Rule History

alert dns $HOME_NET any -> any any (msg:"ET MALWARE SparkRAT Related Domain in DNS Lookup (gwekekccef .webull .day)"; dns.query; content:"gwekekccef.webull.day"; nocase; bsize:21; reference:url,asec.ahnlab.com/en/52899/; reference:md5,2e3ce7d90d988e1b0bb7ffce1731b04b; reference:md5,b571d849c0cb3c7af1cee6990654972b; reference:md5,5b78c44262ebcb4ce52e75c331683b5b; classtype:domain-c2; sid:2045795; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_05_22, deployment Perimeter, deprecation_reason Age, malware_family SparkRAT, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_10_23, reviewed_at 2023_10_23;)