# Copyright 2001-2019 Sourcefire, Inc. All Rights Reserved. # # This file contains (i) proprietary rules that were created, tested and certified by # Sourcefire, Inc. (the "VRT Certified Rules") that are distributed under the VRT # Certified Rules License Agreement (v 2.0), and (ii) rules that were created by # Sourcefire and other third parties (the "GPL Rules") that are distributed under the # GNU General Public License (GPL), v2. # # The VRT Certified Rules are owned by Sourcefire, Inc. The GPL Rules were created # by Sourcefire and other third parties. The GPL Rules created by Sourcefire are # owned by Sourcefire, Inc., and the GPL Rules not created by Sourcefire are owned by # their respective creators. Please see http://www.snort.org/snort/snort-team/ for a # list of third party owners and their respective copyrights. # # In order to determine what rules are VRT Certified Rules or GPL Rules, please refer # to the VRT Certified Rules License Agreement (v2.0). # #--------------------- # MALWARE-OTHER RULES #--------------------- # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER known malicious email string - You have received a Hallmark E-Card"; flow:to_server,established; content:"Subject|3A| You have received a Hallmark E-Card!"; nocase; content:!"href=|22|http|3A|//www.hallmark.com/"; distance:0; metadata:service smtp; reference:url,www.virustotal.com/#/file/925a4a25cfa562a0330c8733cc697021/detection; reference:url,www.virustotal.com/en/file/bd1cfd7b15f70d131d8f3f013a4e6afb0807791b898d96d3cc2b57de576acf1f/analysis/; classtype:misc-activity; sid:19595; rev:9;) alert tcp $EXTERNAL_NET 21 -> $HOME_NET any (msg:"MALWARE-OTHER known malicious FTP login banner - 0wns j0"; flow:established,to_client; content:"220|20|"; depth:4; content:"0wns j0"; distance:0; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp; reference:url,seclists.org/fulldisclosure/2004/Sep/895; reference:url,www.cyber-ta.org/releases/malware-analysis/public/SOURCES/CLUSTERS-NEW/behavior-summary.html; classtype:trojan-activity; sid:21255; rev:5;) alert tcp $EXTERNAL_NET 21 -> $HOME_NET any (msg:"MALWARE-OTHER known malicious FTP quit banner - Goodbye happy r00ting"; flow:established,to_client; content:"221 Goodbye happy r00ting"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp; reference:url,taosecurity.blogspot.com/2006/01/nepenthes-discoveries-earlier-today-i.html; classtype:trojan-activity; sid:21256; rev:6;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER connection to malware sinkhole"; flow:to_client,established; content:"malware-sinkhole|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,en.wikipedia.org/wiki/Sinkhole_Server; classtype:trojan-activity; sid:25018; rev:5;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER connection to malware sinkhole"; flow:to_client,established; content:"X-Sinkhole|3A| Malware"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,en.wikipedia.org/wiki/Sinkhole_Server; classtype:trojan-activity; sid:30320; rev:4;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER connection to malware sinkhole"; flow:to_client,established; dsize:22; content:"Sinkholed by abuse.ch|0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,en.wikipedia.org/wiki/Sinkhole_Server; classtype:trojan-activity; sid:33306; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER VBScript potential executable write attempt"; flow:to_client,established; file_data; content:"VBScript"; nocase; content:"4D5A"; content:"50450000"; distance:0; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ecfb852662d8127673332939f8b062645797e91bce6acae0615e24334a3df2ad/analysis/; classtype:trojan-activity; sid:28054; rev:6;) alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-OTHER DirtJumper denial of service attack traffic"; flow:to_server,established; content:"login="; nocase; http_client_body; content:"&passwrd="; within:9; distance:2121; nocase; http_client_body; content:"&vb_login_md5password="; within:22; distance:235; nocase; http_client_body; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:attempted-dos; sid:27115; rev:2;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Clickserver ad harvesting redirection attempt"; flow:to_server,established; content:"/?q="; http_uri; content:"##1"; fast_pattern:only; http_uri; pcre:"/^\/\?q=[^&]*##1$/U"; metadata:policy balanced-ips alert, policy security-ips drop, service http; classtype:misc-activity; sid:26934; rev:4;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Clickserver ad harvesting redirection attempt"; flow:to_server,established; urilen:8; content:"/?id=##1"; fast_pattern:only; http_uri; metadata:policy balanced-ips alert, policy security-ips drop, service http; classtype:misc-activity; sid:26933; rev:3;) alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"MALWARE-OTHER Win.Trojan.Kazy download attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"CLSID = s '{D4D8E7EF-EB95-405E-A9F2-886DBB4168F4}'"; fast_pattern:only; content:"ForceRemove {D4D8E7EF-EB95-405E-A9F2-886DBB4168F4} = s 'Norm Class'"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/787b20ee10650cc3bd0df34f210000e771e7d5d1d902ffbbd9f6786c46fd5e0b/analysis/; classtype:trojan-activity; sid:26921; rev:1;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTML.Dropper.Agent uri scheme detected"; flow:to_server,established; content:"/recurrence=always"; fast_pattern:only; http_uri; content:"adid="; nocase; http_uri; content:"loadfirst="; nocase; http_uri; content:"event_type="; nocase; http_uri; content:"signature="; nocase; http_uri; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/105646b598cc60695243b89a49ba24814f83a93545e380be235573a0b95abd83/analysis/; classtype:trojan-activity; sid:26881; rev:2;) alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-OTHER DNS data exfiltration attempt"; flow:to_server; content:"|00 00 00|"; offset:2; content:"|01|"; within:1; content:"|3A|"; within:1; distance:6; content:"|2D 2D 2D|"; within:3; distance:30; fast_pattern; content:"|3A|"; within:1; distance:25; content:"|01|"; within:1; distance:58; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,attack.mitre.org/techniques/T1020; classtype:policy-violation; sid:26803; rev:5;) # alert tcp $HOME_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER WIN.Worm.Beagle.AZ SMTP propagation detection"; flow:to_server,established; flowbits:isset,file.exe; content:"yuuvelntbgfkbkjhhkgjgvkvkggtkbbjbg"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2005-012714-0030-99&tabid=2; reference:url,www.virustotal.com/en/file/bd820efb2a5befb776bde2e47a7fb5ad98d191b04438a4c0b11289bd5d8abb50/analysis/; classtype:trojan-activity; sid:26802; rev:1;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER ANDR.Trojan.ZertSecurity encrypted information leak"; flow:to_server,established; content:"/sms/d_m009.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.lookout.com/blog/2013/05/06/zertsecurity; classtype:trojan-activity; sid:26796; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Kazy download attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"CLSID = s '{D4D8E7EF-EB95-405E-A9F2-886DBB4168F4}'"; fast_pattern:only; content:"ForceRemove {D4D8E7EF-EB95-405E-A9F2-886DBB4168F4} = s 'Norm Class'"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/787b20ee10650cc3bd0df34f210000e771e7d5d1d902ffbbd9f6786c46fd5e0b/analysis/; classtype:trojan-activity; sid:26778; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Compromised Website response - leads to Exploit Kit"; flow:to_client,established; file_data; content:""; content:""; distance:0; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.jsunpack.jeek.org/?report=c94ca7cda909cf93ae95db22a27bb5d711c2ae8f; classtype:trojan-activity; sid:26698; rev:1;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER OSX.Trojan.KitM file download"; flow:to_server,established; flowbits:isset,file.universalbinary; file_data; content:"N37CXSRXLD"; fast_pattern:only; content:"Developer ID Application: Rajinder Kumar"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.f-secure.com/weblog/archives/00002554.html; reference:url,www.virustotal.com/en/file/6acd92d0dfe3e298d73b78a3dcc6d52ff4f85a70a9f2d0dcfe7ae4af2dd685cc/analysis/; classtype:trojan-activity; sid:26671; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.KitM file download"; flow:to_client,established; flowbits:isset,file.universalbinary; file_data; content:"N37CXSRXLD"; fast_pattern:only; content:"Developer ID Application: Rajinder Kumar"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.f-secure.com/weblog/archives/00002554.html; reference:url,www.virustotal.com/en/file/6acd92d0dfe3e298d73b78a3dcc6d52ff4f85a70a9f2d0dcfe7ae4af2dd685cc/analysis/; classtype:trojan-activity; sid:26670; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Fake delivery information phishing attack"; flow:to_client,established; content:"|3B| filename="; http_header; content:"Delivery_Information_ID-"; fast_pattern:only; http_header; file_data; content:"Delivery_Information_ID-"; content:".exe"; within:50; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1192; classtype:trojan-activity; sid:26660; rev:2;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Unix.Backdoor.Cdorked download attempt"; flow:to_server,established; flowbits:isset,file.elf; file_data; content:"Jan 13 2013 10:57:10"; fast_pattern:only; content:"Cpanel::Easy::Apache"; content:"1.4.6|00|Architecture:"; within:19; distance:151; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,blog.sucuri.net/2013/04/apache-binary-backdoors-on-cpanel-based-servers.html; reference:url,virustotal.com/en/file/7b3cd8c1bd0249df458084f28d91648ad14e1baf455fdd53b174481d540070c6/analysis/; classtype:trojan-activity; sid:26532; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Unix.Backdoor.Cdorked download attempt"; flow:to_client,established; flowbits:isset,file.elf; file_data; content:"Jan 13 2013 10:57:10"; fast_pattern:only; content:"Cpanel::Easy::Apache"; content:"1.4.6|00|Architecture:"; within:19; distance:151; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,blog.sucuri.net/2013/04/apache-binary-backdoors-on-cpanel-based-servers.html; reference:url,virustotal.com/en/file/7b3cd8c1bd0249df458084f28d91648ad14e1baf455fdd53b174481d540070c6/analysis/; classtype:trojan-activity; sid:26531; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Zeus Spam 2013 dated zip/exe HTTP Response - potential malware download"; flow:to_client,established; content:"-2013.zip|0D 0A|"; fast_pattern:only; content:"-2013.zip|0D 0A|"; http_header; content:"-"; within:1; distance:-14; http_header; file_data; content:"-2013.exe"; content:"-"; within:1; distance:-14; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2eff3ee6ac7f5bf85e4ebcbe51974d0708cef666581ef1385c628233614b22c0/analysis/; classtype:trojan-activity; sid:26470; rev:1;) # alert tcp any any -> $HOME_NET 445 (msg:"MALWARE-OTHER Win.Worm.Dorkbot Desktop.ini snkb0ptz.exe creation attempt SMB"; flow:to_server,established; content:"|73 00 6E 00 6B 00 62 00 30 00 70 00 74 00 7A 00|"; content:"|5C|"; within:1; content:"|00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 2E 00 69 00 6E 00 69 00|"; distance:0; metadata:ruleset community, service netbios-ssn; classtype:trojan-activity; sid:26413; rev:2;) # alert tcp any any -> $HOME_NET 445 (msg:"MALWARE-OTHER Win.Worm.Dorkbot executable snkb0ptz.exe creation attempt SMB"; flow:to_server,established; content:"|73 00 6E 00 6B 00 62 00 30 00 70 00 74 00 7A 00|"; fast_pattern:only; content:".exe"; metadata:ruleset community, service netbios-ssn; classtype:trojan-activity; sid:26412; rev:2;) # alert tcp any any -> $HOME_NET 445 (msg:"MALWARE-OTHER Win.Worm.Dorkbot folder snkb0ptz creation attempt SMB"; flow:to_server,established; content:"|73 00 6E 00 6B 00 62 00 30 00 70 00 74 00 7A 00|"; fast_pattern:only; metadata:ruleset community, service netbios-ssn; classtype:trojan-activity; sid:26411; rev:2;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER UTF-8 BOM in zip file attachment detected"; flow:to_client,established; file_data; content:"|EF BB BF 50 4B 03 04|"; depth:7; metadata:policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26382; rev:3;) # alert tcp $EXTERNAL_NET [110,143] -> $HOME_NET any (msg:"MALWARE-OTHER UTF-8 BOM in zip file attachment detected"; flow:to_client,established; file_data; content:"|EF BB BF 50 4B 03 04|"; depth:7; metadata:policy security-ips drop, ruleset community, service ftp-data, service imap, service pop3; classtype:trojan-activity; sid:26381; rev:4;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER UTF-8 BOM in zip file attachment detected"; flow:to_server,established; file_data; content:"|EF BB BF 50 4B 03 04|"; depth:7; metadata:policy security-ips drop, ruleset community, service smtp; classtype:trojan-activity; sid:26380; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Double HTTP Server declared"; flow:to_client,established; content:"Server|3A| Apache"; http_header; content:"Server|3A|nginx"; fast_pattern:only; http_header; metadata:policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:26369; rev:1;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Fake postal receipt HTTP Response phishing attack"; flow:to_client,established; content:"|3B 20|filename=Postal-Receipt.zip|0D 0A|"; fast_pattern:only; http_header; file_data; content:"Postal-Receipt.exe"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1192; reference:url,www.urlquery.net/search.php?q=receipt&type=string&start=2013-01-03&end=2013-01-18&max=50; classtype:trojan-activity; sid:26261; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Compromised website response - leads to Exploit Kit"; flow:to_client,established; file_data; content:"/*eb167039d64daa68c565052678c517a4*/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:misc-activity; sid:26093; rev:1;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER WIN.Trojan.Nap Malicious executable file download from webroot"; flow:to_server,established; content:"/newbos2.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, service http; classtype:bad-unknown; sid:25782; rev:1;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Fake bookingdetails HTTP Response phishing attack"; flow:to_client,established; content:"|3B 20|filename=BookingDetails.zip|0D 0A|"; fast_pattern:only; http_header; file_data; content:"BookingDetails.exe"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1192; reference:url,www.urlquery.net/search.php?q=receipt&type=string&start=2013-01-03&end=2013-01-18&max=50; classtype:trojan-activity; sid:25580; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Fake bookinginfo HTTP Response phishing attack"; flow:to_client,established; content:"|3B 20|filename=BookingInfo.zip|0D 0A|"; fast_pattern:only; http_header; file_data; content:"BookingInfo.exe"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1192; reference:url,www.urlquery.net/search.php?q=receipt&type=string&start=2013-01-03&end=2013-01-18&max=50; classtype:trojan-activity; sid:25579; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Fake postal receipt HTTP Response phishing attack"; flow:to_client,established; content:"|3B 20|filename=PostalReceipt.zip|0D 0A|"; fast_pattern:only; http_header; file_data; content:"PostalReceipt.exe"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1192; reference:url,www.urlquery.net/search.php?q=receipt&type=string&start=2013-01-03&end=2013-01-18&max=50; classtype:trojan-activity; sid:25578; rev:3;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Request for a non-legit postal receipt"; flow:to_server,established; content:".php?php=receipt"; fast_pattern:only; http_uri; pcre:"/\x2f[a-z0-9]+\.php\?php\x3dreceipt$/Ui"; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,urlquery.net/search.php?q=.php%3Fphp%3Dreceipt&type=string; classtype:misc-activity; sid:25277; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER PHP.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"lama|27|s|27|hell"; fast_pattern:only; content:"execute"; nocase; content:"htmlspecialchars"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/9666386336e7b708bb3a6e971bcfdec772aec1d293f0d3f02939503d71f18424/analysis/; classtype:trojan-activity; sid:25097; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER PHP.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"post|5B 27|tac|27 5D|"; fast_pattern:only; content:"login"; nocase; content:"admin"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/9666386336e7b708bb3a6e971bcfdec772aec1d293f0d3f02939503d71f18424/analysis/; classtype:trojan-activity; sid:25096; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER HTML.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"AnakDompu"; fast_pattern:only; content:"Convertbytes"; nocase; content:"explode"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/3730e3c259cb4f727f7a803c23716ceacd640dab102ec61c3bda3974a4ef0175/analysis/; classtype:trojan-activity; sid:25095; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER PERL.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"Mass Defacement"; fast_pattern:only; content:"d:f:n"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/9666386336e7b708bb3a6e971bcfdec772aec1d293f0d3f02939503d71f18424/analysis/; classtype:trojan-activity; sid:25094; rev:3;) alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool variant outbound connection"; flow:to_client,established; file_data; content:"cmd|3A 5B 2D|bindconnverb"; fast_pattern:only; content:"bindconnverb command received"; nocase; content:"verb |5B 2D|tran|5D|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/cc10084096cf45e6529565590ec371198f997c6b3e9d09bb25a1b3cfa593a594/analysis/; classtype:trojan-activity; sid:25092; rev:2;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"wvs.exe|2C|iexplore.exe"; fast_pattern:only; content:"Can|27|t Load"; nocase; content:"Error Code: |5B 25|d|5D|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b88279fc0b0c42a76df7f54219fe969d02603151cf3b79763dc58c9f72ceb95d/analysis/; classtype:trojan-activity; sid:25091; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"wvs.exe|2C|iexplore.exe"; fast_pattern:only; content:"Can|27|t Load"; nocase; content:"Error Code: |5B 25|d|5D|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b88279fc0b0c42a76df7f54219fe969d02603151cf3b79763dc58c9f72ceb95d/analysis/; classtype:trojan-activity; sid:25090; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"Start Transmit"; fast_pattern:only; content:"One recv|5B 25|d|5D|"; nocase; content:"sockconsole.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/89acf767780e0d427b58310eb2776179cb963016b908e197c41a7504c6663d8c/analysis/; classtype:trojan-activity; sid:25089; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Start Transmit"; fast_pattern:only; content:"One recv|5B 25|d|5D|"; nocase; content:"sockconsole.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/89acf767780e0d427b58310eb2776179cb963016b908e197c41a7504c6663d8c/analysis/; classtype:trojan-activity; sid:25088; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"transmit produce over"; fast_pattern:only; content:"Two send|5B 25|d|5D|"; nocase; content:"transerver.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/09c0ab18b970a5f0dd35a591aeb8073a7fa1c6b6aac829a04ea66784e99b127f/analysis/; classtype:trojan-activity; sid:25087; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"transmit produce over"; fast_pattern:only; content:"Two send|5B 25|d|5D|"; nocase; content:"transerver.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/09c0ab18b970a5f0dd35a591aeb8073a7fa1c6b6aac829a04ea66784e99b127f/analysis/; classtype:trojan-activity; sid:25086; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"I got back a null buffer !"; fast_pattern:only; content:"Coded by fzk"; nocase; content:"|40 00|smb.txt"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/8edb0a8f701f8be6b33aa5e708411f914d7337b81ee48afa695fde31e2c86e03/analysis/; classtype:trojan-activity; sid:25085; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"I got back a null buffer !"; fast_pattern:only; content:"Coded by fzk"; nocase; content:"|40 00|smb.txt"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/8edb0a8f701f8be6b33aa5e708411f914d7337b81ee48afa695fde31e2c86e03/analysis/; classtype:trojan-activity; sid:25084; rev:4;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Win.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"!!!!=>iNF-"; fast_pattern:only; content:"|0D 0A|Priority: urgent|0D 0A|"; content:"|0D 0A|X-Priority: 1|0D 0A|"; pcre:"/[A-F0-9]{2}\-[A-F0-9]{2}\-[A-F0-9]{2}\-[A-F0-9]{2}\-[A-F0-9]{2}\-[A-F0-9]{2}|0D 0A|/"; metadata:impact_flag red, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/CDAD6C1C11C130F193FBB76D09073DE40A27DC142D42AE30FF3430C991BE9831/analysis/; classtype:trojan-activity; sid:25031; rev:1;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Trojan.Narilam variant inbound attachemtn"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|27|##Maliran_PROG_COUNT|27| |00|Yes|00|No|00|Disactive"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/cf3c015d828784c7dffcba80619dba4cba970680ea5aa9f42f7356e79643a749/analysis/; classtype:trojan-activity; sid:25002; rev:3;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Narilam variant outbound connection"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|27|##Maliran_PROG_COUNT|27| |00|Yes|00|No|00|Disactive"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/cf3c015d828784c7dffcba80619dba4cba970680ea5aa9f42f7356e79643a749/analysis/; classtype:trojan-activity; sid:25001; rev:3;) # alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"MALWARE-OTHER itsoknoproblembro v2 UDP flood attempt"; flow:to_server; content:"|00 17 01 00 00 01 00 00 00 00 00 00 03 77 77 77|"; fast_pattern:only; content:"|00 00 01 00 01 2E 2E 2E 2E 2E 2E 2E 2E 2E 2E 2E|"; metadata:impact_flag red, service dns; reference:url,www.virustotal.com/file/87cbb24e5f6de2a788955572005b0577462a1ae570bfcf31dd99c7d5e0a0d373/analysis/1355347894/; classtype:attempted-dos; sid:24988; rev:1;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER HTML.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"ngatur"; fast_pattern:only; content:"filenyo"; content:"ls -la"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/1e737d034848cc7cdec9940e09fd952c9357d24d25e430027649be91867e770e/analysis/; classtype:trojan-activity; sid:24900; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Compromised Website response - leads to Exploit Kit"; flow:to_client,established; file_data; content:"/*c3284d*/"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html; classtype:misc-activity; sid:24899; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Compromised website response - leads to Exploit Kit"; flow:to_client,established; file_data; content:"/*qhk6sa6g1c*/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,stopmalvertising.com/tag/km0ae9gr6m/; classtype:misc-activity; sid:24884; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Compromised website response - leads to Exploit Kit"; flow:to_client,established; file_data; content:"/*km0ae9gr6m*/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,stopmalvertising.com/tag/km0ae9gr6m/; classtype:misc-activity; sid:24883; rev:2;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER OSX.Trojan.Imuler suspicious download"; flow:to_server,established; flowbits:isset,file.universalbinary; file_data; content:"/tmp/launch-ICS000"; fast_pattern:only; content:".confr"; nocase; content:"rm -rf"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24800; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.Imuler suspicious download"; flow:to_client,established; flowbits:isset,file.universalbinary; file_data; content:"/tmp/launch-ICS000"; fast_pattern:only; content:".confr"; nocase; content:"rm -rf"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24799; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER HTML.