# Inconsistency between the rules 2049660 & 2049661 and the family

**URL:** https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219
**Category:** Rule Signatures
**Created:** [December 19, 2023, 5:20pm UTC](https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219 "2023-12-19T17:20:26Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)
#### Post date: [December 19, 2023, 5:20pm UTC](https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219/1 "2023-12-19T17:20:26Z")

</div>

Hi, there seems to be a little confusion with signatures 2049660 & 2049661, the fact is that it was written in RisePro because the magic and the encrypted bytes 0x36 match its traffic.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/05d95a7843d59a01824b062af43b7bf1b82962a9.jpeg)

> **[Analysis d5c0d9e9b7ab82909616db51853f52fb.exe (MD5:...](https://app.any.run/tasks/57c1a359-db52-4ec7-9302-46ed30301da3/#)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Best regards, Jane ˶ᵔ ᵕ ᵔ˶

---

_[View the full topic](https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219)._