[***]            Summary:            [***]

 8 new Open, 28 new Pro (8 + 20). Kimsuky, Polaris Botnet, Magniber
Ransomware, Magnitude EK JSE, and VARIOUS PHISHING

 Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

Open:

  2029576 - ET TROJAN Kimsuky Related Host Data Exfil (trojan.rules)
  2029577 - ET SCAN Polaris Botnet User-Agent (Inbound) (scan.rules)
  2029578 - ET TROJAN Polaris Botnet User-Agent (Outbound) (trojan.rules)
  2029579 - ET TROJAN Magniber Ransomware Retrieving Instructions
(trojan.rules)
  2029580 - ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup
(trojan.rules)
  2029581 - ET TROJAN Magniber Ransomware CnC Domain in DNS Lookup
(trojan.rules)
  2029582 - ET CURRENT_EVENTS Magnitude EK JSE (current_events.rules)
  2029583 - ET TROJAN Kimsuky Related Host Data Exfil (trojan.rules)

Pro:

  2841383 - ETPRO TROJAN Observed Malicious SSL Cert (More_eggs CnC)
(trojan.rules)
  2841384 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-03-05 1) (trojan.rules)
  2841385 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-03-05 2) (trojan.rules)
  2841386 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish 2020-03-05
(current_events.rules)
  2841387 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish 2020-03-05
(current_events.rules)
  2841388 - ETPRO CURRENT_EVENTS Successful Dropbox Phish 2020-03-05
(current_events.rules)
  2841389 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish 2020-03-05
(current_events.rules)
  2841390 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-03-05 (current_events.rules)
  2841391 - ETPRO CURRENT_EVENTS Successful First National Bank Phish
2020-03-05 (current_events.rules)
  2841392 - ETPRO CURRENT_EVENTS Successful Box Phish 2020-03-05
(current_events.rules)
  2841393 - ETPRO CURRENT_EVENTS Successful Ionos 1&1 Webhosting Phish
2020-03-05 (current_events.rules)
  2841394 - ETPRO CURRENT_EVENTS Successful Mweb Mailbox Phish 2020-03-05
(current_events.rules)
  2841395 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-03-05
(current_events.rules)
  2841396 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-03-05
(current_events.rules)
  2841397 - ETPRO CURRENT_EVENTS Successful Netease 163 Phish 2020-03-05
(current_events.rules)
  2841398 - ETPRO CURRENT_EVENTS Successful Generic Banking Information
Phish 2020-03-05 (current_events.rules)
  2841399 - ETPRO CURRENT_EVENTS Successful Bank of America Phish
2020-03-05 (current_events.rules)
  2841400 - ETPRO CURRENT_EVENTS Possible Successful Chase Phish 2020-03-05
(current_events.rules)
  2841401 - ETPRO MALWARE Win32/Adware.Hai33.A Installation Activity
(malware.rules)
  2841402 - ETPRO TROJAN Win32/Agent.YSL CnC Activity (trojan.rules)

 [///]     Modified active rules:     [///]

