[***] Summary: [***]

12 new OPEN, 21 new PRO (12 + 9). Multiple Cobalt Strike,
Gamaredon/Armageddon and W32/Startun.

Thanks @BlackLotusLabs, @malwrhunterteam, @MBThreatIntel and @ServiceSsu

Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

[+++] Added rules: [+++]

Open:

2034343 - ET TROJAN W32/Pterodo.CL CnC Checkin (trojan.rules)
2034344 - ET TROJAN Win32/Pterodo.NG Checkin 2 (trojan.rules)
2034345 - ET TROJAN W32/Pterodo CnC Checkin (trojan.rules)
2034346 - ET TROJAN Cobalt STrike Activity (GET) (trojan.rules)
2034347 - ET TROJAN Cobalt Strike Activity (GET) (trojan.rules)
2034348 - ET TROJAN SolarMarker Backdoor Related Domain in DNS
Lookup (noelfpar .com) (trojan.rules)
2034349 - ET MOBILE_MALWARE Gamaredon/Armageddon Related Domain in
DNS Lookup (google-play .serveftp .com) (mobile_malware.rules)
2034350 - ET TROJAN Gamaredon/Armageddon Related Domain in DNS
Lookup (bitsadmin .ddns .net) (trojan.rules)
2034351 - ET TROJAN Gamaredon/Armageddon Related Domain in DNS
Lookup (list-sert .ddns .net) (trojan.rules)
2034352 - ET TROJAN Gamaredon/Armageddon CnC Activity (Sending
Windows System Information) (trojan.rules)
2034353 - ET TROJAN Gamaredon/Armageddon Activity (Retrieving Remote
.dot) (trojan.rules)
2034354 - ET EXPLOIT Vanguard v2.1 (Search) POST Inject Web
Vulnerability (exploit.rules)

Pro:

2850369 - ETPRO TROJAN Observed Cobalt Strike Domain in TLS SNI (trojan.rules)
2850372 - ETPRO TROJAN Cobalt Strike Activity (GET) (trojan.rules)
2850373 - ETPRO TROJAN W32/Startun CnC Activity Insert Command (trojan.rules)
2850374 - ETPRO TROJAN W32/Startun CnC Activity General Set Command
(trojan.rules)
2850375 - ETPRO TROJAN W32/Startun CnC Activity (trojan.rules)
2850376 - ETPRO TROJAN W32/Startun CnC Activity Set Online Status
and Get Date Commands (trojan.rules)
2850377 - ETPRO TROJAN Cobalt Strike Activity (GET) (trojan.rules)
2850378 - ETPRO TROJAN Cobalt Strike Activity (GET) (trojan.rules)
2850379 - ETPRO TROJAN Observed Cobalt Strike Domain in TLS SNI (trojan.rules)

[///] Modified active rules: [///]

2849219 - ETPRO TROJAN PCShare RAT Heartbeat from CnC (trojan.rules)
2850316 - ETPRO MALWARE Observed SmokeLoader CnC Activity (malware.rules)

[---] Removed rules: [---]

2830574 - ETPRO TROJAN W32/Pterodo.CL CnC Checkin (trojan.rules)
2835637 - ETPRO TROJAN Win32/Pterodo.NG Checkin 2 (trojan.rules)
2838292 - ETPRO TROJAN W32/Pterodo CnC Checkin (trojan.rules)