MALWARE-C2 CryptBot HTTP Connection

Rule ID

1232644

Severity

High

Description

CryptBot is a typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data archived and uploaded to the C2 server.

Impact

Information disclosure

Recommendation

Update vendor's patch.

IPS Category

Malware traffic

IPS Anomaly Group

N/A

IPS Rule Default Action

Deny

References

Keywords

N/A