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:"wieeeee"; fast_pattern:only; content:"md5 cracker"; nocase; content:"die()"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/eb8c799f47fad06026e5e454e3dc56902055c9c6c55f5f1ded4f88f53ac9076c/analysis/1350929362/; classtype:trojan-activity; sid:24727; rev:3;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER HTML.Exploit.C99 suspicious file download"; flow:to_client,established; file_data; content:" $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"Error in cmdline|21|"; fast_pattern:only; content:"InjectDllAndCallFunction"; nocase; content:"lsass.exe"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b88279fc0b0c42a76df7f54219fe969d02603151cf3b79763dc58c9f72ceb95d/analysis/; classtype:trojan-activity; sid:24622; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Error in cmdline|21|"; fast_pattern:only; content:"InjectDllAndCallFunction"; nocase; content:"lsass.exe"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b88279fc0b0c42a76df7f54219fe969d02603151cf3b79763dc58c9f72ceb95d/analysis/; classtype:trojan-activity; sid:24621; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|5B|SERVER|5D|connection to |25|s|3A 25|d error"; fast_pattern:only; content:"ntimfos|2E|eng"; nocase; content:"wsastartup"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/c770b96d25c4f0102b3d0a728f75d683779308dca2283a0ebae69ac1e2672a52/analysis/; classtype:trojan-activity; sid:24620; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|5B|SERVER|5D|connection to |25|s|3A 25|d error"; fast_pattern:only; content:"ntimfos|2E|eng"; nocase; content:"wsastartup"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/c770b96d25c4f0102b3d0a728f75d683779308dca2283a0ebae69ac1e2672a52/analysis/; classtype:trojan-activity; sid:24619; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|23 23|auth|23 23 5B 25|s|5D| succ|21|"; fast_pattern:only; content:"cqo |00|cqto |00|"; nocase; content:"block socket|5B 25|d|5D|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/8f6c0e43bab53df013ef522c83acf0278e9c3ed248f6d10560ae57e13fc3c0a3/analysis/; classtype:trojan-activity; sid:24618; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|23 23|auth|23 23 5B 25|s|5D| succ|21|"; fast_pattern:only; content:"cqo |00|cqto |00|"; nocase; content:"block socket|5B 25|d|5D|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/08f7c373abfa4dc80b015c518834a2f441544a75ae5091f7585bedd31c0e31e2/analysis/; classtype:trojan-activity; sid:24617; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; file_data; content:"crack|5F|ftp|28|self|29|"; fast_pattern:only; content:"users |3D| |5B 27|root"; nocase; content:"do|5F|smb|5F|ck"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/7c334a0a9ef6ab520366e0b20ba488e41b546aae34395c83c0d420102ad550cd/analysis/; classtype:trojan-activity; sid:24616; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; file_data; content:"crack|5F|ftp|28|self|29|"; fast_pattern:only; content:"users |3D| |5B 27|root"; nocase; content:"do|5F|smb|5F|ck"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/7c334a0a9ef6ab520366e0b20ba488e41b546aae34395c83c0d420102ad550cd/analysis/; classtype:trojan-activity; sid:24615; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; file_data; content:"Type your current password to get root"; fast_pattern:only; content:"/usr/bin/chfn |2D|h"; nocase; content:"uid|3D|1000|28|hunger|29|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/25748edee2e58e31b9f79d328ce9286b69f082db86467d6401dd23cb55b0cdfa/analysis/; classtype:trojan-activity; sid:24614; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; file_data; content:"Type your current password to get root"; fast_pattern:only; content:"/usr/bin/chfn |2D|h"; nocase; content:"uid|3D|1000|28|hunger|29|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/25748edee2e58e31b9f79d328ce9286b69f082db86467d6401dd23cb55b0cdfa/analysis/; classtype:trojan-activity; sid:24613; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; file_data; content:"IO_wfile_underflow"; fast_pattern:only; content:"Gethostbyname|28 25|s|29|"; nocase; content:"stack smashing attack"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/e01351a627a5db51607b1bffd7cb22eabf64d421436131a1ef24fc447d47a85d/analysis/; classtype:trojan-activity; sid:24612; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; file_data; content:"IO_wfile_underflow"; fast_pattern:only; content:"Gethostbyname|28 25|s|29|"; nocase; content:"stack smashing attack"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/e01351a627a5db51607b1bffd7cb22eabf64d421436131a1ef24fc447d47a85d/analysis/; classtype:trojan-activity; sid:24611; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; file_data; content:"udp associate"; fast_pattern:only; content:"lost host1|21|"; nocase; content:"cmdsocks |3C|1.34|3E|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/af2a6b22b4f42d6b190f122c1c06abb0760b47c4e195cc0e5bd4e4fabf56b8cb/analysis/; classtype:trojan-activity; sid:24610; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; file_data; content:"udp associate"; fast_pattern:only; content:"lost host1|21|"; nocase; content:"cmdsocks |3C|1.34|3E|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/af2a6b22b4f42d6b190f122c1c06abb0760b47c4e195cc0e5bd4e4fabf56b8cb/analysis/; classtype:trojan-activity; sid:24609; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"SSLTlsvc has removed successfully!"; fast_pattern:only; content:"bindconnverb"; nocase; content:"cmd3"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/655d1a21fbaf3571beee860a99d009ba0a604430fe42925d07eff48a97a3cf73/analysis/; classtype:trojan-activity; sid:24607; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"SSLTlsvc has removed successfully!"; fast_pattern:only; content:"bindconnverb"; nocase; content:"cmd3"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/655d1a21fbaf3571beee860a99d009ba0a604430fe42925d07eff48a97a3cf73/analysis/; classtype:trojan-activity; sid:24606; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"msiveop.dat|00|msnetst.exe"; fast_pattern:only; content:"cmd.exe|00|command.com"; nocase; content:"700WP"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/3a99a24bd0420fa5176e68092b803f68a8d13d803de4f9d8d375256b132c8951/analysis/; classtype:trojan-activity; sid:24605; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"msiveop.dat|00|msnetst.exe"; fast_pattern:only; content:"cmd.exe|00|command.com"; nocase; content:"700WP"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/3a99a24bd0420fa5176e68092b803f68a8d13d803de4f9d8d375256b132c8951/analysis/; classtype:trojan-activity; sid:24604; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"bind port |5B 25|d|5D| faild!"; fast_pattern:only; content:"-conn"; nocase; content:"cmdsocks.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/410a85bb7522e86de3da953c69d3721752ef88b272ef47c86555a08c1767cdda/analysis/; classtype:trojan-activity; sid:24603; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"bind port |5B 25|d|5D| faild!"; fast_pattern:only; content:"-conn"; nocase; content:"cmdsocks.pdb"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/410a85bb7522e86de3da953c69d3721752ef88b272ef47c86555a08c1767cdda/analysis/; classtype:trojan-activity; sid:24602; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"p2x5142.dll failed"; fast_pattern:only; content:"DBG: FIND"; nocase; content:"GetTempDir"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/886ecd19280ab8f7dc962d85ad1b94b251592e412f4f41fe7c1596767e739489/analysis/ ; classtype:trojan-activity; sid:24601; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"p2x5142.dll failed"; fast_pattern:only; content:"DBG: FIND"; nocase; content:"GetTempDir"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/886ecd19280ab8f7dc962d85ad1b94b251592e412f4f41fe7c1596767e739489/analysis/ ; classtype:trojan-activity; sid:24600; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.MiniFlame C&C command response attempt"; flow:to_client,established; flowbits:isset,malware.miniflame; content:"|0D 0A|\r\n/smi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/3eeaf4df50d375123d7c2c459634b7b43bdb7823198afd9399b7ec49548e3f12/analysis/; classtype:trojan-activity; sid:24594; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"unable to start gsecdump"; fast_pattern:only; content:"dump_usedhashes,u"; nocase; content:"iamservice"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/0821986b379c8f823bffea73cb25819a8a807c381b084e962b5e51c78f187199/analysis/; classtype:trojan-activity; sid:24592; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"unable to start gsecdump"; fast_pattern:only; content:"dump_usedhashes,u"; nocase; content:"iamservice"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/0821986b379c8f823bffea73cb25819a8a807c381b084e962b5e51c78f187199/analysis/; classtype:trojan-activity; sid:24591; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"Coded by fzk"; nocase; content:"|40 00|smb.txt"; nocase; content:"I got back a null buffer !"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/8edb0a8f701f8be6b33aa5e708411f914d7337b81ee48afa695fde31e2c86e03/analysis/; classtype:trojan-activity; sid:24590; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Exploit.Hacktool suspicious file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Coded by fzk"; nocase; content:"|40 00|smb.txt"; nocase; content:"I got back a null buffer !"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/8edb0a8f701f8be6b33aa5e708411f914d7337b81ee48afa695fde31e2c86e03/analysis/; classtype:trojan-activity; sid:24589; rev:2;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Trojan.Lucuis malware file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"01234567890123456789eric0123456789012345678karen|00 00 00 00 25|SystemRoot"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b76b6c8d5378e465c91f6283b6f11fdd58916cfe02923b3a48344174c2272bc0/analysis/; classtype:trojan-activity; sid:24516; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Lucuis malware file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"01234567890123456789eric0123456789012345678karen|00 00 00 00 25|SystemRoot"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24515; rev:2;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Java.Trojan.Jacksbot jar download"; flow:to_client,established; flowbits:isset,file.jar; file_data; content:"key.dat3715pr52u"; fast_pattern:only; content:"B.class"; content:"v.class"; distance:0; content:"y.class"; distance:0; content:"a.class"; distance:0; metadata:impact_flag red, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/7b654a13d36d3497636c4e934e06ba64/analysis/; classtype:trojan-activity; sid:24427; rev:3;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Java.Trojan.Jacksbot class download"; flow:to_client,established; flowbits:isset,file.class; file_data; content:"FLOOD DRAIN"; fast_pattern:only; content:"#!/bin/bash"; content:".minecraft"; distance:0; content:"/etc/rc.common"; distance:0; content:"/etc/rc.local"; distance:0; content:".filezilla/recentservers.xml"; distance:0; metadata:impact_flag red, service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1087; reference:url,www.virustotal.com/file/7b654a13d36d3497636c4e934e06ba64/analysis/; classtype:trojan-activity; sid:24426; rev:4;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Trojan.Gauss download attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|2E 00|B|00|a|00|c|00|k|00|u|00|p|00|0|00|D"; nocase; content:"t|00|a|00|r|00|g|00|e|00|t|00 2E 00|l|00|n|00|k"; fast_pattern:only; content:"|25 00|x"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/3eeaf4df50d375123d7c2c459634b7b43bdb7823198afd9399b7ec49548e3f12/analysis/; classtype:trojan-activity; sid:24411; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Gauss download attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|2E 00|B|00|a|00|c|00|k|00|u|00|p|00|0|00|D"; nocase; content:"t|00|a|00|r|00|g|00|e|00|t|00 2E 00|l|00|n|00|k"; fast_pattern:only; content:"|25 00|x"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/3eeaf4df50d375123d7c2c459634b7b43bdb7823198afd9399b7ec49548e3f12/analysis/; classtype:trojan-activity; sid:24410; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Trojan.Miniflame download attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"icsvnt"; fast_pattern:only; content:"RegisterService"; nocase; content:"ServiceMain"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24409; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Miniflame download attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"icsvnt"; fast_pattern:only; content:"RegisterService"; nocase; content:"ServiceMain"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24408; rev:3;) # alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"MALWARE-OTHER itsoknoproblembro UDP flood"; flow:stateless,no_stream; dsize:>1300; content:"AAAAAAAAAAAAAAAAAAAA"; fast_pattern:only; detection_filter:track by_src, count 30, seconds 60; metadata:service dns; reference:url,arstechnica.com/security/2012/10/ddos-attacks-against-major-us-banks-no-stuxnet/; classtype:attempted-dos; sid:24396; rev:5;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"MALWARE-OTHER itsoknoproblembro TCP flood"; flow:to_server,established,no_stream; dsize:>1300; content:"AAAAAAAAAAAAAAAAAAAA"; depth:20; detection_filter:track by_src, count 30, seconds 30; metadata:impact_flag red, service http; reference:url,arstechnica.com/security/2012/10/ddos-attacks-against-major-us-banks-no-stuxnet/; classtype:attempted-dos; sid:24395; rev:6;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Win.Trojan.Downloader inbound email"; flow:to_server,established; file_data; content:"|01 7C F2 E8 39 0A 61 81 59 BD CA 62 00 BE CA 7D D3 F9 4E CC EB 48 20 5F EC D3 61 46 36 7B 36 EB|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/2256753459e529a64d5559e2f1154456187f49e84b5fe9fda8a180aadde9dc9f/analysis/; classtype:trojan-activity; sid:24312; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Downloader download"; flow:to_client,established; file_data; content:"|01 7C F2 E8 39 0A 61 81 59 BD CA 62 00 BE CA 7D D3 F9 4E CC EB 48 20 5F EC D3 61 46 36 7B 36 EB|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/2256753459e529a64d5559e2f1154456187f49e84b5fe9fda8a180aadde9dc9f/analysis/; classtype:trojan-activity; sid:24311; rev:4;) alert tcp $HOME_NET any -> $EXTERNAL_NET 84 (msg:"MALWARE-OTHER Malicious UA detected on non-standard port"; flow:to_server,established,no_stream; content:"User-Agent|3A| Mozilla/5.0 |28|Windows|3B| U|3B| MSIE 9.0|3B| Windows NT 9.0|3B| en-US|29|"; detection_filter:track by_src, count 1, seconds 120; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,anubis.iseclab.org/?action=result&task_id=1691c3b8835221fa4692960681f39c736&format=html; classtype:trojan-activity; sid:24265; rev:5;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Lanman2.dll download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|55 8B EC 51 C7 45 FC 41 C7 B5 D2 C9 C3 66 A1 04 90 01 10 0F B7 C0 99 B9 1F CE 00 00 F7 F9 B9 03|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/763fec95b3c5daf7be6dbdae16355fde4829191956bf3c41e08fee1901872d78/analysis/; classtype:trojan-activity; sid:24262; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Lanman2.dll download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|55 8B EC 51 C7 45 FC 41 C7 B5 D2 C9 C3 66 A1 04 90 01 10 0F B7 C0 99 B9 1F CE 00 00 F7 F9 B9 03|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/763fec95b3c5daf7be6dbdae16355fde4829191956bf3c41e08fee1901872d78/analysis/; classtype:trojan-activity; sid:24261; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER PwDump7.exe download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"Dump system passwords"; nocase; content:"Dump passwords from files"; within:150; nocase; content:"pwdump"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b20f667c2539954744ddcb7f1d673c2a6dc0c4a934df45a3cca15a203a661c88/analysis/; classtype:trojan-activity; sid:24260; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER PwDump7.exe download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Dump system passwords"; nocase; content:"Dump passwords from files"; within:150; nocase; content:"pwdump"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b20f667c2539954744ddcb7f1d673c2a6dc0c4a934df45a3cca15a203a661c88/analysis/; classtype:trojan-activity; sid:24259; rev:3;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER mygeeksmail.dll download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"improve performance|00|check=|00 00|REMOTE_ADDR"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24258; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER mygeeksmail.dll download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"improve performance|00|check=|00 00|REMOTE_ADDR"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/b884f723d4c775cc1c86019a19ba922fd4060e5456883914962daf5ddef9a9ec/analysis/; classtype:trojan-activity; sid:24257; rev:3;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER malicious redirection attempt"; flow:to_server,established; content:"a=YWZmaWQ9MDUyODg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.sucuri.net/2012/09/compromised-websites-hosting-calls-to-java-exploit.html; classtype:bad-unknown; sid:24225; rev:2;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Dorifel/Quervar/XDocCrypt sent over email"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"[+++fpnesnpr+++]"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,blog.eset.com/2012/08/21/quervar-induc-c-reincarnate; reference:url,hitmanpro.wordpress.com/2012/08/11/joint-strike-force-against-dorifel/; classtype:trojan-activity; sid:24145; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Dorifel/Quervar/XDocCrypt download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"[+++fpnesnpr+++]"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,blog.eset.com/2012/08/21/quervar-induc-c-reincarnate; reference:url,hitmanpro.wordpress.com/2012/08/11/joint-strike-force-against-dorifel/; classtype:trojan-activity; sid:24144; rev:4;) alert udp $HOME_NET any -> $HOME_NET 137 (msg:"MALWARE-OTHER Dorifel/Quervar/XDocCrypt query for machine name KASPERSKY"; content:"|01 10 00 01|"; depth:4; offset:2; content:" ELEBFDFAEFFCFDELFJCACACACACACAAA|00 00 20 00 01|"; depth:38; offset:12; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service netbios-ns; reference:url,blog.eset.com/2012/08/21/quervar-induc-c-reincarnate; reference:url,hitmanpro.wordpress.com/2012/08/11/joint-strike-force-against-dorifel/; classtype:trojan-activity; sid:24143; rev:3;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to an MP3 file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".mp3"; nocase; http_uri; pcre:"/\.mp3([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24110; classtype:non-standard-protocol; sid:24110; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a ZIP file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".zip"; nocase; http_uri; pcre:"/\.zip([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24109; classtype:non-standard-protocol; sid:24109; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a RAR file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".rar"; nocase; http_uri; pcre:"/\.rar([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24108; classtype:non-standard-protocol; sid:24108; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a BMP file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".bmp"; nocase; http_uri; content:!"Content-Type|3A| multipart/form-data|3B|"; http_header; pcre:"/\.bmp([\?\x5c\x2f]|$)/Usmi"; metadata:impact_flag red, service http; reference:url,snort.org/rule_docs/1-24107; classtype:non-standard-protocol; sid:24107; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a PNG file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".png"; nocase; http_uri; pcre:"/\.png([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24106; classtype:non-standard-protocol; sid:24106; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a GIF file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".gif"; nocase; http_uri; content:!"widgetserver.com"; nocase; http_header; pcre:"/\.gif([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24105; classtype:non-standard-protocol; sid:24105; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a JPEG file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".jpeg"; nocase; http_uri; pcre:"/\.jpeg([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24104; classtype:non-standard-protocol; sid:24104; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER HTTP POST request to a JPG file"; flow:to_server,established; content:"POST"; nocase; http_method; urilen:<50; content:".jpg"; nocase; http_uri; pcre:"/\.jpg([\?\x5c\x2f]|$)/Usmi"; metadata:service http; reference:url,snort.org/rule_docs/1-24103; classtype:non-standard-protocol; sid:24103; rev:7;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Malvertising redirection attempt"; flow:to_server,established; content:".ru/"; nocase; http_uri; content:"/?"; distance:0; http_uri; content:"|0D 0A|"; within:2; distance:1; http_uri; pcre:"/\x2eru\/\w+\?\d$/miU"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,labs.sucuri.net/?malware; classtype:trojan-activity; sid:24099; rev:3;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Possible malicious redirect - rebots.php"; flow:to_server,established; content:"/rebots.php"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.sucuri.net/2012/08/rebots-php-javascript-malware-being-actively-injected.html; reference:url,labs.sucuri.net/db/malware/mwjs-include-rebots; classtype:misc-activity; sid:24017; rev:4;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Malvertising redirection campaign - blackmuscat"; flow:to_server,established; content:"/blackmuscat"; fast_pattern:only; http_uri; pcre:"/\x2fblackmuscats?\x3f\d/Ui"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,labs.sucuri.net/?malware; classtype:trojan-activity; sid:23833; rev:3;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Malvertising redirection page"; flow:to_client,established; file_data; content:"|22| height=0 width=0>|27 29 3B|"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.kahusecurity.com/2012/new-chinese-exploit-pack/; classtype:trojan-activity; sid:23798; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Malvertising network attempted redirect"; flow:to_client,established; file_data; content:".php|22| name=|22|Twitter|22| scrolling=|22|auto|22| frameborder=|22|no|22| align=|22|center|22| height=|22|2|22| width=|22|2|22|>"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1102; reference:url,labs.sucuri.net/?details=pairedpixels.com; classtype:trojan-activity; sid:23620; rev:5;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Malvertising redirection attempt"; flow:to_client,established; file_data; content:"|27 20|width=|27|6|27 20|height=|27|10|27 20|style=|27|position|3A 20|absolute|3B 20|left|3A 20 2D|1000px|3B 20|top|3A 20 2D|1000px|3B 20|z-index|3A 20|1|3B 27 3E 3C 2F|iframe|3E 22 29 3B|"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,labs.sucuri.net/?malware; classtype:trojan-activity; sid:23618; rev:3;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER potential clickjacking via css pointer-events attempt"; flow:to_client,established; file_data; content:""; within:10; nocase; pcre:"/position\s*?\x3a\s*?absolute\s*?\x3b[^\x7d]*?pointer-events\s*?\x3a\s*?none\s*?\x3b/i"; metadata:service http; reference:url,jsfiddle.net/gcollazo/UMyEm/embedded/result/; classtype:policy-violation; sid:23350; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER NeoSploit Malvertising - URI Requested"; flow:to_server,established; urilen:34; content:"/?"; depth:2; http_uri; content:" *|3B| q=.2, */*|3B| q=.2"; fast_pattern:only; http_header; pcre:"/\/\?[0-9a-f]{32}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:23058; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Alureon - Malicious IFRAME load attempt"; flow:to_client,established; file_data; content:"name=|5C 22|Twitter|5C 22| scrolling=|5C 22|auto|5C 22| frameborder=|5C 22|no|5C 22| align=|5C 22|center|5C 22| height = |5C 22|1px|5C 22| width = |5C 22|1px|5C 22|>"; fast_pattern:only; metadata:policy balanced-ips alert, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1102; classtype:trojan-activity; sid:22061; rev:7;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER nikjju script injection"; flow:to_client,established; file_data; content:"script src=http|3A 2F 2F|"; nocase; content:"|2F|r.php"; within:50; fast_pattern; nocase; metadata:policy balanced-ips alert, policy security-ips alert, service http; reference:url,isc.sans.edu/diary.html?storyid=13036; classtype:misc-activity; sid:21949; rev:3;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER TDS Sutra - redirect received"; flow:to_client,established; content:"302"; http_stat_code; content:"=_"; content:"_|5C 3B| domain="; within:11; distance:1; pcre:"/^[a-z]{5}\d=_\d_/C"; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,wepawet.iseclab.org/view.php?hash=822b95927fd4d8bb6eb2e62f4e1ef645&t=1243359208&type=js; reference:url,www.nartv.org/tag/tds/; reference:url,xylibox.blogspot.com/2011/12/sutra-tds-v34.html; classtype:trojan-activity; sid:21851; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER TDS Sutra - request hi.cgi"; flow:to_server,established; content:"/hi.cgi"; http_uri; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,wepawet.iseclab.org/view.php?hash=822b95927fd4d8bb6eb2e62f4e1ef645&t=1243359208&type=js; reference:url,www.nartv.org/tag/tds/; reference:url,xylibox.blogspot.com/2011/12/sutra-tds-v34.html; classtype:trojan-activity; sid:21850; rev:6;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER TDS Sutra - HTTP header redirecting to a SutraTDS"; flow:to_client,established; content:"/in.cgi"; http_header; pcre:"/\x2Fin\.cgi\?