# Copyright (c) 2014-2019 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-PE/detailed-analysis.aspx

afawydymss.blogoveg.org
azipev.blogoveg.org
ikvbog.blogoveg.org
ipufukavyd.blogoveg.org
iqtpyty.blogoveg.org
odenatl.blogoveg.org
omomeqygex.blogoveg.org
ozywopesb.blogoveg.org
ugejiju.blogoveg.org
uglz.blogoveg.org
ujoparq.blogoveg.org
ules.blogoveg.org
uxykeh.blogoveg.org
ysoc.blogoveg.org
yzuhk.blogoveg.org

# Reference: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Androm-NE/detailed-analysis.aspx

ie.n502.com
900cpa.cc
ip138.com

# Reference: https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
# Reference: https://www.virustotal.com/gui/file/98413cf9281d4b00f6503c18256aab3b7cb5b2c7017f3579388cc4641e8a1696/detection

ddnservice10.ru
ddnservice11.ru
/and/jopagate.php
