# Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://twitter.com/ViriBack/status/1023286939858939906

http://5.8.88.25

# Reference: https://www.bleepingcomputer.com/news/security/azorult-trojan-serving-aurora-ransomware-by-malactor-oktropys/

lulaaura.top

# Reference: # Reference: https://samples.vx-underground.org/APTs/2010/2010.01.27/Paper/Operation%20Aurora%20Detect%20Diagnose%20Respond.pdf

33iqst.com
360.homeunix.com
blog1.serverbeer.com
demo1.ftpaccess.cc
ftp2.homeunix.com
s11.homelinux.org
update.ourhobby.com

# Reference: https://www.virustotal.com/gui/file/5e449a2664be9d024e78d660e9cad4099c64bb7d91fb40d08459dec274de02dc/detection

a0653691.xsph.ru
/AuroraLoader/check.txt
/AuroraLoader/CheckAccount.php?jopa=
/AuroraLoader/LoaderVersion.php?jopa=
/AuroraNEW/check.txt
/AuroraNEW/CheckAccount.php?jopa=
/AuroraNEW/LoaderVersion.php?jopa=
