ET MALWARE NanoLocker Check-in (ICMP) M1

Query · suricata

itype:8;
icode:0;
dsize:26<>35;
content:"|31|"; depth:1;
pcre:"/^(?=[A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(?:64)?$/R";
Raw source ET MALWARE NanoLocker Check-in (ICMP) M1 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert icmp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE NanoLocker Check-in (ICMP) M1";
    itype:8;
    icode:0;
    dsize:26<>35;
    content:"|31|"; depth:1;
    pcre:"/^(?=[A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(?:64)?$/R";
    reference:md5,24273ce5ca8e84c52b270b52659304a8;
    reference:url,blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/;
    classtype:trojan-activity;
    sid:2022331; rev:3;
    metadata:created_at 2016_01_05, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.