(\d{1,2}|default)$/Hsmi"; metadata:impact_flag red, ruleset community, service http; reference:url,wepawet.iseclab.org/view.php?hash=822b95927fd4d8bb6eb2e62f4e1ef645&t=1243359208&type=js; reference:url,www.nartv.org/tag/tds/; reference:url,xylibox.blogspot.com/2011/12/sutra-tds-v34.html; classtype:trojan-activity; sid:21849; rev:9;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER TDS Sutra - page redirecting to a SutraTDS"; flow:to_client,established; file_data; content:"/in.cgi?"; isdataat:15,relative; content:!"id="; within:3; nocase; content:!"&"; within:6; content:!"="; within:6; pcre:"/\x2Fin\.cgi\?(\w{1,6}|default)\b/smi"; metadata:impact_flag red, ruleset community, service http; reference:url,wepawet.iseclab.org/view.php?hash=822b95927fd4d8bb6eb2e62f4e1ef645&t=1243359208&type=js; reference:url,www.nartv.org/tag/tds/; reference:url,xylibox.blogspot.com/2011/12/sutra-tds-v34.html; classtype:trojan-activity; sid:21848; rev:14;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER TDS Sutra - redirect received"; flow:to_client,established; content:"_0000="; fast_pattern; content:"SL_"; http_cookie; content:"_0000="; within:8; http_cookie; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,wepawet.iseclab.org/view.php?hash=822b95927fd4d8bb6eb2e62f4e1ef645&t=1243359208&type=js; reference:url,www.nartv.org/tag/tds/; reference:url,xylibox.blogspot.com/2011/12/sutra-tds-v34.html; classtype:trojan-activity; sid:21845; rev:8;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Possible malicious jar file download page"; flow:to_client, established; file_data; content:"String.fromCharCode"; nocase; content:".jar|27|"; content:"%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%"; fast_pattern:only; metadata:service http; classtype:attempted-user; sid:21642; rev:3;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Possible banking trojan with known banking strings"; flow:to_client,established; file_data; content:"bankofamerica.com"; content:"capitalonebank.com"; content:"citigroup.com"; content:"capitalonebank.com"; content:"ebanking-services.com"; content:"mandtbank.com"; fast_pattern:only; metadata:service http; classtype:trojan-activity; sid:21641; rev:3;) # alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-OTHER Horde javascript.php href backdoor"; flow:to_server,established; content:"/horde/services/javascript.php"; fast_pattern; http_uri; content:"href="; http_cookie; content:"file=open_calendar.js"; http_client_body; metadata:service http; reference:cve,2012-0209; reference:url,eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/; classtype:trojan-activity; sid:21555; rev:3;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Tong Keylogger outbound connection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"KeyLogged"; distance:0; nocase; content:"from"; distance:0; nocase; content:"|5B|Sync"; nocase; content:" Manager|5D|"; distance:0; nocase; content:"|2D|"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/5251107a201ddc5bd3d1fdc5b2f64bf1a4480f0f95e92c69a150a41078b1e4e5/analysis/; classtype:trojan-activity; sid:19901; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Tong Keylogger outbound connection"; flow:to_server,established; flowbits:isset,backdoor.tongkeylogger; content:"|5B|Sync"; nocase; content:" Manager|5D|"; distance:0; nocase; content:"|2D|"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/5251107a201ddc5bd3d1fdc5b2f64bf1a4480f0f95e92c69a150a41078b1e4e5/analysis/; classtype:trojan-activity; sid:19900; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Tong Keylogger outbound connectiooutbound connection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"KeyLogged"; distance:0; nocase; content:"from"; distance:0; nocase; flowbits:set,backdoor.tongkeylogger; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/5251107a201ddc5bd3d1fdc5b2f64bf1a4480f0f95e92c69a150a41078b1e4e5/analysis/; classtype:trojan-activity; sid:19899; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER PWS.Win32.Scofted keylogger runtime detection"; flow:to_server,established; content:"STOR JUNIPER-"; depth:13; nocase; content:".log|0D 0A|"; within:10; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/1ed945316f12208e4d45633d78de79eade9af9904f9817e447d39148668e2d75/analysis/; classtype:trojan-activity; sid:19741; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger Monitor.win32.perflogger"; flow:to_server,established; flowbits:isset,w32.perflogger; content:"MKD"; nocase; pcre:"/MKD\s+\d{4}\x2d(\d{2}\x2d){4}/i"; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; classtype:trojan-activity; sid:19393; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger Monitor.win32.perflogger"; flow:to_server,established; content:"USER|20|nacky8|0D 0A|"; nocase; flowbits:set,w32.perflogger; flowbits:noalert; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; classtype:trojan-activity; sid:19392; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER generic IRC botnet connection"; flow:to_server,established; content:"USER|20|"; content:"|20 30 20 30 20 3A|"; within:32; distance:2; metadata:impact_flag red, service ircd; reference:url,www.virustotal.com/file/209D49E1A327919329BD8E737A133A33826668D4678DF56330CC7AF58A80B3D0/analysis/; reference:url,www.virustotal.com/file/4bf35e8ca725ccb4a3ca3be464141b49a5f0e9292aed5dd244235edf7e809626/analysis/; reference:url,www.virustotal.com/file/4c2c745bde3ada3c266d9d341c52aefc4b3a79dfc42e269c6af04119e6f13aa7/analysis/; classtype:trojan-activity; sid:19362; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger WL-Keylogger outbound connection"; flow:to_server,established; flowbits:isset,Malware_Keylogger_InitConnection; content:"ServerDetails|7C|"; depth:14; nocase; pcre:"/^ServerDetails\x7c[^\r\n]*\x7c[^\r\n]*\x7c/smi"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.megasecurity.org/trojans/k/keylogger/Keylogger_darkdays.html; classtype:trojan-activity; sid:19325; rev:4;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER Keylogger WL-Keylogger inbound connection"; flow:to_client,established; content:"ServerDetails"; depth:13; nocase; flowbits:set,Malware_Keylogger_InitConnection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.megasecurity.org/trojans/k/keylogger/Keylogger_darkdays.html; classtype:trojan-activity; sid:19324; rev:5;) # alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER Dos.Tool.LOIC TCP default U dun goofed attack"; flow:established,to_server,no_stream; content:"U dun goofed"; fast_pattern:only; detection_filter:track by_src, count 10, seconds 2; reference:url,attack.mitre.org/techniques/T1078; reference:url,sourceforge.net/projects/loic/; classtype:attempted-dos; sid:19319; rev:5;) # alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER Dos.Tool.LOIC UDP default U dun goofed attack"; flow:stateless,no_stream; content:"U dun goofed"; fast_pattern:only; detection_filter:track by_src, count 10, seconds 2; reference:url,attack.mitre.org/techniques/T1078; reference:url,sourceforge.net/projects/loic/; classtype:attempted-dos; sid:19318; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Keylogger Ardamax keylogger runtime detection - http"; flow:to_server,established; content:"/pub/u1.php?v="; http_uri; content:"&pr="; http_uri; content:"&id="; http_uri; content:"&rn="; http_uri; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.malware-control.com/statics-pages/fc321d8376cc9fad4cf02453d3cd353c.php; classtype:trojan-activity; sid:19106; rev:5;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER lizamoon script injection"; flow:to_client,established; file_data; content:"script src=http|3A 2F 2F|"; nocase; content:"|2F|ur.php"; within:50; fast_pattern; nocase; metadata:service http; reference:url,isc.sans.edu/diary.html?storyid=10642; classtype:misc-activity; sid:18604; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger egyspy keylogger 1.13 runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:"EgySpy"; distance:0; nocase; content:"Victim"; distance:0; nocase; pcre:"/^From\x3a[^\r\n]*EgySpy\s+Victim/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.sunbeltsecurity.com/threatdisplay.aspx?name=EgySpy&tid=48410&cs=6ECDDEC7712C7CE701773045B519AE38; classtype:successful-recon-limited; sid:16455; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger cheat monitor runtime detection"; flow:to_server,established; content:"Report"; nocase; content:"@"; nocase; content:"name=cheatmonitorR_SCREEN.DATETIME."; fast_pattern:only; pcre:"/Report\x20\x40.*name\x3dcheatmonitorR\x5fSCREEN\x2eDATETIME/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453141479; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-090408-5607-99&tabid=2; classtype:successful-recon-limited; sid:16137; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware owlforce runtime detection - remote server #2"; flow:to_server,established; content:"/status.php?"; nocase; http_uri; content:"searchurl="; http_uri; content:"version="; http_uri; content:"act="; http_uri; content:"User-Agent|3A|"; nocase; http_header; content:"Nimo Software HTTP Retriever"; nocase; http_header; pcre:"/^User-Agent\x3a[^\r\n]*Nimo\x20Software\x20HTTP\x20Retriever/smiH"; metadata:service http; reference:url,spywaresignatures.com/details/owlforce.pdf; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453113210; classtype:successful-recon-limited; sid:16133; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware owlforce runtime detection - remote server #1"; flow:to_server,established; content:"/success.php?"; nocase; http_uri; content:"itemname="; http_uri; content:"User-Agent|3A| Nimo Software HTTP Retriever"; fast_pattern:only; metadata:service http; reference:url,spywaresignatures.com/details/owlforce.pdf; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453113210; classtype:successful-recon-limited; sid:16132; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware adclicker trojan zlob.dnz runtime detection - ads"; flow:to_server,established; content:"/bc/123kah.php"; nocase; content:"Host|3A|"; nocase; http_header; content:"ads.gooochi.biz"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*ads\x2egooochi\x2ebiz/smiH"; metadata:service http; classtype:successful-recon-limited; sid:16131; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Keylogger lord spy pro 1.4 runtime detection"; flow:to_server,established; content:"POST //"; nocase; content:"Host|3A| www.fakemailer.info"; fast_pattern:only; http_header; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:16130; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Keylogger kamyab Keylogger v.3 runtime detection"; flow:to_server,established; content:"/ahmad.php"; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.kamyab-hack.com"; distance:0; fast_pattern; nocase; http_header; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.megasecurity.org/trojans/k/keylogger/Kamyabkeylogger3.0.html; classtype:successful-recon-limited; sid:16129; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger spyyahoo v2.2 runtime detection"; flow:to_server,established; content:"RETR k3ylogger.txt"; fast_pattern:only; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.megasecurity.org/trojans/s/spyyahoo/Spyyahoo2.2.html; classtype:successful-recon-limited; sid:16125; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware rightonadz.biz adrotator runtime detection - ads"; flow:to_server,established; content:"/bc/123kah.php"; nocase; content:"Host|3A|"; nocase; http_header; content:"ads.targetedbanner.biz"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*ads\x2etargetedbanner\x2ebiz/smiH"; metadata:service http; reference:url,www.sophos.com/security/analyses/adware-and-puas/rightonadz.html; classtype:successful-recon-limited; sid:16117; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware rightonadz.biz adrotator runtime detection - pass user info to remote server"; flow:to_server,established; content:"/bc/ip.php"; nocase; content:"Host|3A| ads.targetedbanner.biz"; distance:0; nocase; metadata:service http; reference:url,www.sophos.com/security/analyses/adware-and-puas/rightonadz.html; classtype:successful-recon-limited; sid:16116; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger ultimate Keylogger pro runtime detection"; flow:to_server,established; content:"Subject|3A| Ultimate Keylogger Report from"; fast_pattern:only; content:"Activity Report from Ultimate"; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,ca.com/us/securityadvisor/pest/pest.aspx?id=453139331; reference:url,www.411-spyware.com/remove-ultimate-keylogger; classtype:successful-recon-limited; sid:14075; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spybosspro 4.2 runtime detection"; flow:to_server,established; content:"Subject|3A| SpyBoss Pro - Log File Mailing"; fast_pattern:only; content:"X-Mailer|3A| SpyBoss Pro"; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.2-spyware.com/remove-spybosspro.html; reference:url,www.411-spyware.com/remove/spyboss-pro; classtype:successful-recon-limited; sid:14074; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Keylogger emptybase j runtime detection"; flow:to_server,established; content:"/th/script.php?"; nocase; content:"boundary=--__abcd-xyz789__--"; distance:0; nocase; content:"name=|22|Module|22 0D 0A 0D 0A|"; distance:0; nocase; content:"IE"; distance:0; nocase; pcre:"/name\x3d\x22Module\x22\x0d\x0a\x0d\x0a(IEGrabber|IEInjector|IEFaker|IEKeylogger|IETanGrabber|IEScrGrabber|IECertGrab|IEFileGrabber)/smi"; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,ca.com/us/securityadvisor/pest/pest.aspx?id=453117299; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/malencpkay.html; classtype:successful-recon-limited; sid:14065; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware rightonadz.biz adrotator runtime detection - ads"; flow:to_server,established; content:"/bc/123kah.php"; fast_pattern:only; content:"Host|3A|"; nocase; http_header; content:"rightonadz.biz"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*rightonadz\x2ebiz/smiH"; metadata:service http; reference:url,www.askmehelpdesk.com/spyware-viruses-etc/pop-up-http-rightonadz-biz-bc-123kah-php-151385.html; reference:url,www.nettrafficchat.com/showthread.php?t=1347; classtype:successful-recon-limited; sid:13933; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware adclicker-fc.gen.a runtime detection"; flow:to_server,established; content:"/?"; nocase; http_uri; content:"cmpname="; nocase; http_uri; content:"gai="; nocase; http_uri; content:"gli="; nocase; http_uri; content:"gff="; nocase; http_uri; content:"ed="; nocase; http_uri; content:"ex="; nocase; http_uri; content:"eu="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"intervarioclick.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*intervarioclick\x2ecom/smiH"; metadata:service http; reference:url,vil.nai.com/vil/content/v_144220.htm; classtype:successful-recon-limited; sid:13867; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware adclicker-fc.gen.a runtime detection - popup ads"; flow:to_server,established; content:"/r.php?"; nocase; http_uri; content:"sid="; nocase; http_uri; content:"pn="; nocase; http_uri; content:"aid="; nocase; http_uri; content:"said="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"directnameservice2008.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*directnameservice2008\x2ecom/smiH"; metadata:service http; reference:url,vil.nai.com/vil/content/v_144220.htm; classtype:successful-recon-limited; sid:13866; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger refog Keylogger runtime detection"; flow:to_server,established; content:"Content-Type|3A|"; nocase; content:"NextPart_2"; nocase; content:"REFOG log"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,secure.shareit.com/shareit/product.html?productid=219815&sessionid=890841208&random=d4da8e41f97c6c623e18f4b52ad63142; reference:url,www.refog.com; classtype:successful-recon-limited; sid:13812; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger kgb employee monitor runtime detection"; flow:to_server,established; content:" KGB log "; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/spydet_26548_kgb_employee_monitor.html; reference:url,www.spywareremove.com/removeKGBKeylogger.html; classtype:successful-recon-limited; sid:13778; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware syscleaner runtime detection - presale traffic"; flow:to_server,established; content:"/order.php?"; nocase; http_uri; content:"uid="; nocase; http_uri; content:"id="; nocase; http_uri; content:"context="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.sys-cleaner.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*www\x2Esys-cleaner\x2Ecom/smiH"; metadata:service http; reference:url,ca.com/us/securityadvisor/pest/pest.aspx?id=453123831; reference:url,spywaredetector.net/spyware_encyclopedia/Fake%20Anti%20Spyware.SysCleaner.htm; classtype:successful-recon-limited; sid:13776; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger cyber sitter runtime detection"; flow:to_server,established; flowbits:isset,cyberSitter_detection; content:"CYBERsitter"; nocase; content:"appears"; distance:0; nocase; content:"to"; distance:0; nocase; content:"be"; distance:0; nocase; content:"functioning"; distance:0; nocase; pcre:"/CYBERsitter\s+appears\s+to\s+be\s+functioning/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=CyberSitter&threatid=30845; reference:url,www.spywareguide.com/spydet_1056_cybersitter.html; classtype:successful-recon-limited; sid:13768; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger cyber sitter runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"CYBERsitter"; distance:0; nocase; content:"Report"; distance:0; nocase; content:"for|3A|"; distance:0; nocase; pcre:"/Subject\x3A[^\r\n]*CYBERsitter\s+Report\s+for\x3A/smi"; flowbits:set,cyberSitter_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13767; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger family cyber alert runtime detection - smtp traffic for recorded activities"; flow:to_server,established; content:"thread-index|3A| Acio"; nocase; content:"Subject|3A| Email from Family Cyber Alert"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Family%20Cyber%20Alert&threatid=48570; reference:url,www.ca.com/ca/en/securityadvisor/pest/pest.aspx?id=453117297; classtype:successful-recon-limited; sid:13651; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger easy Keylogger runtime detection"; flow:to_server,established; content:"DQp+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fg0KV2luZG93IFRpd"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Easy%20Keylogger&threatid=43573; reference:url,spywaresignatures.com/details.php?spyware=easykeyloggerfree5.0; classtype:successful-recon-limited; sid:13642; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger sys keylog 1.3 advanced runtime detection"; flow:to_server,established; content:"This is the file kept 'LOG', of the program Sys="; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Sys_Keylog&threatid=48624; reference:url,spywaredetector.net/spyware_encyclopedia/Spyware.SysKeylog.htm; classtype:successful-recon-limited; sid:13568; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger msn spy monitor runtime detection"; flow:to_server,established; content:"MSN Spy Monitor Logging Report"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=MSN%20Spy%20Monitor&threatid=41180; classtype:successful-recon-limited; sid:13567; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger smart pc Keylogger runtime detection"; flow:to_server,established; content:"Subject|3A| Smart PC Keylogger - Log File Mailing"; fast_pattern:only; content:"X-Mailer|3A| Smart PC Keylogger"; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Smart%20Pc%20Keylogger&threatid=48645; reference:url,www.ca.com/ca/en/securityadvisor/pest/pest.aspx?id=453124511; classtype:successful-recon-limited; sid:13494; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger findnot guarddog 4.0 runtime detection"; flow:to_server,established; flowbits:isset,FindNotGuardDog_detection; content:"X-Mailer|3A|"; nocase; content:"FindNot"; distance:0; nocase; content:"GuardDog"; distance:0; nocase; pcre:"/^X\x2DMailer\x3A[^\r\n]*FindNot\s+GuardDog/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=FindNot%20GuardDog&threatid=41463; reference:url,www.findnot.eu/pg_guarddog.htm; classtype:successful-recon-limited; sid:13480; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger findnot guarddog 4.0 runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:"|22|FindNot"; distance:0; nocase; content:"GuardDog|22|"; distance:0; nocase; pcre:"/^From\x3A[^\r\n]*\x22FindNot\s+GuardDog\x22/smi"; flowbits:set,FindNotGuardDog_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13479; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger email spy monitor 6.9 runtime detection"; flow:to_server,established; flowbits:isset,EmailSpyMonitor_detection; content:""; nocase; content:"Email"; distance:0; nocase; content:"Spy"; distance:0; nocase; content:"Monitor"; distance:0; nocase; content:"Logging"; distance:0; nocase; content:"Report"; distance:0; nocase; content:""; distance:0; nocase; pcre:"/\x3CTitle\x3EEmail\s+Spy\s+Monitor\s+Logging\s+Report\x3C\x2Ftitle\x3E/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,ca.com/us/securityadvisor/pest/pest.aspx?id=453122634; reference:url,www.spywareremove.com/removeEmailSpyMonitor.html; classtype:successful-recon-limited; sid:13281; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger email spy monitor 6.9 runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Chilkat"; distance:0; nocase; content:"Software"; distance:0; nocase; content:"Inc"; distance:0; nocase; pcre:"/^X\x2DMailer\x3A[^\r\n]*Chilkat\s+Software\s+Inc/smi"; flowbits:set,EmailSpyMonitor_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13280; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger advanced spy 4.0 runtime detection"; flow:to_server,established; flowbits:isset,AdvancedSpy_detection; content:"filename="; nocase; content:"|22|as_report_"; distance:0; nocase; content:".zip|22|"; distance:0; nocase; pcre:"/filename\s*\x3D\s*\x22as\x5Freport\x5F[^\x22]+\x2Ezip\x22/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Advanced%20Spy&threatid=127939; reference:url,www.advancedspy.net/; classtype:successful-recon-limited; sid:13279; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger advanced spy 4.0 runtime detection"; flow:to_server,established; content:"Advanced"; nocase; content:"Spy"; distance:0; nocase; content:"Report"; distance:0; nocase; content:"for"; distance:0; nocase; pcre:"/Advanced\s+Spy\s+Report\s+for/smi"; flowbits:set,AdvancedSpy_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13278; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger computer monitor 1.1 by lastcomfort runtime detection"; flow:to_server,established; flowbits:isset,ComputerMonitor11_detection; content:"Computer"; nocase; content:"Monitor"; distance:0; nocase; content:"by"; distance:0; nocase; content:"Lastcomfort"; distance:0; nocase; pcre:"/Computer\s+Monitor\s+by\s+Lastcomfort/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Computer%20Monitor&threatid=48576; classtype:successful-recon-limited; sid:13244; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger computer monitor 1.1 by lastcomfort runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Computer"; distance:0; nocase; content:"Monitor"; distance:0; nocase; pcre:"/^X-Mailer\x3A[^\r\n]*Computer\s+Monitor/smi"; flowbits:set,ComputerMonitor11_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13243; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger active Keylogger 3.9.2 runtime detection"; flow:to_server,established; flowbits:isset,ActiveKeylogger392_detection; content:"filename=|22|"; nocase; content:"akllogs.zip|22|"; distance:0; nocase; pcre:"/filename\x3D\x22[^\r\n]*akllogs\x2Ezip\x22/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Active%20Key%20Logger&threatid=1622; classtype:successful-recon-limited; sid:13237; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger active Keylogger 3.9.2 runtime detection"; flow:to_server,established; content:"Attached"; nocase; content:"|28|ZIP"; distance:0; nocase; content:"file|29|"; distance:0; nocase; content:"to"; distance:0; nocase; content:"this"; distance:0; nocase; content:"email"; distance:0; nocase; content:"are"; distance:0; nocase; content:"the"; distance:0; nocase; content:"activity"; distance:0; nocase; content:"logs"; distance:0; nocase; content:"that"; distance:0; nocase; content:"you"; distance:0; nocase; content:"have"; distance:0; nocase; content:"requested."; distance:0; nocase; pcre:"/Attached\s+\x28ZIP\s+file\x29\s+to\s+this\s+email\s+are\s+the\s+activity\s+logs\s+that\s+you\s+have\s+requested\x2E/smi"; flowbits:set,ActiveKeylogger392_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:13236; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spy lantern Keylogger pro 6.0 runtime detection"; flow:to_server,established; flowbits:isset,SpyLanternKeylogger6_detection; content:"filename=|22|"; nocase; content:".ltr"; distance:0; nocase; pcre:"/filename\x3D\x22[^\r\n]*\x2Eltr\x22/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Spy%20Lantern%20Keylogger&threatid=29156; classtype:successful-recon-limited; sid:12793; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spy lantern Keylogger pro 6.0 runtime detection"; flow:to_server,established; content:"Attachment"; nocase; content:"contains"; distance:0; nocase; content:"Spy"; distance:0; nocase; content:"Lantern"; distance:0; nocase; content:"Keylogger"; distance:0; nocase; content:"log"; distance:0; nocase; content:"file"; distance:0; nocase; pcre:"/Attachment\s+contains\s+Spy\s+Lantern\s+Keylogger.