# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: acr stealer, grmsk stealer

# Reference: https://twitter.com/sekoia_io/status/1784943443157930449
# Reference: https://www.virustotal.com/gui/file/5b8290f563694f3977b8fc994b6c5dc3445a3b2b87ee0fd8daf4f5fe97f55547/detection
# Reference: https://www.virustotal.com/gui/file/c20948517d9210c8a7ccac76c4ad2e474157c408c49f07497677c3fcca736976/detection
# Reference: https://www.virustotal.com/gui/file/f7d15a3027d3a430511630c91898c72b91b5fb42bf99315cc5a5ef009a473835/detection
# Reference: https://www.virustotal.com/gui/file/aa02880802bfcd04ebfbd1dcc0289ccfa7cd8143175c1964aacaa18e2834fac8/detection

dervinko.biz
iicc.fun
veronicabal.com

# Reference: https://twitter.com/crep1x/status/1785766443226640666

trxh.xyz
trxq.xyz
trxu.xyz

# Reference: https://x.com/seanmw/status/1824118200620982285
# Reference: https://x.com/ddash_ct/status/1824181880540840274
# Reference: https://www.virustotal.com/gui/file/e8aeacf53531c3e4befc2c750f7592e7d22e0d6a0e728ea60566e798d148ea50/detection
# Reference: https://www.virustotal.com/gui/file/f13acf740d98741b63fdc372029439fe6a703c50a46d1d15fc277cdb06e53751/detection
# Reference: https://www.virustotal.com/gui/file/f8fe61e04324bca052cb7a6808c0e15502128106028e9cd9bbca5426ee2b568f/detection
# Reference: https://www.virustotal.com/gui/file/9b46bfe252190136a14ad3f63628469c0f8e0587b36ffc56ad9edb8e8bc0d510/detection
# Reference: https://www.virustotal.com/gui/file/909c5de972488ba5961601480c7e802dc9eb743000ec0b1ab89a4baf601cb42c/detection
# Reference: https://www.virustotal.com/gui/file/bf04f1095661a32fae746430ff31de02f686ddadd288d9ea3b58d4279e079c41/detection
# Reference: https://www.virustotal.com/gui/file/1ef9e69d370034db2a2d26971b626f15e8da6d4da9f4015738e77f3dbbb2765c/detection
# Reference: https://www.virustotal.com/gui/file/0f6dfda8af429acd0083901a927febe3c43a8e1a066645dcca1c0cc8c4d1df1a/detection

http://188.40.17.118
http://193.233.132.92
http://45.61.136.124
http://81.19.135.226
http://91.103.252.225

# Reference: https://x.com/K_N1kolenko/status/1937745066463809590

cornmealjustly.lat
encountergulf.world
gawkheading.lat
b1.cornmealjustly.lat
b1.encountergulf.world
b1.gawkheading.lat

# Reference: https://www.virustotal.com/gui/file/54f0787516067eddf044fff95af7536b2f05d2f7ac3592b1955a776ea0f7fd88/detection

chatterscalded.top
hashgranite.top
b1.hashgranite.top
h4.chatterscalded.top

# Reference: https://x.com/K_N1kolenko/status/1938568444464746788

crushedwildly.top
husbandlandside.top
wreckermodule.life
xumu.press
b1.crushedwildly.top
b1.husbandlandside.top
b1.wreckermodule.life
ui.xumu.press

# Reference: https://x.com/Fact_Finder03/status/1947519545687564639
# Reference: https://app.validin.com/detail?find=6e80e6deef7f571ac5588dcbc9d2d9ae&type=hash#tab=host_pairs (# 2025-07-22)

