[***]            Summary:            [***]

6 new OPEN, 28 new PRO (6 + 22).  Geocon, Remcos, AsyncRAT, Various Phish, Various Edits.

Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

Open:

  2021092 - ET INFO Download file with BITS via LNK file (Likely
Malicious) (info.rules)
  2031234 - ET TROJAN Observed DNS Query to Blackrota Domain (trojan.rules)
  2031235 - ET TROJAN Observed Blackrota Domain (blackrato .ga in TLS
SNI) (trojan.rules)
  2031236 - ET TROJAN Observed Malicious SSL Cert (Blackrota) (trojan.rules)
  2031237 - ET TROJAN Geocon CnC Request (trojan.rules)
  2031238 - ET CURRENT_EVENTS Cloned Instagram Page - Possible
Phishing Landing M3 (current_events.rules)

Pro:

  2845656 - ETPRO TROJAN Observed Malicious SSL Cert (AsyncRAT) (trojan.rules)
  2845657 - ETPRO INFO Suspiicous Binary Encoded String (powershell)
(info.rules)
  2845658 - ETPRO INFO Suspiicous Binary Encoded String
(-ExecutionPolicy) (info.rules)
  2845659 - ETPRO INFO Suspiicous Binary Encoded String
([Net.WebRequest]) (info.rules)
  2845660 - ETPRO INFO Suspiicous Binary Encoded String (Powershell)
(info.rules)
  2845661 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-25 1) (trojan.rules)
  2845662 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-25 2) (trojan.rules)
  2845663 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-25 3) (trojan.rules)
  2845664 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-25 4) (trojan.rules)
  2845665 - ETPRO CURRENT_EVENTS Successful Bitwala Phish 2020-11-25
(current_events.rules)
  2845666 - ETPRO CURRENT_EVENTS Successful Generic Credit Card
Information Phish 2020-11-25 (current_events.rules)
  2845667 - ETPRO CURRENT_EVENTS Successful Fifth Third Bank Phish
2020-11-25 (current_events.rules)
  2845668 - ETPRO CURRENT_EVENTS Successful Fifth Third Bank Phish
2020-11-25 (current_events.rules)
  2845669 - ETPRO CURRENT_EVENTS Successful Navy Federal Credit Union
Phish 2020-11-25 (current_events.rules)
  2845670 - ETPRO CURRENT_EVENTS Successful Navy Federal Credit Union
Phish 2020-11-25 (current_events.rules)
  2845671 - ETPRO CURRENT_EVENTS Successful Adobe Phish 2020-11-25
(current_events.rules)
  2845672 - ETPRO TROJAN MSIL/Bucaspys.A CnC Host Checkin (trojan.rules)
  2845673 - ETPRO TROJAN Win32/Nymeria CnC Install Activity (trojan.rules)
  2845674 - ETPRO TROJAN Win32/Remcos RAT Checkin 618 (trojan.rules)
  2845675 - ETPRO TROJAN Observed Malicious SSL Cert (Ursnif CnC) (trojan.rules)
  2845676 - ETPRO CURRENT_EVENTS Successful Instagram Credential Phish
2020-11-25 (current_events.rules)
  2845677 - ETPRO CURRENT_EVENTS Successful Office 365 Credential
Phish 2020-11-25 (current_events.rules)

[///]     Modified active rules:     [///]

  2014847 - ET CURRENT_EVENTS php with eval/gzinflate/base64_decode
possible webshell (current_events.rules)
  2014912 - ET CURRENT_EVENTS Unknown - Java Request  - gt 60char
hex-ascii (current_events.rules)
  2015704 - ET CURRENT_EVENTS DoSWF Flash Encryption Banner
(current_events.rules)
  2016154 - ET CURRENT_EVENTS Possible TURKTRUST Spoofed Google Cert
(current_events.rules)
  2016794 - ET CURRENT_EVENTS Possible Linux/Cdorked.A Incoming
Command (current_events.rules)
  2017193 - ET CURRENT_EVENTS c0896 Hacked Site Response Hex
(Outbound) (current_events.rules)
  2017373 - ET CURRENT_EVENTS Possible CookieBomb Generic JavaScript
Format (current_events.rules)
  2017899 - ET CURRENT_EVENTS Possible PDF Dictionary Entry with
Hex/Ascii replacement (current_events.rules)
  2018052 - ET CURRENT_EVENTS Zbot Generic URI/Header Struct .bin
(current_events.rules)
  2018145 - ET CURRENT_EVENTS Generic HeapSpray Construct (current_events.rules)
  2018146 - ET CURRENT_EVENTS Generic HeapSpray Construct (current_events.rules)
  2018343 - ET CURRENT_EVENTS Hikvision DVR attempted Synology Recon
Scan (current_events.rules)
  2019822 - ET CURRENT_EVENTS WinHttpRequest Downloading EXE
(current_events.rules)
  2020573 - ET CURRENT_EVENTS .exe download with no referer (noalert)
(current_events.rules)
  2020956 - ET TROJAN Windows nbtstat -r Microsoft Windows DOS prompt
command exit OUTBOUND (trojan.rules)
  2021944 - ET CURRENT_EVENTS Netgear Multiple Router Auth Bypass
(current_events.rules)
  2022500 - ET CURRENT_EVENTS Xbagger Macro Encrypted DL (current_events.rules)
  2022622 - ET CURRENT_EVENTS Likely Evil Macro EXE DL mar 15 2016
(current_events.rules)
  2022686 - ET CURRENT_EVENTS Likely Evil Macro EXE DL mar 28 2016
(current_events.rules)
  2022732 - ET CURRENT_EVENTS Open MGate Device (current_events.rules)
  2022895 - ET CURRENT_EVENTS Xbagger Macro Encrypted DL Jun 13 2016
(current_events.rules)
  2022940 - ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01
2016 (userdir dotted quad) (current_events.rules)
  2022941 - ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01
2016 (dll generic custom headers) (current_events.rules)
  2023755 - ET CURRENT_EVENTS Possible Microsoft RDP Client for Mac
RCE (current_events.rules)
  2024945 - ET CURRENT_EVENTS Fake Update/Installer ForceDL Template
Nov 03 2017 (current_events.rules)

[///]    Modified inactive rules:    [///]

  2015738 - ET CURRENT_EVENTS pamdql obfuscated javascript --- padding
(current_events.rules)
  2016807 - ET CURRENT_EVENTS Eval With Base64.decode seen in DOL
Watering Hole Attack 05/01/13 (current_events.rules)

[---]  Disabled and modified rules:  [---]

  2014984 - ET CURRENT_EVENTS Hacked Website Response /*km0ae9gr6m*/
Jun 25 2012 (current_events.rules)
  2014985 - ET CURRENT_EVENTS Hacked Website Response /*qhk6sa6g1c*/
Jun 25 2012 (current_events.rules)
  2016511 - ET CURRENT_EVENTS Successful Compromise svchost.jpg Beacon
- Java  Zeroday (current_events.rules)
  2017257 - ET CURRENT_EVENTS Fake FedEX/Pony spam campaign URI Struct
2 (current_events.rules)
  2018355 - ET CURRENT_EVENTS Win32.RBrute http server request
(current_events.rules)
  2021986 - ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015
B64 1 (current_events.rules)
  2021987 - ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015
B64 2 (current_events.rules)
  2021988 - ET CURRENT_EVENTS Possible click2play bypass Oct 19 2015
B64 3 (current_events.rules)

[---]         Disabled rules:        [---]

