Versions (4)
Version DetailsCurrent
Rev: 2 • May 1, 2023, 12:00 PMET MALWARE Ducktail Stealer Related Domain in DNS Lookup (techvibeo .com)
alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ducktail Stealer Related Domain in DNS Lookup (techvibeo .com)"; dns.query; content:"techvibeo.com"; nocase; bsize:13; reference:url,twitter.com/StopMalvertisin/status/1649371042090205184; reference:md5,32df3634f0e457fbd191389f28cd5ea5; reference:md5,aa6c29da0f89131f38fc6a0ea20abff0; reference:md5,8dc27ba3775ecc1d2b98b8a6f0d5ce7b; reference:md5,9742cd02a3d03c4e3394cf4d199ac8d6; classtype:domain-c2; sid:2045268; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_05_01, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_07_31;)
May 1, 2023, 12:00 PM
Jul 31, 2023, 12:00 PM
Sep 21, 2024, 3:00 AM
Aug 25, 2025, 9:35 PM
rules/emerging-malware.rules