Forest Global Training Partners

Cyber Risks · Cisco Talos

Some Snort discussion about Murofet, Kazy, or whatever we're calling it..

Summary: Cisco Talos analyzed a malware family it calls Murofet, noting vendors use different names for samples with similar characteristics, and described its network behavior: a connectivity check, a flood of DNS lookups for .eu domains, outbound SYN packets to port 22292, and an HTTP/1.0 request with a distinctive URI to a host in China and no Referer. Talos released Snort rules for the DNS flood (sid 21544) and the outbound HTTP connection (sid 21440, in customers' hands since February 27), and declined to write a rule for the port 22292 traffic because changing the port easily evades it.

What you should know: The malware's DNS behavior is noisy enough to catch with a threshold rule, but Talos skipped the port 22292 traffic precisely because a single port change defeats it - so coverage built on easily altered indicators leaves the quieter HTTP request as the more durable detection point.

Read the original at Cisco Talos ↗

Topics
Malware
Related