  2010344 - ET TROJAN Chorns/PoisonIvy related Backdoor Initial
Connection (trojan.rules)
  2010345 - ET TROJAN Chorns/PoisonIvy related Backdoor Keep Alive
(trojan.rules)
  2014560 - ET CURRENT_EVENTS Modified Metasploit Jar (current_events.rules)
  2016167 - ET TROJAN PoisonIvy.2013Jan04 victim beacon (trojan.rules)
  2016168 - ET TROJAN PoisonIvy.2013Jan04 server response (trojan.rules)
  2016270 - ET TROJAN PoisonIvy Variant Jan 24 2013 (trojan.rules)
  2016271 - ET TROJAN PoisonIvy Variant Jan 24 2013 (trojan.rules)
  2017052 - ET TROJAN PoisonIvy [victim beacon] (trojan.rules)
  2017053 - ET TROJAN PoisonIvy [server response] (trojan.rules)
  2017430 - ET TROJAN Bladabindi/njrat CnC Command (Keylogger) (trojan.rules)
  2018336 - ET TROJAN Asprox Fake Ximian Evolution X-Mailer Header
(XimianEvolution1.4.6) (trojan.rules)
  2018465 - ET TROJAN Possible Backdoor.Adwind Download 2 (trojan.rules)
  2019086 - ET TROJAN Unknown Trojan Dropped by Angler Aug 29 2014
(trojan.rules)
  2019117 - ET TROJAN Possible Double Flated Encoded Inbound Malicious
PDF (trojan.rules)
  2019118 - ET TROJAN Possible Double Flated Encoded Inbound Malicious
PDF (trojan.rules)
  2019119 - ET TROJAN Possible Double Flated Encoded Inbound Malicious
PDF (trojan.rules)
  2019190 - ET TROJAN Infostealer.Banprox Proxy.pac Download 2 (trojan.rules)
  2019295 - ET TROJAN Linux/ShellshockCampaign.DDOSBot Get Bot IP CnC
Server Message (trojan.rules)
  2019296 - ET TROJAN Linux/ShellshockCampaign.DDOSBot Ping CnC Server
Message (trojan.rules)
  2019297 - ET TROJAN Linux/ShellshockCampaign.DDOSBot Scanner CnC
Server Message (trojan.rules)
  2019299 - ET TROJAN Linux/ShellshockCampaign.DDOSBot Random Byte
Flood CnC Server Message (trojan.rules)
  2019301 - ET TROJAN Linux/ShellshockCampaign.DDOSBot TCP Flood CnC
Server Message (trojan.rules)
  2019302 - ET TROJAN Linux/ShellshockCampaign.DDOSBot HOLD TCP Flood
CnC Server Message (trojan.rules)
  2019303 - ET TROJAN Linux/ShellshockCampaign.DDOSBot Kill Attack CnC
Server Message (trojan.rules)
  2019357 - ET TROJAN SpyClicker.ClickFraud Query Instructions CnC
Response (trojan.rules)
  2019395 - ET CURRENT_EVENTS Possible SandWorm INF Download
(current_events.rules)
  2019397 - ET CURRENT_EVENTS Possible SandWorm INF Download (UNICODE)
(current_events.rules)
  2019398 - ET CURRENT_EVENTS Possible SandWorm INF Download (SMB)
(current_events.rules)
  2019399 - ET CURRENT_EVENTS Possible SandWorm INF Download (SMB
UNICODE) (current_events.rules)
  2019504 - ET TROJAN BlackEnergy SSL Cert (trojan.rules)
  2019505 - ET TROJAN BlackEnergy SSL Cert (trojan.rules)
  2019588 - ET TROJAN W32/ZxShell Checkin (trojan.rules)
  2019589 - ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN
Variant) (trojan.rules)
  2019590 - ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN
Variant) (trojan.rules)
  2019592 - ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN
Variant) (trojan.rules)
  2019593 - ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN
Variant) (trojan.rules)
  2019637 - ET TROJAN Shellshock Backdoor.Perl.Shellbot.F C2 (trojan.rules)
  2019644 - ET TROJAN Shellshock Backdoor.Perl.Shellbot.F retrieval
(trojan.rules)
  2019711 - ET TROJAN W32Autorun.worm.aaeh Checkin (trojan.rules)
  2019712 - ET TROJAN W32/Keylogger.CI Checkin (trojan.rules)
  2019739 - ET TROJAN W32/AlienSpy RAT Checkin (trojan.rules)
  2019757 - ET TROJAN Bamital Checkin Response 1 (trojan.rules)
  2019878 - ET TROJAN Destover RAT Check-in (trojan.rules)
  2019883 - ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.ws) (trojan.rules)
  2019887 - ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cn) (trojan.rules)
  2019927 - ET TROJAN Beastdoor Keylogger Report via SMTP (trojan.rules)
  2019941 - ET TROJAN Win32.Bumrat.B Checkin (trojan.rules)
  2019964 - ET TROJAN W32/AGENT.NXNX checkin (trojan.rules)
  2019975 - ET TROJAN Syrian.Slideshow Sending Information via SMTP
(trojan.rules)
  2019995 - ET TROJAN US-CERT TA14-353A Listening Implant 1 (trojan.rules)
  2019996 - ET TROJAN US-CERT TA14-353A Listening Implant 2 (trojan.rules)
  2019997 - ET TROJAN US-CERT TA14-353A Listening Implant 3 (trojan.rules)
  2019998 - ET TROJAN US-CERT TA14-353A Listening Implant 4 (trojan.rules)
  2019999 - ET TROJAN US-CERT TA14-353A Listening Implant 5 (trojan.rules)
  2020002 - ET TROJAN US-CERT TA14-353A Listening Implant 8 (trojan.rules)
  2020003 - ET TROJAN US-CERT TA14-353A Listening Implant 9 (trojan.rules)
  2020004 - ET TROJAN US-CERT TA14-353A Listening Implant 10 (trojan.rules)
  2020005 - ET TROJAN US-CERT TA14-353A Listening Implant 11 (trojan.rules)
  2020006 - ET TROJAN US-CERT TA14-353A Listening Implant 12 (trojan.rules)
  2020009 - ET TROJAN US-CERT TA14-353A Lightweight Backdoor 3 (trojan.rules)
  2020013 - ET TROJAN US-CERT TA14-353A Lightweight Backdoor 7 (trojan.rules)
  2020020 - ET TROJAN US-CERT TA14-353A WIPER4 (trojan.rules)
  2020021 - ET TROJAN Possible Operation Poisoned Helmand jar download
(trojan.rules)
  2020023 - ET TROJAN US-CERT TA14-353A Network Propagation Wiper (trojan.rules)
  2020025 - ET TROJAN Win32/Spy.Agent.OHT - AnunakAPT TCP Checkin 2
(trojan.rules)
  2020069 - ET TROJAN TROJ_WHAIM.A message (trojan.rules)
  2020081 - ET TROJAN Win32.Akdoor Reporting MAC Address (trojan.rules)
  2020152 - ET TROJAN TinyLoader.A Sending UUID and Processes x86 (trojan.rules)
  2020153 - ET TROJAN TinyLoader.A Sending UUID and Processes x64 (trojan.rules)
  2020162 - ET TROJAN Linux/DDoS.M JUNK command (trojan.rules)
  2020163 - ET TROJAN Linux/DDoS.M GETLOCALIP command (trojan.rules)
  2020164 - ET TROJAN Linux/DDoS.M SCANNER command (trojan.rules)
  2020165 - ET TROJAN Linux/DDoS.M KILLATTK command (trojan.rules)
