# Copyright (c) 2014-2024 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: EternalBlue, Eqtonex, EquationDrug, ShadowBrokers

# Reference: https://www.virustotal.com/gui/file/5dc46dd363b02df2f4addd95554c97edd13da6ffc1db859dba56fb26b1700855/detection

198.98.57.188:5900
d.tocat.co
e.tocat.co
rundl.l0o01.com

# Reference: https://www.virustotal.com/gui/file/45316f0ed81376d8c4a941c4f980bfa0f89fc841e3f76b0e768ea79b60ce9a4c/detection
# Reference: https://www.virustotal.com/gui/file/fa3b9e1afdc2147972ace1cdcf840daefbb65896591efe99a13d25be29997f66/detection
# Reference: https://www.virustotal.com/gui/file/dfe4578a7524c69beba392d29dbe0c88c43a6b67cfd88bfb8ab42c4e5cda074f/detection

198.98.57.188:7722
0000o.xyz
00000.l0o01.com
e.0000o.xyz
edns.duckdns.org
rundl.0000o.xyz

# Reference: https://www.virustotal.com/gui/file/c98aaaa4626c04bd4e1dc089b9b1f9c86f3ec2ac11e1d7e7f59b67109927709b/detection

drawal.tk
l0o01.com
d.drawal.tk
d.l0o01.com
e.l0o01.com

# Reference: https://www.virustotal.com/gui/file/0e21ce4dce8dae2ef69f09867386cd08057ac26347cf32ade84dff79a3d23701/detection

s.drawal.tk

# Reference: https://www.virustotal.com/gui/domain/d.tocat.co/relations

171.22.30.107:88
203.159.80.214:88
41.216.230.54:88

# Reference: https://www.virustotal.com/gui/file/a86144d30945709b0f544280533abcf1bae9465e97b283ee49380c88ad601348/detection

35.205.61.67:63145
heroherohero.info
uio.heroherohero.info

# Reference: https://twitter.com/James_inthe_box/status/1138440424765288454
# Reference: https://www.virustotal.com/gui/domain/hognoob.se/relations
# Reference: https://www.virustotal.com/gui/file/0001dddae87ac8981bab147e8a9258a4fefa1ecbf7fe0fd4e784a264558533fe/detection

185.198.57.213:63145
hognoob.se
fid.hognoob.se
haq.hognoob.se
pxi.hognoob.se
pxx.hognoob.se
uio.hognoob.se
q1a.hognoob.se
upa1.hognoob.se
upa2.hognoob.se