*log\s+file\x2E/smi"; flowbits:set,SpyLanternKeylogger6_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12792; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware partypoker runtime detection"; flow:to_server,established; content:"/utility/client/images/ProductVersion.txt"; fast_pattern; nocase; http_uri; content:"Host|3A| www.partycasino.com"; nocase; metadata:service http; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=PartyPoker&threatid=44086; classtype:successful-recon-limited; sid:12790; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger powered Keylogger 2.2 runtime detection"; flow:to_server,established; flowbits:isset,PoweredKeylogger22_detection; content:"Please,"; nocase; content:"find"; distance:0; nocase; content:"the"; distance:0; nocase; content:"log"; distance:0; nocase; content:"file"; distance:0; nocase; content:"|28|PKL|29|"; distance:0; nocase; content:"attached"; distance:0; nocase; content:"to"; distance:0; nocase; content:"this"; distance:0; nocase; content:"e-mail."; distance:0; nocase; pcre:"/Please\x2C\s+find\s+the\s+log\s+file\s+\x28PKL\x29\s+attached\s+to\s+this\s+e\x2Dmail\x2E/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.ca.com/securityadvisor/pest/pest.aspx?id=453097852; classtype:successful-recon-limited; sid:12761; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger powered Keylogger 2.2 runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Powered"; distance:0; nocase; content:"Keylogger"; distance:0; nocase; content:"Logs"; distance:0; nocase; pcre:"/^Subject\x3A[^\r\n]*Powered\s+Keylogger\s+Logs/smi"; flowbits:set,PoweredKeylogger22_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12760; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger/RAT digi watcher 2.32 runtime detection"; flow:to_server,established; flowbits:isset,DigiWatcher232_detection; content:"Motion"; nocase; content:"detected!"; distance:0; nocase; content:"Watcher"; distance:0; nocase; content:"PC"; distance:0; nocase; content:"IP"; distance:0; nocase; content:"address|3A|"; distance:0; nocase; pcre:"/Motion\s+detected\x21/smi"; pcre:"/Watcher\s+PC\s+IP\s+address\x3A/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.ca.com/ca/en/securityadvisor/pest/pest.aspx?id=453119363; classtype:successful-recon-limited; sid:12759; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger/RAT digi watcher 2.32 runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:"Digi-Watcher.com"; distance:0; nocase; pcre:"/^From\x3A[^\r\n]*Digi\x2DWatcher\x2Ecom/smi"; flowbits:set,DigiWatcher232_detection; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12758; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger net vizo 5.2 runtime detection"; flow:to_server,established; content:"This is an alert notification from NetVizor"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,ca.com/us/securityadvisor/pest/pest.aspx?id=453097457; classtype:successful-recon-limited; sid:12698; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware browser accelerator runtime detection - pass user information to server"; flow:to_server,established; content:"/data/track.aspx"; nocase; http_uri; content:"Host|3A| data.browseraccelerator.com"; fast_pattern:only; metadata:service http; reference:url,www.spywareguide.com/spydet_1253_browseracclerator.html; classtype:successful-recon-limited; sid:12697; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger windows family safety 2.0 runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Windows Supervisor Report"; distance:0; nocase; content:"Windows Family Safety"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453117306; classtype:successful-recon-limited; sid:12625; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger inside website logger 2.4 runtime detection"; flow:to_server,established; content:"Subject|3A| Email Reports from Inside Website Logger"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.programurl.com/inside-website-logger.htm; classtype:successful-recon-limited; sid:12480; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 20 (msg:"MALWARE-OTHER Keylogger PaqKeylogger 5.1 runtime detection - ftp"; flow:to_client,established; content:"version 4.0 key|3A 0D 0A|~~~~~~~~~~~~~~~~~~~~~~~~~~"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=2709; classtype:successful-recon-limited; sid:12379; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger mg-shadow 2.0 runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Mailer"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*Mailer/smi"; content:"+++ MG-Shadow 2.0"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,tweakyourwindows.com/Software-Details/19993/MGShadow-Computer-monitoring-software.html; reference:url,www.softpedia.com/progDownload/MGShadow-Download-44651.html; classtype:successful-recon-limited; sid:12372; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger overspy runtime detection"; flow:to_server,established; content:"Subject|3A| OverSpy Surveillance Data"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,secunia.com/virus_information/27591/spyware-overspy/; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-021412-4303-99; classtype:successful-recon-limited; sid:12226; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger logit v1.0 runtime detection"; flow:to_server,established; content:"Subject|3A| Logger Results"; nocase; content:"|0D 0A 0D 0A|<|7C|"; distance:0; content:"|7C|>|0D 0A 0D 0A|"; distance:0; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.trojanfrance.com/index.php?dir=KeyLoggers/; classtype:successful-recon-limited; sid:12141; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Trackware stealth website logger 3.4 runtime detection"; flow:to_server,established; content:"Subject|3A| Email Reports from Stealth Website Logger"; fast_pattern:only; metadata:service smtp; reference:url,www.programurl.com/stealth-website-logger.htm; classtype:successful-recon-limited; sid:12139; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger Keylogger king home 2.3 runtime detection"; flow:to_server,established; content:"|0D 0A|King log|0D 0A||0D 0A|"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097591; classtype:successful-recon-limited; sid:12137; rev:7;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - fun"; flow:to_client,established; flowbits:isset,RemoteKeyLog.b.Fun_detection; content:"WND"; depth:3; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Remote%20Keylogger&threatid=10445; reference:url,www.downloadtopc.com/spywareadware/993/3560/Win32RemoteKeyLogb.html; classtype:successful-recon-limited; sid:12136; rev:4;) alert tcp $EXTERNAL_NET any -> $HOME_NET 456 (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - fun"; flow:to_server,established; content:"fun"; depth:3; flowbits:set,RemoteKeyLog.b.Fun_detection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12135; rev:4;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - open url"; flow:to_client,established; flowbits:isset,RemoteKeyLog.b.Url_detection; content:"WND"; depth:3; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Remote%20Keylogger&threatid=10445; reference:url,www.downloadtopc.com/spywareadware/993/3560/Win32RemoteKeyLogb.html; classtype:successful-recon-limited; sid:12134; rev:5;) alert tcp $EXTERNAL_NET any -> $HOME_NET 456 (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - open url"; flow:to_server,established; content:"url"; depth:3; flowbits:set,RemoteKeyLog.b.Url_detection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12133; rev:4;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - keylogging"; flow:to_client,established; flowbits:isset,RemoteKeyLog.b.Keylogging_detection; content:"KEY"; depth:3; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Remote%20Keylogger&threatid=10445; reference:url,www.downloadtopc.com/spywareadware/993/3560/Win32RemoteKeyLogb.html; classtype:successful-recon-limited; sid:12132; rev:5;) alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - keylogging"; flow:to_client,established; content:"WND"; depth:3; flowbits:set,RemoteKeyLog.b.Keylogging_detection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12131; rev:4;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - get sys info"; flow:to_client,established; flowbits:isset,RemoteKeyLog.b.Info_detection; content:"Product Name"; depth:12; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Remote%20Keylogger&threatid=10445; reference:url,www.downloadtopc.com/spywareadware/993/3560/Win32RemoteKeyLogb.html; classtype:successful-recon-limited; sid:12130; rev:4;) alert tcp $EXTERNAL_NET any -> $HOME_NET 456 (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - get sys info"; flow:to_server,established; content:"info"; depth:4; flowbits:set,RemoteKeyLog.b.Info_detection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:12129; rev:4;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger remotekeylog.b runtime detection - init connection"; flow:to_client,established; content:"WNDkServer"; depth:10; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Remote%20Keylogger&threatid=10445; reference:url,www.downloadtopc.com/spywareadware/993/3560/Win32RemoteKeyLogb.html; classtype:successful-recon-limited; sid:12128; rev:4;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger apophis spy 1.0 runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"A-Spy"; distance:0; nocase; content:"Server"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*A-Spy[^\r\n]*Server/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453072636; classtype:successful-recon-limited; sid:12049; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger computer Keylogger runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"ComputerKeylogger.com"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*ComputerKeylogger\x2Ecom/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098303; classtype:successful-recon-limited; sid:12048; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware uplink runtime detection"; flow:to_server,established; content:"/Response2.aspx"; fast_pattern; nocase; http_uri; content:"mac="; nocase; http_uri; content:"myadid="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"uplink.co.kr"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*uplink\x2Eco\x2Ekr/smiH"; metadata:service http; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2007-031317-1701-99&tabid=1; classtype:successful-recon-limited; sid:11312; rev:13;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Keylogger pcsentinelsoftware Keylogger runtime detection - upload infor"; flow:to_server,established; content:"/upload.php"; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.pcsentinelsoftware.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*www\x2Epcsentinelsoftware\x2Ecom/smiH"; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.pcsentinelsoftware.com; classtype:successful-recon-limited; sid:11311; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger sskc v2.0 runtime detection"; flow:to_server,established; content:"SSKC"; nocase; content:"v2.0"; distance:0; nocase; content:"Startup"; distance:0; nocase; content:"at"; distance:0; nocase; pcre:"/^SSKC[^\r\n]*v2\x2E0[^\r\n]*Startup[^\r\n]*at/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076545; classtype:successful-recon-limited; sid:11309; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger computer monitor Keylogger runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Computer"; distance:0; nocase; content:"Monitor"; distance:0; nocase; content:"Keylogger"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*Computer[^\r\n]*Monitor[^\r\n]*Keylogger/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097349; classtype:successful-recon-limited; sid:11307; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger pc black box runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"PC"; distance:0; nocase; content:"Black"; distance:0; nocase; content:"Box"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*PC[^\r\n]*Black[^\r\n]*Box/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=PC%20Black%20Box&threatid=117239; classtype:successful-recon-limited; sid:10440; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger keyspy runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"mail"; distance:0; nocase; content:"function"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*mail\s+function/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=3266; classtype:successful-recon-limited; sid:10436; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware admedia runtime detection"; flow:to_server,established; content:"/hzyt/client/procpost.aspx"; fast_pattern; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.ccnnlc.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*www\x2Eccnnlc\x2Ecom/smiH"; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098012; classtype:successful-recon-limited; sid:10435; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger activity Keylogger runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Activity"; distance:0; nocase; content:"Keylogger"; distance:0; nocase; content:"Logs"; distance:0; nocase; pcre:"/^Subject\x3a[^\r\n]*Activity[^\r\n]*Keylogger[^\r\n]*Logs/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097325; classtype:successful-recon-limited; sid:10183; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger systemsleuth runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"SystemSleuth"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*SystemSleuth/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097306; classtype:successful-recon-limited; sid:10181; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 20 (msg:"MALWARE-OTHER Keylogger radar spy 1.0 runtime detection - send html log"; flow:to_client,established; content:"New Page 1"; nocase; content:"Log Started |3A|"; distance:0; fast_pattern; nocase; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453079942; classtype:successful-recon-limited; sid:10167; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware baigoo runtime detection"; flow:to_server,established; content:"/sszsex.html"; nocase; http_uri; content:"src="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"ver="; nocase; http_uri; content:"dm="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"client.baigoo.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*client\x2Ebaigoo\x2Ecom/smiH"; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098801; classtype:successful-recon-limited; sid:10166; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger mybr Keylogger runtime detection"; flow:to_server,established; content:"From|3A D0 C5 CF A2|"; fast_pattern:only; content:"Subject|3A|"; nocase; pcre:"/^From\x3a\xd0\xc5\xcf\xa2.*Subject\x3a[^\r\n]*\d+\x2d\d+\x2d\d+\x2d\d+\x3a\d+\x3a\d+/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.hack77.com/Soft/hkgj/jpjl/200701/2844.html; classtype:successful-recon-limited; sid:10165; rev:8;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win32.remotekeylog.b runtime detection - open website"; flow:to_client,established; flowbits:isset,Win32.RemoteKeylog.b.website; content:"WNDMicrosoft"; depth:12; nocase; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075959; classtype:successful-recon-limited; sid:10100; rev:7;) alert tcp $EXTERNAL_NET any -> $HOME_NET 456 (msg:"MALWARE-OTHER Keylogger win32.remotekeylog.b runtime detection"; flow:to_server,established; content:"url"; depth:3; nocase; flowbits:set,Win32.RemoteKeylog.b.website; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:10099; rev:5;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win32.remotekeylog.b runtime detection - get system info"; flow:to_client,established; flowbits:isset,Win32.RemoteKeylog.b.info; content:"Product"; depth:7; nocase; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075959; classtype:successful-recon-limited; sid:10098; rev:7;) alert tcp $EXTERNAL_NET any -> $HOME_NET 456 (msg:"MALWARE-OTHER Keylogger win32.remotekeylog.b runtime detection"; flow:to_server,established; content:"info"; depth:4; nocase; flowbits:set,Win32.RemoteKeylog.b.info; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:10097; rev:5;) # alert tcp $HOME_NET 456 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win32.remotekeylog.b runtime detection - keylog"; flow:to_client,established; content:"KEY"; depth:3; nocase; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075959; classtype:successful-recon-limited; sid:10096; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware bydou runtime detection"; flow:to_server,established; content:"/pra.php?"; nocase; http_uri; content:"url="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.bydou.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*www\x2Ebydou\x2Ecom/smiH"; metadata:service http; reference:url,bbs.360safe.com/viewthread.php?tid=58707; classtype:successful-recon-limited; sid:10095; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware russian searchbar runtime detection"; flow:to_server,established; content:"referer="; nocase; http_uri; content:"show="; nocase; http_uri; content:"Host|3A| bar-navig.yandex.ru"; fast_pattern:only; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453079056; classtype:successful-recon-limited; sid:10092; rev:12;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger beyond Keylogger runtime detection - log sent by ftp"; flow:to_server,established; content:"Open Beyond Keylogger"; fast_pattern:only; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453097340; classtype:successful-recon-limited; sid:10089; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger beyond Keylogger runtime detection - log sent by smtp"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Beyond"; distance:0; nocase; content:"Keylogger"; distance:0; nocase; content:"Report"; distance:0; nocase; pcre:"/^Subject\x3a[^\r\n]*Beyond\s+Keylogger\s+Report\x2E\s+Id\x3d\x5b.*\x5d/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097340; classtype:successful-recon-limited; sid:10088; rev:9;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i45MQBVUFghDQkCCOqHqPmgGbzTU9IAAA1jAAAArAAAJgAACWwe"; metadata:service smtp; classtype:trojan-activity; sid:10083; rev:8;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i4wMwBVUFghDQkCCHAOKRNyQeuyBeMAAHBsAAAAwgAAJgAA76VO"; metadata:service smtp; classtype:trojan-activity; sid:10082; rev:8;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i4wMwBVUFghDQkCCHAOKRNyQeuyBeMAAHBsAAAAwgAAJgAA7/2n"; metadata:service smtp; classtype:trojan-activity; sid:10081; rev:8;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i45MQBVUFghDQkICEywTzzbc2+gVYUVAIGpAAAA2AAAJgAARC1i"; metadata:service smtp; classtype:trojan-activity; sid:10080; rev:8;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i45MQBVUFghDQkICEywTzzbc2+gVYUVAIGpAAAA2AAAJgAARIj9"; metadata:service smtp; classtype:trojan-activity; sid:10079; rev:8;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER W32.Nuwar.AY smtp propagation detection"; flow:to_server,established; content:"i45MQBVUFghDQkICKDx6PZ9cWtlZzUVAMY0AAAAZAAAJgAAqwTm"; metadata:service smtp; classtype:trojan-activity; sid:10078; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger supreme spy runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Supreme"; distance:0; nocase; content:"Spy"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*Supreme\s+Spy/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097729; classtype:successful-recon-limited; sid:9830; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware relevantknowledge runtime detection"; flow:to_server,established; content:"/oss/"; nocase; http_uri; content:"X-OSSProxy|3A|"; nocase; http_header; content:"OSSProxy"; nocase; http_header; pcre:"/^X-OSSproxy\x3a[^\r\n]*OSSProxy/smiH"; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097949; classtype:successful-recon-limited; sid:9829; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 20 (msg:"MALWARE-OTHER Keylogger paq keylog runtime detection - ftp"; flow:to_client,established; content:"version"; nocase; content:"key"; distance:0; nocase; pcre:"/^version\s+\d+\x2E\d+\s+key\x3a/smi"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098520; classtype:successful-recon-limited; sid:9828; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger paq keylog runtime detection - smtp"; flow:to_server,established; content:"Subject|3A|"; nocase; content:".l|0D 0A|"; within:200; fast_pattern; nocase; pcre:"/^Subject\x3a[^\r\n]*20\d{3,4}\x5f[123]?\d\x2El/mi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098520; classtype:successful-recon-limited; sid:9827; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger ghost Keylogger runtime detection"; flow:to_server,established; flowbits:isset,ghost_keylogger_start; content:"[Static"; nocase; content:"Text]"; distance:0; nocase; pcre:"/^\s*\x5BStatic\s+Text\x5D/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=70892; classtype:successful-recon-limited; sid:9650; rev:9;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger ghost Keylogger runtime detection - flowbit set"; flow:to_server,established; content:"|23|"; nocase; content:"Ghost"; distance:0; nocase; content:"keylogger"; distance:0; nocase; content:"has"; distance:0; nocase; content:"started"; distance:0; nocase; pcre:"/^\x23\s+Ghost\s+Keylogger\s+has\s+started\x2E/smi"; flowbits:set,ghost_keylogger_start; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=70892; classtype:successful-recon-limited; sid:9649; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger emailspypro runtime detection"; flow:to_server,established; content:"X-FILTERED-BY-GHOST|3A|"; fast_pattern:only; content:"1"; pcre:"/^X-FILTERED-BY-GHOST\x3a[^\r\n]*1/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453083347; classtype:successful-recon-limited; sid:9648; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger system surveillance pro runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"System"; distance:0; nocase; content:"Surveillance"; distance:0; nocase; content:"Log"; distance:0; nocase; content:"Open"; nocase; content:"log"; distance:0; nocase; content:"file"; distance:0; nocase; content:"import"; distance:0; nocase; pcre:"/^Subject\x3a[^\r\n]*System\s+Surveillance\s+Log/smi"; pcre:"/^Open\s+log\s+file\s+to\s+import/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098658; classtype:successful-recon-limited; sid:9647; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mydoom.ap attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; nocase; content:"Received message is available at"; metadata:service smtp; classtype:trojan-activity; sid:9426; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky attachment"; flow:to_server,established; content:"Content-Disposition|3A|"; nocase; content:"OsrkDtNPNg9Xj38hSOB7pKSR+RzaaUnt5GIvg8wXTYQPiLhBPWmLUXYLSN2KDpF0AWHCd8Po"; metadata:service smtp; classtype:trojan-activity; sid:9425; rev:11;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"MALWARE-OTHER /winnt/explorer.exe unicode klez infection"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/sR"; byte_test:4,&,2,28,little,relative; content:"|5C 00|w|00|i|00|n|00|n|00|t|00 5C 00|e|00|x|00|p|00|l|00|o|00|r|00|e|00|r|00|.