  2020166 - ET TROJAN Linux/DDoS.M LOLNOGTFO command (trojan.rules)
  2020170 - ET TROJAN Possible Office Doc with Embedded VBA containing
Reverse Meterpreter Shell (trojan.rules)
  2020222 - ET TROJAN Win32/Nitol.A Checkin 2 (trojan.rules)
  2020297 - ET TROJAN Scieron Retrieving Information Response (trojan.rules)
  2020335 - ET TROJAN MSIL/Agent.PYO Receiving Config (trojan.rules)
  2020349 - ET TROJAN BePush/Kilim Checkin response (trojan.rules)
  2020421 - ET TROJAN Win32/Gulcrypt.B Downloading components (trojan.rules)
  2020653 - ET TROJAN Banker Boleto Fraud JS_BROBAN.SM Firefox Plug-In
Download (trojan.rules)
  2020671 - ET TROJAN Win32/Rofin.A CnC traffic (OUTBOUND) (trojan.rules)
  2020736 - ET CURRENT_EVENTS Unauthorized SSL Cert for Google Domains
(current_events.rules)
  2020748 - ET TROJAN Win32.Chroject.B Receiving ClickFraud Commands
from CnC 1 (trojan.rules)
  2020807 - ET TROJAN Volatile Cedar Win32.Explosive CnC Beacon 1 (trojan.rules)
  2020808 - ET TROJAN Volatile Cedar Win32.Explosive CnC Beacon 2 (trojan.rules)
  2020811 - ET TROJAN Volatile Cedar Win32.Explosive External IP Leak
(trojan.rules)
  2020836 - ET TROJAN IRC Bot dropped by Mikey Variant CnC Beacon (trojan.rules)
  2020909 - ET TROJAN CoinVault CnC Beacon Response (trojan.rules)
  2020923 - ET TROJAN Unit42 PoisonIvy Keepalive to CnC (trojan.rules)
  2020929 - ET TROJAN Possible Dalexis downloader encrypted binary (1)
(trojan.rules)
  2020930 - ET TROJAN Possible Dalexis downloader encrypted binary (2)
(trojan.rules)
  2020931 - ET TROJAN Possible Dalexis downloader encrypted binary (3)
(trojan.rules)
  2021395 - ET TROJAN Wekby PCRat/Gh0st CnC Beacon (Outbound) (trojan.rules)
  2021396 - ET TROJAN Wekby PCRat/Gh0st CnC Beacon (Inbound) (trojan.rules)
  2021504 - ET TROJAN Java/QRat Receiving Command 1 (trojan.rules)
  2021505 - ET TROJAN Java/QRat Receiving No Commands (trojan.rules)
  2021624 - ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate
detected (BlackEnergy CnC) (trojan.rules)
  2021745 - ET TROJAN PredatorPain Keylogger FTP Activity (trojan.rules)
  2021789 - ET TROJAN Iron Tiger DNSTunnel Retrieving CnC (trojan.rules)
  2021930 - ET TROJAN MSIL/Banker.M Requesting Binary from SQL (trojan.rules)
  2021931 - ET TROJAN MSIL/Banker.M Downloading Binary from SQL (trojan.rules)
  2022000 - ET TROJAN Duuzer Checkin (trojan.rules)
  2022005 - ET TROJAN LummoX Keylogger Report SMTP (trojan.rules)
  2022064 - ET TROJAN Win32/HideWindows.C IRC Checkin (trojan.rules)
  2022069 - ET TROJAN KilerRAT CnC - Info Checkin (trojan.rules)
  2022132 - ET TROJAN Rincux CnC (trojan.rules)
  2022206 - ET TROJAN Ponmocup plugin #2600 (SIP scanner) (trojan.rules)
  2022293 - ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate
detected (Gozi MITM) (trojan.rules)
  2022327 - ET TROJAN BlackEnergy SSL Cert (trojan.rules)
  2022330 - ET TROJAN NanoLocker Check-in (ICMP) M2 (trojan.rules)
  2026848 - ET CURRENT_EVENTS Python Eval Compile seen in HTTP Request
Headers (current_events.rules)
  2806306 - ETPRO TROJAN Trojan-PSW.Reedum FTP long Port (LPRT) (trojan.rules)
  2806591 - ETPRO TROJAN Deka Infostealer FTP upload (trojan.rules)
  2807982 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Agent.gj Checkin
(mobile_malware.rules)
  2808844 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Agent.kh
Response 2 (mobile_malware.rules)
  2808855 - ETPRO TROJAN TROJANCLICKER.MSIL/EZBRO.A Keep-Alive (trojan.rules)
  2808858 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.FakeInst.a
Response (mobile_malware.rules)
  2808872 - ETPRO TROJAN Trojan.StoleCert.SPK CnC (trojan.rules)
  2808930 - ETPRO TROJAN Trojan.Backdoor.Prosti CnC (trojan.rules)
  2808932 - ETPRO TROJAN Win32/Bloodhound.Bancos Checkin (trojan.rules)
  2808933 - ETPRO TROJAN TrojanSpy.Win32/Bancos.gen!B Checkin via SMTP
(trojan.rules)
  2808966 - ETPRO MOBILE_MALWARE Android.Monitor.Spy2mobile.A Checkin
(mobile_malware.rules)
  2809053 - ETPRO MOBILE_MALWARE Android/Rlove.A Checkin (mobile_malware.rules)
  2809066 - ETPRO TROJAN Backdoor.Tepmim Checkin (trojan.rules)
  2809099 - ETPRO TROJAN Trojan.Win32.KillProc.dfwkin DNS TXT Checkin
Response (trojan.rules)
  2809102 - ETPRO MOBILE_MALWARE Trojan-Dropper.AndroidOS.Sadpor.g
Sending Info via FTP (mobile_malware.rules)
  2809137 - ETPRO TROJAN Win32/GameHack.RU Checkin via SQL (trojan.rules)
  2809170 - ETPRO TROJAN PE downloaded with malicious APT OPH
certificate (QTI International Inc) (trojan.rules)
  2809185 - ETPRO TROJAN Win32.Troj.Reconyc Sending Screenshots and
Keystrokes Via SMTP (trojan.rules)
  2809227 - ETPRO TROJAN Win32/Joviddy.A Checkin via IRC (trojan.rules)
  2809295 - ETPRO TROJAN Backdoor.IRC.Azbot CnC via IRC (trojan.rules)
  2809322 - ETPRO TROJAN Jaik Variant Checkin Response (trojan.rules)
  2809324 - ETPRO TROJAN Zusy Variant Checkin (trojan.rules)
  2809341 - ETPRO TROJAN VBS/Cechip.A SSH Banner Checkin 2 (trojan.rules)
  2809352 - ETPRO TROJAN Win32/ChkBot.A IRC Checkin (trojan.rules)
  2809386 - ETPRO TROJAN PWS.Win32.Mujormel.A Reporting Infection via
SMTP (trojan.rules)
  2809396 - ETPRO MOBILE_MALWARE Android/Smsir.B Checkin via FTP
(mobile_malware.rules)
  2809430 - ETPRO TROJAN Win32/Taskman Checkin Via IRC (trojan.rules)
  2809471 - ETPRO TROJAN Trojan-Dropper.Win32.Sysn.arfz Checkin
Response (trojan.rules)
  2809536 - ETPRO TROJAN Backdoor.Linux.Mayday Checkin (trojan.rules)
  2809572 - ETPRO TROJAN Trojan.Win32.VinSelf.p Malformed Checkin (trojan.rules)
  2809588 - ETPRO TROJAN W32/Sourtoff Receiving Config (trojan.rules)
  2809594 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Logisr.a
Uploading Info via FTP (mobile_malware.rules)
  2809655 - ETPRO TROJAN Win32/Plugx.L Keepalive Request (trojan.rules)
