ET MALWARE SparkRAT Related Domain in DNS Lookup (gwekekccef .webull .day)

7.0.35.0SID: 2045795Rev: 3Disabled8 views
Sourceet/open
Fileemerging-malware.rules
CreatedMay 22, 2023
UpdatedMarch 27, 2024
Classificationdomain-c2
alert dns $HOME_NET any -> any any (msg:"ET MALWARE SparkRAT Related Domain in DNS Lookup (gwekekccef .webull .day)"; dns.query; bsize:21; content:"gwekekccef.webull.day"; nocase; reference:url,asec.ahnlab.com/en/52899/; reference:md5,2e3ce7d90d988e1b0bb7ffce1731b04b; reference:md5,b571d849c0cb3c7af1cee6990654972b; reference:md5,5b78c44262ebcb4ce52e75c331683b5b; classtype:domain-c2; sid:2045795; rev:3; metadata:attack_target Client_Endpoint, created_at 2023_05_22, deployment Perimeter, deprecation_reason Age, malware_family SparkRAT, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_27, reviewed_at 2023_10_23;)

References

urlasec.ahnlab.com/en/52899/
md5
2e3ce7d90d988e1b0bb7ffce1731b04b
Google SearchBrave Search
md5
b571d849c0cb3c7af1cee6990654972b
Google SearchBrave Search
md5
5b78c44262ebcb4ce52e75c331683b5b
Google SearchBrave Search

Metadata

attack targetClient_Endpoint
created at2023_05_22
deploymentPerimeter
deprecation reasonAge
malware familySparkRAT
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_03_27
reviewed at2023_10_23

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!