  2022295 - ET WEB_SERVER WeBaCoo Web Backdoor Detected (web_server.rules)
  2022357 - ET TROJAN Linux/Torte Downloading Binary (trojan.rules)
  2022466 - ET CURRENT_EVENTS Possible Keitaro TDS Redirect
(current_events.rules)
  2022554 - ET EXPLOIT FireEye Detection Evasion [temp]% attempt - Inbound
(exploit.rules)
  2022657 - ET TROJAN IrcBot Downloading .old (trojan.rules)
  2022697 - ET WEB_CLIENT Fake AV Phone Scam Landing Apr 4
(web_client.rules)
  2022723 - ET MALWARE Win32/Adware.Adposhel.A Checkin 4 (malware.rules)
  2022894 - ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD IE Flash request to
set non-standard filename (some overlap with 2021752) (current_events.rules)
  2022900 - ET TROJAN FOX-SRT ShimRat check-in (Data) (trojan.rules)
  2022902 - ET TROJAN FOX-SRT ShimRat check-in (Yuok) (trojan.rules)
  2022939 - ET CURRENT_EVENTS Possible Pony DLL Download
(current_events.rules)
  2022940 - ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016
(userdir dotted quad) (current_events.rules)
  2022941 - ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016
(dll generic custom headers) (current_events.rules)
  2022988 - ET TROJAN Win32/Pottieq.A Check-in (trojan.rules)
  2023075 - ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit
Attempt (exploit.rules)
  2023138 - ET CURRENT_EVENTS Suspicious Proxifier DL (non-browser observed
in maldoc campaigns) (current_events.rules)
  2023203 - ET TROJAN Quant Loader Download Request (trojan.rules)
  2023583 - ET TROJAN Known Malicious Doc Downloading Payload Dec 06 2016
(trojan.rules)
  2024121 - ET EXPLOIT NETGEAR WNR2000v5 hidden_lang_avi Stack Overflow
(CVE-2016-10174) (exploit.rules)
  2024171 - ET MOBILE_MALWARE Android Trojan Pegasus CnC Beacon
(mobile_malware.rules)
  2024175 - ET TROJAN Red Leaves HTTP CnC Beacon (APT10 implant)
(trojan.rules)
  2024183 - ET TROJAN Possible Turla Carbon Paper CnC Beacon (Fake
User-Agent) (trojan.rules)
  2024223 - ET TROJAN MSIL/Runsome Ransomware CnC Checkin (trojan.rules)
  2024272 - ET TROJAN W32.Geodo/Emotet Checkin (trojan.rules)
  2024274 - ET TROJAN W32/Emotet CnC Beacon 1 (trojan.rules)
  2024275 - ET TROJAN W32/Emotet CnC Beacon 2 (trojan.rules)
  2024276 - ET TROJAN MSIL/OzazaLocker Ransomware CnC Checkin (trojan.rules)
  2825924 - ETPRO MOBILE_MALWARE Android.Trojan.InfoStealer.FY CnC Beacon 2
(mobile_malware.rules)
  2825992 - ETPRO TROJAN MSIL/Possessor Keylogger Reporting External IP
(trojan.rules)
  2825993 - ETPRO TROJAN MSIL/Possessor Keylogger HTTP Logging M2
(trojan.rules)
  2825998 - ETPRO TROJAN Malicious JS Download Request (trojan.rules)
  2826018 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.Fyec.bna CnC Beacon
(mobile_malware.rules)
  2826026 - ETPRO TROJAN MSIL/Softmalaria Trojan CnC Checkin (trojan.rules)
  2826033 - ETPRO MOBILE_MALWARE Android/SMSreg.GB Checkin 3
(mobile_malware.rules)
  2826046 - ETPRO MOBILE_MALWARE Android.Trojan.SLocker.TX CnC Beacon
(mobile_malware.rules)
  2826061 - ETPRO MOBILE_MALWARE Android.Trojan.Guerrilla.n Checkin
(mobile_malware.rules)
  2826072 - ETPRO MOBILE_MALWARE Android/Adware.Kuguo.C Checkin 2
(mobile_malware.rules)
  2826098 - ETPRO MOBILE_MALWARE Android/Monitor.Drower.B SMS Exfil
(mobile_malware.rules)
  2826099 - ETPRO TROJAN MSIL/Spy.Agent.AUE Checkin (trojan.rules)
  2826100 - ETPRO MOBILE_MALWARE Android.Adware.Wapsx.A CnC Beacon
(mobile_malware.rules)
  2826103 - ETPRO MOBILE_MALWARE Android.Adware.Dowgin.gQAM Checkin
(mobile_malware.rules)
  2826112 - ETPRO MOBILE_MALWARE Android/SMForw.RL Contact Exfil
(mobile_malware.rules)
  2826154 - ETPRO TROJAN Cobalt Strike Malleable C2 Webbug Profile
(trojan.rules)
  2826176 - ETPRO MOBILE_MALWARE Android Unknown Trojan-Spy CnC Beacon
(mobile_malware.rules)
  2826177 - ETPRO MOBILE_MALWARE Android Unknown Trojan-Spy Contact Exfil
(mobile_malware.rules)
  2826178 - ETPRO TROJAN Cobalt Strike Malleable C2 Amazon Profile
(trojan.rules)
  2826183 - ETPRO TROJAN APT.ChChes CnC Beacon 3 (trojan.rules)
  2826203 - ETPRO TROJAN Trojan/AutoIT RMS Dropper Checkin (trojan.rules)
  2826205 - ETPRO TROJAN Possible Linux.Shishiga HTTP Fake 404 Response
(trojan.rules)

 [---]         Disabled rules:        [---]

  2024270 - ET TROJAN Kazuar CnC Beacon (trojan.rules)

Date:
Summary title:
8 new Open, 28 new Pro (8 + 20). Kimsuky, Polaris Botnet, Magniber Ransomware, Magnitude EK JSE, and VARIOUS PHISHING