<commit_before># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: codoso, c0d0so0, codoso team, sunshop group

# Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html (Network Based Indicators (NBI))

http://172.16.31.10
http://172.16.58.3
http://192.168.127.12
autodiscover.2bunny.com
lyncdiscover.2bunny.com
tk-in-f156.2bunny.com
sfo02s01-in-f2.cloudsend.net

# Reference: https://unit42.paloaltonetworks.com/new-attacks-linked-to-c0d0s0-group/
# Reference: https://www.domaintools.com/resources/blog/domaintools-101-the-art-of-tracking-threat-actors

http://172.16.31.10
http://172.16.31.10
http://172.16.58.3
microsoft-cache.com
supermanbox.org
jbossas.org

# Generic

/example/McAltLib.dll<commit_msg>Merging apt_deeppanda.txt into apt_codoso.txt<commit_after># Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: apt19, codoso, c0d0so0, codoso team, deep panda, sunshop group

# Reference: https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html (Network Based Indicators (NBI))

http://172.16.31.10
http://172.16.58.3
http://192.168.127.12
autodiscover.2bunny.com
lyncdiscover.2bunny.com
tk-in-f156.2bunny.com
sfo02s01-in-f2.cloudsend.net

# Reference: https://unit42.paloaltonetworks.com/new-attacks-linked-to-c0d0s0-group/
# Reference: https://www.domaintools.com/resources/blog/domaintools-101-the-art-of-tracking-threat-actors

http://172.16.31.10
http://172.16.31.10
http://172.16.58.3
microsoft-cache.com
supermanbox.org
jbossas.org

# Reference: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf

ameteksen.com
asconline.we11point.com
assso.net
capstoneturbine.cechire.com
caref1rst.com
careflrst.com
EmpireB1ue.com
extcitrix.we11point.com
facefuture.us
gifas.blogsite.org
gifas.cechire.com
healthslie.com
hrsolutions.we11point.com
icbcqsz.com
kaspersyk.com
me.we11point.com
mycitrix.we11point.com
myhr.we11point.com
oa.ameteksen.com
oa.technical-requre.com
oa.trustneser.com
polarroute.com
prennera.com
savmpet.com
sharepoint-vaeit.com
sinmoung.com
ssl-vaeit.com
ssl-vait.com
topsec2014.com
vipreclod.com
vpn.we11point.com
we11point.com
webmail.kaspersyk.com
webmail.vipreclod.com
wiki-vaeit.com
we11point.com
ysims.com

# Reference: https://attack.mitre.org/wiki/Group/G0009
# Reference: https://krebsonsecurity.com/wp-content/uploads/2015/02/FBI-Flash-Warning-Deep-Panda.pdf

googlewebcache.com
outlookssl.com
images.googlewebcache.com
smtp.outlookssl.com

# Reference: https://twitter.com/unpacker/status/1343143954007482369
# Reference: https://cybergeeks.tech/analyzing-apt19-malware-using-a-step-by-step-method/
# Reference: https://www.virustotal.com/gui/file/8b0877209594dada522e606ebac60ce82ceaa31978e71e7772fd8ae0065d53de/detection

http://172.16.58.3/user/atv.html
google-dash.com
microsoft-cache.com

# Generic

/example/McAltLib.dll
/lifeandstyle/marmalade-paddington-sales-up-making-drinking
/money/ofcom-fines-nuisance-calls
/world/video/shrien-dewani-arrives-uk-murder-trial-collapses-video
{'fraction_non_alphanumeric': 0.13857448761089017, 'fraction_numerical': 0.08687672070969715, 'mean_word_length': 4.923913043478261, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 14, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 13, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5984741', 'n_tokens_mistral': 1520, 'n_tokens_neox': 1321, 'n_words': 156}