ET MOBILE_MALWARE Observed Android ERMAC Banker (PL) Domain (bolt-food .site in TLS SNI)

SID: 2036635Rev: 10 views
History
Sourceet/open
CreatedMay 19, 2022
UpdatedMay 19, 2022
Classificationdomain-c2
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Observed Android ERMAC Banker (PL) Domain (bolt-food .site in TLS SNI)"; flow:established,to_server; tls.sni; content:"bolt-food.site"; bsize:14; fast_pattern; reference:url,twitter.com/ESETresearch/status/1526897310231322630; reference:md5,1e0586aef0f106031260fecb412c5cdf; classtype:domain-c2; sid:2036635; rev:1; metadata:attack_target Mobile_Client, created_at 2022_05_19, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_05_19;)

References

urltwitter.com/ESETresearch/status/1526897310231322630
md5
1e0586aef0f106031260fecb412c5cdf
Google SearchBrave Search

Metadata

attack targetMobile_Client
created at2022_05_19
deploymentPerimeter
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2022_05_19

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!