[***]            Summary:            [***]

11 new OPEN, 40 new PRO (11 + 29).  MSIL/SilentHunter, Osno, Various Phish, Others.

Thanks: @jstrosch, @travisbgreen.

Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

Open:

  2031086 - ET CURRENT_EVENTS Outlook Phishing Landing 2020-10-23
(current_events.rules)
  2031087 - ET POLICY PCHunter Download Observed (policy.rules)
  2031088 - ET INFO Request to .XYZ Domain with Minimal Headers (info.rules)
  2031089 - ET INFO Request to .TOP Domain with Minimal Headers (info.rules)
  2031090 - ET INFO Request to 000webhostapp Domain with Minimal
Headers (info.rules)
  2031091 - ET INFO Request to .ML Domain with Minimal Headers (info.rules)
  2031092 - ET INFO Request to .CF Domain with Minimal Headers (info.rules)
  2031093 - ET INFO Request to .GQ Domain with Minimal Headers (info.rules)
  2031094 - ET INFO Request to .TK Domain with Minimal Headers (info.rules)
  2031095 - ET INFO Request to .GA Domain with Minimal Headers (info.rules)
  2031096 - ET TROJAN Win32/Spy.Pavica.FH Variant CnC Activity (trojan.rules)

Pro:

  2845109 - ETPRO MOBILE_MALWARE Android/Spy.Agent.BJD Checkin
(mobile_malware.rules)
  2845110 - ETPRO CURRENT_EVENTS Successful Generic Credit Card
Information Phish 2020-10-23 (current_events.rules)
  2845111 - ETPRO CURRENT_EVENTS Successful Generic Credit Card
Information Phish 2020-10-23 (current_events.rules)
  2845112 - ETPRO CURRENT_EVENTS Successful Wells Fargo Phish
2020-10-23 (current_events.rules)
  2845113 - ETPRO CURRENT_EVENTS Successful Navy Federal Credit Union
Phish 2020-10-23 (current_events.rules)
  2845114 - ETPRO CURRENT_EVENTS Successful Yodobashi Phish 2020-10-23
(current_events.rules)
  2845115 - ETPRO CURRENT_EVENTS Successful Facebook Phish 2020-10-23
(current_events.rules)
  2845116 - ETPRO CURRENT_EVENTS Successful Generic Multibrand Phish
2020-10-23 (current_events.rules)
  2845117 - ETPRO CURRENT_EVENTS Successful Made in China Phish
2020-10-23 (current_events.rules)
  2845118 - ETPRO TROJAN MSIL/SilentHunter CnC Activity (trojan.rules)
  2845119 - ETPRO TROJAN MSIL/SilentHunter CnC Exfil Activity (trojan.rules)
  2845120 - ETPRO TROJAN MSIL/SilentHunter Data Exfil (trojan.rules)
  2845121 - ETPRO CURRENT_EVENTS Successful Microsoft Voicemail Phish
2020-10-23 (current_events.rules)
  2845122 - ETPRO CURRENT_EVENTS Successful Generic Webmail Phish
2020-10-23 (current_events.rules)
  2845123 - ETPRO CURRENT_EVENTS Successful Ionos Phish 2020-10-23
(current_events.rules)
  2845124 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-10-23 1) (trojan.rules)
  2845125 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-10-23 2) (trojan.rules)
  2845126 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-10-23 3) (trojan.rules)
  2845127 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845128 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845129 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845130 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845131 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845132 - ETPRO CURRENT_EVENTS Successful Generic Phish (302)
2020-10-23 (current_events.rules)
  2845133 - ETPRO TROJAN Osno CnC Exfil Activity (trojan.rules)
  2845134 - ETPRO TROJAN Osno CnC Activity (trojan.rules)
  2845135 - ETPRO TROJAN Revil Ransomware .onion Proxy Domain (trojan.rules)
  2845136 - ETPRO TROJAN Win32/Agent.65CA!tr Checkin Activity (trojan.rules)
  2845137 - ETPRO CURRENT_EVENTS Successful Royal Bank of Canada Phish
2020-10-23 (current_events.rules)

