# Copyright (c) 2014-2025 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: emmenhtal loader

# Reference: https://malpedia.caad.fkie.fraunhofer.de/details/win.emmenhtal
# Reference: https://x.com/JAMESWT_MHT/status/1868927219021799662
# Reference: https://app.any.run/tasks/a27e753f-8a27-487f-ba4a-0c29779767f2

92.255.57.75:9000
csp-invoices-v5.com
green-pathways.shop
klipxuhaq.shop
cdn-defac18.artcollective-snapclick.com
cndef1.green-pathways.shop
static.klipxuhaq.shop

# Reference: https://x.com/RussianPanda9xx/status/1870210225674035280
# Reference: https://x.com/s1dhy/status/1875864236028526807
# Reference: https://x.com/s1dhy/status/1875986692664185315
# Reference: https://app.any.run/tasks/8902d447-88c3-4627-9ae8-9b3824fb91ba

http://147.45.179.37
http://147.45.50.250
http://185.66.91.182
http://185.66.91.17
http://185.66.91.23
http://84.200.24.34
infomsghub.com
rodgersluciecassy.com

# Reference: https://x.com/CERTCyberdef/status/1900460479778030013
# Reference: https://raw.githubusercontent.com/cert-orangecyberdefense/cti/refs/heads/main/emmenhtal/iocs%20(March%202025)%20-%20Emmenhtalv3

acepro.shop
adobee.shop
adventurevault.shop
airtbn.shop
amacys.shop
angrybrds.shop
appp.file-factory.pro
asosz.shop
astonishingbuys.shop
atariq.shop
audiomaxx.shop
available-files.oss-ap-northeast-2.aliyuncs.com
avonex.shop
ball-strike-up.shop
bargaincove.shop
bargainland.shop
bigpick.shop
bigsphere.shop
bimola.shop
bizmir.shop
bolddeals.shop
boldway.shop
budgetlane.shop
budgetmart.shop
budgetsphere.shop
budgetvibe.shop
buferingo.shop
buyloom.shop
buyluxe.shop
bytes.microstorage.shop
captivatingkeepsakes.shop
cariz.shop
chicmoments.shop
classicwraps.shop
classydelights.shop
classykeepsakes.shop
collectiblegifts.shop
collectiblejoy.shop
colorfulkeepsakes.shop
colorfulmoments.shop
colorfulpicks.shop
colorfultreasures.shop
creedos.shop
dareglimpse.shop
dawnbloom.shop
dazewave.shop
dazzlejoy.shop
dazzletouch.shop
deepvibes.shop
def.ball-strike-up.shop
desime.shop
desimol.shop
dewdropbliss.shop
dewshine.shop
discoverconicalcrouton.shop
driftcharm.shop
driftpulse.shop
drizzleraving.shop
dulaan.shop
dunewave.shop
durablyscrimmage.rent
dustglow.shop
ebazaarelite.shop
ebuyelite.shop
ebuymore.shop
ecartdirect.shop
echoicedeals.shop
edirect.shop
edonlo.shop
emarketelite.shop
eoutletpro.shop
eprime.shop
eprimemart.shop
eptidown1.b-cdn.net
eretailpro.shop
eretailzone.shop
espardo.shop
estorepro.shop
evaluehub.shop
ferrysurgicallustily.shop
fersiko.shop
file-factory.pro
fuzzyz.shop
gabrize.shop
ganderbrisklyonly.shop
gapdevoutlycitrus.shop
giddinessrebirth.shop
goatstuff.shop
gossipsurrender.shop
grazine.shop
grumpilos.shop
hhxe.org
hismajesty.shop
holker.shop
http://195.211.191.120
ialpha.shop
ialphaboost.shop
ialphazone.shop
iarenablaze.shop
ibattleboost.shop
iepic.shop
iepicboost.shop
iepicplay.shop
igamedash.shop
igameforge.shop
igameinfinity.shop
igamerblast.shop
igamercore.shop
igamexp.shop
igamezone.shop
iinfinitybattle.shop
ilegendrush.shop
incognito.uploads.it.com
ineobattle.shop
ipixelblaze.shop
ipixeledge.shop
ipixelquest.shop
iquestzone.shop
ishadowquest.shop
ishadowstrike.shop
itechvortex.shop
items.kycc-camera.shop
ixpforge.shop
ixpzone.shop
jekin.shop
jizil.shop
jozeni.shop
jumpcelibateencounter.shop
kiddoloom.shop
klipderiq.shop
klipdesak.shop
klipjaqemiu.shop
klipzynigou.shop
kp.ferrysurgicallustily.shop
kycc-camera.shop
leksion.shop
likinom.shop
luxeway.shop
lzmb.org
markitos.shop
megahive.shop
microstorage.shop
monekam.shop
ne1.discoverconicalcrouton.shop
oldiger.shop
opisso.shop
optdropper.shop
overuseunderuse.shop
pegas.durablyscrimmage.rent
perent.ganderbrisklyonly.shop
perent1.ganderbrisklyonly.shop
perent2.ganderbrisklyonly.shop
perent3.ganderbrisklyonly.shop
perent4.ganderbrisklyonly.shop
pinmore.shop
pn5.gapdevoutlycitrus.shop
pomppie.shop
possibleshimmer.shop
previewcapped.shop
puckerlinguist.shop
refereng.shop
rekono.shop
requinos.shop
resmuna.shop
rtshoop.shop
rubana.shop
sazak.shop
servicelandingkaraoke.shop
sesimok.shop
shalebrussels.shop
sharethewebs.shop
shredderradar.shop
shufflerline.shop
silver-card-maker.cloud
solve.hhxe.org
solve.lzmb.org
sparticus.shop
stungoverhaul.shop
sumala.shop
superheroomen.shop
suzixoxo.shop
tag.shufflerline.shop
tesnok.shop
timing.silver-card-maker.cloud
trendys.cloud
u1.drizzleraving.shop
u1.giddinessrebirth.shop
u1.gossipsurrender.shop
u1.jumpcelibateencounter.shop
u1.optdropper.shop
u1.overuseunderuse.shop
u1.possibleshimmer.shop
u1.previewcapped.shop
u1.puckerlinguist.shop
u1.servicelandingkaraoke.shop
u1.shalebrussels.shop
u1.shredderradar.shop
u1.stungoverhaul.shop
u1.superheroomen.shop
u1.wannabeclobber.shop
usa.trendys.cloud
utahano.shop
vedingo.shop
vermano.shop
w66.discoverconicalcrouton.shop
wannabeclobber.shop
warsad.shop
woolav.shop
x22.eioae.shop
x73.eioae.shop
x75.eioae.shop
yallano.shop
yezmil.shop
zeemaro.shop

# Reference: https://x.com/1ZRR4H/status/1908174715614634257
# Reference: https://app.validin.com/detail?type=hash&find=58d465585e4c55729bb1372aea2891b3#tab=host_pairs (# 2025-04-04)

cat-frog-lamp.today
cherry-pink.shop
fish-cloud-jar.us
fox-chair-dust.xyz
grey-nuke-camera.us
horse-shadow-key.vip
moon-river-coin.xyz
silver-map-generator.shop
zoo-ciry.shop
cdn.horse-shadow-key.vip
clo.grey-nuke-camera.us
message.zoo-ciry.shop
ok.fish-cloud-jar.us
power.moon-river-coin.xyz
run.fox-chair-dust.xyz
sandbox.silver-map-generator.shop
text.cherry-pink.shop
webnet.cat-frog-lamp.today
