ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware - Suricata Rule 2024241 (et/open)

ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware

SID: 2024241Rev: 21 viewsHistory

Sourceet/open

CreatedApril 25, 2017

UpdatedJuly 26, 2019

Classificationtrojan-activity

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware"; flow:from_server,established; flowbits:isset,ET.armwget; content:"|25|24|25|28nc+"; content:"+-e+|25|2Fbin|25|2Fsh|25|29"; within:50; fast_pattern; reference:url,blog.netlab.360.com/a-new-threat-an-iot-botnet-scanning-internet-on-port-81-en/; classtype:trojan-activity; sid:2024241; rev:2; metadata:attack_target IoT, created_at 2017_04_25, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2019_07_26;)

References

url	blog.netlab.360.com/a-new-threat-an-iot-botnet-scanning-internet-on-port-81-en/

Metadata

attack targetIoT

created at2017_04_25

deploymentPerimeter

confidenceMedium

signature severityMajor

updated at2019_07_26

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!