[///]     Modified active rules:     [///]

  2011588 - ET TROJAN Zeus Bot Connectivity Check (trojan.rules)
  2018886 - ET TROJAN Windows TaskList Microsoft Windows DOS prompt
command exit OUTBOUND (trojan.rules)
  2027120 - ET TROJAN ELF/Mirai Variant UA Inbound (Rift) (trojan.rules)
  2027122 - ET TROJAN ELF/Mirai Variant UA Inbound (Tsunami) (trojan.rules)
  2027124 - ET TROJAN ELF/Mirai Variant UA Inbound (Yowai) (trojan.rules)
  2027126 - ET TROJAN ELF/Mirai Variant UA Inbound (Yakuza) (trojan.rules)
  2027128 - ET TROJAN ELF/Mirai Variant UA Inbound (Hentai) (trojan.rules)
  2027130 - ET TROJAN ELF/Mirai Variant UA Inbound (lessie) (trojan.rules)
  2027132 - ET TROJAN ELF/Mirai Variant UA Inbound (Cakle) (trojan.rules)
  2027134 - ET TROJAN ELF/Mirai Variant UA Inbound (Damien) (trojan.rules)
  2027136 - ET TROJAN ELF/Mirai Variant UA Inbound (Solar) (trojan.rules)
  2027138 - ET TROJAN ELF/Mirai Variant UA Inbound (muhstik) (trojan.rules)
  2027140 - ET TROJAN ELF/Mirai Variant UA Inbound (Shaolin) (trojan.rules)
  2028989 - ET TROJAN ELF/Mirai Variant UA Outbound (ph0ne) (trojan.rules)
  2029015 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029016 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029017 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029018 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029019 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029020 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029021 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029023 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029024 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029026 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029027 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029028 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029029 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029030 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029031 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029032 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029033 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029035 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029036 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029038 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029047 - ET TROJAN Observed Malicious SSL Cert (Ursnif CnC) (trojan.rules)
  2029048 - ET TROJAN Observed Malicious SSL Cert (ACBackdoor CnC)
(trojan.rules)
  2029049 - ET TROJAN Observed Malicious SSL Cert (ACBackdoor CnC)
(trojan.rules)
  2029050 - ET TROJAN Observed Malicious SSL Cert (Possible Godlua
CnC) (trojan.rules)
  2029051 - ET POLICY Observed SSL Cert (DoH Service) (policy.rules)
  2029053 - ET TROJAN SSL/TLS Certificate Observed (Various Crimeware)
(trojan.rules)
  2029054 - ET SCAN Zmap User-Agent (Inbound) (scan.rules)
  2029061 - ET TROJAN Legion Loader Activity Observed (Mylegion666)
(trojan.rules)
  2029062 - ET TROJAN Legion Loader Activity Observed (YourUserAgent)
(trojan.rules)
  2029063 - ET TROJAN Legion Loader Activity Observed
(salmonella-symptome) (trojan.rules)
  2029064 - ET TROJAN Legion Loader Activity Observed (suspira) (trojan.rules)