|00|e|00|x|00|e|00 00 00|"; within:41; distance:51; nocase; classtype:trojan-activity; sid:9424; rev:9;) alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"MALWARE-OTHER lovegate attempt"; flow:to_server,established; dce_iface:000001a0-0000-0000-c000-000000000046; dce_opnum:4; dce_stub_data; content:"F|00|X|00|N|00|B|00|F|00|X|00|F|00|X|00|N|00|B|00|F|00|X|00|F|00|X|00|F|00|X|00|F|00|X|00|"; content:"|9F|u|18 00|"; within:4; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,8205; reference:cve,2003-0352; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-026; classtype:trojan-activity; sid:9423; rev:9;) alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"MALWARE-OTHER msblast attempt"; flow:to_server,established; dce_iface:000001a0-0000-0000-c000-000000000046; dce_opnum:4; dce_stub_data; content:"F|00|X|00|N|00|B|00|F|00|X|00|F|00|X|00|N|00|B|00|F|00|X|00|F|00|X|00|F|00|X|00|F|00|X|00|"; content:"|9D 13 00 01|"; within:4; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,8205; reference:cve,2003-0352; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-026; classtype:trojan-activity; sid:9422; rev:9;) alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"MALWARE-OTHER zotob attempt"; flow:to_server,established; dce_iface:8d9f4e40-a03d-11ce-8f69-08003e30051b; dce_opnum:54; dce_stub_data; content:"|C0 07 00 00 00 00 00 00|"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:bugtraq,14513; reference:cve,2005-1983; reference:url,technet.microsoft.com/en-us/security/bulletin/ms05-039; classtype:trojan-activity; sid:9421; rev:12;) alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"MALWARE-OTHER korgo attempt"; flow:to_server,established; dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; dce_opnum:9; dce_stub_data; content:"|AD 0D 00 00|"; depth:4; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,10108; reference:cve,2003-0533; reference:nessus,12205; reference:url,technet.microsoft.com/en-us/security/bulletin/MS04-011; classtype:trojan-activity; sid:9420; rev:12;) alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"MALWARE-OTHER sasser attempt"; flow:to_server,established; dce_iface:3919286a-b10c-11d0-9ba8-00c04fd92ef5; dce_opnum:9; dce_stub_data; content:"|EC 03 00 00|"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,10108; reference:cve,2003-0533; reference:nessus,12205; reference:url,technet.microsoft.com/en-us/security/bulletin/MS04-011; classtype:trojan-activity; sid:9419; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.a smtp propagation detection"; flow:to_server,established; content:"aWNyb3NvZnQAQGF2cC4AACVzP3A9JWx1JmlkPSVzAGh0dHA6Ly93d3cuZWxyYXNzaG9wLmRl|0D 0A|LzEucGhwAGh0dHA6Ly93d3cuaXQtbXNjLmRlLzEucGhwAGh0dHA6Ly93d3cuZ2V0eW91cmZy"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32baglea.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-011815-3332-99&tabid=2; classtype:trojan-activity; sid:9417; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.at smtp propagation detection"; flow:to_server,established; content:"CFzisjUEyJsg4LLn9YPllwezsmCH/FoLDp8ttt5rlq2cy18Y2O3lemS1iy+B35D9veT2X3ys|0D 0A|6mupMisPtw82NJQBvU4U30nV3kdI4KNtHjiz9AUOmU+oQYcw9M3v9pJHb2MNmFxxkYvyqDWc"; metadata:service smtp; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.AT; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=41539; classtype:trojan-activity; sid:9416; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER plexus.a smtp propagation detection"; flow:to_server,established; content:"YGVjaG9yIHdwdW4zJXMGZNs+6WEKUxRsRxYMIXDnZ2d04XN1cMku+XjqlhcKcXVpdA9HZoxeLSBzOowm80FoWlbIUi0/SXKAZnZiYTogMQYuMA"; metadata:service smtp; reference:url,vil.nai.com/vil/content/v_126116.htm; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=39272; classtype:trojan-activity; sid:9415; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lovelorn.a smtp propagation detection"; flow:to_server,established; content:"dGpuby9meWYAT1VUTE9PSy5FWEVOZXRDYXB0b3IuZXhlbWlyYzMyLmV4ZWFpbS5leGVZcGFnZXIu|0D 0A|ZXhlAHV2anNidWRpYm9kdnBkZXBqb2J6QXpiaXBwL2RwbgBOUUhfTE9WRQBsb3ZlX2xvcm5AeWFo|0D 0A|b28uY29tAE5RSF9MT1ZFTE9STgB0aHV5cXV5ZW5AeWFob28uY29tAE5RSABsb3ZlbG9ybkB5YWhv"; metadata:service smtp; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=35041; classtype:trojan-activity; sid:9414; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER ganda smtp propagation detection"; flow:to_server,established; content:"cXJ1dmFiemFickBob3RtYWlsLmNvbT4NCgA8cmVkQGZuYS5zZT4N|0D 0A|CgA8ZGViYXR0QHN2dC5zZT4NCgA8c3VzYW5uZS5zam9zdGVkdEB0aWRuaW5nZW4udG8+DQoAPHNr|0D 0A|b2x2ZXJrZXRAc2tvbHZlcmtldC5zZT4NCgA8bWFyeS5tYXJ0ZW5zc29uQGFmdG9uYmxhZGV0LnNl"; metadata:service smtp; reference:url,www.sophos.com/security/analyses/w32gandaa.html; classtype:trojan-activity; sid:9413; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"MALWARE-OTHER sinmsn.b msn propagation detection"; flow:to_server,established; content:"Application-File|3A| smb.exe"; nocase; content:"Application-FileSize|3A| 163840"; nocase; reference:url,www.f-secure.com/v-descs/smibag.shtml; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=23776; classtype:trojan-activity; sid:9412; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.f smtp propagation detection"; flow:to_server,established; content:"on0MCbCSCWxk8BZK8Pbft5+D4wPB489V8IHiOMH6BAnTW7+wrVyDUyk0xgQ+PTmyb2URwUKK|0A|"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-110414-0652-99&tabid=2; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FMIMAIL%2EF&VSect=T; classtype:trojan-activity; sid:9411; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.z smtp propagation detection"; flow:to_server,established; content:"CpDwPVgF2ygS8h34dA18deYVsUYkiCjCrsbvJAcQwjPoYwKqVdMfCFQH/RrpYmxALn3s4A8S|0D 0A|hAMBMRpXBAZoVgfiM0gukIQZD8YQg+h6M3huCoaqDMuXcF0x"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-042110-2302-99&tabid=2; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=38949; classtype:trojan-activity; sid:9410; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER atak.b smtp propagation detection"; flow:to_server,established; content:"OsJMFEHYgBh19HlTYBliOtoPlfhIFVsjwTiRgBgMU+ZVSARWhclXidGWdED5LdJLArJcQ1DSfENl|0D 0A|cmgc0ooDhxdHUODyQ//V6tBJVtc2IBPS7SAmCAw7wXUWiRzJMEgI5UA/pM45Gl1qDJkPuJI/4V6j"; metadata:service smtp; reference:url,www.sophos.com/security/analyses/w32atakb.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-120309-3312-99&tabid=2; classtype:trojan-activity; sid:9409; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lacrow smtp propagation detection"; flow:to_server,established; content:"ZT0iTVMtNTYwOTVNX1BBVENILmV4ZSINCgAAAP////8XAAAAQ29udGVudC1JRDogPFNPTUVDSUQ+DQoA/////w4AAAAtLS0tQUJDREVGLS0NCgAA/////wUAAAANCi4NCgAAAP////8GAAAAUVVJVA0KAABDOlxNUy01NjA5NU1fUEFUQ0guZXhlAAD/////EwAAAEM6XExpc3Rl"; metadata:service smtp; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=W32.Lacrow@mm&threatid=53187; classtype:trojan-activity; sid:9408; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 139 (msg:"MALWARE-OTHER lovgate.b netshare propagation detection"; flow:to_server,established; content:"|F7|F|DA C4|D|22|A|AB E6 0D AA 10 17 A5 9F|=|90 B6|D7|AD F6 EE|UN|E5 17|rx|B7|v|E1 94 C7 8C|Q9y|A1 D9 C9|wL|E2 94|Q|7C 0F|6QA6|02|Y|D4 D2 B0 C9|k|C5|r|B9|m|81 DE|'|08 D8 DB 1B A4 99 AC EB 08 BD A7 24|G|8C BC 07 0D E5 06 7F|3|80 0A|T3|90|B|7F 0F|V|95|m|0D 16|g|0A|Y|CB CF 18 FF CB CA|Z|01|_|DE|Z52|0C|Y|CE|Y|1F|&|8C|W|B0 14|u|5C 88 B1 B0 EB C3|<|84 B4|h|D4|>|B8 1E 0F A6|~"; reference:url,www.sophos.com/virusinfo/analyses/w32lovgateb.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-021922-4852-99&tabid=2; classtype:trojan-activity; sid:9407; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lovgate.e smtp propagation detection"; flow:to_server,established; content:"OziaMMstyp3ZvEfNLZDdGUotsJcU9AUzGyIbVCkkslc8AX44pHVQ7cFVd7zMsneJSAaBvoS3iUeo|0D 0A|hlEQ24NXuyvw8X2q88Vmjnqxjk0ouK8Fqb71DLdEZ2FbTDGrGuRodeFwiNi+pKq863l"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32lovgatee.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-030416-4942-99&tabid=2; classtype:trojan-activity; sid:9406; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.ac smtp propagation detection"; flow:to_server,established; content:"cG51RlelhMtbU7QpjWKxOTvQLS+4wB20IzjrIlOWMc5XP3AcIgGMOETE8DI5fRIUfhDaJzhT|0D 0A|RPRpWWAQFKHEl02LHRYUHOqsbkd8SKZGHURgndMOfSCyIMVz/7cu1hIk3EZ8IEmLghDkO9/D"; metadata:service smtp; reference:url,www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=det&idvirus=46889; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=39026; classtype:trojan-activity; sid:9404; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.aa smtp propagation detection"; flow:to_server,established; content:"NNQX1qMoBi2hCzN5hBb/0LqoYbyhKHgQBVpTEUeLLRgDTO6MTZFsBeto+Gr/qFzvz1uPXM5c|0D 0A|j1s8XFzuo1yuz1ysXPhc81zPXDxcXPNcz1w6XOs7XDxcXPNcz1yuzl7jXu4+XTpePF1d8136"; metadata:service smtp; reference:url,www.sophos.com/security/analyses/w32netskyaa.html; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FNETSKY%2EAA&VSect=T; classtype:trojan-activity; sid:9403; rev:11;) # alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"MALWARE-OTHER welchia tftp propagation detection"; flow:to_server; content:"C|BB 0E|Gy3a38DM4|EC|5e|C2 0A 86 0B|Yde|02 EE|s|EB 18 0A B9|S9Cb|05|Zk|ED|F|29|cf|0D|dl|08|5u@|EB E7|8sm-95|23 AC|p+%|1D|3f|F1|s|FF 03|-|09 CD 00|q -i %s <|02 03 F2|get nSVC|80 C0 CA 96|/|29 D6|b|80 C0| |9E CF 24 BE|-|EB D6|w&k |A9|8Shar|F0 D6 80 DD|+g|00|l|00 EC|DTCo|24 D0|L|07|B|FA 13|j|EF|"; reference:url,www.pchell.com/virus/welchia.shtml; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-081815-2308-99&tabid=2; classtype:trojan-activity; sid:9402; rev:10;) # alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER gokar http propagation detection"; flow:to_client,established; file_data; content:"|0B|Bp|D6|p|00 C2 91 C5 83 DE 3B 08 C9| Ll|F8|l|18 F0 80|K!|89|.*|B0 AC 0C C8 08 88 93 E4|d1%7|DF BA 84 3A 3B|,|02 0C E7|,,8|80 D1 24 B1|j|10 D4 E0 E8|>B|C1 29 D3|I|F7 D8 1B C0 05 96 A4 D6 03 01 AE 7C 91 0F 9D A5 BA 95|F|8D 02|'n|99 8F E0 15 98 A0|j|FF FD BE|G|BE B3 EC A3 E1 17 C4|h|DC 3A|f|B8 02 F9 0E 81 CE E2 1B E4 10 13 C8 E7 E3 0C 3B E4 0C C6 01|`6h|D3|h|C0 98 99 87 8C 3B|V|D3|"; fast_pattern:only; metadata:service http; reference:url,www.f-secure.com/v-descs/gokar.shtml; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=10606; classtype:trojan-activity; sid:9401; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER abotus smtp propagation detection"; flow:to_server,established; content:"cPf//1ChHGtAAFDokPv//6Eca0AAUOh1+///i0UIuhhnQAC5AAQAAOhn9v//M8BaWVlkiRBonzpA|0D 0A|AI1F+LoCAAAA6E31///D6b/v///r61tZWV3CBACLwFWL7DPAVWjHOkAAZP8wZIkgM8BaWVlkiRBo"; metadata:service smtp; reference:url,www.isecuritysource.com/threats/worm/w32-abotus-worm-m.aspx; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2001-082919-3906-99&tabid=2; classtype:trojan-activity; sid:9400; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER hanged smtp propagation detection"; flow:to_server,established; content:"AExhWABYYUwAWGFMAE5ld19GYW1vdVNfR2lyTHMAQS5TLk4uAFNNVFA6VGhlX0hhbmdlZEBqYXp6|0D 0A|ZnJlZS5jb20AU01UUDpUaGVfSGFuZ2VkQGhvdG1haWwuY29tAFNleF9TcGFtXyxfRXhjdXNFX01l"; metadata:service smtp; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Email-Worm.Win32.Hanged&threatid=81170; reference:url,www.emsisoft.com/en/malware/?Worm.Win32.Hanged; classtype:trojan-activity; sid:9399; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER totilix.a smtp propagation detection"; flow:to_server,established; content:"YjpDKytIT09LkOkckUAAoQ+RQADB4AKjE5FAAFJqAOglfQAAi9DoMhgAAFroyAsAAOgrGAAAagDo|0D 0A|PCQAAFlouJBAAGoA6P98AACjF5FAAGoA6ddeAADpaiQAADPAoAGRQADDoReRQADDYLsAULC8U2it"; metadata:service smtp; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Worm.Totilix.a&threatid=6703; reference:url,www.viruslist.com/en/viruslist.html?id=4097; classtype:trojan-activity; sid:9398; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER neysid smtp propagation detection"; flow:to_server,established; content:"1eO8sLlq7UIor1GwCmto7XsiMt9GchrcNlbVPh1GT18n0EDLTWKdYxpB5nZPeoxCHDzQuKOyEtsb|0D 0A|MCqnv2Y1wJoGWMGEslVIzj05hLSGDTLIbGy0uaslY66ENTqEiiXk5HxsL8KRnL2EpjwzDZScLR3G"; metadata:service smtp; reference:url,www.logiguard.com/spyware/i/i-worm-neysid.htm; reference:url,www.spywareremove.com/removeIWormNeysid.html; classtype:trojan-activity; sid:9397; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.t netshare propagation detection"; flow:to_server,established; content:"C|80 EA 01 A1 EC|GB|00 8B|H|10 88|QC|8B 15 EC|GB|00 8B|B|10 0F BE|HC|85 C9|u|14 8B 15 EC|GB|00 8B|B|04 24 FE 8B 0D EC|GB|00 89|A|04 8B 15 EC|GB|00 83|z|08 FF 0F 85 92 00 00 00|h|00 80 00 00|j|00 A1 EC|GB|00 8B|H|0C|Q|FF 15 1C|cB|00 8B 15 EC|GB|00 8B|B|10|Pj|00 8B 0D E4|]B|00|Q|FF 15|4cB|00 8B 15 F0|GB|00|k|D2 14 A1 F4|GB|00 03 C2 8B 0D EC|GB|00 83 C1 14|+|C1|P|8B 15 EC|GB|00 83 C2 14|R|A1 EC|GB|00|P|E8|Z%|00 00 83 C4 0C 8B 0D F0|GB|00 83 E9 01 89 0D F0|GB|00 8B|U|08 3B 15 EC|GB|00|v"; reference:url,www.softwaretipsandtricks.com/virus/64865-DebormT.html; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=24669; classtype:trojan-activity; sid:9396; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.j netshare propagation detection"; flow:to_server,established; content:"@|00|@|3B C7|v|F5|AA|80|9|00|u|D4 FF|E|FC 83 C3 08 83|}|FC 04|r|C1 8B|E|08 C7 05 5C|}@|00 01 00 00 00|P|A3|L}@|00 E8 C6 00 00 00 8D B6 EC|x@|00 BF|P}@|00 A5 A5|Y|A3|d|7F|@|00 A5 EB|UAA|80|y|FF 00 0F 85|H|FF FF FF|j|01|X|80 88|a~@|00 08|@=|FF 00 00 00|r|F1|V|E8 8C 00 00 00|Y|A3|d|7F|@|00 C7 05 5C|}@|00 01 00 00 00 EB 06 89 1D 5C|}@|00|3|C0 BF|P}@|00 AB AB AB EB 0D|"; reference:url,www.viruslist.com/ru/viruses/encyclopedia?virusid=24659; reference:url,www3.cai.com/securityadvisor/virusinfo/virus.aspx?ID=30328; classtype:trojan-activity; sid:9395; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.n smtp propagation detection"; flow:to_server,established; content:"UwFU9VVzpIrXAls0zlhDNOHldmMULkXDsJRNQZiPekC47DW5vF9mS3gKhBe2I0JSPouRMRBl|0D 0A|w8AJvAcDlRprEHbYgf+GOmWVzZa5XNbrM7AlDCyZfmBiCbABUFgAlCxXE2JRonBJRXLSoLAA"; metadata:service smtp; reference:url,www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=det&idvirus=45593; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE%5FBAGLE%2EN&VSect=T; classtype:trojan-activity; sid:9394; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.k smtp propagation detection"; flow:to_server,established; content:"RcJ0RFKbuZlqeaaoQ76D0Tf6ESD+RgjrN6QDtvvsvNXbR6BlXZviaG3d1NJtmU++UEmRCixX|0D 0A|RCaDz8IzdWIidAq1dzJwwTvIJglu/0IQwX8WrLD6EheQRlQhil5PQbv9oC3Y0HgAfIERnIb5"; metadata:service smtp; reference:url,www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=det&idvirus=45304; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FBAGLE%2EK&VSect=T; classtype:trojan-activity; sid:9393; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.j smtp propagation detection"; flow:to_server,established; content:"AFM8bJHtPFvDEkEXcUExflY49kR1cEEIUkM9CVRyaW0/TddNAkkvfRRVUkxRaCWgRLFeZa2d|0D 0A|ppsmHIgcP6Qp8ve2TB1lRQtVcHAiPE23aXCUdGYrkyxJZUtwfXxuCusU7RVxrDNuboGBhT0s"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-030214-1700-99&tabid=2; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FBAGLE%2EJ&VSect=T; classtype:trojan-activity; sid:9392; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.i smtp propagation detection"; flow:to_server,established; content:"A8Hjz"; content:"A8Hjz1XwgeLbymX/OMH6BAnTW4NTKTT7VvYLxgQ+PRHBjYpIBpIj7OxkWZbl8A8C7MD+SqZkBhTr|0A|VP9NDD+w5chL7D866BN1I2Vn7giaB2cqOQ1LZIaFNwpjlXTaJQ+TCqW4q6H"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32mimaili.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-111317-1701-99&tabid=2; classtype:trojan-activity; sid:9391; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.d netshare propagation detection"; flow:to_server,established; content:"E|F4 00 00 00 00 8B 8D E8 FB FF FF 89|M|F0 EB 09 FF 15|dsB|00 89|E|F4 83|}|F0 00|uy|83|}|F4 00|t,|83|}|F4 05|u|15 C7 05|DVB|00 09 00 00 00 8B|U|F4 89 15|HVB|00 EB 0C 8B|E|F4|P|E8|*I|00 00 83 C4 04 83 C8 FF EB|P|8B|M|08 C1 F9 05 8B|U|08 83 E2 1F 8B 04 8D|@nB|00 0F BE|L|D0 04 83 E1|@|85 C9|t|0F 8B|U|0C 0F BE 02 83 F8 1A|u|04|3|C0 EB 22 C7 05|DVB|00 1C 00 00 00 C7 05|HVB|00 00 00 00 00 83 C8 FF EB 09 8B|E|F0|+|85 E0 FB|"; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=24653; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=30322; classtype:trojan-activity; sid:9390; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.i smtp propagation detection"; flow:to_server,established; content:"H3Vi96OpogVHcLpTQXO9Nsx0cnR1FCErIXOpKbYFbDzudjBsaQIXui4IaYZfDmRymAFceHlQ|0D 0A|RUwBBGJkRWT5f0ie4AAPAQsBBQwAMlZy9r13ED8EMA1ACwIn3SzYBDMHDMA9b2BnsYMeNBAH"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/bagle_i.shtml; reference:url,www.sarc.com/avcenter/venc/data/w32.beagle.i@mm.html; classtype:trojan-activity; sid:9389; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.g smtp propagation detection"; flow:to_server,established; content:"VdBjl"; content:"VdBjlpmHLVfqaPUitmytmlPwIiJiViqPhDwHsP8fO2CDfCpkZVVqQCfFgXUtB+gfgDUcrZZOjpqX|0A|l20NIkQDEwEOAOwgy2VA5OSAJBx7JeRs391cnLJAlivkZdzcmZBvNipSWthsl41k2B3UrdTsguvQ"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-110414-0646-99; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=37467; classtype:trojan-activity; sid:9388; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.j web propagation detection"; flow:to_server,established; content:"1|03|3-|3B|+|B5 23|!|03 E9 0B 03 23 23|5i9|23|1|3B 19 B5|/73|B5|9?|E9 1B|+|1B|+i|07|%/|B5|/73|B5 01 07 E9|+|01|7|1D|i|8D 9B 8B 8B B5|5|23 01 E9|+5|01 3B|i9|23|1|3B 19 B5|/73|B5|9?|E9|'|0D|+|09|9i9|23|1|3B 19 B5|/73|B5|9?|E9 0F 01 0D 23 23 01|i|05 23 0D 3B 1D|75|B5|5|23 01 E9 0F|+5|3B|i|8D 9B 8B 8B B5|5|23 01 E9|=+?|1B|i|01 23 0D 0D|+|B5 23 0F E9|"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=376; classtype:trojan-activity; sid:9387; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.f smtp propagation detection"; flow:to_server,established; content:"LkRMTAAAAEdldFByb2NBZGRyZXNzAAAATG9hZExpYnJhcnlBAAAARXhpdFByb2Nlc3MAAABW|0D 0A|aXJ0dWFsQWxsb2MAAABWaXJ0dWFsRnJlZQAAAE1lc3NhZ2VCb3hBAAAAAABqe5M2t6ajjak1"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/bagle_f.shtml; reference:url,www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?lst=det&idvirus=45199; classtype:trojan-activity; sid:9386; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER collo.a smtp propagation detection"; flow:to_server,established; content:"UP8VWBIAAYPEDI1FoFBoAgEAAP91cP8VVBIAAf91cP8VUBIAAenf/v//aHQTAAFqCv81XIAAAf91|0D 0A|eOsTi0V8aHQTAAFqDP81XIAAAf9wDP8VCBIAATPAX15bg8VoycIQAFeLfCQMM8CD/wF2U1aLdCQM"; metadata:service smtp; reference:url,www.emsisoft.com/en/malware/?Worm.Win32.Collo.a; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=23787; classtype:trojan-activity; sid:9385; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER beglur.a smtp propagation detection"; flow:to_server,established; content:"bszmmP1TlDRGFDA1uDG1GyF3fw7zQae3hTJk7dtK0xmjv339SvtDPLhswsFAGUQX34naqqcKxEjp|0A|yns2FwCn9oiRtoiyYFfwAsT6v/2SvioeIkj2WAb6lQoNyzLUhbQtpekiV9ZUpOW2u4Lv73FPrkud"; metadata:service smtp; reference:url,www.hacksoft.com.pe/virus/w32_beglur_a.htm; reference:url,www.viruslibrary.com/virusinfo/I-Worm.Beglur.a.htm; classtype:trojan-activity; sid:9384; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.y smtp propagation detection"; flow:to_server,established; content:"SzXgMkNWL9sVG+tK+PAvoGAHIBs6uGCk+LimunCOdVZetTLfshMihnVwSZSOMgbeJ1nQ2VuH|0D 0A|OE0A6SCpjgS431+O+Uwr0hbFwC0Tt9gjk5n006G2DLQ93fwnPbO2fmzcaPYFYNhTijcHgc6u"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32netskyy.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-042011-2621-99&tabid=2; classtype:trojan-activity; sid:9383; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER fearso.c smtp propagation detection"; flow:to_server,established; content:"W4niV2CNlkzNbJ91T1IgkFpIUag2/cL3Sy5za4C8BhwOwEDr72oCP3sBuUkp0D0NoEh1djz3tvfr|0D 0A|PY2GLMgIGNbPfqP9LTUUqLLXdKC4DoH+8FHNt922QnUL9OtN9dKAdLrOtrM5zrElF1Bw9RA101DY"; metadata:service smtp; reference:url,www.sophos.com/security/analyses/w32noferc.html; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=35646; classtype:trojan-activity; sid:9382; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lara smtp propagation detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Lara Wallpaper Download Software"; distance:0; nocase; content:"I found on the net a new interesting software about Lara Croft"; nocase; metadata:service smtp; reference:url,www.sophos.com/security/analyses/mirclara.html; classtype:trojan-activity; sid:9381; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"MALWARE-OTHER jitux msn messenger propagation detection"; flow:to_server,established; content:"http|3A|//www.home.no/"; nocase; content:"/jituxramon.exe"; distance:0; nocase; reference:url,vil.nai.com/vil/content/v_100931.htm; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-123116-3525-99&tabid=2; classtype:trojan-activity; sid:9380; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.s smtp propagation detection"; flow:to_server,established; content:"xAJ2g9vb5s6MgEwifAAA99d2k9vrFPl057JOQIiRxvTw54r4l64U/qrFiXxGSJOoS9u77/mo|0D 0A|T/01iESEpu/wemHvlfNyYs+hogBpkojHr6r1w6r5OLdqdovbvwQmcoqsu7aPznGT+6qsCYET"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/netsky_s.shtml; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-040512-2436-99&tabid=2; classtype:trojan-activity; sid:9379; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.q smtp propagation detection"; flow:to_server,established; content:"Zacc/sWcQrpGNGbPzJedST7hJMXZJVKNy7LLBP2V90UwX7IHSyhFxPPTlRpdlJtxYLAU3s+E|0D 0A|ekcFyTLIwRYHVjWm16JZXIxAhQROCT/c+L5SU8juIBBaGTg21xUr52qxnAfzmZdzLksQUE+0"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32netskyq.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-032913-5722-99&tabid=2; classtype:trojan-activity; sid:9378; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mydoom.g smtp propagation detection"; flow:to_server,established; content:"B0QnUGCDNE08WiwoB4MNMsggGBAnBHf27GA//CMX7CNH5A/y7CBNQdTAI5e4I0jTDHaoB5xkkCCD|0D 0A|DTaIF4QvfIMNMth0H2xkB1wMMsggVExEMthgg0B/MEco0jSDDRwPFFoIybODDQAH/CIv9CLBXjPY"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mydoom_g.shtml; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-030213-0918-99&tabid=2; classtype:trojan-activity; sid:9377; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER fishlet.a smtp propagation detection"; flow:to_server,established; content:"AAACAAAAQAAAAAQAAAANAAoAAAAAABgAAABcAGYAaQBzAGgAbABlAHQALgBiAGkAbgAAAAAAVgAA|0D 0A|AFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAA"; metadata:service smtp; reference:url,www.sophos.com/security/analyses/w32fishleta.html; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=12285; classtype:trojan-activity; sid:9376; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER duksten.c smtp propagation detection"; flow:to_server,established; content:"+QAEAE1FhFEAAaABBIAD/VCMgIADcAAAABJnSlP+aThqAAKRKqKioqDQAAABA|0D 0A|Q/hAAQDQfAIgACn/KoVAQACjzQ0IAE0AocDVAACa//81cw0IAP9RJUBAADNaKVL/qebQEAAaEtAQAP+opCAgAIUMdAYaEtAQAP+oxCAgADSQGoAA/xXkICAAQJ5EiAgA"; metadata:service smtp; reference:url,www.hftonline.com/forum/archive/index.php/t-11044.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2002-122016-4223-99&tabid=2; classtype:trojan-activity; sid:9375; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER creepy.b smtp propagation detection"; flow:to_server,established; content:"i8iFyXUFM8BeW8OhUIREAIkBiQ1QhEQAM9KLwgPAjUTBBIseiRiJ|0D 0A|BkKD+mR17IsGixCJFl5bw5CJAIlABMOLwFNWi/KL2Oid////hcB1BTPAXlvDixaJUAiLVgSJUAyL"; metadata:service smtp; reference:url,vil.nai.com/vil/content/v_112739.htm; reference:url,www.emsisoft.com/en/malware/?Email-Worm.Win32.Creepy.b; classtype:trojan-activity; sid:9374; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER clepa smtp propagation detection"; flow:to_server,established; content:"S|23|L1GP]U%A!BA-RBY5.