Versions (4)
Version DetailsCurrent
Rev: 3 • Sep 20, 2018, 12:00 PMET MALWARE Fbot/Satori CnC DNS Lookup (rippr .cc)
alert dns $HOME_NET any -> any any (msg:"ET MALWARE Fbot/Satori CnC DNS Lookup (rippr .cc)"; dns.query; content:"rippr.cc"; nocase; fast_pattern; endswith; reference:url,blog.netlab.360.com/threat-alert-a-new-worm-fbot-cleaning-adbminer-is-using-a-blockchain-based-dns-en/; classtype:command-and-control; sid:2026325; rev:3; metadata:affected_product Linux, attack_target Server, created_at 2018_09_20, deployment Perimeter, malware_family Satori, malware_family Fbot, performance_impact Low, confidence Medium, signature_severity Major, tag Worm, tag DDoS, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_16;)
Sep 20, 2018, 12:00 PM
Sep 16, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 26, 2025, 9:34 PM
rules/emerging-malware.rules