  2029065 - ET TROJAN Legion Loader Activity Observed (lilith) (trojan.rules)
  2029066 - ET TROJAN Legion Loader Activity Observed (legion) (trojan.rules)
  2029067 - ET TROJAN Legion Loader Activity Observed (the devil) (trojan.rules)
  2029068 - ET TROJAN Legion Loader Activity Observed (trojan.rules)
  2029069 - ET TROJAN Legion Loader Activity Observed (Amen) (trojan.rules)
  2029070 - ET TROJAN Legion Loader Activity Observed (satan) (trojan.rules)
  2029071 - ET TROJAN Legion Loader Activity Observed (neva-project)
(trojan.rules)
  2029072 - ET TROJAN SSL/TLS Certificate Observed (Magecart) (trojan.rules)
  2029073 - ET WEB_CLIENT Possible Magecart Credit Card Information JS
Script (web_client.rules)
  2029074 - ET TROJAN Magecart CnC Domain Observed in DNS Query (trojan.rules)
  2834242 - ETPRO MOBILE_MALWARE Android.Trojan.FakeApp.EV Checkin
(mobile_malware.rules)
  2839239 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
  2839240 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound) (trojan.rules)
  2839468 - ETPRO TROJAN Observed ELF/Mirai Variant UA Inbound (ph0ne)
(trojan.rules)
  2839514 - ETPRO TROJAN W32/Kanatara CnC Activity (trojan.rules)
  2839542 - ETPRO CURRENT_EVENTS Successful SMBC Phish 2019-11-21
(current_events.rules)
  2839543 - ETPRO CURRENT_EVENTS Successful Office 365 Phish
2019-11-21 (current_events.rules)
  2839544 - ETPRO CURRENT_EVENTS Successful Binance Phish 2019-11-21
(current_events.rules)
  2839545 - ETPRO CURRENT_EVENTS Successful Caixa Bank Phish
2019-11-21 (current_events.rules)
  2839546 - ETPRO CURRENT_EVENTS Successful Caixa Bank Phish
2019-11-21 (current_events.rules)
  2839547 - ETPRO CURRENT_EVENTS Successful Caixa Bank Phish
2019-11-21 (current_events.rules)
  2839548 - ETPRO CURRENT_EVENTS Successful Adobe PDF Cloud Phish
2019-11-21 (current_events.rules)
  2839549 - ETPRO CURRENT_EVENTS Evil Keitaro Set-Cookie Inbound
(aef4f) (current_events.rules)
  2839560 - ETPRO TROJAN Observed Malicious SSL Cert (ServHelper CnC)
(trojan.rules)
  2839561 - ETPRO TROJAN Observed Malicious SSL Cert (ServHelper CnC)
(trojan.rules)
  2839562 - ETPRO TROJAN Observed Malicious SSL Cert (SmokeLoader CnC)
(trojan.rules)
  2839572 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.MobOk.pac Checkin
(mobile_malware.rules)
  2839573 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.MobOk.pac CnC Beacon
(mobile_malware.rules)
  2839574 - ETPRO MOBILE_MALWARE Andr/PornClk-AR Checkin (mobile_malware.rules)
  2839575 - ETPRO MOBILE_MALWARE AndroidOS.Bookoloid Geo
Location/Device Info Exfil (mobile_malware.rules)
  2839576 - ETPRO MOBILE_MALWARE Riskware.AndroidOS.Hamiraca
Device/Debug Info Exfil (mobile_malware.rules)
  2839577 - ETPRO MOBILE_MALWARE
Trojan-Downloader.AndroidOS.Guerrila.j Checkin (mobile_malware.rules)
  2839583 - ETPRO CURRENT_EVENTS Successful GMX Phish 2019-11-22
(current_events.rules)
  2839584 - ETPRO CURRENT_EVENTS Successful Chase Phish 2019-11-22
(current_events.rules)
  2839585 - ETPRO CURRENT_EVENTS Successful Chase Phish 2019-11-22
(current_events.rules)
  2839586 - ETPRO CURRENT_EVENTS Successful Banco Inter Phish
2019-11-22 (current_events.rules)
  2839587 - ETPRO CURRENT_EVENTS Successful Wells Fargo Phish
2019-11-22 (current_events.rules)
