<commit_before># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: gamarue

# Reference: http://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Gamarue#tab=2

cityhotlove.com
clothesshopuppy.com
conpastcon.com
freefinder.me
grrrff24213402.com
grrrff2452.com
iurhjfnmflsdf.com
lanamakotrue.com
mgrsdfkprogerg.com
pastinwest.com
puppyclothesshop1.net
puppyclothesshop2.net

# Reference: http://www.malware-traffic-analysis.net/2015/10/20/index.html

motherbeing-news.com
mindfucktoys.com
mommycums.com
musictocheer.com
731pro.pw

# Reference: https://www.aldeid.com/wiki/48e29119b03641499492336695c29ffd

suckmycocklameavindustry.in
xdqzpbcgrvkj.ru
anam0rph.su
orzdwjtvmein.in
ygiudewsqhct.in
bdcrqgonzmwuehky.nl
somicrososoft.ru

# Reference: https://www.virustotal.com/en/domain/amnsreiuojy.ru/information/
# Reference: https://www.threatcrowd.org/malware.php?md5=8bdfb5f4f2292eba9a2e68eb1aab7840

amnsreiuojy.ru
morphed.ru
deltaheavy.ru

# Reference: https://www.virustotal.com/en/domain/bdcrqgonzmwuehky.nl/information/

bdcrqgonzmwuehky.nl

# Reference: https://malwr.com/analysis/YzA2MGY4MDE2NzNmNDEyMmE3OWEzZDQ5ZTEwMjZmZTc/

amnsreiuojy.ru
xdqzpbcgrvkj.ru
anam0rph.su
orzdwjtvmein.in
ygiudewsqhct.in
bdcrqgonzmwuehky.nl
somicrososoft.ru
rentipod.ru
lnx-games.su

# Reference: https://blog.avast.com/andromeda-under-the-microscope

atomictrivia.ru
designthefuture.ru
gvaq70s7he.ru
getuptateserv.eu
disorderstatus.ru
ac6ruv8t.ru

# Reference: https://www.virustotal.com/gui/domain/4nbizac8.ru/relations

4nbizac8.ru

# Reference: https://blog.avast.com/andromeda-under-the-microscope

differentia.ru
disorderstatus.ru
http://differentia.ru/diff.php
http://disorderstatus.ru/order.php

# Reference: https://lists.openinfosecfoundation.org/pipermail/oisf-users/2018-October/016203.html

atomictrivia.ru
http://atomictrivia.ru/atomic.php

# Reference: https://www.threatcrowd.org/malware.php?md5=3044af3a89e9e110889ba9d0923f25f3

xxtyr0xg4w.ru
76236osm1.ru
sxxtyr0xg4w.ru

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Gamarue-AT/detailed-analysis.aspx

hzmksreiuojy.biz
hzmksreiuojy.com
hzmksreiuojy.in
hzmksreiuojy.nl
hzmksreiuojy.ru

# Reference: https://blog.talosintelligence.com/2018/09/threat-roundup-0907-0914.html (Win.Dropper.Gamarue-6682684-0)

awele.duckdns.org
dogged.cf
genpral.top
pafindo.me
safemann.tk
siyaghasourccing.com
www.greenfleld.com
www.slompbit.xyz

# Reference: https://www.virustotal.com/en/file/198dbf18747c4592fcce43c3b1c45f9706f9c3fb781e8ac9f23f0c2418caa5ca/analysis/

differentia.ru
atomictrivia.ru
39slxu3bw.ru
76236osm1.ru

# Reference: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Gamarue
# Reference: https://totalhash.cymru.com/analysis/?ab3a71d5d1dfec699ccfbaddbb4ac5a2ad34c617
# Reference: https://totalhash.cymru.com/analysis/?767f89633e21fc96b430a17058b572720eaf7228

faumoussuperstars.ru
a.nas.ru
b.nas.ru
c.nas.ru
powerrembo.ru
lunaizemlya.ru
/intro/data.php

