| snort |
ET TROJAN Operation Baby Coin syschk CnC Communication |
rev 2 |
2018-11-15 |
| snort |
ET TROJAN Operation Mystery Baby syschk CnC Communication |
rev 2 |
2018-11-15 |
| snort |
ET TROJAN ELF/Muhstik Scanner Module Activity |
rev 2 |
2018-11-15 |
| snort |
ET TROJAN JunkMiner Downloader Communicating with CnC |
rev 2 |
2018-11-14 |
| snort |
ET TROJAN MSIL.Kraken.v2 HTTP Pattern |
rev 1 |
2018-11-09 |
| snort |
ET TROJAN ArrobarLoader CnC Checkin M1 |
rev 3 |
2018-11-08 |
| snort |
ET TROJAN Sharik/Smoke CnC Beacon 12 |
rev 3 |
2018-11-07 |
| snort |
ET TROJAN JavaRAT Sending Screenshot |
rev 1 |
2018-11-07 |
| snort |
ET TROJAN APT33/CharmingKitten DDNS Overlap Domain in DNS Lookup M2 |
rev 3 |
2018-11-06 |
| snort |
ET TROJAN APT33/CharmingKitten DDNS Overlap Domain in DNS Lookup M1 |
rev 3 |
2018-11-06 |
| snort |
ET TROJAN APT33/CharmingKitten JS/HTA Stage 1 CnC Checkin |
rev 2 |
2018-11-05 |
| snort |
ET TROJAN Perl/Shellbot.SM IRC CnC Checkin |
rev 1 |
2018-11-05 |
| snort |
ET TROJAN MSIL/Lordix Stealer Exfiltrating Data |
rev 2 |
2018-11-02 |
| snort |
ET INFO Possibly Suspicious Request for Putty.exe from Non-Standard Download Location |
rev 2 |
2018-11-02 |
| snort |
ET TROJAN MSIL.BackNet Checkin |
rev 1 |
2018-11-02 |
| snort |
ET EXPLOIT Possible CVE-2018-4407 - Apple ICMP DoS PoC |
rev 1 |
2018-11-01 |
| snort |
ET TROJAN BlackTech/PLEAD TSCookie CnC Checkin M1 |
rev 4 |
2018-11-01 |
| snort |
ET TROJAN BlackTech/PLEAD TSCookie CnC Checkin M2 |
rev 2 |
2018-11-01 |
| snort |
ET TROJAN TrueBot/Silence.Downloader Keep-Alive |
rev 2 |
2018-10-29 |
| snort |
ET TROJAN MSIL/KeyRedirEx Banker Requesting Redirect/Inject List |
rev 2 |
2018-10-29 |
| snort |
ET TROJAN TrueBot/Silence.Downloader CnC Checkin |
rev 2 |
2018-10-29 |
| snort |
ET TROJAN MSIL/KeyRedirEx Banker Receiving Exit Instruction |
rev 2 |
2018-10-29 |
| snort |
ET TROJAN Sharik/Smoke Fake 404 Response with Payload Location |
rev 2 |
2018-10-25 |
| snort |
ET CURRENT_EVENTS Successful Generic Phish to zap-webspace.com Webhost 2018-10-25 |
rev 2 |
2018-10-25 |
| snort |
ET TROJAN TA399/SideWinder Stage 2 VBS Downloader Reporting Successful Infection |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN MICROPSIA Sending JPG Screenshot to CnC with .his Extension |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN MICROPSIA HTTP Failover CnC Checkin |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN Octopus Malware CnC Server Request |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN Possible APT28 DOC Uploader SSL/TLS Certificate Observed |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN MICROPSIA HTTP Failover Reporting Infected System Information and RAT Version |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN MICROPSIA HTTP Failover Response M2 |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN Octopus Malware Initial Connectivity Check |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN MICROPSIA HTTP Failover Response M1 |
rev 2 |
2018-10-24 |
| snort |
ET TROJAN Octopus Malware CnC Server Connectivity Check |
rev 2 |
2018-10-24 |
| snort |
ET POLICY Suspicious EXE Download Content-Type image/jpeg |
rev 2 |
2018-10-23 |
| snort |
ET CURRENT_EVENTS Successful Fedex/DHL Phish 2018-10-22 |
rev 2 |
2018-10-22 |
| snort |
ET TROJAN ELF/Chacha.DDoS/Xor.DDoS Stage 2 CnC Checkin |
rev 2 |
2018-10-18 |
| snort |
ET TROJAN Win32/BlackCarat Response from CnC |
rev 2 |
2018-10-18 |
| snort |
ET CURRENT_EVENTS Possible Successful Phish - Generic Credential POST to Ngrok.io |
rev 2 |
2018-10-17 |
| snort |
ET INFO Suspicious Redirect to Download EXE from Bitbucket |
rev 2 |
2018-10-17 |