ET ADWARE_PUP Observed Win32/Foniad Domain (aclassigned .info in TLS SNI)

SID: 2025489Rev: 40 views
History
Sourceet/open
CreatedApril 13, 2018
UpdatedSeptember 17, 2020
Classificationpup-activity
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Observed Win32/Foniad Domain (aclassigned .info in TLS SNI)"; flow:established,to_server; tls.sni; content:"aclassigned.info"; endswith; reference:url,www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Foniad; classtype:pup-activity; sid:2025489; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_04_13, deployment Perimeter, malware_family Foniad, performance_impact Moderate, confidence High, signature_severity Minor, updated_at 2020_09_17;)

References

urlwww.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/Foniad

Metadata

affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
created at2018_04_13
deploymentPerimeter
malware familyFoniad
performance impactModerate
confidenceHigh
signature severityMinor
updated at2020_09_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!