# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: salat stealer, WebRAT

# Reference: https://x.com/suyog41/status/1889999593716506942
# Reference: https://x.com/abuse_ch/status/1952720761472373029
# Reference: https://app.validin.com/detail?find=fd64809b0b5016081e0b04018fa3f90c&type=hash&ref_id=03c4bce5f94#tab=host_pairs (# 2025-08-05)
# Reference: https://www.virustotal.com/gui/file/0c813f621e562cefb8c2099e0e89deb9d92e9b1c8d59969a786c5a3621f285a6/detection
# FAVICON_HASH-HOST=fd64809b0b5016081e0b04018fa3f90c

krista-tur.ru
pidorasina.ru
posholnahuy.ru
sa1at.ru
salat.cn
salator.ru
webr.at
webrat.es
webrat.in
webrat.life
webrat.org
webrat.ru
webrat.su
webrat.top
webrat.uk
websalat.top
wrat.in

# Reference: https://x.com/skocherhan/status/1902163232560689553
# Reference: https://www.virustotal.com/gui/file/52a1750dc75795faa2bfdd3405ee027ee7a4fe78928027a5439372312479ca33/detection

194.87.115.90:55880
ws2.webrat.top

# Reference: https://www.virustotal.com/gui/file/0497be05152e5790464006a581ad98f89fc9415f8cfcc135918b2e80493ea28c/detection

193.33.206.11:55880

# Reference: https://www.virustotal.com/gui/file/823c21e5390a943a1dad0ee356712698e7564c5802304375957ce77c0005523d/detection

62.109.0.189:443

# Reference: https://app.validin.com/detail?find=%2FC%3DUS%2FST%3DAbama%2FL%3DObama%2FO%3DEbeme%2FOU%3DKurwa%20bobr%2FCN%3DResolver%2FemailAddress%3Dputin%40kremlin.ru&type=raw&ref_id=86fca993260#tab=host_pairs (# 2025-08-05)

188.213.165.49:443
5.249.150.82:443
62.109.0.189:443
79.137.32.60:443
82.202.130.32:443
90.156.168.187:443

# Reference: https://x.com/Fact_Finder03/status/1958752423226331473

webrat.site

# Reference: https://www.virustotal.com/gui/file/2a445dfd9edba060f9d12ab9223646f73922fc4e1b2945ccc79445bac778fab8/detection

http://193.233.113.101

# Reference: https://www.virustotal.com/gui/file/171870e14e10dd7be9a3906163d3f15984f24d8b7eaf2d816964d91891266a9b/detection

http://147.45.42.161
http://41.216.188.215
147.45.42.161:3333

# Reference: https://x.com/smica83/status/1996846490908807652
# Reference: https://www.virustotal.com/gui/file/fde3819fe90193bd64f3e6257a9a7e683aa359405e40f56658ea56cae46ed8a6/detection

147.185.221.180:20342
mon-parties.gl.at.ply.gg

# Reference: https://x.com/malwrhunterteam/status/1999821313959956708
# Reference: https://x.com/suyog41/status/2000561204125945962
# Reference: https://www.virustotal.com/gui/file/fe02d8d7a6b8f66624b238665d63094a2bcd19c44a3f9c449788cadbb1b741a6/detection

46.151.182.238:6969

# Reference: https://cert.gov.ua/article/6287707

salator.es

# Reference: https://x.com/1ZRR4H/status/2029671665840308602

http://217.26.28.234
217.26.28.234:443

# Reference: https://intel.breakglass.tech/post/salatstealer-s-new-trick-using-ton-blockchain-dns-to-make-c2-takedowns-impossible
# Reference: https://urlscan.io/result/019d0ba3-47a2-75e8-b173-49bf765930d3/
# Reference: https://urlscan.io/result/019d0ba4-e16c-7239-9a98-f18460debd60/

nyashteam.ru
nyash.team