  2839588 - ETPRO CURRENT_EVENTS Successful Generic Credit Card
Information Phish 2019-11-22 (current_events.rules)
  2839589 - ETPRO CURRENT_EVENTS Successful Amazon Phish 2019-11-22
(current_events.rules)
  2839590 - ETPRO CURRENT_EVENTS Successful Rabobank Phish 2019-11-22
(current_events.rules)
  2839591 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish
2019-11-22 (current_events.rules)
  2839592 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish
2019-11-22 (current_events.rules)
  2839601 - ETPRO CURRENT_EVENTS Evil Keitaro Set-Cookie Inbound
(eccc8) (current_events.rules)
  2839602 - ETPRO CURRENT_EVENTS Successful Plenty of Fish Phish
2019-11-25 (current_events.rules)
  2839603 - ETPRO CURRENT_EVENTS Successful Office 365 Phish
2019-11-25 (current_events.rules)
  2839604 - ETPRO CURRENT_EVENTS Successful Bank of America Phish
2019-11-25 (current_events.rules)
  2839605 - ETPRO CURRENT_EVENTS Successful Microsoft Account Phish
2019-11-25 (current_events.rules)
  2839606 - ETPRO CURRENT_EVENTS Successful BECU Phish 2019-11-25
(current_events.rules)
  2839607 - ETPRO CURRENT_EVENTS Successful WeTransfer Phish
2019-11-25 (current_events.rules)
  2839608 - ETPRO CURRENT_EVENTS Successful EMS High Speed Mail Phish
2019-11-25 (current_events.rules)
  2839609 - ETPRO CURRENT_EVENTS Successful Generic Account Recovery
Phish 2019-11-25 (current_events.rules)
  2839610 - ETPRO CURRENT_EVENTS Successful Commonwealth Bank Phish
2019-11-25 (current_events.rules)
  2839611 - ETPRO CURRENT_EVENTS Successful Commonwealth Bank Phish
2019-11-25 (current_events.rules)
  2839612 - ETPRO CURRENT_EVENTS Successful Commonwealth Bank Phish
2019-11-25 (current_events.rules)
  2839613 - ETPRO TROJAN DustSquad/Octopus CnC Initial Check M1 (trojan.rules)
  2839614 - ETPRO TROJAN DustSquad/Octopus CnC Initial Check M2 (trojan.rules)
  2839615 - ETPRO TROJAN DustSquad/Octopus CnC Initial Server Request
M1 (trojan.rules)
  2839616 - ETPRO TROJAN DustSquad/Octopus CnC Initial Server Request
M2 (trojan.rules)
  2839617 - ETPRO TROJAN DustSquad/Octopus CnC Host Checkin M2 (trojan.rules)
  2839618 - ETPRO TROJAN DustSquad/Octopus CnC Host Checkin M1 (trojan.rules)
  2839620 - ETPRO TROJAN DustSquad/Octopus CnC Activity (trojan.rules)
  2839637 - ETPRO CURRENT_EVENTS Successful Excel Online Phish
2019-11-26 (current_events.rules)
  2839639 - ETPRO CURRENT_EVENTS Successful Pagseguro UOL Phish
2019-11-26 (current_events.rules)
  2839640 - ETPRO CURRENT_EVENTS Successful Pagseguro UOL Phish
2019-11-26 (current_events.rules)
  2839641 - ETPRO CURRENT_EVENTS Successful BCP Phish 2019-11-26
(current_events.rules)
  2839642 - ETPRO CURRENT_EVENTS Successful Facebook Phish 2019-11-26
(current_events.rules)
  2839643 - ETPRO CURRENT_EVENTS Successful Snapchat Phish 2019-11-26
(current_events.rules)
  2839644 - ETPRO CURRENT_EVENTS Successful Santander Phish 2019-11-26
(current_events.rules)
  2839645 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound) (trojan.rules)
  2839646 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
  2839647 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound) (trojan.rules)
  2839648 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
