# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
# Reference: https://www.ironnet.com/blog/edr-killing-malware-need-network-detection-ndr
# Reference: https://www.virustotal.com/gui/file/b169ed3d993241ef8d8e68c0ecb50c2d8f4fc87aaecca8a18459bd8dfb06c420/detection
# Reference: https://www.virustotal.com/gui/file/aac7f8e174ba66d62620bd07613bac1947f996bb96b9627b42910a1db3d3e22b/detection
# Reference: https://www.virustotal.com/gui/file/60227c61219bfba2a397ff898e998e41bea302741edf2e6b68a5a389302c43ef/detection

http://111.90.143.130
http://111.90.158.40
http://93.184.221.240
http://93.95.225.137
http://93.95.228.47
yrnvtklot.com
download.yrnvtklot.com
ftp.yrnvtklot.com
online.yrnvtklot.com