365druoinks.shop
8balldes.shop
acediscgolfdes.shop
acrstealer.com
acrstealer.top
actionclutchdes.shop
addictiuoveapparelpas.shop
aleuossis.shop
allnightflightuorecords.shop
allthreuoads.shop
almanuoaars.shop
altusfinuoears.shop
amruos.shop
anitasuolists.shop
apothuoecaries.shop
aquacaduoabras.shop
aquaticuosupplies.shop
aquirkofuofates.shop
aristabeuoads.shop
armadaduoeals.shop
artestads.shop
artificialfloralsuppliedrs.shop
aussiesuperstordes.shop
babygoouodswarehouses.shop
balduowinscycles.shop
ballyruoobertgardens.shop
barneyssalonsuppliders.shop
beadsunlimitedes.shop
bellauohomecos.shop
bigberthaoriginadesl.shop
bigdreamdes.shop
blackcooucktoys.shop
blingmebabydes2.shop
blinguo3ts.shop
bobuoberdavescustomcycles.shop
boxofhuougs.shop
brsportdes.shop
budguoethbs.shop
bulkwhuoolesalesweets.shop
bundlfuoeshs.shop
camperduoowncellars.shop
carpeduoiemwithremis.shop
casiuooaus.shop
casualcuoollections.shop
casulahobbuoies.shop
cchairandbeautydes.shop
celebratefuoaiths.shop
cendroex.com
chatterboutiqudes.shop
cheapestrugsonlineds.shop
chelseuoababys.shop
chesapeakedistributiondes.shop
chickenuolittlekids.shop
choosingkuoeeping.shop
claritycuorafts.shop
classiquesupplydes.shop
coffeeuocups.shop
collaredgreendes.shop
cookwuooods.shop
cornuoborns.shop
cosmicclotuohing.shop
cosplayclandes.shop
countryuohouselibrarys.shop
craftncolordes.shop
crownuoandpaws.shop
crowooder.shop
crystaluoaddictions.shop
crystauolsandbeadsforfriends.shop
ctkollecuotables.shop
customuoplugs.shop
daddypopdes.shop
davidauoustinroses.shop
decouorsavings.shop
deskbuoandits.shop
diabeticuosupplys.shop
dollaruobargains.shop
dragonflyuokids.shop
eandetuorading.shop
easytotdes.shop
elitesalouonsupplies.shop
epbeautysupplydefs.shop
eraser-doily.shop
erstwuoilders.shop
euromauollusas.shop
fabovuoes.shop
fabricguyeds.shop
fastruoons.shop
feathuoers.shop
fenzauuosas.shop
ferristuoales.shop
flashbacuokshosp.shop
focuoos.shop
folluous.shop
forever4uobeautys.shop
fortprousdas.shop
friscodressesuomyshopifys.shop
furndes.shop
furrienders.shop
gamedaybaeds.shop
gamerhuoolics.shop
gaypruoideshops.shop
glamwithmackdes.shop
goldengirlglitzdes.shop
gozob.shop
greasemonkeydirectdes.shop
greenuodoordecors.shop
growtropicaldes.shop
guitarfactorydes.shop
halfpuoricesalonsupplies.shop
hamrcoatingdes.shop
happyinmartdes.shop
heritagebuildingdes.shop
heritageofscotlandders.shop
highcountrywesternweaders.shop
horizonleisureds.shop
houseofkojodes.shop
houseofspellders.shop
hydrillageardes.shop
iconbodyjewelrydes.shop
idealtextildres.shop
idreamuomarts.shop
imissyououvintages.shop
instanthbdes.shop
internationalbeautydes.shop
ivorygeuoms.shop
ivyonmaindes.shop
jekkadess.shop
jellyfabricdes.shop
jigsawgallerydes.shop
johncootders.shop
justlittleluxuriedrs.shop
kaisercraftdes.shop
kidshalloweencostumders.shop
kidspartycraftforlessdes.shop
killuostars.shop
kingswarehouseds.shop
kpoptimuoes.shop
lebeautydes.shop
lightingsuouperstores.shop
lights4fuuons.shop
littleheartdes.shop
londouongrocerys.shop
longstoryshortdesigndes.shop
losheuons.shop
loveyouourhealths.shop
lussgeneralstordes.shop
madeinuoplys.shop
magicshopdes.shop
magneticcitizen.shop
magnoluoiatoos.shop
mamasauondpapaslbs.shop
mananduoshaving.shop
mancheuosterfactorys.shop
mehrathuoontradings.shop
mektrouonics.shop
miragesareedes.shop
moderuoniques.shop
modiphuoius.shop
mrbouongos.shop
mrfurnuoitures.shop
mrmenuos.shop
musicruoadiocreatives.shop
mybeauoutyaffairs.shop
myhappuoyhelpers.shop
mysleepfuournitures.shop
n101nutriuotions.shop
nationalinteriorders.shop
natureaquouariums.shop
ndjohuons.shop
nextuodealshops.shop
nmauos.shop
noahuos.shop
nordacious.shop
notchders.shop
nyhairbuoeautys.shop
obitrul.online
ogdenbeautydes.shop
oroatrauodes.shop
otterspromisdes.shop
ottostouores.shop
ourboathousdes.shop
oursatelliteheartders.shop
outdonefurniturders.shop
outdoorgoodstoreds.shop
outlawtackdes.shop
oxternes.online
paperflouourishs.shop
papillouonwholesales.shop
partyglowzdes.shop
partypauouocks.shop
partypluoanets.shop
partytouchders.shop
partytowndes.shop
partyuopieces.shop
partyuosavers.shop
patternpuoops.shop
perfecttradingcodes.shop
petparlourdes.shop
pickitfeuonces.shop
piercefurnuoituregallerys.shop
pinkpigcuoards.shop
planetmerchdes.shop
planetwaxdes.shop
plumpoluokadots.shop
poisoncityestoreds.shop
popmojuois.shop
portergulchdes.shop
pureluxuouries.shop
pwdiruoects.shop
qualityfoodsonlineds.shop
queenmuoayjewelrys.shop
racereadyfabes.shop
railsouofsheffields.shop
raymonduoswarehouses.shop
realaquouatics.shop
redbuoers.shop
rinkitdes.shop
rootsplantders.shop
ruooyalarmouries.shop
rustuoys.shop
sahairsuppldiers.shop
sandyssuoecretwednesdays.shop
scarboruooughjokeshops.shop
seconuodstringleathers.shop
shopadelaiders.shop
shopfuournishs.shop
shopmascdes.shop
shoppalaceuobeautys.shop
shoptwinkuolebabys.shop
shopuobeautys.shop
silvercoveds.shop
simpleuoforms.shop
simplybeeboutiqueds.shop
skincareuobyalanas.shop
skinlovecreuoams.shop
skysiesuocakes.shop
slapstuoas.shop
slaymyprindest.shop
slimsdeuotailing.shop
smartpractice.shop
smoothuosales.shop
sokollabdes.shop
sophieauollports.shop
spiritjourneysgifteds.shop
spymonkeydes.shop
sshairbeautydes.shop
stateblisdes.shop
stompinggrounders.shop
strangeworldrecorders.shop
sunevuoerydays.shop
sylviapdes.shop
symposiuuombooks.shop
talkinuogtables.shop
tanstellades.shop
terouos.shop
thebabyuozrooms.shop
thebayruoooms.shop
thebeautifuls.shop
theblinguothings.shop
thecauordking.shop
thegamescornerdes.shop
thegreatyorkshireshopdes.shop
thegroomingclinicdes.shop
thekangaruooopouchs.shop
thelittleuobluebrushs.shop
themosuoaicstores.shop
thepanduoorasplayhouses.shop
thepartysuperstoreds.shop
therenuomystores.shop
thesilverdahlidas.shop
thestubbyclubdes.shop
thesultryvixendes.shop
theterraceuostores.shop
thevinyuollobbys.shop
thezeuonshops.shop
thornsdiydes.shop
tigerfitneuoss.shop
tileuos.shop
toys2learndes.shop
trainworldes.shop
ttcomuobats.shop
ttmartguolobals.shop
usatuouffs.shop
vendingsuuoperstores.shop
vesabeauoutys.shop
vesimiuodesigns.shop
vgmuoxs.shop
violetskyeboutiqueds.shop
warlordgamesdes.shop
watsonkuoennedys.shop
weareluoakebounds.shop
weaverleuoathersupplys.shop
weddingcollectibles.shop
whichcrafuotdoyoudos.shop
yesterhomeds.shop
zabeccalivuoings.shop
zapcreuoatives.shop
zntswhouolesales.shop