  2839654 - ETPRO MOBILE_MALWARE Android/Agent.BNX Checkin
(mobile_malware.rules)
  2839659 - ETPRO CURRENT_EVENTS Successful Minha BV Phish 2019-11-27
(current_events.rules)
  2839660 - ETPRO CURRENT_EVENTS Successful Minha BV Phish 2019-11-27
(current_events.rules)
  2839661 - ETPRO CURRENT_EVENTS Successful Caixa Phish 2019-11-27
(current_events.rules)
  2839662 - ETPRO CURRENT_EVENTS Successful Microsoft OneCall Phish
2019-11-27 (current_events.rules)
  2839663 - ETPRO CURRENT_EVENTS Successful 1&1 Hosting Phish
2019-11-27 (current_events.rules)
  2839664 - ETPRO CURRENT_EVENTS Successful State Employees Credit
Union Phish 2019-11-27 (current_events.rules)
  2839665 - ETPRO CURRENT_EVENTS Successful Generic Session Expired
Phish 2019-11-27 (current_events.rules)
  2839666 - ETPRO TROJAN Win32/Chapak Payload Request (trojan.rules)
  2839667 - ETPRO TROJAN Win32/Chapak Initial Response (trojan.rules)
  2839668 - ETPRO TROJAN Win32/Chapak Payload Downloaded (trojan.rules)
  2839669 - ETPRO TROJAN HorseHours Powershell Request (trojan.rules)
  2839670 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound) (trojan.rules)
  2839671 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
  2839676 - ETPRO TROJAN Observed Malicious SSL Cert (ServHelper CnC)
(trojan.rules)
  2839677 - ETPRO TROJAN Observed Malicious SSL Cert (Delf.BJP CnC)
(trojan.rules)
  2839678 - ETPRO TROJAN Observed Malicious SSL Cert (Delf.BJP CnC)
(trojan.rules)
  2839679 - ETPRO TROJAN Observed Malicious SSL Cert (Delf.BJP CnC)
(trojan.rules)
  2839681 - ETPRO TROJAN Observed Malicious SSL Cert (SmokeLoader CnC)
(trojan.rules)
  2839682 - ETPRO TROJAN Observed Malicious SSL Cert (Unk CnC -
Targeted Phishing) (trojan.rules)
  2839685 - ETPRO MOBILE_MALWARE Android/Spy.Agent.APG CnC Beacon
(mobile_malware.rules)
  2839686 - ETPRO MOBILE_MALWARE Monitor.AndroidOS.Bulgok.a CnC Beacon
(mobile_malware.rules)
  2839687 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Erop.a CnC
Beacon (mobile_malware.rules)
  2839688 - ETPRO MOBILE_MALWARE Android.Trojan.FakeTelegram-6736160-2
CnC Beacon (mobile_malware.rules)
  2839691 - ETPRO TROJAN Observed Malicious SSL Cert (Ursnif CnC) (trojan.rules)
  2839700 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.Rootnik.k CnC Beacon
(mobile_malware.rules)
  2839702 - ETPRO MOBILE_MALWARE Android Gustuff Header (mobile_malware.rules)
  2839714 - ETPRO CURRENT_EVENTS Successful Bank of America Phish
2019-12-03 (current_events.rules)
  2839715 - ETPRO CURRENT_EVENTS Successful Generic Credit Card
Information Phish 2019-12-03 (current_events.rules)
  2839716 - ETPRO CURRENT_EVENTS Successful Banco do Brasil Phish
2019-12-03 (current_events.rules)
  2839717 - ETPRO CURRENT_EVENTS Successful Adobe Reader Phish
2019-12-03 (current_events.rules)
  2839718 - ETPRO CURRENT_EVENTS Successful Microsoft File Received
Phish 2019-12-03 (current_events.rules)
  2845011 - ETPRO CURRENT_EVENTS Successful Office 365 Phish
2020-10-19 (current_events.rules)

[---]  Disabled and modified rules:  [---]

  2806297 - ETPRO POLICY InnoTools Downloader User-Agent (InnoTools
Downloader) (policy.rules)

Date:
Summary title:
11 new OPEN, 40 new PRO (11 + 29). MSIL/SilentHunter, Osno, Various Phish, Others.