# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: betruger, vipertunnel

# Reference: https://twitter.com/AlvieriD/status/1754691984105607564
# Reference: https://twitter.com/noexceptcpp/status/1766195215453364634

ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion
ransomxifxwc5eyeopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion

# Reference: https://twitter.com/AlvieriD/status/1783261781487387003

ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaicg3pgpe5qcad.onion

# Reference: https://x.com/ShanHolo/status/1868575863446602029

adidasf50messi.com
paymentsconfirm.com

# Reference: https://www.trendmicro.com/en_us/research/23/i/redline-vidar-first-abuses-ev-certificates.html
# Reference: https://www.virustotal.com/gui/ip-address/193.106.175.107/relations

12301230.co
40031.co
abccba.co
adaytriana.co
almaliam.co
chloemario.co
danielamanuela.co
helenaasier.co
isabelmartin.co
laiamia.co
martaafrica.co
martinpol.co
ola007.co
samuelelena.co
santiagocarlos.co
terms2023.co
uno230.co
updated-2023.co
updated-terms.co
updatedterms2023.co
violetavera.co

# Reference: https://45734016.fs1.hubspotusercontent-na1.net/hubfs/45734016/Ransomhub%20Group%20&%20New%20Betruger%20Backdoor%20%20Technical%20Malware%20Analysis%20Report.pdf
# Reference: https://github.com/ThreatMon/ThreatMon-Reports-IOC/blob/main/Ransomhub/Betruger/IOC/DOMAIN.txt
# Reference: https://github.com/ThreatMon/ThreatMon-Reports-IOC/blob/main/Ransomhub/Betruger/IOC/URL.txt
# Reference: https://www.virustotal.com/gui/file/c0fcf7096bccfe2252a2167a25d5b94b9fea7c8aa399f2f138f833400fcd0aff/detection
# Reference: https://www.virustotal.com/gui/file/ae7c31d4547dd293ba3fd3982b715c65d731ee07a9c1cc402234d8705c01dfca/detection
# Reference: https://www.virustotal.com/gui/file/7c53d20e882ba1b98320e76df6ff907b6a341c25e3de695657c8439a26afe09f/detection

504e1c95.host.njalla.net

# Reference: https://x.com/AlvieriD/status/1908486521151168554

ijbw7iiyodqzpg6ooewbgn6mv2pinoer3k5pzdecoejsw5nyoe73zvad.onion

# Reference: https://cybersecuritynews.com/ransomhub-ransomware-rdp-servers/
# Reference: https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/

http://38.180.139.56
164.138.90.2:3389
185.190.24.33:3389
185.190.24.54:3389
38.180.139.56:443
5.181.86.158:3389

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2025-11-08)

104.238.61.144:443
108.181.115.171:443
108.181.182.143:443
158.255.213.22:443
158.255.213.22:63421
162.248.224.223:443
162.248.224.223:7882
162.252.173.12:443
162.252.173.12:8000
173.44.141.226:443
185.174.101.240:443
185.174.101.69:443
185.233.166.124:443
185.233.166.124:9702
185.33.86.15:443
185.72.8.137:443
185.72.8.137:7882
185.72.8.65:443
185.72.8.65:9531
193.203.49.90:443
23.227.193.172:1999
23.227.193.172:443
37.1.212.18:443
38.146.28.93:443
38.180.81.153:443
45.66.248.150:1999
45.66.248.150:443
45.82.85.50:443
45.82.85.50:8000
5.8.63.178:1999
5.8.63.178:443
88.119.175.65:443
88.119.175.70:443
92.118.112.143:443
92.118.112.208:443

# Reference: https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csv (# 2026-03-01)

104.238.60.108:443
104.238.60.108:54372
185.180.198.3:2025
185.180.198.3:443
185.72.8.121:1032
185.72.8.121:443
38.135.54.24:1976
38.135.54.24:443
45.66.248.150:4201
45.82.85.50:13063

# Reference: https://labs.infoguard.ch/posts/slithering_through_the_noise/
# Reference: https://www.virustotal.com/gui/file/4bb2f52df4ab8147a750ff1cac8845bbc5ec7d9ca57a81bc8522d9b0f7356dff/detection
# Reference: https://www.virustotal.com/gui/file/668b77e4e53490eba960abd7f482ff5126af4b16abb4dd3972e533444d5dffa9/detection
# Reference: https://www.virustotal.com/gui/file/813f89f92501588c8229cc369ee4847a9d9818ba1cb5ae65f2942683f85bfb2f/detection
# Reference: https://www.virustotal.com/gui/file/f17c05ce7476c11c58731d4081e4f5e5288df15e301cbc43bb0d245998c33140/detection

108.181.115.254:10000
108.181.115.254:443
162.248.225.165:38263
162.248.225.165:41537
162.248.225.165:443
162.248.225.165:50851
162.248.225.165:54435
162.248.225.165:59393
193.5.65.151:1883
193.5.65.151:3000
193.5.65.151:443
45.56.162.61:40795
45.56.162.61:443
45.56.162.61:45515
45.56.162.61:48583
45.56.162.61:52771
45.56.162.61:55885
carryingitall.com
chateaugalicia.com
joealdana.com
rentiantech.com
