# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Reference: https://x.com/Malwarehunterr/status/2086366984003056118
# Reference: https://www.group-ib.com/blog/redhook-android-rat-upgraded/
# BANNER_0_HASH-HOST=4b6a84a0bd2b2aa7b98a136744a55d8d
# BANNER_0_HASH-HOST=6fcad8bc88bd0ea069ec7b089c8dd356
# CLASS_0_HASH-HOST=2341f1bb27baa1c2a5a75d15a21dabcd
# HEADER_HASH-HOST=f430fdc880884e9e4341

0fxtys05.xyz
0gh6u.xyz
21hsm.xyz
2b96z.com
352fjadsa.xyz
3n7wj.com
4ycan0.xyz
4ywmd.com
5oxy4a.com
73dw8.com
7neca.xyz
81ex001.com
81ex008.com
81ex009.com
81ex01.com
81ex08.com
8cdyk.com
9pi4p.xyz
9u74o.xyz
adsocket.e13falsz.xyz
aionedev.xyz
almefn.com
api.0fxtys05.xyz
api.0gh6u.xyz
api.21hsm.xyz
api.2b96z.com
api.352fjadsa.xyz
api.3n7wj.com
api.4ycan0.xyz
api.4ywmd.com
api.5oxy4a.com
api.73dw8.com
api.7neca.xyz
api.81ex001.com
api.81ex008.com
api.81ex009.com
api.81ex01.com
api.81ex08.com
api.8cdyk.com
api.9pi4p.xyz
api.9u74o.xyz
api.aionedev.xyz
api.almefn.com
api.bagawf45.com
api.bcjjdag234.xyz
api.bdgan234.com
api.bjdgaaga324.xyz
api.bkd352543ag.xyz
api.bkldlgna34.com
api.bmmm4w8r.shop
api.bxcczva234.com
api.cgje4.xyz
api.cowotc.com
api.cowpay.co
api.d1z39aui.xyz
api.dbrlyk.com
api.e13falsz.xyz
api.edbrl.com
api.fql01.com
api.fql02.com
api.fqlexchanger.xyz
api.fxjmr.com
api.glzno.xyz
api.gpfql001.com
api.hayuki.com
api.hns6i.com
api.iewrawx342.xyz
api.is653b8d.top
api.j75p6h.com
api.jczvcfa.com
api.jftxm.xyz
api.jgwaeewg234.xyz
api.jrscg.xyz
api.jytrcxzvzgda234.xyz
api.k1axxgfa.xyz
api.kcns332.com
api.kdnbasdg3643.xyz
api.kle2b.xyz
api.ksafsa.top
api.kshirafin.shop
api.kuzief.com
api.ll1jo.com
api.m1e50b.com
api.m89su.com
api.mhtqp.com
api.mnfdaf23.xyz
api.n9xvl.com
api.nbczb243.com
api.nbfaogaw.com
api.nbfdaddg34.xyz
api.nbfkafj00032.xyz
api.nboeag453.xyz
api.nbxvvfa324.com
api.nbzvzga353.com
api.nei01.com
api.nzxcvjoaaf34.com
api.oengad.com
api.oewngadf435.xyz
api.ofnfadfa.xyz
api.onbfaga.com
api.onbfao32532.xyz
api.payme.win
api.qewrwer3242.xyz
api.qzwji9o7.shop
api.r8223.com
api.s43l7cv5.top
api.slht5.com
api.t664z7rw.xyz
api.tqy8n.xyz
api.weoteash342.xyz
api.werqogda.com
api.wjf72.xyz
api.yge4h.com
api.z7i4d58q.xyz
api.zcngdaf32.xyz
api1.gemeney-st.xyz
api5.jftxm.xyz
api9.iosgaxx423.xyz
app.fdte-us.xyz
app.fdte.xyz
app.mcsv.info
app.mcsv.qpon
