# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: brushworm

# Reference: https://twitter.com/VirITeXplorer/status/1042108048632934406
# Reference: https://www.tgsoft.it/italy/news_archivio.asp?id=953

http://192.3.204.229/api.php
proservesmail.science
dencedence.denceasdq
laredoute.space

# Reference: https://twitter.com/Racco42/status/1047401966303948801

http://192.3.207.117/index.php
serveselitmailer.science

# Reference: https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html

cheapairlinediscount.site
emailerservo.science
faxpctodaymessage.press
faxpctodaymessage.space
faxpctodaymessage.website
faxzmessageservice.club
fazadminmessae.info
housecleaning.press
hrent.site
irepare.site
macmall.fun
managerdriver.website
mantorsagcoloms.club
mediaaplayer.win
mobileshoper.science
plomnetus.club
ppservice.stream
progresservesmail.science
proservesmail.science
proservesmailing.science
searchidriverip.space
servemai.science
servemaining.science
serveselitmail.science
serveselitmailer.science
servesmailelit.science
servesmailerpro.science
servesmailerprogres.science
servespromail.science
servicemaile.science
serviveemail.science
servoemail.science
servomail.science

# Reference: https://www.tgsoft.it/italy/news_archivio.asp?id=953 (Italian)

laredoute.space

# Reference: https://twitter.com/Racco42/status/1119367194813579264

dssassasa.info

# Reference: https://twitter.com/Racco42/status/1123937772778213378

ohlandos.info

# Reference: https://twitter.com/Racco42/status/1123936195149537281

doloverip.info

# Reference: https://twitter.com/Racco42/status/1119367194813579264

dinoaps.info

# Reference: https://twitter.com/Racco42/status/1116630728257617921

jopsier.info

# Reference: https://twitter.com/matte_lodi/status/1095234945134587904

traderserviceinfo.info

# Reference: https://twitter.com/matte_lodi/status/1084845979663241216

supportitservice.info

# Reference: https://twitter.com/devnullek/status/1073159905480183808

searchhostid.info

# Reference: https://twitter.com/devnullek/status/1072513834009665537

flagnetwpor.club

# Reference: https://twitter.com/Racco42/status/1068460883515490304

loada.club

# Reference: https://twitter.com/Racco42/status/1068055699169648640

soplo.club

# Reference: https://twitter.com/Racco42/status/1098223717300215809

messagesuonsus.info

# Reference: https://twitter.com/Racco42/status/1097803746099249153

messagesupport.info

# Reference: https://twitter.com/Racco42/status/1097469463694397442

softwaresearch.info

# Reference: https://twitter.com/Racco42/status/1096184637137842176

traderssoftware.info

# Reference: https://twitter.com/Racco42/status/1093490063764307968

supportmixdayopens.info

# Reference: https://twitter.com/Racco42/status/1088102923685515264

faxzmessageservice.club

# Reference: https://twitter.com/matte_lodi/status/1075414447802466304

phonecalls.info

# Reference: https://twitter.com/Racco42/status/1098961075490508801

messansiplos.info

# Reference: https://twitter.com/Racco42/status/1109002102204960768

balaza.info

# Reference: https://twitter.com/Racco42/status/1099971844923379712

colormessa.info

# Reference: https://twitter.com/Racco42/status/1100313494791118848

sarioname.info

# Reference: https://twitter.com/Racco42/status/1100708426592780288

seasioname.info

# Reference: https://twitter.com/Racco42/status/1101520217308626944

wwebsservice.info

# Reference: https://twitter.com/Racco42/status/1102870670789275648

doomsriosa.info

# Reference: https://twitter.com/Racco42/status/1103436577949315077

pizcheks.info

# Reference: https://twitter.com/Racco42/status/1103950235108290560

nteriap.info

# Reference: https://twitter.com/Racco42/status/1105485693990682624

pikostris.info

# Reference: https://twitter.com/Racco42/status/1106134421231538176

serpas.info

# Reference: https://twitter.com/Racco42/status/1126381994139688960

hopliojn.info

# Reference: https://twitter.com/Racco42/status/1126824753942212609

manalitos.info

# Reference: https://twitter.com/Racco42/status/1133717606198861824

halatest.info

# Reference: https://twitter.com/Racco42/status/1134214372996390913

canasikos.info

# Reference: https://twitter.com/Racco42/status/1135449081092988928

pionosde.info

# Reference: https://twitter.com/Racco42/status/1136174555284877313

kloniroms.info

# Reference: https://twitter.com/Racco42/status/1136597444593143808

dartions.info

# Reference: https://twitter.com/Racco42/status/1136898137166090241

francesj.info

# Reference: https://twitter.com/Racco42/status/1136995314706124801

fopinms.info

# Reference: https://twitter.com/Racco42/status/1138003538381090816

renowal.info

# Reference: https://twitter.com/Zerophage1337/status/1138113507369598976

ctrsopsis.info

# Reference: https://twitter.com/Racco42/status/1138700015269044224

motorsj.info

# Reference: https://twitter.com/Racco42/status/1139085986711953408

maknolsd.info

# Reference: https://twitter.com/Racco42/status/1139431038751563778

santamario.info

# Reference: https://twitter.com/Racco42/status/1140566681003208709

panakoplos.info

