🐾 - ☠ DNS request 🌐 --> 🎛 Possible C2 🔒 REvil/Sodinokibi ransomware

SID: 3313425Rev: 10 views
Sourcepawpatrules
CreatedJuly 25, 2020
UpdatedJuly 25, 2020
Classificationtrojan-activity
alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 --> 🎛 Possible C2 🔒 REvil/Sodinokibi ransomware"; flow:to_server, stateless; dns_query; content:"mountaintoptiny-homes.com"; nocase; reference:url,https://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf; reference:url,https://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/; reference:url,https://twitter.com/ScumBots/status/1285211002125127681; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.revil; metadata:created_at 2020_07_25, updated_at 2020_07_25; sid:3313425; rev:1; classtype:trojan-activity;)

References

urlhttps://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf
urlhttps://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/
urlhttps://twitter.com/ScumBots/status/1285211002125127681
urlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.revil

Metadata

created at2020_07_25
updated at2020_07_25

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!