🐾 - 🚨 Suspicious SSLv3 connection from WinHttpOpen C++ fonction 🪟

SID: 3301091Rev: 314 views
History
Sourcepawpatrules
CreatedNovember 18, 2023
UpdatedMarch 17, 2025
Classificationtrojan-activity
alert tls $HOME_NET any -> ![135.224.0.0/13,135.232.0.0/14,135.236.0.0/15] any (msg:"🐾 - 🚨 Suspicious SSLv3 connection from WinHttpOpen C++ fonction 🪟"; flow:to_server, stateless; ssl_version:sslv3; ja3.hash; content:"79c9e26fe870347aca15a4b6b6aea6d0"; reference:url,https://learn.microsoft.com/en-us/windows/win32/api/winhttp/nf-winhttp-winhttpopen; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.revil; metadata:created_at 2023_11_18, updated_at 2025_03_17; sid:3301091; rev:3; classtype:trojan-activity;)

References

urlhttps://learn.microsoft.com/en-us/windows/win32/api/winhttp/nf-winhttp-winhttpopen
urlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.revil

Metadata

created at2023_11_18
updated at2025_03_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!