ET MALWARE Observed Filch Stealer Domain (cmb8k1nbj000008l1api07o0n .info) in TLS SNI
Sourceet/open
CreatedSeptember 19, 2025
UpdatedSeptember 19, 2025
Classificationdomain-c2
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed Filch Stealer Domain (cmb8k1nbj000008l1api07o0n .info) in TLS SNI"; flow:established,to_server; tls.sni; bsize:30; content:"cmb8k1nbj000008l1api07o0n.info"; fast_pattern; reference:url,www.rapid7.com/blog/post/filch-stealer-a-new-infostealer-leveraging-old-techniques/; reference:md5,5e13fd50160acfc9c40de6c3b0f43c11; classtype:domain-c2; sid:2064804; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2025_09_19, deployment Perimeter, malware_family Filch_Stealer, performance_impact Low, confidence High, signature_severity Major, tag Stealer, updated_at 2025_09_19, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;)
References
| url | www.rapid7.com/blog/post/filch-stealer-a-new-infostealer-leveraging-old-techniques/ |
| md5 | 5e13fd50160acfc9c40de6c3b0f43c11 |
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
created at2025_09_19
deploymentPerimeter
malware familyFilch_Stealer
performance impactLow
confidenceHigh
signature severityMajor
tagStealer
updated at2025_09_19
mitre tactic idTA0009
mitre tactic nameCollection
mitre technique idT1005
mitre technique nameData_from_local_system
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!