# Copyright (c) 2014-2021 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: blackteam, blacknet, blackout

# Reference: https://twitter.com/makflwana/status/1210466313954414592

5ineprojects.com
hckrmytest.com
netdz.ga
davidescu.000webhostapp.com
kiraamora.000webhostapp.com

# Reference: https://twitter.com/tkanalyst/status/1212695828931973122
# Reference: https://app.any.run/tasks/607a63ec-0ab5-45a9-b255-df78eb73bd79/

weboss.in

# Reference: https://twitter.com/wwp96/status/1218260858524065794

meublesinde.in/black/

# Reference: https://twitter.com/wwp96/status/1218263835007758336
# Reference: https://app.any.run/tasks/6feea8e2-7390-4439-bb23-a35df75422e1/

r-s.us

# Reference: https://twitter.com/jorgemieres/status/1222611503125356544

vintosw0.beget.tech

# Reference: https://twitter.com/ps66uk/status/1228268374649659392
# Reference: https://app.any.run/tasks/9be4f8eb-e828-4ca5-ba76-6f8db7f1627a/

sinsixclaw.com

# Reference: https://twitter.com/ViriBack/status/1228676828107300864

agent.agentreef.xyz

# Reference: http://tracker.viriback.com/dump.php (# 2020-02-23, BlackNet)

davidaredetoate.000webhostapp.com
davidescu.000webhostapp.com
kiraamora.000webhostapp.com
lex1qlist3.temp.swtest.ru
loadbytes.tn
mailstealer.zzz.com.ua
meublesinde.in
piratashost.top
raders.ru
semanariolaprensa.com
sinsixclaw.com
snapk.org
vovagaka.myjino.ru
wwe23pro.myjino.ru
xblackeyex.000webhostapp.com

# Reference: https://twitter.com/MBThreatIntel/status/1242173577639550976

antivirus-covid19.site
corona-antivirus.com
instaboom-hello.site

# Reference: https://app.any.run/tasks/e5dcc906-4f08-464b-b738-e39a0458dd4f/
# Reference: https://app.any.run/tasks/c0432968-da70-46ef-a4ff-5156603ae3ae/
# Reference: https://www.virustotal.com/gui/file/18cc40d5c56f621dc4b1386b37892ce9723145c7e2b580053386bf93dd329dfa/detection

developersblacknet.ru

# Reference: https://www.virustotal.com/gui/file/c860d4c575c1548da86c9a6a9a4e63d48612fe28cae7f12097542f2ea4b013bd/behavior/VirusTotal%20Jujubox
# Reference: https://app.any.run/tasks/f57a3fd0-fbfe-4534-9992-39e784ada8cb/

bootpay.ru

# Reference: https://any.run/report/c205d50556fe7ae5923452dbe6f5fc118229966bb1a7ce6ac87a9f2d371c987d/d51e29b1-1f91-4b7e-a55d-4d0a001b0b1f
# Reference: https://urlhaus.abuse.ch/url/339364/
# Reference: https://bbs.kafan.cn/thread-2179435-1-1.html

/US-2020-20-03-16-18-40-0569324B-9414737A-3C853917-C61460EF-C4978359.com

# Reference: https://www.virustotal.com/gui/file/3d9a2aa28c67d76ebd6512789014880dabb0b21164970f3618294899323fb3e6/detection

rat3.ddns.net

# Reference: https://twitter.com/ganeshnathan28/status/1261677808268369922

cryptobitnex.co.za

# Reference: https://twitter.com/jorgemieres/status/1273290086159978496

informavoce.com

# Reference: https://pastebin.com/Hc73BzJT

blacknet.riskpi.xyz
mozillabgsvc.com

# Reference: https://pastebin.com/SgZamRit

zeronine.duckdns.org

# Reference: https://www.virustotal.com/gui/file/6f508df03a36256666b092ab63082350dd09b8ecc05c4f5a2fcf89f9a2f8a885/detection

a0439294.xsph.ru

# Reference: https://twitter.com/jstrosch/status/1307178150753951750

bigblackcandles.com

# Reference: https://www.virustotal.com/gui/file/1079bedb436d38bc482f574f2b4fe72facb44d73a2dcdea05bb712eccce34eb5/detection

9551777.com

# Reference: https://www.virustotal.com/gui/file/1cefc8caf3c75d1392107e3f298fa3b8d8e2013fd5092106fbc80d810d3086c5/detection

siresconsultancy.com

# Reference: https://www.virustotal.com/gui/file/892265446bf18edaf83a4a0b7fb3caf3d477ba0a5e90e74cc1899c24057c4389/detection

sf-rp.8u.cz

# Reference: https://www.virustotal.com/gui/file/d59ca79e15d5aebdcfa02af91fdbeb41948809b3565c3f709b20c22aba124b46/detection

cofix.best

# Reference: https://www.virustotal.com/gui/file/35918e2f5f7b00f8d6e25f50c82c245360dbce7223395ec00278ab0c0eae0c77/detection
# Reference: https://www.virustotal.com/gui/file/c502e863775e1cc16e55c8aabd72c1004e10a622b191bc213f53169945e70bbd/detection

bot.rupturnet.cf
rupturnet.000webhostapp.com

# Reference: https://www.virustotal.com/gui/file/1c70eae778246e46fd769c80dd2064775b3658945b72ccfe996a7300f8125457/detection

kommand.rf.gd

# Reference: https://www.virustotal.com/gui/file/019e4cbc3cb028b67a0c89f4d9622bf7b0cac6491d8f6317e67535d43060a756/detection

ancient-parrot-9.loca.lt

# Reference: https://www.virustotal.com/gui/file/f6627bae86836a0887c75570820bff07faeefab6a1d43f7f17f7bd8aa88f9288/detection

rabcheat1g.temp.swtest.ru

# Reference: https://www.virustotal.com/gui/file/72ce0182331318feeff29f09110646e7fc2b920a54ab3ed520f147bc2d6389ce/detection

f0428648.xsph.ru

# Reference: https://app.any.run/tasks/ea87cfd7-8752-4fb5-878c-464b9644ed60/

timecforgoodnes.ml

# Reference: https://twitter.com/ActorExpose/status/1371583520095764483
# Reference: https://www.virustotal.com/gui/file/ffb71aeb0750c6186d35d8d57af40cc29d9e0f4b6fedf19a9112b1f9ed25eb05/detection

d3n1s.ddns.net

# Reference: https://app.any.run/tasks/8cecc0bf-7361-433a-be4a-903441b04b49/

a0524310.xsph.ru

# Generic trails

/1-x-x-x-1/
/BlackNET-master/
/blacknet/
/BlackNETPanel/
/BlackNET%20Panel/
/connection.php?data=
/getCommand.php?id=
/receive.php?command=
/flags/Client.exe