Versions (6)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMSTEALER [PTsecurity] EncryptHub
alert http any any -> any any (msg:"STEALER [PTsecurity] EncryptHub"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/send_notification?machine="; startswith; fast_pattern; content:"&emails="; content:"&wallets="; content:"&passwords="; content:"&cookies="; content:"&os="; http.header; content:!"Accept"; content:!"Referer"; reference:url, trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013570; rev:1;)
Oct 9, 2025, 2:49 PM
Oct 9, 2025, 2:49 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-malware.rules