  2809656 - ETPRO TROJAN Win32/Plugx.L Keepalive Response (trojan.rules)
  2809799 - ETPRO TROJAN TrojanSpy.MSIL/Golroted.A Checkin FTP 2 (trojan.rules)
  2809836 - ETPRO TROJAN Win32/Spy.Banker.AALI MSSQL CnC Beacon (trojan.rules)
  2809895 - ETPRO TROJAN MSIL.Small.ee CnC Beacon (IN) (trojan.rules)
  2809896 - ETPRO TROJAN MSIL.Small.ee CnC Beacon 1 (OUT) (trojan.rules)
  2809897 - ETPRO TROJAN MSIL.Small.ee CnC Beacon 2 (OUT) (trojan.rules)
  2809898 - ETPRO TROJAN MSIL.Small.ee CnC Beacon 3 (OUT) (trojan.rules)
  2810097 - ETPRO TROJAN Win32/Spy.Banker.ZMO Variant Checkin via SQL
(trojan.rules)
  2810100 - ETPRO TROJAN Win32/Injector Variant Checkin via SQL (trojan.rules)
  2810162 - ETPRO TROJAN Win32.VB.hlqz Keepalive (trojan.rules)
  2810189 - ETPRO MOBILE_MALWARE Backdoor.AndroidOS.Agent.aq Checkin
via FTP (mobile_malware.rules)
  2810201 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(458e3600) (trojan.rules)
  2810205 - ETPRO TROJAN PoisonIvy Keepalive to CnC 1 (trojan.rules)
  2810206 - ETPRO TROJAN PoisonIvy Keepalive to CnC 2 (trojan.rules)
  2810207 - ETPRO TROJAN PoisonIvy Keepalive to CnC 3 (trojan.rules)
  2810208 - ETPRO TROJAN PoisonIvy Keepalive to CnC 4 (trojan.rules)
  2810209 - ETPRO TROJAN PoisonIvy Keepalive to CnC 5 (trojan.rules)
  2810210 - ETPRO TROJAN PoisonIvy Keepalive to CnC 6 (trojan.rules)
  2810211 - ETPRO TROJAN PoisonIvy Keepalive to CnC 7 (trojan.rules)
  2810212 - ETPRO TROJAN PoisonIvy Keepalive to CnC 8 (trojan.rules)
  2810213 - ETPRO TROJAN PoisonIvy Keepalive to CnC 9 (trojan.rules)
  2810214 - ETPRO TROJAN PoisonIvy Keepalive to CnC 10 (trojan.rules)
  2810215 - ETPRO TROJAN PoisonIvy Keepalive to CnC 11 (trojan.rules)
  2810216 - ETPRO TROJAN PoisonIvy Keepalive to CnC 12 (trojan.rules)
  2810217 - ETPRO TROJAN PoisonIvy Keepalive to CnC 13 (trojan.rules)
  2810218 - ETPRO TROJAN PoisonIvy Keepalive to CnC 14 (trojan.rules)
  2810219 - ETPRO TROJAN PoisonIvy Keepalive to CnC 15 (trojan.rules)
  2810220 - ETPRO TROJAN PoisonIvy Keepalive to CnC 16 (trojan.rules)
  2810221 - ETPRO TROJAN PoisonIvy Keepalive to CnC 17 (trojan.rules)
  2810222 - ETPRO TROJAN PoisonIvy Keepalive to CnC 18 (trojan.rules)
  2810223 - ETPRO TROJAN PoisonIvy Keepalive to CnC 19 (trojan.rules)
  2810224 - ETPRO TROJAN PoisonIvy Keepalive to CnC 20 (trojan.rules)
  2810225 - ETPRO TROJAN PoisonIvy Keepalive to CnC 21 (trojan.rules)
  2810226 - ETPRO TROJAN PoisonIvy Keepalive to CnC 22 (trojan.rules)
  2810227 - ETPRO TROJAN PoisonIvy Keepalive to CnC 23 (trojan.rules)
  2810228 - ETPRO TROJAN PoisonIvy Keepalive to CnC 24 (trojan.rules)
  2810229 - ETPRO TROJAN PoisonIvy Keepalive to CnC 25 (trojan.rules)
  2810230 - ETPRO TROJAN PoisonIvy Keepalive to CnC 26 (trojan.rules)
  2810231 - ETPRO TROJAN PoisonIvy Keepalive to CnC 27 (trojan.rules)
  2810232 - ETPRO TROJAN PoisonIvy Keepalive to CnC 28 (trojan.rules)
  2810233 - ETPRO TROJAN PoisonIvy Keepalive to CnC 29 (trojan.rules)
  2810256 - ETPRO TROJAN PoisonIvy Keepalive to CnC 30 (trojan.rules)
  2810257 - ETPRO TROJAN PoisonIvy Keepalive to CnC 31 (trojan.rules)
  2810258 - ETPRO TROJAN PoisonIvy Keepalive to CnC 32 (trojan.rules)
  2810259 - ETPRO TROJAN PoisonIvy Keepalive to CnC 33 (trojan.rules)
  2810260 - ETPRO TROJAN PoisonIvy Keepalive to CnC 34 (trojan.rules)
  2810261 - ETPRO TROJAN PoisonIvy Keepalive to CnC 35 (trojan.rules)
  2810262 - ETPRO TROJAN PoisonIvy Keepalive to CnC 36 (trojan.rules)
  2810263 - ETPRO TROJAN PoisonIvy Keepalive to CnC 37 (trojan.rules)
  2810264 - ETPRO TROJAN PoisonIvy Keepalive to CnC 38 (trojan.rules)
  2810265 - ETPRO TROJAN PoisonIvy Keepalive to CnC 39 (trojan.rules)
  2810279 - ETPRO TROJAN PoisonIvy Keepalive to CnC 40 (trojan.rules)
  2810280 - ETPRO TROJAN PoisonIvy Keepalive to CnC 41 (trojan.rules)
  2810283 - ETPRO TROJAN PoisonIvy Keepalive to CnC 42 (trojan.rules)
  2810284 - ETPRO TROJAN PoisonIvy Keepalive to CnC 43 (trojan.rules)
  2810285 - ETPRO TROJAN PoisonIvy Keepalive to CnC 44 (trojan.rules)
  2810286 - ETPRO TROJAN PoisonIvy Keepalive to CnC 45 (trojan.rules)
  2810287 - ETPRO TROJAN PoisonIvy Keepalive to CnC 46 (trojan.rules)
  2810307 - ETPRO TROJAN PoisonIvy Keepalive to CnC 47 (trojan.rules)
  2810308 - ETPRO TROJAN PoisonIvy Keepalive to CnC 48 (trojan.rules)
  2810309 - ETPRO TROJAN PoisonIvy Keepalive to CnC 49 (trojan.rules)
  2810310 - ETPRO TROJAN PoisonIvy Keepalive to CnC 50 (trojan.rules)
  2810311 - ETPRO TROJAN PoisonIvy Keepalive to CnC 51 (trojan.rules)
  2810312 - ETPRO TROJAN PoisonIvy Keepalive to CnC 52 (trojan.rules)
  2810313 - ETPRO TROJAN PoisonIvy Keepalive to CnC 53 (trojan.rules)
  2810314 - ETPRO TROJAN PoisonIvy Keepalive to CnC 54 (trojan.rules)
  2810315 - ETPRO TROJAN PoisonIvy Keepalive to CnC 55 (trojan.rules)
  2810316 - ETPRO TROJAN PoisonIvy Keepalive to CnC 56 (trojan.rules)
  2810317 - ETPRO TROJAN PoisonIvy Keepalive to CnC 57 (trojan.rules)
  2810318 - ETPRO TROJAN PoisonIvy Keepalive to CnC 58 (trojan.rules)
  2810319 - ETPRO TROJAN PoisonIvy Keepalive to CnC 59 (trojan.rules)
  2810320 - ETPRO TROJAN PoisonIvy Keepalive to CnC 60 (trojan.rules)
  2810321 - ETPRO TROJAN PoisonIvy Keepalive to CnC 61 (trojan.rules)
  2810322 - ETPRO TROJAN PoisonIvy Keepalive to CnC 62 (trojan.rules)
  2810323 - ETPRO TROJAN PoisonIvy Keepalive to CnC 63 (trojan.rules)
  2810324 - ETPRO TROJAN PoisonIvy Keepalive to CnC 64 (trojan.rules)
  2810325 - ETPRO TROJAN PoisonIvy Keepalive to CnC 65 (trojan.rules)
  2810343 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(16142) (trojan.rules)
  2810357 - ETPRO TROJAN PoisonIvy Keepalive to CnC 66 (trojan.rules)
  2810358 - ETPRO TROJAN PoisonIvy Keepalive to CnC 67 (trojan.rules)
  2810359 - ETPRO TROJAN PoisonIvy Keepalive to CnC 68 (trojan.rules)
