# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: kronos, osiris

# Reference: https://www.proofpoint.com/us/threat-insight/post/kronos-reborn

jhrppbnh4d674kzh.onion
jmjp2l7yqgaj5xvv.onion
mysmo35wlwhrkeez.onion
suzfjfguuis326qw.onion
milliaoin.info
kioxixu.abkhazia.su
lionoi.adygeya.su
startupbulawayo.website

# Reference: http://www.broadanalysis.com/2016/10/31/compromised-site-redirects-to-rig-exploit-kit-delivering-kronos-and-nymaim/

2mynameins3344.net
johane3234.net

# Reference: https://twitter.com/nao_sec/status/1148799237049552896
# Reference: https://twitter.com/VK_Intel/status/1148803869239128071
# Reference: https://app.any.run/tasks/dcae4160-a76a-483c-ae4c-788eed561103/

xtaahlcqyfppmvwwprblvveog.paletoxyz.com

# Reference: https://twitter.com/JayTHL/status/1166744243861360642

d2gyv54plbc23to.onion

# Reference: https://twitter.com/P3pperP0tts/status/1179731289248808960
# Reference: https://app.any.run/tasks/80119a51-fc3f-40ca-bb1f-c543927db269/
# Reference: https://app.any.run/tasks/2c1d5942-b788-4316-952b-320f61494fd2/
# Reference: https://app.any.run/tasks/52656d24-b866-416c-b703-ee0fae0e3f78/

149.56.45.200:9030
213.32.71.116:9030
66.111.2.131:9030

# Reference: https://twitter.com/Artilllerie/status/1179753482783473665

chlwdxvug4ptljce.onion

# Reference: https://blog.talosintelligence.com/2019/10/threat-roundup-for-september-27-to.html (# Win.Malware.Osiris-7191711-1)

updateserver4.top
updateserver7.top
updateserver5.top
updateserver9.top
updateserver2.top
updateserver8.top
updateserver10.top
updateserver6.top
updateserver3.top

# Reference: https://app.any.run/tasks/498a43e4-05fe-4413-afc2-842aa4d6764d/

51.15.42.19:9030
94.16.114.105:8080
95.217.42.50:1067

# Reference: https://twitter.com/VK_Intel/status/1190317493224689667
# Reference: https://www.virustotal.com/gui/file/f61870ea2b807f6a3314ff303942961b6f4009464da09d98ea202d3450534ad3/detection

178.17.170.194:444
192.124.250.83:9001
jpb3hvq7v7bsyemq.onion

# Generic trails

/kpanel/connect.php
/ZRNlFwIb/connect.php
/tor/server/fp/
/tor/status-vote/current/consensus
