🐾 - 🚨 Outgoing connection ↗ 🎛 Possible Trickbot ♞ C2 ➡ 🔒 Ryuk Ransomware

SID: 3315860Rev: 20 views
Sourcepawpatrules
CreatedJuly 5, 2020
UpdatedNovember 16, 2021
Classificationtrojan-activity
alert ip any any -> 95.179.214.127 any (msg:"🐾 - 🚨 Outgoing connection ↗ 🎛 Possible Trickbot ♞ C2 ➡ 🔒 Ryuk Ransomware"; reference:url,https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk; metadata:created_at 2020_07_05, updated_at 2021_11_16; sid:3315860; rev:2; classtype:trojan-activity;)

References

urlhttps://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/
urlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot
urlhttps://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk

Metadata

created at2020_07_05
updated at2021_11_16

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!