# PennyWise Stealer - Update on rules

**URL:** <https://community.emergingthreats.net/t/pennywise-stealer-update-on-rules/812>\
**Category:** Rule Signatures\
**Created:** [July 28, 2023, 8:52am UTC](https://community.emergingthreats.net/t/pennywise-stealer-update-on-rules/812 "2023-07-28T08:52:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![g0njxa](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/g0njxa/32/364_2.png) [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\
**Post date:** [July 28, 2023, 8:52am UTC](https://community.emergingthreats.net/t/pennywise-stealer-update-on-rules/812/1 "2023-07-28T08:52:06Z")

</div>

Pennywise stealer is still being used actively on YouTube malware campaigns but i cant find any ET rule detection although im aware some rules were written in the past. Maybe an update is needed to these new variants.

Some new & recent detonations

> **[Analysis https://www.mediafire.com/file/z0b1lp1cr4q6b6x/EMPRESS.rar/file...](https://app.any.run/tasks/b208777e-455b-4267-ace7-91db58305f0c/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

> **[Analysis https://fromsmash.com/oTzFcSUb8a-ct Malicious activity - Interactive...](https://app.any.run/tasks/1adf2a4d-3bce-4a12-a7c8-19afa65a7391/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

> **[Analysis https://tinyurl.com/yx62te6r Malicious activity - Interactive...](https://app.any.run/tasks/8d903f93-3e60-4145-8918-3f378b0fcbb6/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Actually only some generic Outbound POST Request rules are being pushed

Thanks!

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [July 28, 2023, 3:08pm UTC](https://community.emergingthreats.net/t/pennywise-stealer-update-on-rules/812/2 "2023-07-28T15:08:55Z")

</div>

hey @g0njxa, I’ll take a look at these today and let you know what I find 👍

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [July 28, 2023, 10:14pm UTC](https://community.emergingthreats.net/t/pennywise-stealer-update-on-rules/812/3 "2023-07-28T22:14:15Z")

</div>

`2046957 - ET MALWARE PennyWise Stealer Data Exfil M4`

Have a great weekend!