|0A|ME>|24|20PNL^|3A|79|24|U|3A|1'G`.+BZ6VD,4|5C|Q,T?!TID7%|3A|+T-SH5|23|K.7|24|^|22|G|5C|]NQ|22|=|0A|M'BUUUU@|5C|MBZ_D[^]<&L6R0/2B|3A|@8|23|!T`"; metadata:service smtp; reference:url,vil.nai.com/vil/content/v_120502.htm; reference:url,www.logiguard.com/spyware/i/i-worm-clepa.htm; classtype:trojan-activity; sid:9373; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER blebla.a smtp propagation detection"; flow:to_server,established; content:"JfzwQACLwP8lnPFAAIvA/yWY8UAAi8D/JZTxQACLwP8lkPFAAIvA/yWM8UAAi8D/JYjxQACLwFOD|0D 0A|xLy7CgAAAFToYf////ZEJCwBdAUPt1wkMIvDg8REW8OLwP8l+PBAAIvA/yX08EAAi8D/JfDwQACL"; metadata:service smtp; reference:url,vil.nai.com/vil/content/v_98894.htm; reference:url,www.sophos.com/security/analyses/w32bleblaa.html; classtype:trojan-activity; sid:9372; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.e smtp propagation detection"; flow:to_server,established; content:"ndAzKAZ0SFmzPdMu6kksSBpMnHn8vHAZLueGBstFWTfqLp3bQgJcaVOxM0W4oc81kinf/QiC|0D 0A|+bYxBaedDbd49u4ktkyUTrFK2ic8FKQI9pXU8vrTcz6RnwRxwAqTRZrKIhN6nL2ivbJIRTmf"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32baglee.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-022809-3232-99&tabid=2; classtype:trojan-activity; sid:9371; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER bagle.b smtp propagation detection"; flow:to_server,established; content:"22cYrYFsp1tV//KXbPbtRRQ4EnUCswFdIl62BQ6BxjtHcmMEwQ573GF0vGNi9B8wPXivfVoL|0D 0A|N9j04cZWzkL7aT31JBRq3/LZM/lJiQo0hUcu9GPvsGExeAQ1eAxsh/8gV4B9/iB1C7h0dRD3"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/bagle_b.shtml; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-021713-3625-99&tabid=2; classtype:trojan-activity; sid:9370; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER atak.a smtp propagation detection"; flow:to_server,established; content:"OwT4dgXDeVgnYHMODdBsTCbwmeciQpDLT1c3bLF1CDPoOT4eiUYEQgtW6Dyq/V0eWdlNFpXqMULp|0D 0A|QSWsmyBXNyoMu5xxWfoEcA/D8fxQV4hosCndivKbkCHoTCa6MLVnCwngBJFJlBHr7ka36Cpo/Mib"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/atak_a.shtml; reference:url,www.sophos.com/security/analyses/w32ataka.html; classtype:trojan-activity; sid:9369; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER agist.a smtp propagation detection"; flow:to_server,established; content:"0ZpkFIcReXCdLfAeEs4k5jglICV+BEij4zH+Xi5QwyfgLb+rO0XnE1xMuyBdVbgW95IPgAVLAnSC|0D 0A|g/5gJes8k0qLVgSAmSvKuNMATWIQ9+HB6gYajUIFsMBdgfogIBxSfyxQ0g6YSxpQiQ8WSQnT55rV"; metadata:service smtp; reference:url,secunia.com/virus_information/10752/agist.a/; reference:url,www.sarc.com/avcenter/venc/data/w32.agist.a@mm.html; classtype:trojan-activity; sid:9368; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER anset.b smtp propagation detection"; flow:to_server,established; content:"i9iF2w+EggAAAItrCIvFA0MMi9CNDDcr0YP6DH8Ei/gr/ovGK8WD+Ax9FI1M|0D 0A|JAGL1itTCAPXi8Xoxfv//+sRjUwkAYvXg+oEjUYE6LL7//+LbCQBhe10NIvV"; metadata:service smtp; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/199/worm_anset.b.html; reference:url,www.bullguard.com/virus/default.aspx?id=51; classtype:trojan-activity; sid:9367; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.s smtp propagation detection"; flow:to_server,established; content:"AAAAAAAAAAx|0A|AMBAi0wkBPdB5gbhjwJ0D69ErgiOVIAQiQK4A8Ejw1NWV78nh1Bq/mgOzkADZP81Yi0OiSUTOj Ug|0A|MFhgcAyDHv7/dNw7//HsGgONNHaLDLNkqzBID3x"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mimail_m.shtml; reference:url,www.sophos.com/virusinfo/analyses/w32mimailm.html; classtype:trojan-activity; sid:9366; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER cult.c smtp propagation detection"; flow:to_server,established; content:"wJ0D69ErgiOVIAQiQK4|0D 0A|A8Ejw1NWV78nh1Bq/mgOzkADZP81Yi0OiSUTOjUgMFhgcAyDHv7/dNw7//Hs|0D 0A|GgONNHaLDLNkqzBID3xOBAF11/9U3/Dr0WQojwU2AIPEDF9eW8NVN4nlu2dq"; metadata:service smtp; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/72/worm_cult.c.html; reference:url,www.sophos.com/security/analyses/w32cultc.html; classtype:trojan-activity; sid:9365; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.e web propagation detection"; flow:to_server,established; content:"|F2 99 00 00 03|+|16|-|A8 90 BA 8A 9A 29|0PH|80|@8` Z|00 08 80|+|A0 80 00 00|X|29|h|00|H`|E8|Z0P@Zhp+|E0| |E0| |29 90 18|0Z0P@Z|88 90|+ |88|P|F8 29 BA E2 A2 A2|ZX|00 88|+ X|88|`|29|h|00|H`|E8|Z0P@Zhp+|10 B8| |A8|h|29|h|00|H`|E8|Z0P@Zhp+|B0 88 B8 00 00 88 29 98 00 B8|`|F8|PXZ"; metadata:service http; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2002-011716-2500-99&tabid=2; classtype:trojan-activity; sid:9364; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.d web propagation detection"; flow:to_server,established; content:"agzyrywelb@igdupgdu.fgs|00|klgfp@yswma.fgs.fd|00|pyaab@igdupgdu.fgs|00|rywelb@163.fgs|00|bwdbwd@yswma.fgs.fd|00|ca1980@163.fgs|00|lmlm@igdupgdu.fgs|00|"; metadata:service http; reference:url,www.sophos.com/security/analyses/w32klezd.html; classtype:trojan-activity; sid:9363; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.m smtp propagation detection"; flow:to_server,established; content:"f+xt2OHdR5d|0A|oYEgACjEdRRHXvYmP9iDPXUL7TXuZkm+6wfHeTAGsEn3sfxyGYt9/GE5yHe7tcZ/Hhj4ORt835ps|0A|Mx+zk+UMO/RnXp7d+QBQQEz4gFL098fbv+3/G3"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mimail_m.shtml; reference:url,www.sophos.com/virusinfo/analyses/w32mimailm.html; classtype:trojan-activity; sid:9362; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.l smtp propagation detection"; flow:to_server,established; content:"Subject|3A| Re[2]"; nocase; content:"Hi Greg its Wendy."; distance:0; nocase; content:"I was shocked, when I found out that it wasn't you but|0D 0A|your twin brother!!!"; distance:0; nocase; content:"name=|22|wendy.zip|22|"; distance:0; nocase; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mimail_l.shtml; reference:url,www.sophos.com/virusinfo/analyses/w32mimaill.html; classtype:trojan-activity; sid:9361; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER cult.b smtp propagation detection"; flow:to_server,established; content:"HgAAAAAAAAAAAAAAAAAAQAAA|0D 0A|wDEuMjIAVVBYIQwJAgkUTDlhQxNezL9kAACkGQAAIEAAACYAABn+//L/McBA|0D 0A|i0wkBPdBBAYAdA+LRCQIi1QkEIkCuAO5/3fvEMNTVlc"; metadata:service smtp; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/72/worm_cult.b.html; reference:url,www.sophos.com/security/analyses/w32cultb.html; classtype:trojan-activity; sid:9360; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER zafi.b smtp propagation detection"; flow:to_server,established; content:"ogoKgD0WhnQSv/XEJq4JCv4wgevPaFDDmyXYndHSgSQEAaqXBpIrHzOgDxW/HTNqUNgsI75gYINA"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/zafi_b.shtml; reference:url,www.sophos.com/security/analyses/w32zafib.html; classtype:trojan-activity; sid:9359; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER fizzer smtp propagation detection"; flow:to_server,established; content:"i8Zew4tMJAQzwDgBdAdAgDwIAHX5w1WL7ItFDFOLXRRWVzP/M/aJRQyFwIldFHUM/3UI6Mz///9Z|0D 0A|iUUMhdt1DP91EOi8////WYlFFItFFDlFDHdqg30YAHQjhcB2Uzt1DHNTi00Qi1UIigwPOgwWdQNG"; metadata:service smtp; reference:url,www.sophos.com/virusinfo/analyses/w32fizzera.html; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-050821-0316-99&tabid=2; classtype:trojan-activity; sid:9358; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.r netshare propagation detection"; flow:to_server,established; content:"=X|A2|/|EF D1 BD C2 EB|0|5C 98|U|1A 08|c|AE|0|F1 06 C4 0B|m|D2 84|W|08|Z/|AD 02 0D|t|12|/|DA D7|>|C6|<|B2 DD 85 18 CF|,1j|8A F0 CF|Z|A4|`|87 D4|NP|89|@|F2 14 23 B8|R9|BF 0C B6 84|f|29 BA 02 0D F0 1D F6 B6|5C|04|n|99 10 BE 1D|j|0A DF 9A|P|BC CE DC C0|R9FlPT|BD CF|f|D4 CF F7|b|99 DD 8A 00 F0 E9 14|~b|9B EF C4 0C 24 96|,|14 89 D7|"; reference:url,www.sophos.com/security/analyses/w32debormr.html; classtype:trojan-activity; sid:9357; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.q netshare propagation detection"; flow:to_server,established; content:"|AB B4|+|F6 04 19 B8 9F CB|t|24|HpR|04 A6 8E|R|17 B1 7F 8A 1E|z|12 8C B8 0C|aVM|81 7C|0|AC|8|BA B5 EE 1A|B|9B|a*xe@|D1|q8|22|T|B7|.`|11 E0|iQ}|C7 CA C1 81 D9|i|B7 A4|C|BE|0|23|2X|9A DF 5C 3B|v|12 CC| |80 AD 7C|cT|19|.|AE|!|8E F8 84|R|F5|1n|D7 1B|8|E8 B0| $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.u netshare propagation detection"; flow:to_server,established; content:"|A3|Hp@|00 81|=Hp@|00 F0 00 00 00|~|0A C7 05|Hp@|00 0A 00 00 00|j|0A 8D|M|F0|Q|8B 15|Hp@|00|R|E8 E1|L|00 00 83 C4 0C 8D|E|F0|P|8B|M|08|Q|E8 DB 0D 00 00 83 C4 08|hlp@|00 8B|U|08|R|E8 DA 0D 00 00 83 C4 08|j|0A 8D|E|F0|P|8B 0D 90|{@|00|Q|E8 AB|L|00 00 83 C4 0C 8D|U|F0|R|8B|E|08|P|E8 B5 0D 00 00 83 C4 08|hpp@|00 8B|M|08|Q|E8|"; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DEBORM.U; classtype:trojan-activity; sid:9355; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.y netshare propagation detection"; flow:to_server,established; content:"|B7 D6 B6 3B|?X4|00|h|94|[h|8F B3 B3|u@|80|*|0C|F|05 29 B3|=|CE|J|19|8V|EF 1E 10|n|90 9A|1|08 08|^X|A0 3A B6 D7|Kn^d|FE 85|h|9D|%|18|d|B7 E0|n|83 BD|x|0C|Lw|9E|`|FD|%Yr+?4|FC|y|24 07 F6 A3|Y|A4 C4|`|FD B6 06 C9 03|d|FE F3|d|8E 91 C6 DE|O|9C|jP[|90 AF 91|j|BA|{|C6|p|13 C4 8A 80 10 8B|@|0C|w|AB D5|P|FF 96|w|C2 10 04|"; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DEBORM.Y; classtype:trojan-activity; sid:9354; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"MALWARE-OTHER deborm.x netshare propagation detection"; flow:to_server,established; content:"0@|00 0A 00 00 00|SV|8B|5|A8| @|00|W|8D|E|F0|j|0A|P|FF|5|28|0@|00 FF D6 8B|]|08 8D|E|F0|PS|E8 9D 08 00 00 BF|L0@|00|WS|E8 8B 08 00 00 8D|E|F0|j|0A|P|FF|5|D0|2@|00 FF D6 8D|E|F0|PS|E8|s|08 00 00|WS|E8|l|08 00 00 8D|E|F0|j|0A|P|FF|5|D4|2@|00 FF D6 83 C4|D|8D|E|F0|PS|E8|Q|08 00 00|WS|E8|J|08 00 00 8D|E|F0|j|0A|P|FF|5"; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_DEBORM.X; classtype:trojan-activity; sid:9353; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lovgate.a smtp propagation detection"; flow:to_server,established; content:"+3UubBZU6QPutdRcZrPEvAZmzZcNakN47VPYbNzc7Nrua2tqc5hULfvf2fjX3Ec6W|0D 0A|bgNaUl7vgcZCDx77BhbeP1Jav5WWRj/8Tjd7mGGE798zp8rczW6tVaQvEyw5Ww3WpU0MwG5nq6G5"; metadata:service smtp; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=22549; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=31576; classtype:trojan-activity; sid:9352; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 139 (msg:"MALWARE-OTHER lovgate.a netshare propagation detection"; flow:to_server,established; content:"M|D5 15 80 85 D9 1C 92|zE|3B|iy|C7|2|97|8|14|/8q|1B DA|^R|DA 15|- A|80|T|BC|EJ|A3 C1 AD 8F|+ya|D9 1B|e|A3|B5|29 BB EE EE C3 D9 15 B3|U|B7 B4|os|3A AF|?|87|s|05 CE E7|rC/{|80|^r|F6|@yY|05 BC|f|83 F8 90 AF 17|d|15 24 83|i|9B 06 A6|H<|A6|H|15 99 22 DA E6 C0 E5|2E|E5|2A|B5 C2|+|5C 90|Za|F8|[|92|@L |FE|0|90|W|01 FC E5|^|DE BF FF FF E9 F7 CF|<|F9 F3 EF|"; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=22549; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=31576; classtype:trojan-activity; sid:9351; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.k smtp propagation detection"; flow:to_server,established; content:"QIi1QkEIkCuAMAAADDU1ZXi0QkEFBq/mgAEEAAZP81AAAAAGSJJQAAAACLRCQgi1gIi3AM|0A|g/7/dCA7dCQkdBqNNHaLDLOLTCQIi0gMg3yzBAB11/9Uswjr0WSPBQAAAACDxAxfXl"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mimail_k.shtml; reference:url,www.sophos.com/virusinfo/analyses/w32mimailk.html; classtype:trojan-activity; sid:9350; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER plemood smtp propagation detection"; flow:to_server,established; content:"+FVQACNg1tXQABQV7hVQed3/9BWV7guaud3/9ALwHQW6IkPAADotxQAAOjqFAAA/7NPVkAAw42DZVVAAFBqAGoAuMTC53f/0I2DWVBAAGoAagBTUGoAagC4N6znd/"; metadata:service smtp; reference:url,www.2-spyware.com/remove-i-worm-plemood.html; classtype:trojan-activity; sid:9349; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER morbex smtp propagation detection"; flow:to_server,established; content:"X3uiXQhvcqrqewRXAmwUkkt+UZVKSCEfAJD16IpxOluoZPgwsCe6T1GNq38tD7G1LQylWfNIZQMc|0D 0A|9sKWsKp24Yz3UxXUVnc++jxshJFqXMM2hAlWyzoRY39o9hbXxNVHGfm7emXOlh8fZP2CLWIe1AHv"; metadata:service smtp; reference:url,www.www.f-secure.com/v-descs/morbex.shtml; classtype:trojan-activity; sid:9348; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 139 (msg:"MALWARE-OTHER klez.b netshare propagation detection"; flow:to_server,established; content:"lwlw@21fd.fgs|00|lgsr@21fd.fgs|00|Wtzmkyj1978@21fd.fgs|00|wtzmkyj@bdswma.fgs|00|owfp@bdswma.fgs|00|lgs@bdswma.fgs|00|rywelb@bdswma.fgs|00|gebwduff@21fd"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2002-011716-2500-99&tabid=2; classtype:trojan-activity; sid:9347; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.b web propagation detection"; flow:to_server,established; content:"lwlw@21fd.fgs|00|lgsr@21fd.fgs|00|Wtzmkyj1978@21fd.fgs|00|wtzmkyj@bdswma.fgs|00|owfp@bdswma.fgs|00|lgs@bdswma.fgs|00|rywelb@bdswma.fgs|00|gebwduff@21fd"; metadata:service http; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2002-011716-2500-99&tabid=2; classtype:trojan-activity; sid:9346; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER kipis.a smtp propagation detection"; flow:to_server,established; content:"xfs9Znq3mJL1CnQXg0epFP4RHBO0n6naXaPhHWdmQaxirccYvMqyYqxiVpY//VZeM7veQEB19ehg|0A|YFK0if9HLNsz9SBqjj/QOGh01hINh2u4f6VGfrwbNSTdzqkjQnZKcB1Ind/UezfRD6KGUHmZkXfy"; metadata:service smtp; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=41312; classtype:trojan-activity; sid:9345; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER kindal smtp propagation detection"; flow:to_server,established; content:"LUiv0xc0fDsKfdy6TB2EYeFCZcNNW9Fcgwxvsi/DSNbYGn8xV1NBSNxudS4jtCC5C7sLb3Ox|0D 0A|0DUKCK6zY6tuhRdoiOEtaER0YnkD4HJsDytowG4HfAwFd6v4YW9h1I54fvsQwTeyUEUGTAEG"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-073016-2910-99&tabid=2; classtype:trojan-activity; sid:9344; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER kadra smtp propagation detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Bin Ladenov zivot"; distance:0; nocase; content:"filename="; nocase; content:"Bin Ladenov zivot"; distance:0; nocase; metadata:service smtp; reference:url,www.kaspersky.com/news?id=260&ipcountry=CA#kadra; classtype:trojan-activity; sid:9343; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER paroc.a smtp propagation detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"PROSAC"; distance:0; nocase; content:"DQoJV2Vs|0D 0A|Y29tZSB0byBQUk9TQUMgKG11bHRpbWVkaWEgcGFjaykNCgkt"; metadata:service smtp; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=W32.Paroc.Worm&threatid=53258; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2002-061121-1025-99&tabid=2; classtype:trojan-activity; sid:9342; rev:11;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 9996 (msg:"MALWARE-OTHER sasser open ftp command shell"; flow:to_server,established; content:"cho off"; depth:7; nocase; content:"cmd.ftp"; distance:0; nocase; content:"_up.exe"; distance:0; nocase; reference:url,www.sophos.com/virusinfo/analyses/w32sassera.html; classtype:trojan-activity; sid:9341; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.i web propagation detection"; flow:to_server,established; content:"E|5C 05|]d|9E|Zd3cpv|29|cpu/e|E6|"; metadata:service http; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=11837; classtype:trojan-activity; sid:9340; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER klez.g web propagation detection"; flow:to_server,established; content:"|0A 08|P|D8|{|18|0|D8 D8 18|Py80|D8|P|18 0A 08|P|D8|{@0@0y8P|18|0|B8 0A|`|00 10 0A|8 {hP|D8|y8P|18|0"; metadata:service http; reference:url,www.sophos.com/virusinfo/analyses/w32klezg.html; classtype:trojan-activity; sid:9339; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mydoom.i smtp propagation detection"; flow:to_server,established; content:"LjI2BDAAorXCxzNJTUVPLDRQ04B9WAN1VEJ5QE1mwWlkOx4gVjm42kp3LOx0Ni1UeepAb S3soFBE|0D 0A|2eN0L/d4UADTtkc7IQkKO a/NWrhyPSJSInMFcbG2vdotVqfZNTFPGIKG5hzoQwecasmOtdZACjEX"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mydoom_i.shtml; classtype:trojan-activity; sid:9338; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.x smtp propagation detection"; flow:to_server,established; content:"g8QMhcB1Fv////+DffwCdA5qZP8VYHBAAEaD/gJ81jPAXsnD|0D 0A|i0QkDIHsKN5+97cBKlNVVos1bB1XM+1oABAQVccA7d9s7xYA/9ZQNWiL2DvdD4RWAhL2N7f2|0D 0A|ahFqAgEV"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/netsky_x.shtml; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NETSKY.X; classtype:trojan-activity; sid:9337; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.t smtp propagation detection"; flow:to_server,established; content:"MS4yNAC20aXJDAkCCFGoGZhQ27pRMAYDAAE/AAAAfAAAJgUAOP//|0D 0A|//9Vi+yLRQxWV4t9CDPSM8kz9oA/AHQpU2oBWyvfiV0Iivf/7f8fgPsudQyIDAKLVSDJA9fr|0D 0A|BYhc"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/netsky_t.shtml; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NETSKY.T; classtype:trojan-activity; sid:9336; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.b smtp propagation detection"; flow:to_server,established; content:"0UMVleLfQgz|0D 0A|0jPJM/aAPwB0KVNqAVsr34ldCIr3/+3/H4D7LnUMiAwCi1UgyQPX6wWIXAYBQUZHJ/v/bXd1|0D 0A|4VsYgGQPAI1GAV9eXcOLRCQIU0xv/3+7fCQQTYH6AAgAAH06D7YIhc"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-021812-2454-99; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NETSKY.B; classtype:trojan-activity; sid:9335; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER lovgate.c smtp propagation detection"; flow:to_server,established; content:"TeRqfPMR5vXWeeZ2NfAaLY1DVPPPFiBi5r34VPgF8sIEpG0shzV4b30euDVoQer6QFQy78snUIPq|0D 0A|EWuSIUAv+OGl1QNYkJXTV5/HzOViMIBfVAY2WQpM6/DVgZ5n8h0ILVu+fjHF1MpcoGgQjIjsDs68"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/lovgate.shtml; classtype:trojan-activity; sid:9334; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.e smtp propagation detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"don't be late!"; distance:0; nocase; content:"gBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAA|0A|AABQRQAATAEDAEKhoz8AAAAAAAAAAOAADwELAQI3ADAAAAAQAAAAIAcA0FIHAAAwBwAA"; pcre:"/^Subject\x3A[^\r\n]*don't\sbe\slate!/smi"; metadata:service smtp; reference:url,www.sarc.com/avcenter/venc/data/w32.mimail.e@mm.html; reference:url,www.sophos.com/virusinfo/analyses/w32mimaile.html; classtype:trojan-activity; sid:9333; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mimail.a smtp propagation detection"; flow:to_server,established; content:"g8QMX15bw1WJ5VNWV1VqAGoAaJIQQAD/dQjoVkYAAF1fXluJ7F3D/FWJ5YPs|0A|CFNWV1WLXQyLRQijMEBHAIkdNEBHAPdABAYAAAB1colF+ItFEIlF/KM0QEcAjUX4iUP8"; metadata:service smtp; reference:url,www.sarc.com/avcenter/venc/data/w32.mimail.a@mm.html; reference:url,www.sophos.com/virusinfo/analyses/w32mimaila.html; classtype:trojan-activity; sid:9332; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mydoom.m smtp propagation detection"; flow:to_server,established; content:"lo5vuBR4VSCJ1pbUTU2ox8gc4A7MEBs3U817uUY7ImH0QRZX+0j2rTCxLjEuMiWWIIQOBqYHIChO|0D 0A|szw6IGwkHhEcctMplAHMtW17PTAB6V1wlG2EO/ggyW8ZTQYiUQdbzhMuIwM4aEvQxSUDthPd7S6"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mydoom_m.shtml; classtype:trojan-activity; sid:9331; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER mydoom.e smtp propagation detection"; flow:to_server,established; content:"o/lN3R5KdgmabpkbqcebrJGVMv/b3+ITcXF4dYrKKEjm3bi1PPcb8ZqKgf//hf6sWTRLdExjstH/|0D 0A|x69YBOSAkClWPEs4oEv//3+BfjW9C702c15JmOUe8W2ey1TAvxOujvc6/7/1/0UA4y/RTfLKo95+"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/mydoom_e.shtml; classtype:trojan-activity; sid:9330; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER zhangpo smtp propagation detection"; flow:to_server,established; content:"zhangpo"; fast_pattern:only; pcre:"/^X-Mailer\x3A[^\r\n]*zhangpo/smi"; metadata:service smtp; reference:url,www.spywareremove.com/removeZhangpo.html; classtype:trojan-activity; sid:9328; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.af smtp propagation detection"; flow:to_server,established; content:"QWxldmlydXMgTmV0U2t5LWIgQ3JhY2tlZCBBbmluaGFBTUFWQyE"; metadata:service smtp; reference:url,www.f-secure.com/v-descs/netsky-af.shtml; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_NETSKY.AF; classtype:trojan-activity; sid:9327; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER netsky.p smtp propagation detection"; flow:to_server,established; content:"Yid5ICdT|0D 0A|J2sneSdOJ2UndCcuJ0MnWicgJ0MnbydyJ3AqJwAAJ0QncidvJ3AncCdlJ2QnUydrJ3knTidl|0D 0A|J3QnACdTJ2sneSdOJ2UndCdGJ2knZydoJ3QncydCJ2EnYydrAAAAAHVzZXJj"; metadata:service smtp; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-032110-4938-99&tabid=2; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FNETSKY%2EP&VSect=T; classtype:trojan-activity; sid:9326; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger nicespy runtime detection - smtp"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"JMail"; distance:0; nocase; content:"by"; distance:0; nocase; content:"Dimac"; distance:0; nocase; content:"NiceSpy's"; nocase; content:"email"; distance:0; nocase; content:"assistant"; distance:0; nocase; pcre:"/^X-Mailer\x3a[^\r\n]*JMail[^\r\n]*by[^\r\n]*Dimac/smi"; pcre:"/^NiceSpy\x27s\s+email\s+assistant/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097309; classtype:successful-recon-limited; sid:8544; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware deluxecommunications runtime detection - display popup ads"; flow:to_server,established; content:"/ip"; nocase; http_uri; content:"cid="; nocase; http_uri; content:"pc_id="; nocase; http_uri; content:"pck_id="; nocase; http_uri; content:"guid="; nocase; http_uri; content:"info="; nocase; http_uri; content:"link="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"media.dxcdirect.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*media\x2Edxcdirect\x2Ecom/smiH"; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453099974; classtype:successful-recon-limited; sid:8543; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware deluxecommunications runtime detection - collect info"; flow:to_server,established; content:"/requestimpression.aspx"; fast_pattern; nocase; http_uri; content:"ver="; nocase; http_uri; content:"guid="; nocase; http_uri; content:"host="; nocase; http_uri; content:"Host|3A| media.dxcdirect.com"; nocase; http_header; metadata:service http; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453099974; classtype:successful-recon-limited; sid:8542; rev:14;) # alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger netobserve runtime detection - remote login response"; flow:established,to_client; content:"Server|3A|"; nocase; http_header; content:"NETObserve"; nocase; http_header; pcre:"/^Server\x3a[^\r\n]*NETObserve/smiH"; metadata:service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=354; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073490; classtype:successful-recon-limited; sid:8467; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger netobserve runtime detection - email notification"; flow:to_server,established; flowbits:isset,NETObserve_SMTP; content:"NETObserve"; nocase; content:"Requested"; distance:0; nocase; content:"Information"; distance:0; nocase; pcre:"/^NETObserve\s+Requested\s+Information/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=354; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073490; classtype:successful-recon-limited; sid:8466; rev:7;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger netobserve runtime detection - email notification"; flow:to_server,established; content:"From|3A|"; nocase; content:"NETObserve"; distance:0; nocase; pcre:"/^From\x3a[^\r\n]*NETObserve/smi"; flowbits:set,NETObserve_SMTP; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=354; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073490; classtype:successful-recon-limited; sid:8465; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware duduaccelerator runtime detection - trace login info"; flow:to_server,established; content:"/login_cn.html"; nocase; http_uri; content:"guid="; nocase; http_uri; content:"mid="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"dddlogin.dudu.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*dddlogin\x2Edudu\x2Ecom/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=2550; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097969; classtype:successful-recon-limited; sid:8463; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware duduaccelerator runtime detection - trace info downloaded"; flow:to_server,established; content:"/rep/dlinfo.html"; fast_pattern; nocase; http_uri; content:"url="; nocase; http_uri; content:"page="; nocase; http_uri; content:"product="; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"dddrep.dudu.