# Reference: https://www.virustotal.com/gui/file/2d4ab83058b7f5a0ba9f717191e7379295620b3ac87ec181a8a6f6fdd535b362/detection

http://85.208.139.75
/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371

# Reference: https://x.com/skocherhan/status/1955533752995922359
# Reference: https://app.validin.com/detail?find=1b6e6d9e474ec6408dcbe4d76d844556&type=hash&ref_id=5953d0fc8d8#tab=host_pairs (# 2025-08-13)
# Reference: https://www.virustotal.com/gui/file/83284a1b4190475208d06681c62c80a6cfa1b68c85998213535f629b2b1279d9/detection
# Reference: https://www.virustotal.com/gui/file/0739165a3215fe6968b4c1db2d8caa28fb852771ab9b5fccbbee34406f9261a5/detection
# Reference: https://www.virustotal.com/gui/file/0226f2bafb0ba2e285bd0d7d26d714600b8ddba5310bd00dda26138269279037/detection
# Reference: https://www.virustotal.com/gui/file/0f6dfda8af429acd0083901a927febe3c43a8e1a066645dcca1c0cc8c4d1df1a/detection

84.54.44.48:54001
84.54.44.48:54003
84.54.44.48:54009
apiwin.bet
extrudingtattle.bet
naturistvenue.digital
securemetricsapi.live
sermonrevolver.top
unpilotedbanter.top
windowsupdateorg.live

# Reference: https://x.com/naumovax/status/1955297617492975951
# Reference: https://tria.ge/250725-s3wyvs1qx2/behavioral1

http://185.76.243.5
http://185.76.243.64
http://80.253.251.138
185.76.243.5:443
185.76.243.64:443
80.253.251.138:443
r2uvdv8hqez2xu.com
ue29ognhugjiqc.com

# Reference: https://x.com/naumovax/status/1978092071350116530
# Reference: https://www.virustotal.com/gui/file/83b63027f77ccc7d1cdfd22ff160a20ff129ef660fb86af5839a675290c73181/detection
# Reference: https://www.virustotal.com/gui/file/e2951e2f1dd3b7ee06a4f9e267f3d581451ede62912465ed1f74c06392db916e/detection

http://87.120.219.223
http://95.216.187.225
87.120.219.223:443
/j8AhGHtzP969Ca/cpdll.bin
/j8AhGHtzP969Ca/discord.bin
/j8AhGHtzP969Ca/scrdll.bin
/j8AhGHtzP969Ca/sodll.bin

# Generic

/ujs/9adbbdfd-2661-43e4-8280-7f9a9698f912
/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371