# Reference: https://twitter.com/Racco42/status/1140915399560708096

lulipcxulci.info

# Reference: https://twitter.com/Racco42/status/1140916422673129473

ginjiokd.info

# Reference: https://twitter.com/Racco42/status/1141108505220395008

tetoklisls.info

# Reference: https://twitter.com/Racco42/status/1143048549338439680

carmenziro.info

# Reference: https://twitter.com/Racco42/status/1143408464452116480

mondsisosd.info

# Reference: https://twitter.com/Racco42/status/1143776723491786753

tefidnsops.info

# Reference: https://twitter.com/Racco42/status/1144352703243595786

pitnicuis.info

# Reference: https://twitter.com/CERT_Polska/status/1145989857195515905

derikaosos.info
statusnim.info

# Reference: https://twitter.com/Racco42/status/1146318347023323142

vtopiuops.info

# Reference: https://twitter.com/Racco42/status/1148166170878644224

varnecoposlo.info

# Reference: https://twitter.com/Racco42/status/1149249291552284672

tatmandopolos.info

# Reference: https://twitter.com/Racco42/status/1149571435628601350

zaraminosdpolos.info

# Reference: https://twitter.com/Racco42/status/1150698156495183873

paratimonoos.info

# Reference: https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later
# Reference: https://otx.alienvault.com/pulse/5d35df000396229f0d515c0b

analiticap.info
tetofevent.online

# Reference: https://twitter.com/Racco42/status/1153287017771556864

plorosoososa.info

# Reference: https://twitter.com/Racco42/status/1154672917650792449

fernanosood.info

# Reference: https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later

http://107.175.83.148
cytotan.website
driverupdatefaxas.info
infosevicues.info
tetofevent.online

# Reference: https://twitter.com/Racco42/status/1155751781210755072

paltoropos.info

# Reference: https://twitter.com/Racco42/status/1189807019890483200

patromink.xyz

# Reference: https://twitter.com/w3ndige/status/1191752053426663425

arethatour.icu
pontrolimon.xyz

# Reference: https://twitter.com/Racco42/status/1195338538142883841

motorlafd.xyz

# Reference: https://www.cert.pl/en/news/single/brushaloader-gaining-new-layers-like-a-pro/
# Reference: https://otx.alienvault.com/pulse/5dd5673e6249f6c67ea0819d

reloffersstart.co
rawpaper.3b213f0d96b4262c8792f57ce7614a2f.ps
rawpaper.df996bd46536d50555f8a211d9ddd8a7.ps
rawpaper.553d8a4a14500e840dea5a4065d9ed4b.ps
rawpaper.d38662fdc831a31779a5104b0dc237f2.ps
rawpaper.b3c531b90f0995fb4cee9abd55334f82.ps

# Reference: https://twitter.com/w3ndige/status/1198984590427340800

ost-341478.info

# Reference: https://twitter.com/reecdeep/status/1207585396617560064

carlosnarlos.xyz
pharma-genomics.com

# Reference: https://twitter.com/Racco42/status/1211786347721175041

flingopskd.xyz

# Reference: https://twitter.com/reecdeep/status/1216707371512320000

duiioosoiis.xyz

# Reference: https://twitter.com/reecdeep/status/1220249193161379841

askkkkkkassaa.xyz

# Reference: https://twitter.com/reecdeep/status/1222785196522688512

panikolsos.xyz

# Reference: https://www.virustotal.com/gui/ip-address/94.140.114.181/relations

danmikolls.xyz
faniposlskd.xyz
ferilppdslos.xyz
findfilius.xyz
mantropoliops.xyz
miiiiisdkkkksd.xyz
prontosloshop.xyz
vitruuusd.xyz

# Reference: https://twitter.com/reecdeep/status/1223275903771467776

filiponiols.xyz

# Reference: https://twitter.com/c3rb3ru5d3d53c/status/1224897781913018368

loppappsas.xyz
fiffaslslslld.xyz

# Reference: https://twitter.com/reecdeep/status/1224994413975363585

little-snitch.xyz

# Reference: https://twitter.com/reecdeep/status/1227929013596884992

gentlemanlyblessing.info
googolslds.xyz
vincentdemiero.com

# Reference: https://twitter.com/nazywam/status/1229720956790329345

biplaneacclima.info
fidropioosop.xyz
visitpakistan360.com

# Reference: https://twitter.com/reecdeep/status/1230407172686827521

arethatour.icu
lopsanoposd.xyz
queryjs.xyz

# Reference: https://app.any.run/tasks/7a8a5207-5174-40d5-a49c-bcd5bb3c6b0e/

wikipedia.112000212.com
managerdriver.website

# Reference: https://twitter.com/Jane_0sint/status/1722965202138775771
# Reference: https://app.any.run/tasks/f5dd2f1c-01dd-4c68-ae14-24f16a42a3f4/

http://170.130.55.46
170.130.55.117:443
170.130.55.117:8080

# Reference: https://www.malware-traffic-analysis.net/2023/11/06/index.html
# Reference: https://www.virustotal.com/gui/file/1fbeb2aee4a49274b1e4bfb01d5fbbaa9b0eb90f239c66fa0a74168295ffb4bd/detection

http://170.130.165.37
170.130.165.107:1444
170.130.165.37:443
170.130.55.117:443
170.130.55.117:8080
ftroftrodro.top
northstartech.online

# Reference: https://www.elastic.co/security-labs/brushworm-targets-financial-services
# Reference: https://www.virustotal.com/gui/file/89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7/detection
# Reference: https://www.virustotal.com/gui/file/b7d2c5dbdc40d42088795a84e566ab67277ea766973576936864841c66d6b521/detection
# Reference: https://www.virustotal.com/gui/file/f744b1b801739323c1a4edce07e995d74d0867f0087678ae71adc5d44767ee06/detection

dawnnewsisl.com
resources.dawnnewsisl.com
