Versions (2)
Version DetailsCurrent
Rev: 3 • Jul 21, 2016, 12:00 PMET MALWARE Evil Monero Cryptocurrency Miner Request Pools
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Evil Monero Cryptocurrency Miner Request Pools"; flow:from_server,established; http.stat_code; content:"200"; http.content_type; content:"text/html"; startswith; file.data; content:"<HTML>|0d 0a|<HEAD>|0d 0a|<BODY>|0d 0a|<DIV"; depth:28; content:"|0d 0a|899@"; distance:0; content:"0.rn,9.re9899@n&9,bgggs"; distance:0; fast_pattern; reference:md5,848720742b957d27f6ee94b9fe4126f0; reference:url,www.fireeye.com/blog/threat-research/2016/06/resurrection-of-the-evil-miner.html; classtype:trojan-activity; sid:2022982; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_07_21, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_07_20;)
Jul 21, 2016, 12:00 PM
Jul 20, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules