# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: etherrat

# Reference: https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/
# Reference: https://medium.com/@august.vansickle/tsundere-botnet-ebfcc0b4420c

103.246.145.201:1234
185.28.119.179:1234
193.24.123.68:3011
196.251.72.192:1234
62.60.226.179:3001

# Reference: https://x.com/malwrhunterteam/status/1997052508464628058
# Reference: https://x.com/k33b0i/status/1998431456792846521
# Reference: https://x.com/bluish_red_/status/1998432859955012065
# Reference: https://x.com/polygonben/status/2023870916497928312
# Reference: https://www.virustotal.com/gui/file/b8d9ef87b3a7a2cf2509317296baf127100a14838d03e1c158b0d5f17ec5b41b/detection

193.24.123.68:3001
91.215.85.42:3000
91.215.85.42:3001
/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh
