# Copyright (c) 2014-2024 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Aliases: neurevt # Reference: https://twitter.com/James_inthe_box/status/1131561504375836673 zolaelectrics.com # Reference: https://twitter.com/pollo290987/status/1100450079515783169 moscow11.host # Reference: https://twitter.com/justmlwhunting/status/1088734644072255489 kas919be.pw # Reference: https://twitter.com/pollo290987/status/1083026735841587202 moscow77.online # Reference: https://twitter.com/jorgemieres/status/1136354513592307712 russk3.icu # Reference: https://twitter.com/P3pperP0tts/status/1142245531604934656 bundasteels.com # Reference: http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan:Win32/Neurevt.A#tab=2 strike-file-hosting.us # Reference: https://threatrecon.wapacklabs.com/malware/betabot/dnsmh6Ew2rsF8V9Ipwy7RtjSKcFv6JQ6lBm37nriIHM%3D upcomingsong.com # Reference: https://pastebin.com/CenCYkHs sinsec.net wachaoutlol.com # Reference: https://www.virustotal.com/gui/domain/hellokiwi.in/relations # Reference: https://www.virustotal.com/gui/file/978527e2afa1887c75a995f7271942d7735fbefc13f2caef5a85010943c90996/detection hellokiwi.in # Reference: https://blog.talosintelligence.com/2019/10/threat-roundup-for-september-27-to.html (# Win.Malware.Neurevt-7192122-0) 12thegamejuststarted10k12.com 2uandmearevideos2k2.com 6worldwipemek6.com allegro.ga doombringer.pw dqwjnewkwefewaaaaa3.com emicrosoft.eu fapncam.com frizzcams.com frky7.name kasn5.name marklou1.eu myssfii.eu pl1.co.vu s1allegro.net theafam.info up-windows.in update-silo.com # Reference: http://tracker.viriback.com/dump.php (# 2019-11-04, BetaBot) piszej.xyz squickycab.ga usb-drive.ru xiaodaoj.club # Reference: https://app.any.run/tasks/4b59b6c9-f5da-4134-ae98-46a885ff30e2/ russk6.icu russk7.icu russk8.icu russk9.icu # Reference: https://app.any.run/tasks/1add35db-0da6-44dd-8020-135abe5196db/ pitchstak.ga # Reference: https://app.any.run/tasks/dbdbcdc9-8903-48f5-aa5c-b89928456031/ russk11.icu # Reference: https://pastebin.com/p0vBRBTE betabot.pw mandahp.ie riyanshoppingbags.com rollscar.pk # Reference: https://pastebin.com/EscWd1Cx asdsadasrdc.ug cvxmhbfghdsd.ug micozup.ru puruntis.ug timecheck.ug # Reference: https://news.sophos.com/en-us/2020/05/14/raticate/ negrodesigns.ga stngpetty.ga webxpo.ga # Reference: https://www.virustotal.com/gui/file/33ea7a0d037f1c8f8ef8f567e83fde7329a4158986d5c331ded698eaa2408410/detection 173.46.85.68:2016 # Reference: https://twitter.com/ganeshnathan28/status/1298112354631155712 # Reference: https://www.virustotal.com/gui/domain/winqits.com/relations winqits.com # Reference: https://app.any.run/tasks/5585447c-1870-4140-9cbe-1566c51f5d3c/ sinomatics.ga # Reference: https://app.any.run/tasks/7331a0a9-6747-4ae4-a94f-cf11c6d57261/ # Reference: https://www.virustotal.com/gui/file/d55d2d63aad9a8d3ca2c5f7fbbd8074d792c2a58ebc6e8dd00b369256cf2a1c8/behavior/Dr.Web%20vxCube # Reference: https://app.any.run/tasks/9a16b195-297a-4f0d-8c27-9be517448789/ russk16.icu beyondthebold.com # Reference: https://www.virustotal.com/gui/file/634ad02fba5314a9c69334923a448c452550e08427ca7edb11d2d984eb66c115/detection # Reference: https://www.virustotal.com/gui/file/548b424bedcb831086fb9ab5b6e284a7a71a53e430acad99155153a869844570/detection # Reference: https://www.virustotal.com/gui/file/72ce154f40ba7fe038a21f18c4be45ab20e7d0a7759b072503c506ad3ba56d30/detection # Reference: https://www.virustotal.com/gui/file/65c1b7b845bb0bf116c7a72fbf146e351c8e3138ec99f9015e502f96640e264d/detection alldayever231.su askjhdaskdhshjfhf.ru fdsfsgagdfgdf.ru kanorkanor23.ru kdfrghdkfj34.ru kikidoyoulabme222.ru micozup.ru skdjgfbsdkjbfns3423.ru sprakitiktitkitik2322225431.ru tantarantantan23.ru tarssdsfdfsdr23.ru # Reference: https://github.com/stamparm/maltrail/commit/733a4d2029755ad71c84caf07fc8dfb0e8332e60 (# Betabot) adamestrde.in androcp.cloudns.pw clivertradesbiz.in dqwjnewkwefewaaaaa1.com exchangeprofitchop.biz fallencrafts.info germoetwa.com leadstome.fr liklemvor.sx lovingthe.crabdance.com mypaintdressk13.com securedcomputer.eu tempotac.biz theshangai.info truslibiz.in # Reference: https://www.hybrid-analysis.com/sample/c41082bc8e07d463a822f4c159d19520dcf9b1679912fe0d702856012ae6a22a?environmentId=100 # Reference: