw.tk

# Reference: https://www.virustotal.com/gui/file/246ed49ede850eaafddff2794415bb71eca90238b8c3ef7969f2a2d9247761a5/detection

192.168.127.12:10134

# Reference: https://www.virustotal.com/gui/file/ba6ac57263f886ec57dbc7d91705bc997a6ee9e0e4753bb1e28036245fa5d954/detection

192.168.127.12:1564

# Reference: https://www.virustotal.com/gui/file/abbf1a3dc2074173f0679edbc25b7e835a799684151f4f5ceb2174515a30f2b6/detection

192.168.127.12:2002

# Reference: https://www.virustotal.com/gui/file/a83458a20fa9f2dd5f58d8bb0b08f9e3c64640b4898d14d4f1494130b9ef2357/detection

192.168.127.12:6666

# Reference: https://www.virustotal.com/gui/file/84a550cd5c0ab129a3e7ddf222e6e20b30e8126abf297d1765c17ef079c8ca9e/detection

192.168.127.12:7007

# Reference: https://twitter.com/JayTHL/status/1199555057513046017
# Reference: https://www.virustotal.com/gui/file/49bd78001249923b28dc30e6c52e121fea38fb58f29c15968379488b4de53c30/detection
# Reference: https://www.virustotal.com/gui/file/fc04d2256cdf30a4fcf5eba79c9d451e3e3d20ba01740edce82c0fe697ffa191/detection

192.168.127.12:5631
warfram3client.duckdns.org

# Reference: https://www.virustotal.com/gui/file/f1e09e33334341d3a91e93a1cf44d5c4d7ac420c5e7a1b7d608b6388174de1d0/detection

172.16.17.32:500

# Reference: https://twitter.com/JAMESWT_MHT/status/961905004960468992
# Reference: https://app.any.run/tasks/d8405f6a-e8a5-45e0-abd2-c7fa5ec899ec/

stinkletjet.me<commit_msg>Update orcusrat.txt<commit_after># Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.fortinet.com/blog/threat-research/circle-of-the-fraud-more-information-about-bitcoin-orcus-rat-campaign.html

adobe.br.com
bitcolntalk.com
bitcolntalk.org
bltcointalk.com
bltcointalk.org
bltcolntalk.com
bltcolntalk.org
githvb.com
qithub.org
qunthy.org
wcx.nz
wex.ac.nz
wex.ms

# Reference: https://twitter.com/oguzpamuk/status/1165739004974817280
# Reference: https://app.any.run/tasks/bc90ea8c-24fd-43d1-a831-2246eca40e32/

192.168.3.11:1337

# Reference: https://twitter.com/JayTHL/status/1188666712813719552
# Reference: https://www.virustotal.com/gui/ip-address/192.168.127.12/relations
# Reference: https://www.virustotal.com/gui/file/ab27de99f9af5b25c51a452734624d275be3f375acb8e2e196753f58edd7ff61/detection

192.168.127.12:1337
192.168.127.12:8080
fbkw.tk
glared.ga
kekw.tk

# Reference: https://www.virustotal.com/gui/file/246ed49ede850eaafddff2794415bb71eca90238b8c3ef7969f2a2d9247761a5/detection

192.168.127.12:10134

# Reference: https://www.virustotal.com/gui/file/ba6ac57263f886ec57dbc7d91705bc997a6ee9e0e4753bb1e28036245fa5d954/detection

192.168.127.12:1564

# Reference: https://www.virustotal.com/gui/file/abbf1a3dc2074173f0679edbc25b7e835a799684151f4f5ceb2174515a30f2b6/detection

192.168.127.12:2002

# Reference: https://www.virustotal.com/gui/file/a83458a20fa9f2dd5f58d8bb0b08f9e3c64640b4898d14d4f1494130b9ef2357/detection

192.168.127.12:6666

# Reference: https://www.virustotal.com/gui/file/84a550cd5c0ab129a3e7ddf222e6e20b30e8126abf297d1765c17ef079c8ca9e/detection

192.168.127.12:7007

# Reference: https://twitter.com/JayTHL/status/1199555057513046017
# Reference: https://www.virustotal.com/gui/file/49bd78001249923b28dc30e6c52e121fea38fb58f29c15968379488b4de53c30/detection
# Reference: https://www.virustotal.com/gui/file/fc04d2256cdf30a4fcf5eba79c9d451e3e3d20ba01740edce82c0fe697ffa191/detection

192.168.127.12:5631
warfram3client.duckdns.org

# Reference: https://www.virustotal.com/gui/file/f1e09e33334341d3a91e93a1cf44d5c4d7ac420c5e7a1b7d608b6388174de1d0/detection

172.16.17.32:500

# Reference: https://twitter.com/JAMESWT_MHT/status/961905004960468992
# Reference: https://app.any.run/tasks/d8405f6a-e8a5-45e0-abd2-c7fa5ec899ec/

stinkletjet.me

# Reference: https://twitter.com/James_inthe_box/status/948880929342173184

192.168.127.12:9989
{'fraction_non_alphanumeric': 0.11847265221878225, 'fraction_numerical': 0.26852425180598555, 'mean_word_length': 6.3202416918429005, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 37, 'lorem ipsum': 0, 'www.': 22, 'xml': 0}, 'pii_count': 23, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '109349', 'n_tokens_mistral': 2919, 'n_tokens_neox': 2203, 'n_words': 155}