  2810360 - ETPRO TROJAN PoisonIvy Keepalive to CnC 69 (trojan.rules)
  2810361 - ETPRO TROJAN PoisonIvy Keepalive to CnC 70 (trojan.rules)
  2810362 - ETPRO TROJAN PoisonIvy Keepalive to CnC 71 (trojan.rules)
  2810367 - ETPRO TROJAN PoisonIvy Keepalive to CnC 72 (trojan.rules)
  2810368 - ETPRO TROJAN PoisonIvy Keepalive to CnC 73 (trojan.rules)
  2810369 - ETPRO TROJAN PoisonIvy Keepalive to CnC 74 (trojan.rules)
  2810406 - ETPRO TROJAN PoisonIvy Keepalive to CnC 75 (trojan.rules)
  2810407 - ETPRO TROJAN PoisonIvy Keepalive to CnC 76 (trojan.rules)
  2810449 - ETPRO TROJAN PoisonIvy Keepalive to CnC 77 (trojan.rules)
  2810450 - ETPRO TROJAN PoisonIvy Keepalive to CnC 78 (trojan.rules)
  2810469 - ETPRO TROJAN PoisonIvy Keepalive to CnC 79 (trojan.rules)
  2810470 - ETPRO TROJAN PoisonIvy Keepalive to CnC 80 (trojan.rules)
  2810471 - ETPRO TROJAN PoisonIvy Keepalive to CnC 81 (trojan.rules)
  2810472 - ETPRO TROJAN PoisonIvy Keepalive to CnC 82 (trojan.rules)
  2810473 - ETPRO TROJAN PoisonIvy Keepalive to CnC 83 (trojan.rules)
  2810489 - ETPRO TROJAN PoisonIvy Keepalive to CnC 84 (trojan.rules)
  2810517 - ETPRO TROJAN PoisonIvy Keepalive to CnC 85 (trojan.rules)
  2810518 - ETPRO TROJAN PoisonIvy Keepalive to CnC 86 (trojan.rules)
  2810519 - ETPRO TROJAN PoisonIvy Keepalive to CnC 87 (trojan.rules)
  2810520 - ETPRO TROJAN PoisonIvy Keepalive to CnC 88 (trojan.rules)
  2810521 - ETPRO TROJAN PoisonIvy Keepalive to CnC 89 (trojan.rules)
  2810522 - ETPRO TROJAN PoisonIvy Keepalive to CnC 90 (trojan.rules)
  2810523 - ETPRO TROJAN PoisonIvy Keepalive to CnC 91 (trojan.rules)
  2810524 - ETPRO TROJAN PoisonIvy Keepalive to CnC 92 (trojan.rules)
  2810525 - ETPRO TROJAN PoisonIvy Keepalive to CnC 93 (trojan.rules)
  2810526 - ETPRO TROJAN PoisonIvy Keepalive to CnC 94 (trojan.rules)
  2810527 - ETPRO TROJAN PoisonIvy Keepalive to CnC 95 (trojan.rules)
  2810528 - ETPRO TROJAN PoisonIvy Keepalive to CnC 96 (trojan.rules)
  2810529 - ETPRO TROJAN PoisonIvy Keepalive to CnC 97 (trojan.rules)
  2810530 - ETPRO TROJAN PoisonIvy Keepalive to CnC 98 (trojan.rules)
  2810531 - ETPRO TROJAN PoisonIvy Keepalive to CnC 99 (trojan.rules)
  2810532 - ETPRO TROJAN PoisonIvy Keepalive to CnC 100 (trojan.rules)
  2810533 - ETPRO TROJAN PoisonIvy Keepalive to CnC 101 (trojan.rules)
  2810534 - ETPRO TROJAN PoisonIvy Keepalive to CnC 102 (trojan.rules)
  2810535 - ETPRO TROJAN PoisonIvy Keepalive to CnC 103 (trojan.rules)
  2810543 - ETPRO MOBILE_MALWARE Android.Trojan.Fadeb.B Response
(mobile_malware.rules)
  2810562 - ETPRO TROJAN PoisonIvy Keepalive to CnC 104 (trojan.rules)
  2810563 - ETPRO TROJAN PoisonIvy Keepalive to CnC 105 (trojan.rules)
  2810564 - ETPRO TROJAN PoisonIvy Keepalive to CnC 106 (trojan.rules)
  2810565 - ETPRO TROJAN PoisonIvy Keepalive to CnC 107 (trojan.rules)
  2810566 - ETPRO TROJAN PoisonIvy Keepalive to CnC 108 (trojan.rules)
  2810567 - ETPRO TROJAN PoisonIvy Keepalive to CnC 109 (trojan.rules)
  2810568 - ETPRO TROJAN PoisonIvy Keepalive to CnC 110 (trojan.rules)
  2810569 - ETPRO TROJAN PoisonIvy Keepalive to CnC 111 (trojan.rules)
  2810570 - ETPRO TROJAN PoisonIvy Keepalive to CnC 112 (trojan.rules)
  2810571 - ETPRO TROJAN PoisonIvy Keepalive to CnC 113 (trojan.rules)
  2810572 - ETPRO TROJAN PoisonIvy Keepalive to CnC 114 (trojan.rules)
  2810573 - ETPRO TROJAN PoisonIvy Keepalive to CnC 115 (trojan.rules)
  2810574 - ETPRO TROJAN PoisonIvy Keepalive to CnC 116 (trojan.rules)
  2810586 - ETPRO TROJAN PoisonIvy Keepalive to CnC 117 (trojan.rules)
  2810587 - ETPRO TROJAN PoisonIvy Keepalive to CnC 118 (trojan.rules)
  2810588 - ETPRO TROJAN PoisonIvy Keepalive to CnC 119 (trojan.rules)
  2810589 - ETPRO TROJAN PoisonIvy Keepalive to CnC 120 (trojan.rules)
  2810590 - ETPRO TROJAN PoisonIvy Keepalive to CnC 121 (trojan.rules)
  2810591 - ETPRO TROJAN PoisonIvy Keepalive to CnC 122 (trojan.rules)
  2810592 - ETPRO TROJAN PoisonIvy Keepalive to CnC 123 (trojan.rules)
  2810593 - ETPRO TROJAN PoisonIvy Keepalive to CnC 124 (trojan.rules)
  2810594 - ETPRO TROJAN PoisonIvy Keepalive to CnC 125 (trojan.rules)
  2810595 - ETPRO TROJAN PoisonIvy Keepalive to CnC 126 (trojan.rules)
  2810596 - ETPRO TROJAN PoisonIvy Keepalive to CnC 127 (trojan.rules)
  2810609 - ETPRO TROJAN PoisonIvy Keepalive to CnC 128 (trojan.rules)
  2810638 - ETPRO TROJAN PoisonIvy Keepalive to CnC 129 (trojan.rules)
  2810639 - ETPRO TROJAN PoisonIvy Keepalive to CnC 130 (trojan.rules)
  2810652 - ETPRO TROJAN Downeks Checkin Response (trojan.rules)
  2810668 - ETPRO TROJAN PoisonIvy Keepalive to CnC 131 (trojan.rules)
  2810669 - ETPRO TROJAN PoisonIvy Keepalive to CnC 132 (trojan.rules)
  2810671 - ETPRO TROJAN PoisonIvy Keepalive to CnC 133 (trojan.rules)
  2810679 - ETPRO TROJAN PoisonIvy Keepalive to CnC 134 (trojan.rules)
  2810680 - ETPRO TROJAN PoisonIvy Keepalive to CnC 135 (trojan.rules)
  2810681 - ETPRO TROJAN PoisonIvy Keepalive to CnC 136 (trojan.rules)
  2810682 - ETPRO TROJAN PoisonIvy Keepalive to CnC 137 (trojan.rules)
  2810683 - ETPRO TROJAN PoisonIvy Keepalive to CnC 138 (trojan.rules)
  2810684 - ETPRO TROJAN PoisonIvy Keepalive to CnC 139 (trojan.rules)
  2810723 - ETPRO TROJAN PoisonIvy Keepalive to CnC 140 (trojan.rules)
  2810724 - ETPRO TROJAN PoisonIvy Keepalive to CnC 141 (trojan.rules)
  2810725 - ETPRO TROJAN PoisonIvy Keepalive to CnC 142 (trojan.rules)
  2810744 - ETPRO TROJAN PoisonIvy Keepalive to CnC 143 (trojan.rules)
  2810745 - ETPRO TROJAN PoisonIvy Keepalive to CnC 144 (trojan.rules)
  2810746 - ETPRO TROJAN PoisonIvy Keepalive to CnC 145 (trojan.rules)
  2810747 - ETPRO TROJAN PoisonIvy Keepalive to CnC 146 (trojan.rules)
  2810748 - ETPRO TROJAN PoisonIvy Keepalive to CnC 147 (trojan.rules)