# Reference: https://www.threatcrowd.org/malware.php?md5=3845acda05dcf834d9f2237fd3db40b4

sbws3v7zh.ru

# Reference: https://blog.talosintelligence.com/2019/07/threat-roundup-0628-0705.html (# Win.Trojan.Gamarue-7008527-0)

srv1000.ru
srv1100.ru
srv1200.ru
srv1300.ru
srv1400.ru
trkhaus.ru

# Reference: https://www.virustotal.com/gui/domain/cp.mvtexgsj.ru/relations

mvtexgsj.ru

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-PE/detailed-analysis.aspx

afawydymss.blogoveg.org
azipev.blogoveg.org
ikvbog.blogoveg.org
ipufukavyd.blogoveg.org
iqtpyty.blogoveg.org
odenatl.blogoveg.org
omomeqygex.blogoveg.org
ozywopesb.blogoveg.org
ugejiju.blogoveg.org
uglz.blogoveg.org
ujoparq.blogoveg.org
ules.blogoveg.org
uxykeh.blogoveg.org
ysoc.blogoveg.org
yzuhk.blogoveg.org

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-NE/detailed-analysis.aspx

ie.n502.com
900cpa.cc

# Reference: https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
# Reference: https://www.virustotal.com/gui/file/98413cf9281d4b00f6503c18256aab3b7cb5b2c7017f3579388cc4641e8a1696/detection

ddnservice10.ru
ddnservice11.ru
/and/jopagate.php

# Reference: https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf

dvdonlinestore.net
eastmedia2112.com
mustache-styles.com
onlinestoreonsale.com
pradahandbagsshoes.com
vhideip.com
wisheshub.com
99mesotheliomalawyers.com

# Reference: https://twitter.com/malwrhunterteam/status/1188056259209158656
# Reference: https://www.virustotal.com/gui/file/8faa02e77c596d1c0e443de4939df308b27f163bae6268ad864d96a3d3e5ff84/detection

172.16.17.32:777

# Reference: https://www.virustotal.com/gui/ip-address/172.16.31.10/relations
# Reference: https://www.virustotal.com/gui/file/a5dd69b84ae8d3ff968d60e03d90d6b6b887e6d2e1de7f23f1bafba5f534f2e4/detection
# Reference: https://www.virustotal.com/gui/file/aae29c9e46532693e1d8a7451ccef47e4a58f8c4e46e76411dc19b8455be732c/detection
# Reference: https://www.virustotal.com/gui/file/cd12e7813669fcf107252997399e052ef03dd0aca5412614f56c8b3e6db43d66/detection

172.16.31.10:10001

# Reference: https://www.virustotal.com/gui/file/5fc7a819f5640918045e0431b4c31c8fa87c1c1485a4f6da7103ad9da620251b/detection

192.168.127.12:10001
rogerfries8.ddns.net

# Reference: https://www.virustotal.com/gui/file/4550db4e0c0f9e871b99164c94185e3b8cc92d3d5463d20092e8559aefe454d7/detection
# Reference: https://www.virustotal.com/gui/file/4550db4e0c0f9e871b99164c94185e3b8cc92d3d5463d20092e8559aefe454d7/detection

mikemonk88.ddns.net

# Reference: https://www.welivesecurity.com/2017/12/04/eset-takes-part-global-operation-disrupt-gamarue/

/last.so
/nonc.so

# Reference: https://app.any.run/tasks/ad7d17b0-bb0f-4e2a-a2d9-7d567af9ff10/
# Reference: https://www.virustotal.com/gui/file/828ba0c795e14a3c712ca8d0f14ef2514ed4b20c97e12f8d684938ff1cba5bc4/detection

cs-server1.biz
/forums/gate.php

# Reference: https://www.virustotal.com/gui/file/3d38f6288716d6999a04bbc008dd4e6a38feb189f5dd6931d761a406410a6c21/detection

