# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: Hupigon, Koblu, Refpron, GGCode, zuqra stealer

# Reference: https://www.virustotal.com/gui/file/047b2321efda025461cc180f73e758d3d0d63c071352a8a18e748c4f61c29c93/detection

updatepac.com

# Reference: https://www.virustotal.com/gui/file/000790f19d06acab1b817a7340fbd92607df21e83b50a1101650f4ee04460046/detection

tehsex.no-ip.com

# Reference: https://www.virustotal.com/gui/file/bd462f835a8a709a449f58dd8cc091b63be2111eae0772b28d6dfd886911fd41/detection

6666.8800.org
address.2288.org

# Reference: https://www.virustotal.com/gui/file/0278d7052c818e206d95cd9c21c8d73238e25e9629d8df95857be0cb02246537/detection

222.247.232.208:49908
27849587.vicp.cc
49908.vicp.cc

# Reference: https://www.virustotal.com/gui/file/f7622ff62aa691c60052d39013cf60844bb7b50a50a103110059982c1911b41a/detection

cyc1165321267.gicp.net

# Reference: https://www.virustotal.com/gui/file/a09602528b966eee9fd1a587eca9fa226066077c89171c83d914d22d70fec2bb/detection

125.77.199.30:81
183.236.2.18:81
avzhaj.3322.org
gm0216.3322.org

# Reference: https://www.virustotal.com/gui/file/08b8be1942ae9cf1b6fe52aebd7467d0c9e1c256e5248542d658f1c57c08c491/detection

173.45.105.218:8392
174.133.72.250:8392
183.236.2.18:1670
185.53.177.54:8392
204.27.57.154:8392
211.149.209.87:8392
64.120.176.66:8392
64.79.86.26:8392
74.54.201.210:8392
findhobbits.com
jsactivity.com

# Reference: https://www.virustotal.com/gui/file/8e6e87c6d7538a63517a2a9d4b0302f8783c0632d7f041c4af818dff7d8389de/detection

pinwei.ddns.net

# Reference: https://www.virustotal.com/gui/file/e9cbc0d3b5cfb3c8a6fb8ac52d1d581eafd0ac381114affb5ec3749b42f53ce4/detection

http://103.231.13.135
103.231.13.135:83
wegame.sytes.net

# Reference: https://www.virustotal.com/gui/file/2154f77e836aba3e505e7a412d4999a5661264e16e129d84b27ed59dcc23d69e/detection

104.233.148.161:38518

# Reference: https://x.com/suyog41/status/2041080264571703774
# Reference: https://www.virustotal.com/gui/file/9ac6ebf25bb3d1becf6b7bf08bc53fc6f8e331ec9d7a882656fe54e4998595cf/detection
# Reference: https://www.virustotal.com/gui/file/02574b94a94940c00cc2290839d176b5b0909e2118a29acf7c796d1f5cf1649c/detection
# HEADER_HASH-HOST/IP=eda115137bff152a22d3
# HEADER_HASH-HOST/IP=e5c2941ac9cffab12740

http://31.58.58.181
allahddos.cc
balista.lol
ciobaba.online
darkside.cy
devruntime.cy
excon.lol
gwtmonroe.com
i-slept-with-ur.mom
louisvuiton.mom
nuzzyservices.com
pee-files.nl
risesmp.net
textpubshiers.top
vcc-library.uk
vcc-libraryguide.help
vcc-redistrbutable.help
vcc-redistributable.help
dhszo.darkside.cy
goadeddev.dpdns.org
mail.allahddos.cc
/Stb/Retev.php

# Generic

/conect-versin838file/index.php
/conect-versin838file/