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*dddrep\x2Edudu\x2Ecom/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=2550; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097969; classtype:successful-recon-limited; sid:8462; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware duduaccelerator runtime detection - send userinfo"; flow:to_server,established; content:"/ddd2/report_userinfo.asp"; fast_pattern; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"ddduser.dudu.com"; nocase; http_header; pcre:"/^Host\x3a[^\r\n]*ddduser\x2Edudu\x2Ecom/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=2550; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097969; classtype:successful-recon-limited; sid:8461; rev:11;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spybuddy 3.72 runtime detection - send alert out through email"; flow:to_server,established; flowbits:isset,SpyBuddy_SMTP; content:"SpyBuddy"; nocase; content:"Alert"; distance:0; nocase; pcre:"/^SpyBuddy\s+Alert/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=21; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097719; classtype:successful-recon-limited; sid:8357; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spybuddy 3.72 runtime detection - send log out through email"; flow:to_server,established; flowbits:isset,SpyBuddy_SMTP; content:"SpyBuddy"; nocase; content:"Activity"; distance:0; nocase; content:"Logs"; distance:0; pcre:"/^SpyBuddy\s+Activity\s+Logs/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=21; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097719; classtype:successful-recon-limited; sid:8356; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spybuddy 3.72 runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:"SpyBuddy"; distance:0; nocase; pcre:"/^From\x3a[^\r\n]*SpyBuddy/smi"; flowbits:set,SpyBuddy_SMTP; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:8355; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger EliteKeylogger runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:""; distance:0; nocase; pcre:"/^From\x3A[^\r\n]*\x3Clogs\x40logs\x2Ecom\x3E/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=814; classtype:successful-recon-limited; sid:7857; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware winsysba-a runtime detection - track surfing activity"; flow:to_server,established; content:"/url_sp2.asp"; fast_pattern; nocase; http_uri; content:"keyword="; nocase; http_uri; content:"url="; nocase; http_uri; content:"User-Agent|3A|"; nocase; http_header; content:"vb"; nocase; http_header; content:"wininet"; nocase; http_header; pcre:"/^User-Agent\x3A[^\r\n]*vb\s+wininet/smiH"; metadata:service http; reference:url,secunia.com/virus_information/26844/winsysba-a/; classtype:successful-recon-limited; sid:7856; rev:13;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger clogger 1.0 runtime detection - send log through email"; flow:to_server,established; flowbits:isset,Clogger_SendLogOut2; content:"<----------- Fin du Fichier ----------- >"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=824; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453068235; classtype:successful-recon-limited; sid:7847; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger clogger 1.0 runtime detection"; flow:to_server,established; flowbits:isset,Clogger_SendLogOut1; content:"|23 23 23 23|"; nocase; content:"Fen|EA|tre |3A|"; distance:0; nocase; content:"|23 23 23 23|"; distance:0; nocase; pcre:"/\x23\x23\x23\x23\s+Fen\xeatre\s+\x3a[^\r\n]*\x23\x23\x23\x23/smi"; flowbits:set,Clogger_SendLogOut2; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7846; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger clogger 1.0 runtime detection"; flow:to_server,established; content:"Subject|3A|"; nocase; content:"Keylogger"; distance:0; nocase; pcre:"/^Subject\x3a[^\r\n]*Keylogger/smi"; flowbits:set,Clogger_SendLogOut1; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7845; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spyoutside runtime detection - email delivery"; flow:to_server,established; content:"From|3A|"; nocase; content:"SpyOuTSiDe@CurrenTChaoS.Tk"; distance:0; nocase; pcre:"/^From\x3A\s+SpyOuTSiDe\x40CurrenTChaoS\x2ETk/smi"; content:"Subject|3A|"; nocase; content:"SpYOuTSiDe"; distance:0; nocase; content:"transmission"; distance:0; nocase; content:"with"; distance:0; nocase; content:"log"; distance:0; nocase; pcre:"/^Subject\x3A\s+\x5B\d+\x5D\x2D\s+SpYOuTSiDe\s+transmission\s+with\s+log\s+\x2D/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.spyoutside.html; classtype:successful-recon-limited; sid:7837; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spy lantern keylogger runtime detection"; flow:to_server,established; flowbits:isset,LanternKeylogger; content:"filename="; nocase; content:".ltr"; distance:0; nocase; pcre:"/filename=\x22[^\r\n]*\x2Eltr\x22/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453083297; classtype:successful-recon-limited; sid:7597; rev:9;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spy lantern keylogger runtime detection - flowbit set"; flow:to_server,established; content:"Hello."; nocase; content:"This"; distance:0; nocase; content:"letter"; distance:0; nocase; content:"contains"; distance:0; nocase; content:"logfile"; distance:0; nocase; content:"from"; distance:0; nocase; pcre:"/Hello\x2E\s+This\s+letter\s+contains\s+logfile\s+from/smi"; flowbits:set,LanternKeylogger; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453083297; classtype:successful-recon-limited; sid:7596; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger keylogger pro runtime detection"; flow:to_server,established; flowbits:isset,KeyloggerPro_SMTP; content:"Keylogger"; nocase; content:"Pro"; distance:0; nocase; content:"Activity"; distance:0; nocase; content:"Logs"; distance:0; pcre:"/^Keylogger\s+Pro\s+Activity\s+Logs/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spyany.com/keylogger.html; classtype:successful-recon-limited; sid:7592; rev:7;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger keylogger pro runtime detection - flowbit set"; flow:to_server,established; content:"From|3A|"; nocase; content:"Keylogger-Pro"; distance:0; nocase; pcre:"/^From\x3a[^\r\n]*Keylogger-Pro/smi"; flowbits:set,KeyloggerPro_SMTP; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7591; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger proagent 2.0 runtime detection"; flow:to_server,established; content:"HELO"; nocase; content:"ProAgent"; distance:0; nocase; pcre:"/^HELO\s+ProAgent/smi"; content:"From|3A|"; nocase; content:"ProAgent"; distance:0; nocase; pcre:"/^From\x3A\s+\x22ProAgent\s+v\d+\x2E\d+\x22/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.2-spyware.com/remove-trojanspy-win32-proagent.html; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076925; classtype:successful-recon-limited; sid:7574; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware webhancer runtime detection"; flow:to_server,established; content:"POST"; depth:4; nocase; content:"X-AT|3A|"; nocase; http_header; content:"X-CI|3A|"; nocase; http_header; content:"Host|3A|"; nocase; http_header; content:"webhancer.com"; nocase; http_header; pcre:"/^Host\x3A[^\r\n]*webhancer\x2Ecom/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=26; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=43482; classtype:successful-recon-limited; sid:7568; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware purityscan runtime detection - opt out of interstitial advertising"; flow:to_server,established; content:"/ps/ps_uninstaller.exe"; fast_pattern; nocase; http_uri; content:"Host|3A|"; nocase; http_header; content:"www.purityscan.com"; nocase; http_header; pcre:"/^Host\x3A[^\r\n]*www\x2Epurityscan\x2Ecom/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=618; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073488; classtype:successful-recon-limited; sid:7561; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware purityscan runtime detection - self update"; flow:to_server,established; content:"/query.php"; fast_pattern; nocase; http_uri; content:"v="; nocase; content:"b="; distance:0; nocase; content:"vt="; distance:0; nocase; content:"c="; distance:0; nocase; content:"os="; distance:0; nocase; content:"lang="; distance:0; nocase; content:"pl="; distance:0; nocase; content:"z="; distance:0; nocase; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=618; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073488; classtype:successful-recon-limited; sid:7560; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware purityscan runtime detection - track user activity and status"; flow:to_server,established; content:"/count.cgi?clickspring"; nocase; http_uri; content:"www.clickspring.net/cs/pop4/frame_ver2.html"; fast_pattern; nocase; http_uri; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=618; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073488; classtype:successful-recon-limited; sid:7559; rev:12;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware purityscan runtime detection - installation notify"; flow:to_server,established; content:"/install/notify.php?"; fast_pattern; nocase; http_uri; content:"pid="; nocase; http_uri; content:"module="; nocase; http_uri; content:"v="; nocase; http_uri; content:"b="; nocase; http_uri; content:"result="; nocase; http_uri; content:"message="; nocase; http_uri; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=618; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073488; classtype:successful-recon-limited; sid:7558; rev:12;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware purityscan runtime detection - start up"; flow:to_server,established; content:"/cs/pop4/"; fast_pattern; nocase; http_uri; content:".html"; nocase; http_uri; pcre:"/\x2Fcs\x2Fpop4\x2F((frame_ver2)|(UI2))\x2Ehtml/Ui"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=618; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073488; classtype:successful-recon-limited; sid:7557; rev:12;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ardamax keylogger runtime detection - ftp"; flow:to_server,established; content:"{D082139B-D5E4-4e63-B866-9BFC97880A48}"; fast_pattern:only; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=526; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453094248; classtype:successful-recon-limited; sid:7552; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger ardamax keylogger runtime detection - smtp"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"ATL"; distance:0; nocase; content:"CSmtp"; distance:0; nocase; content:"Class"; distance:0; nocase; content:"Mailer"; distance:0; nocase; content:"by"; distance:0; nocase; content:"Robert"; distance:0; nocase; content:"Simpson"; distance:0; nocase; pcre:"/^X-Mailer\x3A[^\r\n]*ATL\s+CSmtp\s+Class\s+Mailer\s+by\s+Robert\s+Simpson\s+\x28robert\x40blackcastlesoft\x2Ecom\x29/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=526; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453094248; classtype:successful-recon-limited; sid:7551; rev:9;) # alert udp $HOME_NET any -> $EXTERNAL_NET 15165 (msg:"MALWARE-OTHER Keylogger activity monitor 3.8 runtime detection"; content:"|1D BA 0B FB|d|5C 86 E1 DA 83|BC|B6 04 E0|^|0A|@|C5 D4 00 00 00 00 00 00 00 00|"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=343; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=35592; classtype:successful-recon-limited; sid:7549; rev:8;) # alert udp $HOME_NET any -> $EXTERNAL_NET 15165 (msg:"MALWARE-OTHER Keylogger activity monitor 3.8 runtime detection - agent up notification"; content:"|00 00 00 00 00 00 00 00|"; depth:8; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=343; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=35592; classtype:successful-recon-limited; sid:7548; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 15164 (msg:"MALWARE-OTHER Keylogger activity monitor 3.8 runtime detection - agent status monitoring"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; depth:16; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=343; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=35592; classtype:successful-recon-limited; sid:7547; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger PerfectKeylogger runtime detection"; flow:to_server,established; flowbits:isset,PerfectKeylogger2; content:"This is a Perfect Keylogger report"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=588; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073333; classtype:successful-recon-limited; sid:7546; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger PerfectKeylogger runtime detection - flowbit set 2"; flow:to_server,established; flowbits:isset,PerfectKeylogger1; content:"filename=|22|keystrokes.html|22|"; depth:300; nocase; flowbits:set,PerfectKeylogger2; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=588; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073333; classtype:successful-recon-limited; sid:7545; rev:6;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger PerfectKeylogger runtime detection - flowbit set 1"; flow:to_server,established; content:"X-Mailer|3A| CSMTPConnection"; depth:256; nocase; flowbits:set,PerfectKeylogger1; flowbits:noalert; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=588; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453073333; classtype:successful-recon-limited; sid:7544; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger starlogger runtime detection"; flow:to_server,established; content:"From|3A|"; nocase; content:"|22|StarLogger|22|"; distance:0; nocase; content:"Subject|3A| StarLogger information"; distance:0; nocase; content:"Please find attached the StarLogger log file named"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=922; classtype:successful-recon-limited; sid:7541; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger eye spy pro 1.0 runtime detection"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"Eye"; distance:0; nocase; content:"Spy"; distance:0; nocase; content:"Pro"; distance:0; nocase; pcre:"/^X-Mailer\x3A[^\r\n]*Eye\s+Spy\s+Pro/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.softslist.com/download-9-50-20783.html; classtype:successful-recon-limited; sid:7539; rev:9;) # alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger watchdog runtime detection - remote monitoring"; flow:to_client,established; content:"Server|3A|"; nocase; http_header; content:"WatchDog"; fast_pattern:only; http_header; content:"Server"; nocase; http_header; pcre:"/Server\x3a[^\r\n]*WatchDog[^\r\n]*Server/smiH"; metadata:impact_flag red, service http; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7515; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger watchdog runtime detection - send out info to server periodically"; flow:to_server,established; content:"S|3A|Users"; fast_pattern:only; pcre:"/^S\x3aUsers\x5c\d+\x2cSTATSTimeTotal/smi"; metadata:impact_flag red; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7514; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger watchdog runtime detection - init connection"; flow:to_server,established; flowbits:isset,WatchDog_Init_Connection; content:"I|3A|NAME|3A|"; fast_pattern:only; pcre:"/^I\x3aNAME\x3a/smi"; metadata:impact_flag red; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7513; rev:7;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER Keylogger watchdog runtime detection - init connection - flowbit set"; flow:to_client,established; content:"N|3A|UC|3A|"; fast_pattern:only; pcre:"/^N\x3aUC\x3a\d+\x2c\d+\x2e\d+\x2e\d+\x2e\d+\x2c/smi"; flowbits:set,WatchDog_Init_Connection; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453098060; classtype:successful-recon-limited; sid:7512; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger actualspy runtime detection - smtp"; flow:to_server,established; content:""; nocase; content:"Actual"; distance:0; nocase; content:"Spy"; distance:0; nocase; content:"software"; distance:0; nocase; content:"report"; distance:0; nocase; content:""; distance:0; nocase; pcre:"/\Actual\s+Spy\s+software\s+report\<\x2Ftitle\>/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453086496; classtype:successful-recon-limited; sid:7505; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 20 (msg:"MALWARE-OTHER Keylogger actualspy runtime detection - ftp-data"; flow:to_client,established; content:""; nocase; content:"Actual"; distance:0; nocase; content:"Spy"; distance:0; nocase; content:"software"; distance:0; nocase; content:"report"; distance:0; nocase; content:""; distance:0; nocase; pcre:"/\Actual\s+Spy\s+software\s+report\<\x2Ftitle\>/smi"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453086496; classtype:successful-recon-limited; sid:7504; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware shopathome runtime detection - setcookie request"; flow:to_server,established; content:"/setcookie.asp?"; nocase; http_uri; content:"cid="; nocase; http_uri; content:"s="; nocase; http_uri; content:"Referer|3A|"; nocase; http_header; content:"discounts.shopathome.com/frameset.asp?"; nocase; http_header; pcre:"/^Referer\x3A[^\r\n]*http\x3A\x2F\x2Fdiscounts\x2Eshopathome\x2Ecom\x2Fframeset\x2Easp\?/smiH"; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=700; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076082; classtype:successful-recon-limited; sid:7189; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger kgb Keylogger runtime detection"; flow:to_server,established; content:"filename="; nocase; content:"zip"; distance:0; nocase; pcre:"/filename\x3D\x22[^\r\n]*?\x2D\d+\x5F\d+\x5F\d+\x2D\d+\x5F\d+\x5F\d+\s+[AP]M\x2Ezip/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1328; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453096494; classtype:successful-recon-limited; sid:7186; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger 007 spy software runtime detection - ftp"; flow:to_server,established; content:"STOR"; fast_pattern:only; pcre:"/^STOR\s+\x2E\x2F(kys|scr|Apps|Urls)[0-9]+\x2Etxt/smi"; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1137; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453082794; classtype:successful-recon-limited; sid:7185; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger 007 spy software runtime detection - smtp"; flow:to_server,established; content:"From|3A| |22|007 Spy Agent|22|"; nocase; content:"Subject|3A| 007 Monitoring Log Report"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1137; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453082794; classtype:successful-recon-limited; sid:7184; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger desktop detective 2000 runtime detection - init connection"; flow:to_client,established; flowbits:isset,DesktopDetective_InitConnection2; content:"|FE FE FE FE|90|00 00|"; fast_pattern:only; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=349; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453060318; classtype:successful-recon-limited; sid:7180; rev:10;) alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-OTHER Keylogger desktop detective 2000 runtime detection - init connection"; flow:to_server,established; flowbits:isset,DesktopDetective_InitConnection1; content:"|FE FE FE FE 00 00 00 00|"; depth:8; content:"DDController"; distance:0; nocase; flowbits:set,DesktopDetective_InitConnection2; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7179; rev:5;) alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger desktop detective 2000 runtime detection - init connection"; flow:to_client,established; content:"|FE FE FE FE|90|00 00|"; depth:8; content:"Private"; distance:0; nocase; content:"Server,"; distance:0; nocase; content:"Login"; distance:0; nocase; content:"Required"; distance:0; nocase; flowbits:set,DesktopDetective_InitConnection1; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; classtype:successful-recon-limited; sid:7178; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - info send through email"; flow:to_server,established; content:"From|3A|"; nocase; content:""; distance:0; content:"Subject|3A|"; nocase; content:"Logs"; distance:0; nocase; content:"X-Mailer|3A|"; nocase; content:"Built-in Mail"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076050; classtype:successful-recon-limited; sid:7177; rev:10;) # alert tcp $HOME_NET 868 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - log retrieve"; flow:to_client,established; flowbits:isset,ABSystemSpy_LogRetrieve; content:"FILEINFO|7C|"; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076050; classtype:successful-recon-limited; sid:7176; rev:7;) alert tcp $EXTERNAL_NET any -> $HOME_NET 868 (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - log retrieve"; flow:to_server,established; content:"Send me the logs, please"; flowbits:set,ABSystemSpy_LogRetrieve; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; classtype:successful-recon-limited; sid:7175; rev:6;) # alert tcp $HOME_NET 868 <> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - information exchange"; flow:established; flowbits:isset,ABSystemSpy_Inforetrieve4; content:"chkCtr"; depth:6; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076050; classtype:successful-recon-limited; sid:7169; rev:9;) alert tcp $HOME_NET 868 <> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - information exchange - flowbit set 4"; flow:established; flowbits:isset,ABSystemSpy_Inforetrieve3; content:"chkCap"; depth:6; flowbits:set,ABSystemSpy_Inforetrieve4; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; classtype:successful-recon-limited; sid:7168; rev:7;) alert tcp $HOME_NET 868 <> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - information exchange - flowbit set 3"; flow:established; flowbits:isset,ABSystemSpy_Inforetrieve2; content:"chkCli"; depth:6; flowbits:set,ABSystemSpy_Inforetrieve3; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; classtype:successful-recon-limited; sid:7167; rev:8;) alert tcp $HOME_NET 868 <> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - information exchange - flowbit set 2"; flow:established; flowbits:isset,ABSystemSpy_Inforetrieve1; content:"chkShe"; depth:6; flowbits:set,ABSystemSpy_Inforetrieve2; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; classtype:successful-recon-limited; sid:7166; rev:8;) alert tcp $HOME_NET 868 <> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger ab system spy runtime detection - information exchange - flowbit set 1"; flow:established; content:"chkLis"; depth:6; flowbits:set,ABSystemSpy_Inforetrieve1; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=591; classtype:successful-recon-limited; sid:7165; rev:8;) # alert tcp $HOME_NET 10050 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - execute file server-to-client"; flow:to_client,established; flowbits:isset,winspy_execute_client-to-server; content:"/RF|16|"; fast_pattern:only; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7164; rev:8;) alert tcp $EXTERNAL_NET any -> $HOME_NET 10050 (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - execute file client-to-server"; flow:to_server,established; content:"/RF"; fast_pattern:only; pcre:"/\x2FRF[^\r\n]*\x16/smi"; flowbits:set,winspy_execute_client-to-server; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7163; rev:6;) # alert tcp $HOME_NET 10050 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - download file server-to-client"; flow:to_client,established; flowbits:isset,winspy_download_client-to-server; content:"/CU"; fast_pattern:only; pcre:"/\x2FCU[^\r\n]*\x18\d+\x18\x16/smi"; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7162; rev:9;) alert tcp $EXTERNAL_NET any -> $HOME_NET 10050 (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - download file client-to-server"; flow:to_server,established; content:"/CD"; fast_pattern:only; pcre:"/\x2FCD[^\r\n]*\x18\x16/smi"; flowbits:set,winspy_download_client-to-server; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7161; rev:6;) # alert tcp $HOME_NET 10050 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - upload file server-to-client"; flow:to_client,established; flowbits:isset,winspy_upload_client-to-server; content:"/CK|16|"; fast_pattern:only; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7160; rev:8;) alert tcp $EXTERNAL_NET any -> $HOME_NET 10050 (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - upload file client-to-server"; flow:to_server,established; content:"/CU"; nocase; content:"True"; distance:0; nocase; pcre:"/\x2FCU[^\r\n]*\x18\d+\x18True\x18\x16/smi"; flowbits:set,winspy_upload_client-to-server; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7159; rev:5;) # alert tcp $HOME_NET 10050 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - remote conn server-to-client"; flow:to_client,established; flowbits:isset,winspy_conn_client-to-server; content:"/CK|16|"; depth:4; nocase; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7158; rev:7;) alert tcp $EXTERNAL_NET any -> $HOME_NET 10050 (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - remote conn client-to-server"; flow:to_server,established; content:"/CLUserName|18|Password|16|"; depth:21; nocase; flowbits:set,winspy_conn_client-to-server; flowbits:noalert; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7157; rev:5;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger win-spy runtime detection - email delivery"; flow:to_server,established; content:"X-Mailer|3A|"; nocase; content:"_ANSMTP_"; distance:0; nocase; content:"Subject|3A|"; nocase; content:"LOG"; distance:0; nocase; content:"FILE"; distance:0; nocase; content:"Current"; distance:0; nocase; content:"User|3A|"; distance:0; nocase; pcre:"/^X-Mailer\x3A[^\r\n]*_\d+_ANSMTP_\d+_.