[***] Summary: [***]
5 new Open rules, 25 new Pro rules (5/20). Various Android, Various Banker, Delf, PCRat/Gh0st, Fiesta EK.
Thanks to @EKWatcher and Darren Spruell for their contributions.
[+++] Added rules: [+++]
Open:
2018007 – ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 17 (trojan.rules)
2018008 – ET TROJAN DNS Query Possible Zbot Infection Query for networksecurityx.hopto.org (trojan.rules)
2018009 – ET CURRENT_EVENTS SUSPICIOUS HTTP Request to .bit domain (current_events.rules)
2018010 – ET TROJAN Suspicious UA (^IE[\d\s]) (trojan.rules)
2018011 – ET CURRENT_EVENTS Fiesta EK Landing Jan 24 2013 (current_events.rules)
Pro:
2807520 – ETPRO TROJAN Win32/Delf.GI Checkin (trojan.rules)
2807521 – ETPRO TROJAN Win32/Qhost.Banker.MU Checkin (trojan.rules)
2807522 – ETPRO MOBILE_MALWARE Android/Spy.Zitmo.B Checkin 2 (mobile_malware.rules)
2807523 – ETPRO TROJAN Win32.Genome.srs Downloader (trojan.rules)
2807524 – ETPRO TROJAN Win32.Blackbeard Downloader (trojan.rules)
2807525 – ETPRO TROJAN Trojan.Win32.Storup Checkin (trojan.rules)
2807526 – ETPRO TROJAN Win32/Delf.OMB Checkin (trojan.rules)
2807527 – ETPRO TROJAN Trojan-Downloader.Win32.Dapato.qio Download (trojan.rules)
2807528 – ETPRO TROJAN DDoS.Win32/Nitol.B Checkin 2 (trojan.rules)
2807529 – ETPRO TROJAN Banker.Win32.Banbra.axea Checkin (trojan.rules)
2807530 – ETPRO TROJAN Win32/Onkods.C User-Agent (g0g) (trojan.rules)
2807531 – ETPRO TROJAN Basine/Outbreak Checkin (trojan.rules)
2807532 – ETPRO TROJAN W32/Banker.YNL!tr.spy sending info about infection via SMTP (trojan.rules)
2807533 – ETPRO MOBILE_MALWARE AndroidOS/Cosha.A / Android/Lovetrap.A Checkin 2 (mobile_malware.rules)
2807534 – ETPRO TROJAN ServStart.E Checkin (trojan.rules)
2807535 – ETPRO TROJAN Win32/Zawat.A User-Agent (trojan.rules)
2807536 – ETPRO MOBILE_MALWARE Android/Spy.Zitmo.A Checkin 2 (mobile_malware.rules)
2807537 – ETPRO TROJAN Trojan-Ransom.Win32.Blocker.ahhr Checkin (trojan.rules)
2807538 – ETPRO TROJAN Win32/Swrort.A Checkin 2 (trojan.rules)
2807539 – ETPRO TROJAN Trojan.Win32.VB.bzqf Checkin (trojan.rules)
[///] Modified active rules: [///]
2807110 – ETPRO TROJAN Trojan.Win32.Qadars Checkin (trojan.rules)