# Ruleset Update Summary - 2024/08/01 - v10658 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 1, 2024, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-01-v10658/1864 "2024-08-01T20:49:08Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 1, 2024, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-08-01-v10658/1864/1 "2024-08-01T20:49:08Z")
## Summary: 38 new OPEN, 51 new PRO (38 + 13) Thanks @kaspersky, @Fortinet ET/ETPRO Customers: Please be aware that tomorrow, August 2nd, is a Proofpoint company holiday. As such, we will not be publishing a daily rule release. Daily rule releases will continue the following Monday, August 5th. * * * ## Added rules: ### Open: - 2054813 - ET INFO DYNAMIC\_DNS Query to a \* .bal-tazaar .be Domain (info.rules) - 2054814 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus .ru) (mobile\_malware.rules) - 2054815 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (toxicodendron .ru) (mobile\_malware.rules) - 2054816 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-ca .ru) (mobile\_malware.rules) - 2054817 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus .su) (mobile\_malware.rules) - 2054818 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-cc .ru) (mobile\_malware.rules) - 2054819 - ET MOBILE\_MALWARE Android/Mandrake CnC Domain in DNS Lookup (ricinus-cb .ru) (mobile\_malware.rules) - 2054820 - ET INFO DYNAMIC\_DNS Query to a \* .avtosnoj .si Domain (info.rules) - 2054821 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .avtosnoj .si Domain (info.rules) - 2054822 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (ricinus .ru) in TLS SNI (mobile\_malware.rules) - 2054823 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (toxicodendron .ru) in TLS SNI (mobile\_malware.rules) - 2054824 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (ricinus-ca .ru) in TLS SNI (mobile\_malware.rules) - 2054825 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (ricinus .su) in TLS SNI (mobile\_malware.rules) - 2054826 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (ricinus-cc .ru) in TLS SNI (mobile\_malware.rules) - 2054827 - ET MOBILE\_MALWARE Observed Android/Mandrake CnC Domain (ricinus-cb .ru) in TLS SNI (mobile\_malware.rules) - 2054828 - ET MALWARE APT SideWinder CnC Domain in DNS Lookup (malware.rules) - 2054829 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pddbj .xyz) (malware.rules) - 2054830 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pcvcf .xyz) (malware.rules) - 2054831 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (ptdrf .xyz) (malware.rules) - 2054832 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pbpbj .xyz) (malware.rules) - 2054833 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pdddj .xyz) (malware.rules) - 2054834 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pqdrf .xyz) (malware.rules) - 2054835 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pdddk .xyz) (malware.rules) - 2054836 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pcvvf .xyz) (malware.rules) - 2054837 - ET MALWARE ACR Stealer CnC Domain in DNS Lookup (pbdbj .xyz) (malware.rules) - 2054838 - ET MALWARE Observed ACR Stealer Domain (pddbj .xyz) in TLS SNI (malware.rules) - 2054839 - ET MALWARE Observed ACR Stealer Domain (pcvcf .xyz) in TLS SNI (malware.rules) - 2054840 - ET MALWARE Observed ACR Stealer Domain (ptdrf .xyz) in TLS SNI (malware.rules) - 2054841 - ET MALWARE Observed ACR Stealer Domain (pbpbj .xyz) in TLS SNI (malware.rules) - 2054842 - ET MALWARE Observed ACR Stealer Domain (pdddj .xyz) in TLS SNI (malware.rules) - 2054843 - ET MALWARE Observed ACR Stealer Domain (pqdrf .xyz) in TLS SNI (malware.rules) - 2054844 - ET MALWARE Observed ACR Stealer Domain (pdddk .xyz) in TLS SNI (malware.rules) - 2054845 - ET MALWARE Observed ACR Stealer Domain (pcvvf .xyz) in TLS SNI (malware.rules) - 2054846 - ET MALWARE Observed ACR Stealer Domain (pbdbj .xyz) in TLS SNI (malware.rules) - 2054847 - ET MALWARE Unknown Loader CnC Domain in DNS Lookup (scratchedcards .com) (malware.rules) - 2054848 - ET MALWARE Unknown Loader CnC Domain in DNS Lookup (21centuryart .com) (malware.rules) - 2054849 - ET MALWARE Unknown Loader CnC Domain in DNS Lookup (proffyrobharborye .xyz) (malware.rules) - 2054850 - ET MALWARE Unknown Loader CnC Domain in DNS Lookup (answerrsdo .shop) (malware.rules) ### Pro: - 2857740 - ETPRO EXPLOIT\_KIT Notification Scam Domain in DNS Lookup (exploit\_kit.rules) - 2857741 - ETPRO EXPLOIT\_KIT Notification Scam Domain in TLS SNI (exploit\_kit.rules) - 2857742 - ETPRO EXPLOIT\_KIT Notification Scam Landing Page (exploit\_kit.rules) - 2857743 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2857744 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2857745 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2857746 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2857747 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2857748 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2857749 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2857750 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2857751 - ETPRO MALWARE SynthIndi Loader Exfiltration Activity (POST) (malware.rules) - 2857752 - ETPRO MALWARE SynthIndi Loader CnC Response (malware.rules) * * * ## Removed rules: - 2054751 - ET INFO DYNAMIC\_DNS Query to a \* .bal-tazaar .be Domain (info.rules)