ET DELETED Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response

SID: 2014372Rev: 80 viewsHistory

Sourceet/open

CreatedMarch 14, 2012

UpdatedMay 4, 2023

Classificationcommand-and-control

alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|02|eu|00|"; fast_pattern; pcre:"/\x00\x07[a-z0-9]{7}\x02eu\x00/"; threshold:type both, track by_src, count 2, seconds 60; reference:url,web.archive.org/web/20120320025955/http://www.abuse.ch/?p=3658; reference:url,marc.info/?t=135207100900022&r=1&w=2; reference:url,www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0; classtype:command-and-control; sid:2014372; rev:8; metadata:created_at 2012_03_14, confidence High, signature_severity Unknown, updated_at 2023_05_04;)

References

url	web.archive.org/web/20120320025955/http://www.abuse.ch/?p=3658
url	marc.info/?t=135207100900022&r=1&w=2
url	www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0

Metadata

created at2012_03_14

confidenceHigh

signature severityUnknown

updated at2023_05_04

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!