[Emerging-updates] Daily Ruleset Update Summary 2020/07/15

Jason Williams jwilliams at emergingthreats.net
Wed Jul 15 14:07:09 HDT 2020


[***]            Summary:            [***]

    16 new OPEN, 42 new PRO (16 + 26). EvilNum, Elysium Stealer, LogPole,
Filecoder, Various Phish, Suri 5 Updates.

    Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

 Open:

  2030518 - ET CURRENT_EVENTS HTTP POST Request to Suspicious *.ma Domain
(current_events.rules)
  2030519 - ET CURRENT_EVENTS Possible Successful Generic Phish to .ma
Domain 2020-07-15 (current_events.rules)
  2030520 - ET INFO Suspicious HTTP GET Request on Port 53 Outbound
(info.rules)
  2030521 - ET INFO Suspicious HTTP GET Request on Port 53 Inbound
(info.rules)
  2030522 - ET INFO Suspicious HTTP POST Request on Port 53 Outbound
(info.rules)
  2030523 - ET INFO Suspicious HTTP POST Request on Port 53 Inbound
(info.rules)
  2030524 - ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet
M1 (info.rules)
  2030525 - ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet
M2 (info.rules)
  2030526 - ET TROJAN EvilNum CnC Checkin (trojan.rules)
  2030527 - ET TROJAN EvilNum CnC Checkin Response (trojan.rules)
  2030528 - ET TROJAN EvilNum CnC Client Data Exfil (trojan.rules)
  2030529 - ET TROJAN EvilNum CnC Client Data Exfil (trojan.rules)
  2030530 - ET TROJAN EvilNum CnC Client Data Exfil (trojan.rules)
  2030531 - ET TROJAN EvilNum CnC Error Report (trojan.rules)
  2030532 - ET EXPLOIT Possible Windows DNS Integer Overflow Attempt M2
(CVE-2020-1350) (exploit.rules)
  2030533 - ET EXPLOIT Possible Windows DNS Integer Overflow Attempt M1
(CVE-2020-1350) (exploit.rules)

 Pro:

  2843527 - ETPRO MOBILE_MALWARE Android BogoXing Checkin
(mobile_malware.rules)
  2843528 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.FakeInst.gn Checkin
(mobile_malware.rules)
  2843529 - ETPRO MOBILE_MALWARE Android/Clicker.KN CnC Beacon
(mobile_malware.rules)
  2843530 - ETPRO TROJAN Observed Malicious SSL Cert (Elysium Stealer CnC)
(trojan.rules)
  2843531 - ETPRO TROJAN Observed Elysium Stealer CnC Domain in TLS SNI
(trojan.rules)
  2843532 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 1) (trojan.rules)
  2843533 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 2) (trojan.rules)
  2843534 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 3) (trojan.rules)
  2843535 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 4) (trojan.rules)
  2843536 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 5) (trojan.rules)
  2843537 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 6) (trojan.rules)
  2843538 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-07-15 7) (trojan.rules)
  2843539 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish 2020-07-15
(current_events.rules)
  2843540 - ETPRO CURRENT_EVENTS Successful Lloyds Bank Phish 2020-07-15
(current_events.rules)
  2843541 - ETPRO CURRENT_EVENTS Successful Generic Phish 2020-07-15
(current_events.rules)
  2843542 - ETPRO CURRENT_EVENTS Successful Generic Phish 2020-07-15
(current_events.rules)
  2843543 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-07-15 (current_events.rules)
  2843544 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-07-15 (current_events.rules)
  2843545 - ETPRO TROJAN Win32/Filecoder Philadelphia Variant Host Checkin
(trojan.rules)
  2843546 - ETPRO TROJAN Win32/Logpole Variant CnC Host Checkin
(trojan.rules)
  2843547 - ETPRO TROJAN MSIL/Injector.P CnC Host Checkin (trojan.rules)
  2843548 - ETPRO TROJAN Win32/Remcos RAT Checkin 487 (trojan.rules)
  2843549 - ETPRO TROJAN Win32/Remcos RAT Checkin 488 (trojan.rules)
  2843550 - ETPRO TROJAN Observed Malicious SSL Cert (AZORult CnC)
(trojan.rules)
  2843551 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2843552 - ETPRO CURRENT_EVENTS Successful First American Mortgage Phish
2020-07-15 (current_events.rules)

 [///]     Modified active rules:     [///]

