ET MALWARE SparkRAT Related Domain in DNS Lookup (gwekekccef .webull .day)

SID: 2045795Rev: 27 views
History
Sourceet/open
CreatedMay 22, 2023
UpdatedOctober 23, 2023
Classificationdomain-c2
alert dns $HOME_NET any -> any any (msg:"ET MALWARE SparkRAT Related Domain in DNS Lookup (gwekekccef .webull .day)"; dns.query; content:"gwekekccef.webull.day"; nocase; bsize:21; reference:url,asec.ahnlab.com/en/52899/; reference:md5,2e3ce7d90d988e1b0bb7ffce1731b04b; reference:md5,b571d849c0cb3c7af1cee6990654972b; reference:md5,5b78c44262ebcb4ce52e75c331683b5b; classtype:domain-c2; sid:2045795; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_05_22, deployment Perimeter, deprecation_reason Age, malware_family SparkRAT, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_10_23, reviewed_at 2023_10_23;)

References

urlasec.ahnlab.com/en/52899/
md5
2e3ce7d90d988e1b0bb7ffce1731b04b
Google SearchBrave Search
md5
b571d849c0cb3c7af1cee6990654972b
Google SearchBrave Search
md5
5b78c44262ebcb4ce52e75c331683b5b
Google SearchBrave Search

Metadata

attack targetClient_Endpoint
created at2023_05_22
deploymentPerimeter
deprecation reasonAge
malware familySparkRAT
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2023_10_23
reviewed at2023_10_23

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!