ET DELETED Possible XDocCrypt/Dorifel CnC IP

SID: 2015630Rev: 50 views
History
Sourceet/open
CreatedAugust 16, 2012
UpdatedJuly 26, 2019
Classificationcommand-and-control
alert ip $HOME_NET any -> [184.82.162.163/32,184.22.103.202/32,158.255.211.28/32] any (msg:"ET DELETED Possible XDocCrypt/Dorifel CnC IP"; threshold:type limit, track by_src, count 1, seconds 600; reference:url,www.fox-it.com/en/blog/xdoccryptdorifel-document-encrypting-and-network-spreading-virus; classtype:command-and-control; sid:2015630; rev:5; metadata:created_at 2012_08_16, signature_severity Unknown, updated_at 2019_07_26;)

References

urlwww.fox-it.com/en/blog/xdoccryptdorifel-document-encrypting-and-network-spreading-virus

Metadata

created at2012_08_16
signature severityUnknown
updated at2019_07_26

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!