192.168.127.12:500<commit_msg>Update andromeda.txt<commit_after># Copyright (c) 2014-2020 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: gamarue

# Reference: http://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Gamarue#tab=2

cityhotlove.com
clothesshopuppy.com
conpastcon.com
freefinder.me
grrrff24213402.com
grrrff2452.com
iurhjfnmflsdf.com
lanamakotrue.com
mgrsdfkprogerg.com
pastinwest.com
puppyclothesshop1.net
puppyclothesshop2.net

# Reference: http://www.malware-traffic-analysis.net/2015/10/20/index.html

motherbeing-news.com
mindfucktoys.com
mommycums.com
musictocheer.com
731pro.pw

# Reference: https://www.aldeid.com/wiki/48e29119b03641499492336695c29ffd

suckmycocklameavindustry.in
xdqzpbcgrvkj.ru
anam0rph.su
orzdwjtvmein.in
ygiudewsqhct.in
bdcrqgonzmwuehky.nl
somicrososoft.ru

# Reference: https://www.virustotal.com/en/domain/amnsreiuojy.ru/information/
# Reference: https://www.threatcrowd.org/malware.php?md5=8bdfb5f4f2292eba9a2e68eb1aab7840

amnsreiuojy.ru
morphed.ru
deltaheavy.ru

# Reference: https://www.virustotal.com/en/domain/bdcrqgonzmwuehky.nl/information/

bdcrqgonzmwuehky.nl

# Reference: https://malwr.com/analysis/YzA2MGY4MDE2NzNmNDEyMmE3OWEzZDQ5ZTEwMjZmZTc/

amnsreiuojy.ru
xdqzpbcgrvkj.ru
anam0rph.su
orzdwjtvmein.in
ygiudewsqhct.in
bdcrqgonzmwuehky.nl
somicrososoft.ru
rentipod.ru
lnx-games.su

# Reference: https://blog.avast.com/andromeda-under-the-microscope

atomictrivia.ru
designthefuture.ru
gvaq70s7he.ru
getuptateserv.eu
disorderstatus.ru
ac6ruv8t.ru

# Reference: https://www.virustotal.com/gui/domain/4nbizac8.ru/relations

4nbizac8.ru

# Reference: https://blog.avast.com/andromeda-under-the-microscope

differentia.ru
disorderstatus.ru
http://differentia.ru/diff.php
http://disorderstatus.ru/order.php

# Reference: https://lists.openinfosecfoundation.org/pipermail/oisf-users/2018-October/016203.html

atomictrivia.ru
http://atomictrivia.ru/atomic.php

# Reference: https://www.threatcrowd.org/malware.php?md5=3044af3a89e9e110889ba9d0923f25f3

xxtyr0xg4w.ru
76236osm1.ru
sxxtyr0xg4w.ru

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Gamarue-AT/detailed-analysis.aspx

hzmksreiuojy.biz
hzmksreiuojy.com
hzmksreiuojy.in
hzmksreiuojy.nl
hzmksreiuojy.ru

# Reference: https://blog.talosintelligence.com/2018/09/threat-roundup-0907-0914.html (Win.Dropper.Gamarue-6682684-0)

awele.duckdns.org
dogged.cf
genpral.top
pafindo.me
safemann.tk
siyaghasourccing.com
www.greenfleld.com
www.slompbit.xyz

# Reference: https://www.virustotal.com/en/file/198dbf18747c4592fcce43c3b1c45f9706f9c3fb781e8ac9f23f0c2418caa5ca/analysis/

differentia.ru
atomictrivia.ru
39slxu3bw.ru
76236osm1.ru

# Reference: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Gamarue
# Reference: https://totalhash.cymru.com/analysis/?ab3a71d5d1dfec699ccfbaddbb4ac5a2ad34c617
# Reference: https://totalhash.cymru.com/analysis/?767f89633e21fc96b430a17058b572720eaf7228

faumoussuperstars.ru
a.nas.ru
b.nas.ru
c.nas.ru
powerrembo.ru
lunaizemlya.ru
/intro/data.php

