Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Regular
Expressions
101
Regular
Expressions
101
Upgrade to Pro
Enterprise
Regular Expression
`
\s([a-zA-Z]+://)*(\b([a-zA-Z][\w-]*\.){1,3}[a-zA-Z0-9]+|(\b((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)\.){3}(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)\b))(:\d+)*([\\\!\"\#\$\%\&\'\(\)\*\+\-\/\:\;\<\=\>\?\@\[\]\^\`\{\|\}\~\.\w])*(\,.+\.[a-z]+)*
`
g
Test String
New
they all call home to 194.68.59.34:2018, 192[.]168[.]1[.]1 hxxp://securedownload2.duckdns.org:7373/docs/ @JAMESWT_MHT abc://www.hhghg.ghgh.jkjkjk.jkjkj.jkjk #LokiBot @ hxxp://xupfile.duckdns.org:1133/$59,200.exe https://www.reverse.it/sam\ple/529b10d3faaa143c074d0f25ee75c8e9bad7f5982ead482d6c0c19a39d207b68?environmentId=100 … 255.2.3.4 194.68.59.34:2018, www.virustotal.com C2: hta.duckdns.org:7373/excel/fre.php http://www.virustotal.com/en/file/a94f7db23f64985f22a4250886db0d67e3cc1fbf59ef3d1bf9ffd28d3357d3f7/analysis/1511168707/ … dasdasd hxxp://172.106.75.131/temp/amazingdoz.exe dasdasd hxxp://172.1d06.75.131/temp/amazingdoz.exe https://www.virustotal.com/#/url/2512afa822b8cadbe9e2fa0ecda5ad55d6024b0694fecf265282a63ef88058cf/detection … hxxp://www.dk-fyn.dk/ebgate/ri.php hxxp://www.fourthtour.it/rus/tour/php.scr hxxp://www.foxydance.cz/repository/ri.php hxxp://www.sabineclaire.com/girasoli/ri.php,1212 sdfsdfsdsdfsdf https://www.reverse.it/sample/b57bd0dec0873bea8e47a16e1da41aafa817ae11d536c90cb7aec6d6686b686e?environmentId=100 … hxxp://www.sabineclaire.com/girasoli/ri.php sdf.bom fasdkj adsflk jasldk fjalskd fjslaskjdf lkaj dsfl So, I've got a matching set of Trojan.Nymeria samples https://www.virustotal.com/en/file/0e6ac6a1db6fdeb8d85edfdd9f33761b2877ae46399f30dee7335e1783ef53c9/analysis/ … … https://www.virustotal.com/en/file/9178e59b6e2227cccf137f5b3c259035d3750f2dfc3314f9e326fb0995a2862c/analysis/ … … https://www.virustotal.com/en/file/0eae5dd0655ca17db3c6b6c7fb921405d82533bb619b12de010b449de1322efd/analysis/ … … https://www.virustotal.com/en/file/394af1f36a36b631cfa48158314dc378c8dba5307f79d86d7262aaa86a694089/analysis/ … … they all call home to 194.68.59.34:2018
Extraction
Processing...