"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c331ddf1104c7a7f556c97d0aeb87ab1ab174a3e13d87a7b866651e8a226e57f/analysis/; classtype:trojan-activity; sid:32243; rev:1;)
# alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC FrameworkPOS data exfiltration through DNS - beacon message"; flow:to_server; content:"|06|beacon"; content:"dc"; within:6; distance:3; nocase; content:"dc"; within:6; distance:2; nocase; content:"dc"; within:6; distance:2; nocase; metadata:impact_flag red, policy security-ips drop, service dns; reference:url,attack.mitre.org/techniques/T1020; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:trojan-activity; sid:32312; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rehtesyk outbound connection"; flow:to_server,established; content:"User-Agent: Firefox|0D 0A|"; fast_pattern:only; content:"first="; depth:6; http_client_body; content:"&data="; within:7; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b1347df8f8940039cb68bd4e2568e8c68b1f1a0067ac9a0fb1a5f1aef2df61ea/analysis/; classtype:trojan-activity; sid:32311; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Farfli variant outbound connection"; flow:to_server,established; content:"FWKJG"; depth:5; fast_pattern; content:"|78 01 00 00|"; within:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/184c083e839451c2ab0de7a89aa801dc0458e2bd1fe79e60f35c26d92a0dbf6a/analysis/; classtype:trojan-activity; sid:32310; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Acanas variant outbound connection"; flow:to_server,established; content:"fernando/RMT/Portal.php?nombre="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4a2019286de4a6bed9e4775e753ca7f52ae6dd31da1779d87fd89da701475b88/analysis/; classtype:trojan-activity; sid:32293; rev:2;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Cryptolocker download detected"; flow:to_server,established; file_data; content:"|00|R|00|e|00|a|00|d|00|E|00|x|00|c|00|e|00|l|00|.|00|E|00|X|00|E|00 00|"; fast_pattern:only; content:"A|00|n|00|w|00|e|00|n|00|d|00|u|00|n|00|g|00 20 00|R|00|e|00|a|00|d|00|E|00|x|00|c|00|e|00|l|00 00|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/ad9692b0d589faf72121e4c390138dfe872fe913f73dd1edb699e60bab38f875/analysis/; classtype:trojan-activity; sid:32292; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Cryptolocker download detected"; flow:to_server,established; file_data; content:"c|00|:|00 5C 00|M|00|Y|00|a|00|p|00|P|00|.|00|e|00|X|00 00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/ad9692b0d589faf72121e4c390138dfe872fe913f73dd1edb699e60bab38f875/analysis/; classtype:trojan-activity; sid:32291; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptolocker download detected"; flow:to_client,established; file_data; content:"|00|R|00|e|00|a|00|d|00|E|00|x|00|c|00|e|00|l|00|.|00|E|00|X|00|E|00 00|"; fast_pattern:only; content:"A|00|n|00|w|00|e|00|n|00|d|00|u|00|n|00|g|00 20 00|R|00|e|00|a|00|d|00|E|00|x|00|c|00|e|00|l|00 00|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/ad9692b0d589faf72121e4c390138dfe872fe913f73dd1edb699e60bab38f875/analysis/; classtype:trojan-activity; sid:32290; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptolocker download detected"; flow:to_client,established; file_data; content:"c|00|:|00 5C 00|M|00|Y|00|a|00|p|00|P|00|.|00|e|00|X|00 00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/ad9692b0d589faf72121e4c390138dfe872fe913f73dd1edb699e60bab38f875/analysis/; classtype:trojan-activity; sid:32289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sapertilz variant outbound connection"; flow:to_server,established; content:"/cgi-bin/session?name="; depth:22; http_uri; content:"@"; distance:0; http_uri; content:"|20|"; distance:0; http_uri; content:"&serial="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/91e3d08c7e86f38725842943a843d85ec2a50a785b1d1364e914cb9b8b222ffd/analysis/; classtype:trojan-activity; sid:32287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zoxpng variant outbound connection"; flow:to_server,established; urilen:>200; content:"imgres?q=A380&hl=en-US&sa="; fast_pattern:only; http_uri; content:"&imgrefurl="; nocase; http_uri; content:"&imgurl="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.novetta.com/files/9114/1329/6233/ZoxPNG_Preliminary_Analysis.pdf; reference:url,www.virustotal.com/en/file/07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d/analysis/; classtype:trojan-activity; sid:32285; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Spamnost variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/stat1.php"; depth:10; http_uri; content:"Host: 87.75.44.12|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/1c3b131e2958ef681f843870ca61131924bbcf1c30c8a45d9ec052ddedd4f541/analysis/; classtype:trojan-activity; sid:32273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC WIN.Trojan.Hesechca variant outbound connection"; flow:to_server,established; content:"/update2/submit_ticket.php"; fast_pattern:only; http_uri; content:"&category="; http_client_body; content:"&priority="; http_client_body; content:"&message="; http_client_body; content:"&FileLocation="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/dcba379bcb415d95f0e4412c6dcbdc6726b211a4ec0874111d308fbaba4ca3ba/analysis/; classtype:trojan-activity; sid:32272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tinba variant outbound connection"; flow:to_server,established; content:"/new1djs657shd/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0aca4efd69c9331751f0e9d13f434aa640a0f94eb1b522b5e4100aefc47670fb/analysis/; classtype:trojan-activity; sid:32270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9999 (msg:"MALWARE-CNC Win.Trojan.Cakwerd variant outbound connection"; flow:to_server,established; content:"ZnVja3lvdQ=="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/b24d47f811138b6d876b9906fee0718a25d48a95e7207543443ab2f36e19fe9a/analysis/; classtype:trojan-activity; sid:32341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ropest