app.mcsv.space
app.mcsv.tv
app.mcsv.vip
app.mcsvplay.tv
app.mcsvshow.tv
bagawf45.com
bcjjdag234.xyz
bdgan234.com
bjdgaaga324.xyz
bkd352543ag.xyz
bkldlgna34.com
bmmm4w8r.shop
bxcczva234.com
capitalmarketone.com
ccqe-mys.org
ccqe-sg.org
ccqe-us.org
ccqe.org
ccqe01.org
ccqe02.org
ccqe03.org
ccqe05.org
ccqe1.org
ccqe2.org
ccqe3.org
ccqe5.org
ccqehk.org
ccqeidn.org
ccqemys.org
ccqesg.org
ccqeus.org
cdnapi.fqlexchanger.xyz
cgje4.xyz
cowotc.com
cowpay.co
d1z39aui.xyz
dbrlyk.com
dnbadjgkaffa32423.xyz
e13falsz.xyz
edbrl.com
erccm.xyz
fdte-fr.xyz
fdte-gr.xyz
fdte-hu.xyz
fdte-lt1.xyz
fdte-uk.xyz
fdte-us.xyz
fdte.xyz
fdte01.xyz
fdte02.xyz
fdte03.xyz
fdte05.xyz
fdte2.xyz
fdte3.xyz
fdte5.xyz
fdtefr.xyz
fdtegr.xyz
fdtehu.xyz
fdtesk.xyz
fdteuk.xyz
fdteus.xyz
fidelitynysepro.com
fidelitynysess.com
fidelitynysevip.com
focallure.cn
fql01.com
fql02.com
fqlexchanger.xyz
fxjmr.com
gemeney-st.xyz
glzno.xyz
gpfql001.com
h5.4ycan0.xyz
h5.capitalmarketone.com
h5.ccqe-mys.org
h5.ccqe-sg.org
h5.ccqe-us.org
h5.ccqe.org
h5.ccqe01.org
h5.ccqe02.org
h5.ccqe03.org
h5.ccqe05.org
h5.ccqe1.org
h5.ccqe2.org
h5.ccqe3.org
h5.ccqe5.org
h5.ccqehk.org
h5.ccqeidn.org
h5.ccqemys.org
h5.ccqesg.org
h5.ccqeus.org
h5.d1z39aui.xyz
h5.erccm.xyz
h5.fdte-fr.xyz
h5.fdte-gr.xyz
h5.fdte-hu.xyz
h5.fdte-lt1.xyz
h5.fdte-uk.xyz
h5.fdte01.xyz
h5.fdte02.xyz
h5.fdte03.xyz
h5.fdte05.xyz
h5.fdte2.xyz
h5.fdte3.xyz
h5.fdte5.xyz
h5.fdtefr.xyz
h5.fdtegr.xyz
h5.fdtehu.xyz
h5.fdtesk.xyz
h5.fdteuk.xyz
h5.fdteus.xyz
h5.fidelitynysepro.com
h5.fidelitynysess.com
h5.fidelitynysevip.com
h5.hsldma.com
h5.hslsecurities.com
h5.jgwaeewg234.xyz
h5.kzidje29.xyz
h5.nace-us.com
h5.nace10.com
h5.naceteam.com
h5.nacevip01.com
h5.nacevip02.com
h5.nacevip03.com
h5.nacevip05.com
h5.nacevip06.com
h5.novamarketsusa.com
h5.oewjgsa.com
h5.ofnfadfa.xyz
h5.ogdcvh53.xyz
h5.onchaincmemarket.com
h5.oweraafd24.xyz
h5.qcfh-de.com
h5.qcfh-fr.com
h5.qcfh-gr.com
h5.qcfh-hu.com
h5.qcfh-lt1.com
h5.qcfh-sk.com
h5.qcfh-uk.com
h5.qcfh.com
h5.qcfh.vip
h5.qcfh01.com
h5.qcfh02.com
h5.qcfh03.com
h5.qcfh05.com
h5.qcfh1.com
h5.qcfh2.com
h5.qcfh3.com
h5.qcfh5.com
h5.qcfhaz.com
h5.qcfhaze.com
h5.qcfhede.com
h5.qcfhfr.com
h5.qcfhgeo.com
h5.qcfhgr.com
h5.qcfhhu.com
h5.qcfhkaz.com
h5.qcfhkz.com
h5.qcfhlt.com
h5.qcfhsk.com
h5.qcfhua.com
h5.qcfhuk.com
h5.qcfhukr.com