  2810785 - ETPRO TROJAN PoisonIvy Keepalive to CnC 148 (trojan.rules)
  2810786 - ETPRO TROJAN PoisonIvy Keepalive to CnC 149 (trojan.rules)
  2810787 - ETPRO TROJAN PoisonIvy Keepalive to CnC 150 (trojan.rules)
  2810788 - ETPRO TROJAN PoisonIvy Keepalive to CnC 151 (trojan.rules)
  2810789 - ETPRO TROJAN PoisonIvy Keepalive to CnC 152 (trojan.rules)
  2810830 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(flywifi101.1) (trojan.rules)
  2810841 - ETPRO TROJAN PoisonIvy Keepalive to CnC 153 (trojan.rules)
  2810842 - ETPRO TROJAN PoisonIvy Keepalive to CnC 154 (trojan.rules)
  2810885 - ETPRO TROJAN Galaxy Keylogger V3 Reporting Infection Via
SMTP (trojan.rules)
  2810926 - ETPRO TROJAN PoisonIvy Keepalive to CnC 155 (trojan.rules)
  2810927 - ETPRO TROJAN PoisonIvy Keepalive to CnC 156 (trojan.rules)
  2810928 - ETPRO TROJAN PoisonIvy Keepalive to CnC 157 (trojan.rules)
  2810929 - ETPRO TROJAN PoisonIvy Keepalive to CnC 158 (trojan.rules)
  2810931 - ETPRO TROJAN Galaxy Keylogger V3 Reporting Infection Via
SMTP (trojan.rules)
  2810975 - ETPRO TROJAN PoisonIvy Keepalive to CnC 159 (trojan.rules)
  2810976 - ETPRO TROJAN PoisonIvy Keepalive to CnC 160 (trojan.rules)
  2810977 - ETPRO TROJAN PoisonIvy Keepalive to CnC 161 (trojan.rules)
  2810995 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(testko.user) (trojan.rules)
  2811006 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(AkiraKiku.4) (trojan.rules)
  2811033 - ETPRO TROJAN PoisonIvy Keepalive to CnC 162 (trojan.rules)
  2811034 - ETPRO TROJAN DDoS.Win32/Nitol.gen!A Checkin 3 (trojan.rules)
  2811037 - ETPRO TROJAN PowerShell Win32/Filecoder.CS Ransomware
Download (trojan.rules)
  2811101 - ETPRO TROJAN PoisonIvy Keepalive to CnC 163 (trojan.rules)
  2811122 - ETPRO TROJAN Mangzamel.B CnC Beacon (trojan.rules)
  2811174 - ETPRO TROJAN MSIL/Injector.JWA CnC Client Details (trojan.rules)
  2811196 - ETPRO TROJAN Asterope JSON CnC Beacon (trojan.rules)
  2811198 - ETPRO TROJAN PoisonIvy Keepalive to CnC 164 (trojan.rules)
  2811204 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(5008e200) (trojan.rules)
  2811302 - ETPRO TROJAN Knight Logger Sending Logs via SMTP (trojan.rules)
  2811400 - ETPRO TROJAN PoisonIvy Keepalive to CnC 165 (trojan.rules)
  2811401 - ETPRO TROJAN PoisonIvy Keepalive to CnC 166 (trojan.rules)
  2811444 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(4fbdec08) (trojan.rules)
  2811452 - ETPRO TROJAN PoisonIvy Keepalive to CnC 169 (trojan.rules)
  2811453 - ETPRO TROJAN PoisonIvy Keepalive to CnC 170 (trojan.rules)
  2811454 - ETPRO TROJAN PoisonIvy Keepalive to CnC 171 (trojan.rules)
  2811455 - ETPRO TROJAN PoisonIvy Keepalive to CnC 172 (trojan.rules)
  2811458 - ETPRO TROJAN Mikey Clickfraud Response (trojan.rules)
  2811463 - ETPRO TROJAN PoisonIvy Keepalive to CnC 173 (trojan.rules)
  2811464 - ETPRO TROJAN PoisonIvy Keepalive to CnC 174 (trojan.rules)
  2811465 - ETPRO TROJAN PoisonIvy Keepalive to CnC 175 (trojan.rules)
  2811466 - ETPRO TROJAN PoisonIvy Keepalive to CnC 176 (trojan.rules)
  2811485 - ETPRO TROJAN Kazy Variant JSON Checkin 1 (trojan.rules)
  2811486 - ETPRO TROJAN Kazy Variant JSON Checkin 2 (trojan.rules)
  2811494 - ETPRO TROJAN Linux/Jbosser.A Checkin (trojan.rules)
  2811503 - ETPRO TROJAN PoisonIvy Keepalive to CnC 177 (trojan.rules)
  2811504 - ETPRO TROJAN PoisonIvy Keepalive to CnC 178 (trojan.rules)
  2811505 - ETPRO TROJAN PoisonIvy Keepalive to CnC 179 (trojan.rules)
  2811517 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(3faa7401) (trojan.rules)
  2811560 - ETPRO TROJAN PoisonIvy Keepalive to CnC 180 (trojan.rules)
  2811561 - ETPRO TROJAN PoisonIvy Keepalive to CnC 181 (trojan.rules)
  2811562 - ETPRO TROJAN PoisonIvy Keepalive to CnC 182 (trojan.rules)
  2811570 - ETPRO TROJAN PoisonIvy Keepalive to CnC 183 (trojan.rules)
  2811571 - ETPRO TROJAN PoisonIvy Keepalive to CnC 184 (trojan.rules)
  2811572 - ETPRO TROJAN PoisonIvy Keepalive to CnC 185 (trojan.rules)
  2811579 - ETPRO TROJAN Malicious SSL certificate detected
(Meterpreter) (trojan.rules)
  2811635 - ETPRO TROJAN Win32/Ceatrg.A CnC Beacon M1 (trojan.rules)
  2811637 - ETPRO TROJAN Win32/Ceatrg.A CnC Beacon M2 (trojan.rules)
  2811638 - ETPRO TROJAN NanoCore RAT CnC 1 (trojan.rules)
  2811639 - ETPRO TROJAN NanoCore RAT CnC 2 (trojan.rules)
  2811640 - ETPRO TROJAN NanoCore RAT CnC 3 (trojan.rules)
  2811655 - ETPRO TROJAN Possible Adwind/AlienSpy JAR Observed (trojan.rules)
  2811665 - ETPRO TROJAN PoisonIvy Keepalive to CnC 186 (trojan.rules)
  2811666 - ETPRO TROJAN PoisonIvy Keepalive to CnC 187 (trojan.rules)
  2811667 - ETPRO TROJAN PoisonIvy Keepalive to CnC 188 (trojan.rules)
  2811680 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(4e86f006) (trojan.rules)
  2811688 - ETPRO TROJAN Win32/Zegost.DG CnC traffic (OUTBOUND) (trojan.rules)
  2811775 - ETPRO TROJAN PoisonIvy Keepalive to CnC 189 (trojan.rules)
  2811781 - ETPRO TROJAN PoisonIvy Keepalive to CnC 190 (trojan.rules)
  2811782 - ETPRO TROJAN PoisonIvy Keepalive to CnC 191 (trojan.rules)
  2811783 - ETPRO TROJAN PoisonIvy Keepalive to CnC 192 (trojan.rules)
  2811806 - ETPRO TROJAN PoisonIvy Keepalive to CnC 193 (trojan.rules)
  2811836 - ETPRO TROJAN PoisonIvy Keepalive to CnC 194 (trojan.rules)
  2811843 - ETPRO TROJAN NanoCore RAT CnC 4 (trojan.rules)
  2811854 - ETPRO TROJAN PoisonIvy Keepalive to CnC 195 (trojan.rules)
  2811855 - ETPRO TROJAN PoisonIvy Keepalive to CnC 196 (trojan.rules)
  2811886 - ETPRO TROJAN Unknown APT Downloader receiving payload (trojan.rules)
  2811890 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2811891 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2811893 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2811909 - ETPRO TROJAN PoisonIvy Keepalive to CnC 197 (trojan.rules)