# Reference: https://www.threatcrowd.org/malware.php?md5=3845acda05dcf834d9f2237fd3db40b4

sbws3v7zh.ru

# Reference: https://blog.talosintelligence.com/2019/07/threat-roundup-0628-0705.html (# Win.Trojan.Gamarue-7008527-0)

srv1000.ru
srv1100.ru
srv1200.ru
srv1300.ru
srv1400.ru
trkhaus.ru

# Reference: https://www.virustotal.com/gui/domain/cp.mvtexgsj.ru/relations

mvtexgsj.ru

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-PE/detailed-analysis.aspx

afawydymss.blogoveg.org
azipev.blogoveg.org
ikvbog.blogoveg.org
ipufukavyd.blogoveg.org
iqtpyty.blogoveg.org
odenatl.blogoveg.org
omomeqygex.blogoveg.org
ozywopesb.blogoveg.org
ugejiju.blogoveg.org
uglz.blogoveg.org
ujoparq.blogoveg.org
ules.blogoveg.org
uxykeh.blogoveg.org
ysoc.blogoveg.org
yzuhk.blogoveg.org

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-NE/detailed-analysis.aspx

ie.n502.com
900cpa.cc

# Reference: https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
# Reference: https://www.virustotal.com/gui/file/98413cf9281d4b00f6503c18256aab3b7cb5b2c7017f3579388cc4641e8a1696/detection

ddnservice10.ru
ddnservice11.ru
/and/jopagate.php

# Reference: https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf

dvdonlinestore.net
eastmedia2112.com
mustache-styles.com
onlinestoreonsale.com
pradahandbagsshoes.com
vhideip.com
wisheshub.com
99mesotheliomalawyers.com

# Reference: https://twitter.com/malwrhunterteam/status/1188056259209158656
# Reference: https://www.virustotal.com/gui/file/8faa02e77c596d1c0e443de4939df308b27f163bae6268ad864d96a3d3e5ff84/detection

172.16.17.32:777

# Reference: https://www.virustotal.com/gui/file/5fc7a819f5640918045e0431b4c31c8fa87c1c1485a4f6da7103ad9da620251b/detection

192.168.127.12:10001
rogerfries8.ddns.net

# Reference: https://www.virustotal.com/gui/file/4550db4e0c0f9e871b99164c94185e3b8cc92d3d5463d20092e8559aefe454d7/detection
# Reference: https://www.virustotal.com/gui/file/4550db4e0c0f9e871b99164c94185e3b8cc92d3d5463d20092e8559aefe454d7/detection

mikemonk88.ddns.net

# Reference: https://www.welivesecurity.com/2017/12/04/eset-takes-part-global-operation-disrupt-gamarue/

/last.so
/nonc.so

# Reference: https://app.any.run/tasks/ad7d17b0-bb0f-4e2a-a2d9-7d567af9ff10/
# Reference: https://www.virustotal.com/gui/file/828ba0c795e14a3c712ca8d0f14ef2514ed4b20c97e12f8d684938ff1cba5bc4/detection

cs-server1.biz
/forums/gate.php

# Reference: https://www.virustotal.com/gui/file/3d38f6288716d6999a04bbc008dd4e6a38feb189f5dd6931d761a406410a6c21/detection

192.168.127.12:500
{'fraction_non_alphanumeric': 0.11597895775110965, 'fraction_numerical': 0.12954134473121814, 'mean_word_length': 6.045165026056746, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 72, 'lorem ipsum': 0, 'www.': 58, 'xml': 0}, 'pii_count': 8, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1669886', 'n_tokens_mistral': 6432, 'n_tokens_neox': 5523, 'n_words': 429}