*Subject\x3A[^\r\n]*LOG\s+FILE\s+Current\s+User\x3A/smi"; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.winspy.html; reference:url,www.spywareguide.com/product_show.php?id=715; classtype:successful-recon-limited; sid:7156; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger active keylogger home runtime detection"; flow:to_server,established; content:"Active"; nocase; content:"Keylogger"; distance:0; nocase; content:"Home"; distance:0; nocase; content:"Report"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1720; classtype:successful-recon-limited; sid:7154; rev:9;) # alert udp $HOME_NET any -> $EXTERNAL_NET 15165 (msg:"MALWARE-OTHER Keylogger stealthwatcher 2000 runtime detection - agent up notification"; content:"|00 00 00 00 0A 02 08 A6|"; depth:8; content:"|02 00 00|v"; distance:0; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=879; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075982; classtype:successful-recon-limited; sid:6386; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 15164 (msg:"MALWARE-OTHER Keylogger stealthwatcher 2000 runtime detection - agent status monitoring"; content:"|0A 02 08 FE 00|"; depth:5; offset:4; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=879; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075982; classtype:successful-recon-limited; sid:6385; rev:8;) # alert udp $EXTERNAL_NET any -> 255.255.255.255 15164 (msg:"MALWARE-OTHER Keylogger stealthwatcher 2000 runtime detection - agent discover broadcast"; flow:to_server; content:"|00|]B|00 0A 02 08 FE 01 FC 12 00|"; depth:12; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=879; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075982; classtype:successful-recon-limited; sid:6384; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 15163 (msg:"MALWARE-OTHER Keylogger stealthwatcher 2000 runtime detection - tcp connection setup"; flow:to_server,established; content:"|04 00 00 00|"; depth:4; content:"|FF D8 FF E0 00 10|JFIF|00 01 01 00 00 00 00 00 00 00 FF DB 00|C|00 08 06 06 07 06 05 08 07 07 07 09 09 08 0A 0C 14 0D 0C 0B 0B 0C 19 12 13 0F 14 1D 1A 1F 1E 1D 1A 1C 1C| |24|.' |22|,|23 1C 1C 28|7|29|,01444|1F|'9=82<.342|FF DB 00|C|01|"; distance:0; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=879; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075982; classtype:successful-recon-limited; sid:6383; rev:6;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Sony rootkit runtime detection"; flow:to_server,established; content:"User-Agent|3A|"; nocase; http_header; content:"SecureNet"; fast_pattern; nocase; http_header; content:"Xtra"; distance:0; nocase; pcre:"/^User-Agent\x3A[^\r\n]*SecureNet\s+Xtra/smiH"; pcre:"/^Host\x3A[^\r\n]*sonymusic\x2Ecom/smiH"; metadata:service http; reference:url,attack.mitre.org/techniques/T1014; reference:url,www.schneier.com/blog/archives/2005/11/sonys_drm_rootk.html; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453096362; classtype:misc-activity; sid:6365; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger handy keylogger runtime detection"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"Handy Keylogger|3A|"; distance:0; nocase; content:"PRODUCED BY HANDY KEYLOGGER LOG PARSER"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1103; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453096599; classtype:successful-recon-limited; sid:6340; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger computerspy runtime detection"; flow:to_server,established; content:"From|3A| keys"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=449; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453072991; classtype:successful-recon-limited; sid:6221; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger boss everyware runtime detection"; flow:to_server,established; content:"X-Mailer|3A| Boss Everyware"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.scanspyware.net/info/BossEveryWare.htm; reference:url,www.spywareguide.com/product_show.php?id=4; classtype:successful-recon-limited; sid:6220; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger winsession runtime detection - ftp"; flow:to_server,established; content:"_WinSession Logger.clk"; fast_pattern:only; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097713; classtype:successful-recon-limited; sid:6208; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger winsession runtime detection - smtp"; flow:to_server,established; content:"===========>"; nocase; content:"WinSession Logger"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453097713; classtype:successful-recon-limited; sid:6207; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger eblaster 5.0 runtime detection"; flow:to_server,established; content:"X-SpectorSerial|3A|"; nocase; content:"X-SpectorMachineID|3A|"; fast_pattern:only; content:"X-SpectorBuild|3A|"; nocase; content:"eBlaster"; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=8; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090687; classtype:successful-recon-limited; sid:6190; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware e2give runtime detection - redirect affiliate site request 2"; flow:to_server,established; content:"/fs-bin/swat?"; nocase; http_uri; content:"lsnsig="; nocase; http_uri; content:"offerid="; nocase; http_uri; content:"Referer|3A| e2give.com"; fast_pattern; nocase; http_header; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; reference:url,www.spywareguide.com/product_show.php?id=1226; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075049; classtype:successful-recon-limited; sid:5909; rev:11;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware e2give runtime detection - redirect affiliate site request 1"; flow:to_server,established; content:"/fs-bin/click?"; nocase; http_uri; content:"id="; nocase; http_uri; content:"offerid="; nocase; http_uri; content:"type="; nocase; http_uri; content:"Referer|3A| e2give.com"; fast_pattern:only; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; reference:url,www.spywareguide.com/product_show.php?id=1226; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075049; classtype:successful-recon-limited; sid:5908; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware e2give runtime detection - check update"; flow:to_server,established; content:"/go/check?"; nocase; http_uri; content:"build="; nocase; http_uri; content:"source="; nocase; http_uri; content:"Host|3A| e2give.com"; fast_pattern:only; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; reference:url,www.spywareguide.com/product_show.php?id=1226; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075049; classtype:successful-recon-limited; sid:5907; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spyagent runtime detect - alert notification"; flow:to_server,established; content:"This is an alert notification from SpyAgent"; fast_pattern:only; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=22; classtype:successful-recon-limited; sid:5882; rev:8;) alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger spyagent runtime detect - ftp delivery"; flow:to_server,established; content:"STOR spyagent-log"; fast_pattern:only; metadata:policy balanced-ips alert, policy connectivity-ips alert, policy security-ips alert, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=22; classtype:successful-recon-limited; sid:5881; rev:10;) alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger spyagent runtime detect - smtp delivery"; flow:to_server,established; content:"Computer IP Address|3A|"; nocase; content:"Attached to this email are the activity logs that you have requested"; distance:0; nocase; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=22; classtype:successful-recon-limited; sid:5880; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware ucmore runtime detection - click sponsor/ad link"; flow:to_server,established; content:"/click.asp?"; nocase; http_uri; content:"Host|3A| sponsor2.ucmore.com"; fast_pattern:only; metadata:service http; reference:url,www.spywareguide.com/product_show.php?id=776; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=58660; classtype:successful-recon-limited; sid:5839; rev:9;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER Trackware myway speedbar runtime detection - switch engines"; flow:to_server,established; content:"PG=SPEEDBAR"; nocase; http_uri; pcre:"/\.(jsp|html)\?[^\r\n]*PG=SPEEDBAR/Ui"; metadata:policy balanced-ips alert, policy connectivity-ips alert, policy security-ips drop, service http; reference:url,www.adwarereport.com/mt/archives/000062.html; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090405; classtype:successful-recon-limited; sid:5805; rev:13;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger pc actmon pro runtime detection - smtp"; flow:to_server,established; content:"X-Sender|3A| ActMon"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=1989; classtype:successful-recon-limited; sid:5790; rev:11;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwae urls browsed log"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"HWAE URLS Browsed LOG"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5784; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwae keystrokes log"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"HWAE Keystrokes LOG"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5783; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwae word filtered echelon log"; flow:to_server,established; content:"Subject|3A| HWAE Word Filtered Echelon LOG"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5782; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwae windows activity logs"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"HWAE Windows Activity LOG"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5781; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwpe word filtered echelon log"; flow:to_server,established; content:"Subject|3A| HWPE Word Filtered Echelon LOG"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5780; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwpe shell file logs"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"HWPE Shell/File LOG"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5779; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger runtime detection - hwpe windows activity logs"; flow:to_server,established; content:"Subject|3A| "; nocase; content:"HWPE Windows Activity LOG"; distance:0; nocase; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=436; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080851; classtype:successful-recon-limited; sid:5778; rev:9;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger gurl watcher runtime detection"; flow:to_server,established; content:"X-Mailer|3A| GURL Watcher"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=503; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080847; classtype:successful-recon-limited; sid:5777; rev:10;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-OTHER Keylogger fearlesskeyspy runtime detection"; flow:to_server,established; content:"STOR"; nocase; content:"FKS_"; distance:0; nocase; pcre:"/^STOR\s+FKS_\w+_\d+-\d+-\d+\.log/i"; metadata:service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=553; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076298; classtype:successful-recon-limited; sid:5759; rev:7;) # alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-OTHER Keylogger activitylogger runtime detection"; flow:to_server,established; content:"X-Mailer|3A| SoftActivity Mailer"; fast_pattern:only; metadata:service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.spywareguide.com/product_show.php?id=32; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453080822; classtype:successful-recon-limited; sid:5742; rev:11;) # alert tcp $HOME_NET 15104 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER mstream handler to client"; flow:to_client,established; content:">"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:250; rev:10;) # alert tcp $HOME_NET 12754 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER mstream handler to client"; flow:to_client,established; content:">"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:248; rev:8;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 12754 (msg:"MALWARE-OTHER mstream client to handler"; flow:to_server,established; content:">"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:247; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"MALWARE-OTHER mstream agent pong to handler"; flow:to_server; content:"pong"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:246; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"MALWARE-OTHER mstream handler ping to agent"; flow:to_server; content:"ping"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:245; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"MALWARE-OTHER mstream handler to agent"; flow:to_server; content:"stream/"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:244; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 6838 (msg:"MALWARE-OTHER mstream agent to handler"; flow:to_server; content:"newserver"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:243; rev:8;) # alert udp $EXTERNAL_NET any -> $HOME_NET 20433 (msg:"MALWARE-OTHER shaft agent to handler"; flow:to_server; content:"alive"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:240; rev:10;) # alert udp $EXTERNAL_NET any -> $HOME_NET 18753 (msg:"MALWARE-OTHER shaft handler to agent"; flow:to_server; content:"alive tijgu"; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:239; rev:10;) # alert udp $EXTERNAL_NET any -> $HOME_NET 27444 (msg:"MALWARE-OTHER Trin00 Master to Daemon default password attempt"; flow:to_server; content:"l44adsl"; metadata:ruleset community; reference:cve,2000-0138; reference:url,attack.mitre.org/techniques/T1078; classtype:attempted-dos; sid:237; rev:11;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"MALWARE-OTHER Trin00 Attacker to Master default mdie password"; flow:established,to_server; content:"killme"; metadata:ruleset community; reference:cve,2000-0138; reference:url,attack.mitre.org/techniques/T1078; classtype:attempted-dos; sid:235; rev:9;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"MALWARE-OTHER Trin00 Attacker to Master default password"; flow:established,to_server; content:"gOrave"; metadata:ruleset community; reference:cve,2000-0138; reference:url,attack.mitre.org/techniques/T1078; classtype:attempted-dos; sid:234; rev:9;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"MALWARE-OTHER Trin00 Attacker to Master default startup password"; flow:established,to_server; content:"betaalmostdone"; metadata:ruleset community; reference:cve,2000-0138; reference:url,attack.mitre.org/techniques/T1078; classtype:attempted-dos; sid:233; rev:11;) # alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"MALWARE-OTHER Trin00 Daemon to Master *HELLO* message detected"; flow:to_server; content:"*HELLO*"; metadata:ruleset community; reference:cve,2000-0138; reference:url,www.sans.org/newlook/resources/IDFAQ/trinoo.htm; classtype:attempted-dos; sid:232; rev:13;) # alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"MALWARE-OTHER Trin00 Daemon to Master message detected"; flow:to_server; content:"l44"; fast_pattern:only; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:231; rev:11;) # alert tcp $HOME_NET 20432 -> $EXTERNAL_NET any (msg:"MALWARE-OTHER shaft client login to handler"; flow:to_client,established; content:"login|3A|"; fast_pattern:only; metadata:ruleset community; reference:cve,2000-0138; reference:url,security.royans.net/info/posts/bugtraq_ddos3.shtml; classtype:attempted-dos; sid:230; rev:13;) # alert udp $EXTERNAL_NET any -> $HOME_NET [31335,35555] (msg:"MALWARE-OTHER Trin00 Daemon to Master PONG message detected"; flow:to_server; content:"PONG"; fast_pattern:only; metadata:ruleset community; reference:cve,2000-0138; classtype:attempted-dos; sid:223; rev:13;) # alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-OTHER self-signed SSL certificate with default Internet Widgits Pty Ltd organization name"; flow:established,to_client; ssl_state:server_hello; content:"|55 04 0A 13 18|Internet Widgits Pty Ltd"; fast_pattern:only; metadata:impact_flag red, service ssl; reference:url,attack.mitre.org/techniques/T1078; reference:url,blog.talosintel.com/2011/07/do-you-really-trust-that-certificate.html; reference:url,en.wikipedia.org/wiki/Self-signed_certificate; reference:url,security.ncsa.illinois.edu/research/grid-howtos/usefulopenssl.html; classtype:policy-violation; sid:19551; rev:11;) alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER OSX.Trojan.HackBack file upload attempt"; flow:to_server,established; flowbits:isset,file.zip; file_data; content:"Interview_Venue_and_Questions.app/Contents/MacOS/FileBackupUX"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/172d54f2ed2c422ab063c57d00c8ed44fcb2f18aa068a289308a1207d79de42d/analysis/; classtype:trojan-activity; sid:27060; rev:1;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.HackBack file download attempt"; flow:to_client,established; flowbits:isset,file.zip; file_data; content:"Interview_Venue_and_Questions.app/Contents/MacOS/FileBackupUX"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/172d54f2ed2c422ab063c57d00c8ed44fcb2f18aa068a289308a1207d79de42d/analysis/; classtype:trojan-activity; sid:27059; rev:2;) alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"MALWARE-OTHER Win.Trojan.Yakes download attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:":|5C|Motor Life|5C|Rotor.pdb"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/f0c7b3c9dfc89a45b4131974ea5a6ab0/analysis/; classtype:trojan-activity; sid:27056; rev:1;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Yakes download attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:":|5C|Motor Life|5C|Rotor.pdb"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/f0c7b3c9dfc89a45b4131974ea5a6ab0/analysis/; classtype:trojan-activity; sid:27055; rev:2;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-OTHER Trojan.Java.JVDrop.A jar file download attempt"; flow:to_server,established; flowbits:isset,file.jar; file_data; content:"WebEnhancer.class"; fast_pattern:only; content:"META-INF/SIGNAPPL.SF"; content:"META-INF/SIGNAPPL.DSA"; within:30; distance:40; content:"win"; within:170; distance:150; nocase; content:"mac"; within:20; distance:60; nocase; metadata:impact_flag red, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/53cd1d6a1cc64d4e8275a22216492b76db186cfb38cec6e7b3cfb7a87ccb3524/analysis/; classtype:trojan-activity; sid:27053; rev:1;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Trojan.Java.JVDrop.A jar file download attempt"; flow:to_client,established; flowbits:isset,file.jar; file_data; content:"WebEnhancer.class"; fast_pattern:only; content:"META-INF/SIGNAPPL.SF"; content:"META-INF/SIGNAPPL.DSA"; within:30; distance:40; content:"win"; within:170; distance:150; nocase; content:"mac"; within:20; distance:60; nocase; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/53cd1d6a1cc64d4e8275a22216492b76db186cfb38cec6e7b3cfb7a87ccb3524/analysis/; classtype:trojan-activity; sid:27052; rev:2;) alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"MALWARE-OTHER Win.Trojan.Dokstormac file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"wrUz2WzrY5v/P3E8LObWW7nrH4/a"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/9576c9d64a8eaefb1c76e099cba98813/analysis/; classtype:trojan-activity; sid:27051; rev:1;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Trojan.Dokstormac file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"wrUz2WzrY5v/P3E8LObWW7nrH4/a"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/9576c9d64a8eaefb1c76e099cba98813/analysis/; classtype:trojan-activity; sid:27050; rev:2;) # alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"MALWARE-OTHER Win.Backdoor.Transhell file download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"Hello,Hell!"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service smtp; reference:url,www.virustotal.com/file/204c13f7ed2d3e5c78f3ef8a44eb561c/analysis/; classtype:trojan-activity; sid:27035; rev:1;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Win.Backdoor.Transhell file download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Hello,Hell!"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/file/204c13f7ed2d3e5c78f3ef8a44eb561c/analysis/; classtype:trojan-activity; sid:27034; rev:2;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER UNIX.Trojan.Netweird.A file download attempt"; flow:to_client,established; file_data; content:"/bin/sh|00|/bin/bash"; nocase; content:"libmozsqlite3"; within:100; nocase; content:"opera/wand.dat"; within:50; distance:400; nocase; content:"Exec=|22|%s|22|"; within:50; distance:500; nocase; content:"%.2d/%.2d/%d %.2d:%.2d:%.2d"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/257da8c8b296dac6b029004ed06253fe622c5438b4a47b7dfbb87323b64f50a1/analysis/1354885571/; classtype:trojan-activity; sid:27025; rev:2;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.Netweird.A file download attempt"; flow:to_client,established; file_data; content:"/bin/sh|00|/bin/bash"; nocase; content:"Opera/wand.dat"; within:100; nocase; content:"libmozsqlite3.dylib"; within:50; distance:114; content:"select * from moz_logins"; within:50; distance:679; content:"%.2d/%.2d/%d %.2d:%.2d:%.2d"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/257da8c8b296dac6b029004ed06253fe622c5438b4a47b7dfbb87323b64f50a1/analysis/1354885571/; classtype:trojan-activity; sid:27024; rev:2;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.Pintsized file download attempt"; flow:to_client,established; file_data; content:""; depth:15; offset:8; nocase; content:"/usr/bin/perl"; within:256; nocase; content:"use Socket|3B|"; within:128; nocase; content:"open(STDIN"; within:512; nocase; content:"|3B|exec(|22|/bin/sh -i"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/490d6a45bd7e5ee265373f46fd00e98ff2eb854c0ceda024aa3adaefd947202f/analysis/; classtype:trojan-activity; sid:27198; rev:2;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.Pintsized file download attempt"; flow:to_client,established; file_data; content:""; depth:15; offset:8; nocase; content:"/Users/"; within:128; nocase; content:"/.cups/cupsd-z"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/3b829abe42252b2fa8d304b93a35090c23f3702ad048adfdd03942f77e0f5a66/analysis/; classtype:trojan-activity; sid:27197; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER IFRAMEr Tool code injection attack"; flow:to_client,established; file_data; content:"a=0|3B|z=|22|y|22 3B|try{a*=25}catch("; fast_pattern:only; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service http; reference:url,malwaremustdie.blogspot.jp/2013/07/proof-of-concept-of-cookiebomb-attack.html; classtype:misc-activity; sid:27229; rev:2;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER OSX.Trojan.Janicab file download attempt"; flow:to_client,established; file_data; content:"RecentNews|2E E2 80 AE|fdp.app"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.f-secure.com/weblog/archives/00002576.html; classtype:attempted-admin; sid:27228; rev:2;) alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-OTHER Mac OSX FBI ransomware"; flow:to_client,established; file_data; content:"