  2811910 - ETPRO TROJAN PoisonIvy Keepalive to CnC 197 (trojan.rules)
  2811911 - ETPRO TROJAN PoisonIvy Keepalive to CnC 199 (trojan.rules)
  2811912 - ETPRO TROJAN PoisonIvy Keepalive to CnC 200 (trojan.rules)
  2811913 - ETPRO TROJAN PoisonIvy Keepalive to CnC 201 (trojan.rules)
  2811971 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw.af
Checkin via SMTP (mobile_malware.rules)
  2812014 - ETPRO TROJAN Python/N3Cr0m0rPh IRC Checkin (trojan.rules)
  2812055 - ETPRO TROJAN PoisonIvy Keepalive to CnC 202 (trojan.rules)
  2812056 - ETPRO TROJAN PoisonIvy Keepalive to CnC 203 (trojan.rules)
  2812120 - ETPRO TROJAN PoisonIvy Keepalive to CnC 204 (trojan.rules)
  2812121 - ETPRO TROJAN MSIL/Zaviso.A Checkin via SQL (trojan.rules)
  2812128 - ETPRO TROJAN PoisonIvy Keepalive to CnC 205 (trojan.rules)
  2812156 - ETPRO TROJAN MSIL/Mictanort.A Checkin (trojan.rules)
  2812170 - ETPRO TROJAN MSIL/Nitwil.A FTP wallet.dat Exfil (trojan.rules)
  2812208 - ETPRO TROJAN Asterope CnC Beacon (trojan.rules)
  2812233 - ETPRO TROJAN PoisonIvy Keepalive to CnC 206 (trojan.rules)
  2812253 - ETPRO TROJAN Backdoor.Korplug Checkin (UDP) 3 (trojan.rules)
  2812285 - ETPRO TROJAN Backdoor.Win32.Agent.dokr CnC Beacon M1 (trojan.rules)
  2812286 - ETPRO TROJAN Backdoor.Win32.Agent.dokr CnC Beacon M2 (trojan.rules)
  2812314 - ETPRO TROJAN FF-RAT CnC Beacon (trojan.rules)
  2812379 - ETPRO TROJAN PoisonIvy Keepalive to CnC 207 (trojan.rules)
  2812389 - ETPRO TROJAN Possible Dridex Open Command in Pastebin
Title (trojan.rules)
  2812390 - ETPRO TROJAN Possible Dridex Exe Command in Pastebin Title
(trojan.rules)
  2812392 - ETPRO TROJAN Win32/VBS.Lnkget.D Checkin (trojan.rules)
  2812420 - ETPRO TROJAN Beaugrit/Zegost CnC Beacon 2 (trojan.rules)
  2812421 - ETPRO TROJAN Beaugrit/Zegost CnC Beacon 3 (trojan.rules)
  2812422 - ETPRO TROJAN Beaugrit/Zegost CnC Beacon 4 (trojan.rules)
  2812423 - ETPRO TROJAN Beaugrit/Zegost CnC Beacon 5 (trojan.rules)
  2812424 - ETPRO TROJAN Beaugrit/Zegost CnC Beacon 6 (trojan.rules)
  2812442 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2812445 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2812446 - ETPRO TROJAN Win32/Beaugrit.gen!AAA Checkin (trojan.rules)
  2812451 - ETPRO TROJAN Possibly Targeted Win32/Senta!rfn Downloading
Binary (trojan.rules)
  2812454 - ETPRO TROJAN Rector/Criakl Ransomware CnC Server Fail
Response (trojan.rules)
  2812499 - ETPRO TROJAN PoisonIvy Keepalive to CnC 208 (trojan.rules)
  2812519 - ETPRO TROJAN Vaultlock/BitCryptor CnC Status Update (trojan.rules)
  2812520 - ETPRO TROJAN PoisonIvy Keepalive to CnC 209 (trojan.rules)
  2812602 - ETPRO TROJAN Win32/Genasom.FO Sending Ransom Details (trojan.rules)
  2812648 - ETPRO TROJAN PoisonIvy Keepalive to CnC 210 (trojan.rules)
  2812649 - ETPRO TROJAN PoisonIvy Keepalive to CnC 211 (trojan.rules)
  2812772 - ETPRO TROJAN PoisonIvy Keepalive to CnC 212 (trojan.rules)
  2812773 - ETPRO TROJAN Win32/Aibatook CnC Beacon Response (trojan.rules)
  2812800 - ETPRO TROJAN PoisonIvy Keepalive to CnC 213 (trojan.rules)
  2812816 - ETPRO TROJAN Backdoor.Telnneru CnC Beacon (INBOUND) 1 (trojan.rules)
  2812817 - ETPRO TROJAN Backdoor.Telnneru CnC Beacon (INBOUND) 2 (trojan.rules)
  2812838 - ETPRO TROJAN PlugX Using C2 of Last Resort HTTP Response
(trojan.rules)
  2812857 - ETPRO TROJAN Unknown Powershell CnC Channel TXT Response
(trojan.rules)
  2812889 - ETPRO MOBILE_MALWARE Backdoor.AndroidOS.Xbot.af Checkin
(mobile_malware.rules)
  2812923 - ETPRO TROJAN PoisonIvy Keepalive to CnC 214 (trojan.rules)
  2812924 - ETPRO TROJAN PoisonIvy Keepalive to CnC 215 (trojan.rules)
  2812925 - ETPRO TROJAN PoisonIvy Keepalive to CnC 216 (trojan.rules)
  2812937 - ETPRO TROJAN PoisonIvy Keepalive to CnC 217 (trojan.rules)
  2812945 - ETPRO TROJAN PoisonIvy Keepalive to CnC 218 (trojan.rules)
  2812972 - ETPRO TROJAN PoisonIvy Keepalive to CnC 219 (trojan.rules)
  2812981 - ETPRO TROJAN Win32/Skeeyah Checkin 3 (trojan.rules)
  2812987 - ETPRO TROJAN PoisonIvy Keepalive to CnC 220 (trojan.rules)
  2812988 - ETPRO TROJAN PoisonIvy Keepalive to CnC 221 (trojan.rules)
  2813038 - ETPRO TROJAN Hawkeye Keylogger Sending Software Keys (trojan.rules)
  2813039 - ETPRO TROJAN Hawkeye Keylogger Sending Web Account Data
(trojan.rules)
  2813040 - ETPRO TROJAN Hawkeye Keylogger Sending Email Account Data
(trojan.rules)
  2813062 - ETPRO TROJAN W32/Agent.NESQNX!tr SQL CnC (trojan.rules)
  2813078 - ETPRO TROJAN PoisonIvy Keepalive to CnC 222 (trojan.rules)
  2813079 - ETPRO TROJAN PoisonIvy Keepalive to CnC 223 (trojan.rules)
  2814056 - ETPRO TROJAN W32/njRAT Variant CnC (rar command) (trojan.rules)
  2814063 - ETPRO TROJAN PoisonIvy Keepalive to CnC 224 (trojan.rules)
  2814064 - ETPRO TROJAN PoisonIvy Keepalive to CnC 225 (trojan.rules)
  2814092 - ETPRO TROJAN PoisonIvy Keepalive to CnC 226 (trojan.rules)
  2814107 - ETPRO TROJAN AutoClicker Test Page (trojan.rules)
  2814122 - ETPRO TROJAN PoisonIvy Keepalive to CnC 227 (trojan.rules)
  2814123 - ETPRO TROJAN PoisonIvy Keepalive to CnC 228 (trojan.rules)
  2814130 - ETPRO TROJAN Unknown.SMTP.Stealer (trojan.rules)
  2814147 - ETPRO TROJAN PoisonIvy Keepalive to CnC 229 (trojan.rules)
  2814148 - ETPRO TROJAN PoisonIvy Keepalive to CnC 230 (trojan.rules)
  2814227 - ETPRO TROJAN PoisonIvy Keepalive to CnC 231 (trojan.rules)
  2814228 - ETPRO TROJAN PoisonIvy Keepalive to CnC 232 (trojan.rules)
  2814258 - ETPRO TROJAN PoisonIvy Keepalive to CnC 233 (trojan.rules)
  2814265 - ETPRO TROJAN PoisonIvy Keepalive to CnC 234 (trojan.rules)
  2814271 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmsThief.de
Response (mobile_malware.rules)