h5.qcfhus.com
h5.qcfhuz.com
h5.qcfhuzb.com
h5.qncx2.com
h5.rr9lj.xyz
h5.upstoxdma.com
h5.upstoxmax.com
h5.upstoxtop.com
h5.vgtradeapp.com
h5.vgtradepro.com
h5.vgtradevip.com
h5.zcngdaf32.xyz
hayuki.com
hbndag34.com
hns6i.com
hsldma.com
hslsecurities.com
icicbankpay.xyz
iewrawx342.xyz
igassetpro.com
igassetvip.com
iginvest.xyz
iginvesting.xyz
iginvestor.xyz
igportfoliopro.com
igportfoliovip.com
iosgaxx423.xyz
is653b8d.top
j75p6h.com
jczvcfa.com
jftxm.xyz
jgwaeewg234.xyz
jrscg.xyz
jytrcxzvzgda234.xyz
k1axxgfa.xyz
kcns332.com
kdnbasdg3643.xyz
kgenaodjf3532.xyz
kle2b.xyz
ksafsa.top
kshirafin.shop
kuzief.com
kzidje29.xyz
lemc.autos
lemc.baby
lemc.bar
lemc.beauty
lemc.blog
lemc.bond
lemc.click
lemc.help
lemc.homes
lemc.lat
lemc.live
lemc.lol
lemc.love
lemc.monster
lemc.my
lemc.one
lemc.onl
lemc.pics
lemc.quest
lemc.sbs
lemc.tv
lemc02.my
ll1jo.com
m1e50b.com
m89su.com
mcsv.info
mcsv.ltd
mcsv.qpon
mcsv.space
mcsv.tv
mcsv.vip
mcsvplay.tv
mcsvshow.tv
mhtqp.com
mnfdaf23.xyz
n9xvl.com
nace-us.com
nace.online
nace10.com
nace32.com
naceteam.com
nacevip01.com
nacevip02.com
nacevip03.com
nacevip05.com
nacevip06.com
nbczb243.com
nbfaogaw.com
nbfdaddg34.xyz
nbfkafj00032.xyz
nboeag453.xyz
nbvxzcv23.xyz
nbxvvfa324.com
nbzvzga353.com
nei01.com
ngkasdjfa.xyz
novamarketsusa.com
nzxcvjoaaf34.com
oengad.com
oewjgsa.com
oewngadf435.xyz
ofnfadfa.xyz
ogdcvh53.xyz
onbfaga.com
onbfao32532.xyz
onchaincmemarket.com
ooereiuaijaf342.xyz
oweraafd24.xyz
payme.win
pmgjob.com
pmgjob.net
pmgjob.online
pmgjob.org
pmgjob.vip
pmgjob.xyz
ppmmgg9999.com
qcfh-de.com
qcfh-fr.com
qcfh-gr.com
qcfh-hu.com
qcfh-lt1.com
qcfh-sk.com
qcfh-uk.com
qcfh.com
qcfh.vip
qcfh01.com
qcfh02.com
qcfh03.com
qcfh05.com
qcfh1.com
qcfh2.com
qcfh3.com
qcfh5.com
qcfhaz.com
qcfhaze.com
qcfhede.com
qcfhfr.com
qcfhgeo.com
qcfhgr.com
qcfhhu.com
qcfhkaz.com
qcfhkz.com
qcfhlt.com
qcfhsk.com
qcfhua.com
qcfhuk.com
qcfhukr.com
qcfhus.com
qcfhuz.com
qcfhuzb.com
qewrwer3242.xyz
qncx2.com
qzwji9o7.shop
r8223.com
rr9lj.xyz
s43l7cv5.top
skt.3n7wj.com
skt9.iosgaxx423.xyz
sktv.3n7wj.com
slht5.com
t664z7rw.xyz
tqy8n.xyz
upstoxdma.com
upstoxmax.com
upstoxtop.com
vctn.xyz
vgtradeapp.com
vgtradepro.com
vgtradevip.com
weoteash342.xyz
werqogda.com
wjf72.xyz
ws.qzwji9o7.shop
yge4h.com
ygj-api.focallure.cn
z7i4d58q.xyz
zcngdaf32.xyz
zranw.com
