Daily Ruleset Update Summary 2017/08/14

[***]            Summary:            [***]

6 new Open, 17 new Pro (6 + 11). MSIL/XnxxAgent Spam Bot, GlobeImposter Payment Domain, Various Phishing, Various Mobile.

Thanks: @malwrhunterteam, @illegalfawn

[+++]          Added rules:          [+++]

Open:

2024541 - ET CURRENT_EVENTS Possible Successful Phish - Verify Email Error Message M1 Aug 14 2017 (current_events.rules)
2024542 - ET CURRENT_EVENTS Possible Successful Phish - Verify Email Error Message M2 Aug 14 2017 (current_events.rules)
2024543 - ET TROJAN Observed DNS Query to Unknown CnC Domain / GlobeImposter Payment Domain (trojan.rules)
2024544 - ET CURRENT_EVENTS Successful Paypal Phish M1 Aug 14 2017 (current_events.rules)
2024545 - ET CURRENT_EVENTS Successful Paypal Phish M2 Aug 14 2017 (current_events.rules)
2024546 - ET CURRENT_EVENTS Successful Paypal Phish M3 Aug 14 2017 (current_events.rules)

Pro:

2827506 - ETPRO TROJAN Win32/Spy.Agent.PFM CnC Checkin (trojan.rules)
2827507 - ETPRO CURRENT_EVENTS Successful Dropbox Phish Aug 14 2017 (current_events.rules)
2827508 - ETPRO CURRENT_EVENTS Successful Linkedin Phish Aug 14 2017 (current_events.rules)
2827509 - ETPRO TROJAN Win32/Downloader.Banload.YAZ CnC Activity (trojan.rules)
2827510 - ETPRO TROJAN MSIL/XnxxAgent Spam Bot Checkin M3 (trojan.rules)
2827511 - ETPRO TROJAN MSIL/XnxxAgent Spam Bot Version Check (trojan.rules)
2827512 - ETPRO TROJAN Win32/Unk.CoinMiner Activity (trojan.rules)
2827513 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw.iz SMS/Contact Exfil via SMTP 12 (mobile_malware.rules)
2827514 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw.ic SMS/Contact Exfil via SMTP 9 (mobile_malware.rules)
2827515 - ETPRO CURRENT_EVENTS Successful Apple Phish Aug 14 2017 (current_events.rules)
2827516 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw.ic SMS/Contact Exfil via SMTP 10 (mobile_malware.rules)

[///]     Modified active rules:     [///]

2018052 - ET CURRENT_EVENTS Zbot Generic URI/Header Struct .bin (current_events.rules)
2814943 - ETPRO CURRENT_EVENTS Successful Square Phish Nov 16 (current_events.rules)
2827504 - ETPRO CURRENT_EVENTS Tech Support Phone Scam M1 Aug 11 2017 (current_events.rules)

Date: 
Monday, August 14, 2017 - 00:00