ET DELETED Possible BlackByte Ransomware Encryption Key Inbound (fake .png)
Sourceet/open
CreatedOctober 18, 2021
UpdatedOctober 19, 2021
Classificationcommand-and-control
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible BlackByte Ransomware Encryption Key Inbound (fake .png)"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:!"|89 50 4E 47 0D 0A 1A 0A|"; startswith; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/si"; flowbits:isset,ET.httpget.png; classtype:command-and-control; sid:2034213; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_10_18, deployment Perimeter, malware_family BlackByte, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_19;)
Metadata
attack targetClient_Endpoint
created at2021_10_18
deploymentPerimeter
malware familyBlackByte
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2021_10_19
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!