# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: mistic, mltbackdoor

# Reference: https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor
# BANNER_0_HASH-HOST=bd7f22d8852997524e55366d92f0b580
# HEADER_HASH-HOST=e5c06c145dd83a3c12b9

carrolc.com
glegchner.com
hrs2y15sungu.com
powwowski.com
rs2y15sungu.com
tillmat.com

# Reference: https://packetwatch.com/resources/threat-profile/threat-profile-kongtuke-clickfix-havoc-campaign

2n1ksf4h0va.com
cj06y9v4xab.com