https://www.virustotal.com/gui/file/43f5b7549f48647435bd16f0b3de6af89b9c290ab9ae258b6d5d3f171e58b22f/behavior i784we65o4ikes.pw i784we65o4ikes.ru i784we65o4ikes.org.ru bmwirving.com weqrandcx.su # Reference: https://open.appscan.io/article-235.html bitdefenderesupdate.ru bothobo.ru downstars.ru gongotraa.com gtrtoolie.com ilous.ru indexer4.ru jfijalgjiookfuje.su kolno.pw krovne.win krustpil.top magoooo.su opixib.bid paweln1.ru vulica.top # Reference: https://app.any.run/tasks/2709ed88-8c4b-42ca-807e-3cccef76233e/ russk16.icu russk17.icu morningstarlincoln.co.uk/site/llllllllll/ # Reference: https://twitter.com/wwp96/status/1369334028558626822 rusianlover.icu siidocumentos.icu # Reference: https://twitter.com/malwrhunterteam/status/1375035932441726978 xtkehjjerbk.icu # Reference: https://www.virustotal.com/gui/file/b20f5ca59efe8878614e7a7e385b8ec1b2cdb35ec5d30a6e31f442a9d701fe65/detection asm3aafs4gzafzf5ag.pw fule12ziasxh.ru geomansre123a.ru hisellv7aza4er.pw hitechawarereer.pw leloner.pw w85naonerash.ru # Reference: https://www.virustotal.com/gui/file/b900f3615a19ad4b55f2f70351455d722386b6a9ec76e0a3875489ef51854800/detection berlivildn.ru burtestbuldes.ru daulmustrong.ru maizonaterstin.ru paracetomolinfo.ru sainportz.ru sentembertolls.ru verybadprozak.ru # Reference: https://twitter.com/pollo290987/status/1394938640376209412 # Reference: https://www.virustotal.com/gui/file/3a2c441a96936c089c1444f4cd50436593fcd43a18c80a1699fc6b2d62dd6907/detection moscow13.at russk17.icu russk18.icu # Reference: https://www.virustotal.com/gui/file/d6893d59585fdf607092668ae7cdf9e3cd508efe18678c832f7c42c9a58bebb1/detection rusav1.icu rusav2.icu # Reference: https://www.virustotal.com/gui/ip-address/23.106.215.83/relations moscow22.icu pppfinder.icu # Reference: https://www.virustotal.com/gui/ip-address/204.16.247.190/relations moscow11.at # Reference: https://www.virustotal.com/gui/ip-address/213.227.155.145/relations russk5.icu # Reference: https://www.virustotal.com/gui/ip-address/185.193.38.160/detection russk12.icu russk13.icu # Reference: https://www.virustotal.com/gui/ip-address/45.153.240.151/detection russk14.icu # Reference: https://www.virustotal.com/gui/ip-address/45.147.229.23/relations russk15.icu # Reference: https://www.virustotal.com/gui/ip-address/213.227.154.134/detection xmpzi.icu # Reference: https://www.virustotal.com/gui/file/923945b086c39c8a6ec66ad3645d44212a8e92d080e6699f9ea0ccf55e43a77a/detection eastexs.com # Reference: https://www.virustotal.com/gui/file/054b7c5d38a00ecfc40168d4dc21610139c5ab6a46d2a0e851ef100397d5e5e9/detection cwjamaica.us # Reference: https://www.virustotal.com/gui/file/d315d64f46a55ef8edbce45aa779ee321bb76cf17a28c21a9c10efc22431ca0d/detection botstars.net # Reference: https://www.virustotal.com/gui/file/468f9abc380cedf17528958eb0ccd8e42e100e05ecb250f31a11d3f946765990/detection brascase-br.com # Reference: https://app.any.run/tasks/c4ea39c5-00d6-4388-861b-fa189d3f9e0b/ globalxpert.pw qvpumps.com rosnfet.com woeer.com/pixies/admin/admin/temp/be/megaman/order.php # Reference: https://www.virustotal.com/gui/file/65fd867d489a0524338fd453a0855d29bb6e0e7e23f9c741f6fd10da870f76e7/detection dedimartbay.top # Reference: https://blog.talosintelligence.com/2021/08/neurevt-trojan-takes-aim-at-mexican.html russk19.icu russk20.icu russk21.icu russk22.icu saltoune.xyz # Reference: https://www.virustotal.com/gui/file/98327e81ee52ed71a10d4549f7cb77ae437b357a7ad4dde250a0e6d11b9f58c3/detection bbb1.chickenkiller.com # Reference: https://twitter.com/jaydinbas/status/1547530236878852096 # Reference: https://www.virustotal.com/gui/file/ad75622a00b54405304b7ce02a23fee02b7c57fddd00b482687fd97866ecb562/detection # Reference: https://www.virustotal.com/gui/file/08ad8bfa45d107b5ddd904f002abb2cd9402bca5564025b3cf4fb309c1371046/detection chtoluca.com.mx ciijus.org colegiovillahidalgo.edu.mx culturasmetropolitanas.org gonal.com.mx javiersantos.info russiandancingmen.top # Reference: https://www.virustotal.com/gui/file/4da1fd9481e885bfc18198bcdbf5e045bc631c4189b1300676515704605085a6/detection sedrftgz.anondns.net # Generic /j7csltegf/login.php /panels_encoded/login.php /panels_encoded/logout.php /skins/betpla/PHP/ /div/me.exe /wid/logout.php /kin/logout.php