  2022811 - ET TROJAN MSIL/Spy.Banker.DH Checkin (trojan.rules)
  2022897 - ET TROJAN Win32.Crypren/Zcrypt Ransomware Checkin (trojan.rules)
  2022899 - ET TROJAN JS/RAA Ransomware check-in (trojan.rules)
  2026532 - ET CURRENT_EVENTS Possible Successful Generic Phish to .ml
Domain 2018-10-23 (current_events.rules)
  2026533 - ET CURRENT_EVENTS Possible Successful Generic Phish to .cf
Domain 2018-10-23 (current_events.rules)
  2026534 - ET CURRENT_EVENTS Possible Successful Generic Phish to .ga
Domain 2018-10-23 (current_events.rules)
  2026535 - ET CURRENT_EVENTS Possible Successful Generic Phish to .gq
Domain 2018-10-23 (current_events.rules)
  2026536 - ET CURRENT_EVENTS Possible Successful Generic Phish to .gqn
Domain 2018-10-23 (current_events.rules)
  2026886 - ET CURRENT_EVENTS Possible Successful Generic Phish to .icu
Domain 2019-02-06 (current_events.rules)
  2814126 - ETPRO CURRENT_EVENTS Successful Vmware/Zimbra Phish 2015-09-28
(current_events.rules)
  2815244 - ETPRO CURRENT_EVENTS Successful Wildblue/CenturyLink Phish
2015-12-08 (current_events.rules)
  2815469 - ETPRO CURRENT_EVENTS Terse POST to Wordpress Folder - Probable
Successful Phishing (current_events.rules)
  2820557 - ETPRO WEB_CLIENT Suspicious Compound Refresh - Possible
Phishing Redirect 2016-06-09 (web_client.rules)
  2820581 - ETPRO TROJAN Inexsmar/Darkhotel/Dubnium CnC POST (trojan.rules)
  2820586 - ETPRO TROJAN Win32/TrojanDownloader.IndigoRose.R Checkin
(trojan.rules)
  2820616 - ETPRO MOBILE_MALWARE Android/Hiddad.J Checkin
(mobile_malware.rules)
  2820675 - ETPRO TROJAN Goopic Ransomware User Agent (trojan.rules)
  2820679 - ETPRO TROJAN Unknown Banker Checkin (trojan.rules)
  2820696 - ETPRO CURRENT_EVENTS Terse POST to Wordpress Folder - Probable
Successful Phishing M3 (current_events.rules)
  2820702 - ETPRO TROJAN PhotoMiner Connectivity Check 2 (trojan.rules)
  2820713 - ETPRO TROJAN Operation Daybreak ScarCruft APT Landing Page
(trojan.rules)
  2820749 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmsThief.kb Checkin
(mobile_malware.rules)
  2820763 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820764 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820765 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820766 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820767 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820768 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820769 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820770 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820771 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820772 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820773 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820774 - ETPRO TROJAN Known Malicious Ethereum Traffic (trojan.rules)
  2820777 - ETPRO TROJAN W32/Trojan.Offend Checkin (trojan.rules)
  2820785 - ETPRO TROJAN Syscan Tool Results Upload (trojan.rules)
  2820786 - ETPRO TROJAN DiamondFox HTTP POST CnC Beacon 5 (trojan.rules)
  2820805 - ETPRO CURRENT_EVENTS Email Termination Phishing Landing
2016-06-22 (current_events.rules)
  2820832 - ETPRO CURRENT_EVENTS Webmail Phishing Landing 2016-06-22
(current_events.rules)
  2820835 - ETPRO INFO Suspicious Redirect to Recursive PHP - Possible
Phishing (info.rules)
  2820842 - ETPRO INFO HTML-Encoder HTML Obfuscation (info.rules)
  2820846 - ETPRO CURRENT_EVENTS Microsoft Encrypted Email Phishing Landing
2016-06-23 (current_events.rules)
  2820848 - ETPRO TROJAN Win32/TrojanDownloader.IndigoRose.R Downloading
EXE (trojan.rules)
  2820861 - ETPRO WEB_CLIENT Possible Phishing Data Submitted to
yolasite.com (web_client.rules)
  2820875 - ETPRO TROJAN Win32/QQpass.A Checkin (trojan.rules)
  2820879 - ETPRO CURRENT_EVENTS Mailbox Upgrade Phishing Landing
2016-06-27 (current_events.rules)
  2820880 - ETPRO CURRENT_EVENTS Successful Mailbox Upgrade Phish
2016-06-27 M1 (current_events.rules)
  2820881 - ETPRO CURRENT_EVENTS Successful Mailbox Upgrade Phish
2016-06-27 M2 (current_events.rules)
  2820894 - ETPRO TROJAN Suspicious Encoded MZ Downloaded from Pastebin
(trojan.rules)
  2820901 - ETPRO TROJAN TowerWeb/Anonpop Ransomware Image Download
(trojan.rules)
  2820905 - ETPRO INFO Data Submitted to MyFreeSites.com - Possible
Phishing (info.rules)
  2842546 - ETPRO TROJAN SamoRAT CnC Host Checkin (trojan.rules)
  2843261 - ETPRO TROJAN Win32/Wacapew.C!ml Stealer CnC Checkin
(trojan.rules)

 [---]         Removed rules:         [---]

  2843525 - ETPRO EXPLOIT Possible Windows DNS Integer Overflow Attempt M2
(CVE-2020-1350) (exploit.rules)
  2843526 - ETPRO EXPLOIT Possible Windows DNS Integer Overflow Attempt M1
(CVE-2020-1350) (exploit.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-updates/attachments/20200715/d26bf9c2/attachment.html>


More information about the Emerging-updates mailing list