# Ruleset Update Summary - 2025/04/01 - v10895 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2025-04-01-v10895/2585 **Category:** Ruleset Updates **Created:** [April 1, 2025, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-04-01-v10895/2585 "2025-04-01T20:52:35Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [April 1, 2025, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-04-01-v10895/2585/1 "2025-04-01T20:52:35Z")
## Summary: 16 new OPEN, 18 new PRO (16 + 2) * * * ## Added rules: ### Open: - 2061230 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (pa-portal .premierhomeviews .com) (malware.rules) - 2061231 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (pa-portal .premierhomeviews .com) (malware.rules) - 2061232 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (movtime78 .shop) (exploit\_kit.rules) - 2061233 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (machine-a-plastifier .com) (exploit\_kit.rules) - 2061234 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (movtime78 .shop) (exploit\_kit.rules) - 2061235 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (machine-a-plastifier .com) (exploit\_kit.rules) - 2061236 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ailmentr .run) (malware.rules) - 2061237 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ailmentr .run) in TLS SNI (malware.rules) - 2061238 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deflamep .live) (malware.rules) - 2061239 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (deflamep .live) in TLS SNI (malware.rules) - 2061240 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ferrofyg .run) (malware.rules) - 2061241 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ferrofyg .run) in TLS SNI (malware.rules) - 2061242 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (oreironx .live) (malware.rules) - 2061243 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (oreironx .live) in TLS SNI (malware.rules) - 2061244 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (weldarob .live) (malware.rules) - 2061245 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (weldarob .live) in TLS SNI (malware.rules) ### Pro: - 2861022 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2861023 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)