ET MALWARE Evil Monero Cryptocurrency Miner Request Pools
Sourceet/open
CreatedJuly 21, 2016
UpdatedJuly 20, 2020
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Evil Monero Cryptocurrency Miner Request Pools"; flow:from_server,established; http.stat_code; content:"200"; http.content_type; content:"text/html"; startswith; file.data; content:"<HTML>|0d 0a|<HEAD>|0d 0a|<BODY>|0d 0a|<DIV"; depth:28; content:"|0d 0a|899@"; distance:0; content:"0.rn,9.re9899@n&9,bgggs"; distance:0; fast_pattern; reference:md5,848720742b957d27f6ee94b9fe4126f0; reference:url,www.fireeye.com/blog/threat-research/2016/06/resurrection-of-the-evil-miner.html; classtype:trojan-activity; sid:2022982; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_07_21, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_07_20;)
References
| md5 | 848720742b957d27f6ee94b9fe4126f0 |
| url | www.fireeye.com/blog/threat-research/2016/06/resurrection-of-the-evil-miner.html |
Metadata
attack targetClient_Endpoint
created at2016_07_21
deploymentPerimeter
performance impactLow
confidenceHigh
signature severityMajor
updated at2020_07_20
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!