  2814390 - ETPRO TROJAN PoisonIvy Keepalive to CnC 235 (trojan.rules)
  2814391 - ETPRO TROJAN PoisonIvy Keepalive to CnC 236 (trojan.rules)
  2814392 - ETPRO TROJAN PoisonIvy Keepalive to CnC 237 (trojan.rules)
  2814393 - ETPRO TROJAN PoisonIvy Keepalive to CnC 238 (trojan.rules)
  2814412 - ETPRO TROJAN PoisonIvy Keepalive to CnC 239 (trojan.rules)
  2814413 - ETPRO TROJAN PoisonIvy Keepalive to CnC 240 (trojan.rules)
  2814414 - ETPRO TROJAN PoisonIvy Keepalive to CnC 241 (trojan.rules)
  2814481 - ETPRO TROJAN Njogv/Joggver Backdoor CnC Beacon (trojan.rules)
  2814483 - ETPRO TROJAN PoisonIvy Keepalive to CnC 242 (trojan.rules)
  2814497 - ETPRO TROJAN PoisonIvy Keepalive to CnC 243 (trojan.rules)
  2814498 - ETPRO TROJAN PoisonIvy Keepalive to CnC 244 (trojan.rules)
  2814503 - ETPRO TROJAN Observed Known Malicious Ethereum Traffic
(trojan.rules)
  2814545 - ETPRO TROJAN PoisonIvy Keepalive to CnC 245 (trojan.rules)
  2814610 - ETPRO TROJAN PoisonIvy Keepalive to CnC 246 (trojan.rules)
  2814637 - ETPRO TROJAN PoisonIvy Keepalive to CnC 247 (trojan.rules)
  2814651 - ETPRO MOBILE_MALWARE Android/TrojanDropper.Agent.CT
Checkin 2 (mobile_malware.rules)
  2814660 - ETPRO TROJAN PoisonIvy Keepalive to CnC Related To APT
(trojan.rules)
  2814664 - ETPRO TROJAN PoisonIvy Keepalive CnC Related To APT (trojan.rules)
  2814668 - ETPRO TROJAN Malicious SSL certificate detected
(Meterpreter) (trojan.rules)
  2814703 - ETPRO TROJAN CoinMiner Known malicious stratum authline
(2015-11-02 1) (trojan.rules)
  2814719 - ETPRO TROJAN Win32.BotShop Checkin Via IRC (trojan.rules)
  2814733 - ETPRO TROJAN PoisonIvy Keepalive to CnC 248 (trojan.rules)
  2814738 - ETPRO TROJAN PoisonIvy Keepalive to CnC 249 (trojan.rules)
  2814768 - ETPRO TROJAN PoisonIvy Keepalive to CnC 250 (trojan.rules)
  2814817 - ETPRO TROJAN PoisonIvy Keepalive to CnC 251 (trojan.rules)
  2814852 - ETPRO TROJAN PoisonIvy Keepalive to CnC 252 (trojan.rules)
  2814976 - ETPRO TROJAN Derusbi Server Receiving Password Init (trojan.rules)
  2814980 - ETPRO TROJAN PoisonIvy Keepalive to CnC 253 (trojan.rules)
  2815048 - ETPRO TROJAN Win32/Spy.Banker.ABMV CnC Response (trojan.rules)
  2815059 - ETPRO TROJAN Trojan.Win32.Swrort.A Checkin Response 2 (trojan.rules)
  2815063 - ETPRO TROJAN Win32/Kitkiot.A CnC Inbound (trojan.rules)
  2815064 - ETPRO TROJAN Win32/Kitkiot.A CnC Outbound (trojan.rules)
  2815093 - ETPRO TROJAN Malicious SWF Receiving Encoded Exploit SWF
(trojan.rules)
  2815101 - ETPRO TROJAN Win32/Spy.Autoit.BV Checkin (trojan.rules)
  2815128 - ETPRO TROJAN Win32/TheBot CnC Checkin (trojan.rules)
  2815159 - ETPRO TROJAN Win32/Qbot CnC (trojan.rules)
  2815225 - ETPRO TROJAN Generic VBScript HeapSpray Construct (trojan.rules)
  2815251 - ETPRO TROJAN Unknown/njRAT Variant CnC Checkin (trojan.rules)
  2815342 - ETPRO TROJAN PoisonIvy Keepalive to CnC 254 (trojan.rules)
  2815343 - ETPRO TROJAN PoisonIvy Keepalive to CnC 255 (trojan.rules)
  2815344 - ETPRO TROJAN PoisonIvy Keepalive to CnC 256 (trojan.rules)
  2815345 - ETPRO TROJAN PoisonIvy Keepalive to CnC 257 (trojan.rules)
  2815346 - ETPRO TROJAN PoisonIvy Keepalive to CnC 258 (trojan.rules)
  2815347 - ETPRO TROJAN PoisonIvy Keepalive to CnC 259 (trojan.rules)
  2815348 - ETPRO TROJAN PoisonIvy Keepalive to CnC 260 (trojan.rules)
  2815349 - ETPRO TROJAN PoisonIvy Keepalive to CnC 261 (trojan.rules)
  2815390 - ETPRO TROJAN AlphaCrypt Payment Page (trojan.rules)
  2815405 - ETPRO TROJAN Backdoor.Beendoor Connecting to XMPP Channel
(trojan.rules)
  2815424 - ETPRO TROJAN PoisonIvy Keepalive to CnC 262 (trojan.rules)
  2815445 - ETPRO TROJAN PoisonIvy Keepalive to CnC 263 (trojan.rules)
  2815458 - ETPRO MOBILE_MALWARE Android/Spy.Agent.RN SSL CnC Cert
(mobile_malware.rules)
  2815461 - ETPRO TROJAN PoisonIvy Keepalive to CnC 264 (trojan.rules)
  2815490 - ETPRO TROJAN PoisonIvy Keepalive to CnC 265 (trojan.rules)
  2815519 - ETPRO TROJAN PoisonIvy Keepalive to CnC 266 (trojan.rules)
  2815564 - ETPRO TROJAN Win32/Agent.RNW CnC Beacon Response (trojan.rules)
  2815579 - ETPRO TROJAN Possible NanoLocker Connectivity Check (trojan.rules)
  2815582 - ETPRO TROJAN MoBi RAT CnC Checkin 2 (trojan.rules)
  2815584 - ETPRO TROJAN MoBi RAT CnC Checkin (trojan.rules)
  2815585 - ETPRO TROJAN Win32.Cl0wnbot Checkin (trojan.rules)
  2815593 - ETPRO TROJAN Win32.Rifdoor Checkin (trojan.rules)
  2815694 - ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Keepalive
Response (trojan.rules)
  2815695 - ETPRO TROJAN Win32.FrauDrop.akljo Backdoor Keepalive (trojan.rules)
  2815732 - ETPRO TROJAN Backdoor.Conpee Checkin (trojan.rules)
  2815739 - ETPRO TROJAN PoisonIvy Keepalive to CnC 267 (trojan.rules)
  2815740 - ETPRO TROJAN PoisonIvy Keepalive to CnC 268 (trojan.rules)
  2815741 - ETPRO TROJAN PoisonIvy Keepalive to CnC 269 (trojan.rules)
  2815742 - ETPRO TROJAN PoisonIvy Keepalive to CnC 270 (trojan.rules)
  2815743 - ETPRO TROJAN PoisonIvy Keepalive to CnC 271 (trojan.rules)
  2815744 - ETPRO TROJAN PoisonIvy Keepalive to CnC 272 (trojan.rules)
  2815745 - ETPRO TROJAN PoisonIvy Keepalive to CnC 273 (trojan.rules)
  2815746 - ETPRO TROJAN PoisonIvy Keepalive to CnC 274 (trojan.rules)
  2815747 - ETPRO TROJAN PoisonIvy Keepalive to CnC 275 (trojan.rules)
  2815789 - ETPRO TROJAN Duuzer Cnc Beacon (trojan.rules)
  2815790 - ETPRO TROJAN PoisonIvy Keepalive to CnC 276 (trojan.rules)
  2815841 - ETPRO TROJAN VirdetDoor CnC Beacon 1 (trojan.rules)
  2815842 - ETPRO TROJAN VirdetDoor CnC Beacon 2 (trojan.rules)

[---]         Removed rules:         [---]

  2021092 - ET CURRENT_EVENTS Download file with BITS via LNK file
(Likely Malicious) (current_events.rules)

Date:
Summary title:
6 new OPEN, 28 new PRO (6 + 22). Geocon, Remcos, AsyncRAT, Various Phish, Various Edits.