variant outbound connection"; flow:to_server,established; content:"/?ver="; http_uri; content:"&os="; distance:0; http_uri; content:"&res="; distance:0; content:"Accept-Asterope: true"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/eda0ee72b64d78496fad5ac3f0dff9c8291f8751df7d8ebb62242c7a915b7e31/analysis/; classtype:trojan-activity; sid:32338; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Stantinko variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/modules/mod_proxy/proxy.php"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:"pass="; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/99c69981aecf111b66006e675f144764f2a8bcd270c8a0bbc976d8f1a6e086f7/analysis/; reference:url,www.virustotal.com/en/file/caf1832e76b5bc663b4dcc77b8ae3ac226481ba16af39bab866d391369529d2b/analysis/; classtype:trojan-activity; sid:32334; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Hancitor variant outbound connection"; flow:to_server,established; content:"/gate.php"; depth:9; http_uri; content:"}GRGRGRGR}"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/en/file/a3cf855b9bfbb17e4e293c6d28290de4329338a988b5c6a33e35e7bc6f3b0c3b/analysis/; classtype:trojan-activity; sid:32332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Maener variant outbound connection"; flow:to_server,established; content:"/signin.php?id="; fast_pattern; http_uri; content:"&aver="; distance:0; http_uri; content:"User-agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ce55ff49ec4d360a1aa06ddf378a44d9a72c49677142298df1b56ce7be871cca/analysis/; classtype:trojan-activity; sid:32331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Maener variant outbound connection"; flow:to_server,established; content:"/method/wall.get.xml"; fast_pattern:only; http_uri; content:"User-agent: "; http_header; content:!"Accept: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ce55ff49ec4d360a1aa06ddf378a44d9a72c49677142298df1b56ce7be871cca/analysis/; classtype:trojan-activity; sid:32330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Maener variant outbound connection"; flow:to_server,established; content:"/method/groups.getById.xml?fields="; fast_pattern:only; http_uri; content:"User-agent: "; http_header; content:!"Accept: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ce55ff49ec4d360a1aa06ddf378a44d9a72c49677142298df1b56ce7be871cca/analysis/; classtype:trojan-activity; sid:32329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Maener variant download request"; flow:to_server,established; content:"/tools/RegWriter.exe.raum_encrypted"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ce55ff49ec4d360a1aa06ddf378a44d9a72c49677142298df1b56ce7be871cca/analysis/; classtype:trojan-activity; sid:32328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Matsune variant outbound connection"; flow:to_server,established; content:"/backup.php?"; depth:12; http_uri; content:"="; within:6; http_uri; content:"="; depth:4; http_client_body; content:"AA"; within:2; distance:3; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6ad7b0b82957a55db92d621bf6689243fc4048d76062e3c9ce233d6c0fa95700/analysis/; classtype:trojan-activity; sid:32354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-CNC Win.Trojan.Graftor variant outbound spam attempt"; flow:to_server,established; file_data; content:"/images/chcm/healthcare_online.gif"; fast_pattern:only; content:"/images/chcm/m_products.gif"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/c0a2d8dfe7f4eea54c0128b11a8a15d12a5c842572346f11e4f8fd43f207748e/analysis/; classtype:attempted-user; sid:32344; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Graftor variant inbound spam attempt"; flow:to_server,established; file_data; content:"/images/chcm/healthcare_online.gif"; fast_pattern:only; content:"/images/chcm/m_products.gif"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/c0a2d8dfe7f4eea54c0128b11a8a15d12a5c842572346f11e4f8fd43f207748e/analysis/; classtype:attempted-user; sid:32343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cridex variant outbound connection"; flow:to_server,established; content:"/bin.exe"; http_uri; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B| Trident/4.0|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.0.04506.648|3B| .NET CLR 3.5.21022)"; fast_pattern:only; http_header; content:!"Referer"; http_header; pcre:"/\/bin\.exe$/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9ad8b524f53542a0fc2dc9bf21291a88d289d0c1be0050606069d48704fa5675/analysis/; classtype:trojan-activity; sid:32368; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GameOverZeus variant outbound connection"; flow:to_server,established; urilen:<10; content:"/update"; http_uri; content:"POST"; http_method; content:"|0D 0A|Accept-Encoding:|0D 0A|Connection: close|0D 0A|Content-Length: "; fast_pattern:only; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/d866214d1f921028f9001ae399e9f8dec32ec8998c84d20d60a992164888a6fc/analysis; classtype:trojan-activity; sid:32367; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Akaza variant outbound connection"; flow:to_server,established; content:"/info.php"; depth:9; http_uri; content:"s=INSERT+INTO+info4+("; depth:21; http_client_body; content:"+values+"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/106D7963BF3228BEBF8FF8FF3DE20860EB772FFA033DAC3C2881ADCA3465F36B/analysis/; classtype:trojan-activity; sid:32357; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Androm variant outbound connection"; flow:to_server,established; urilen:13; content:"POST"; http_method; content:"/and/gate.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malwr.com/analysis/ZmE3ZWU2YTkyM2U0NGQ0MmI1NDcxMjUwZDE2NTM5MjQ/; classtype:trojan-activity; sid:32374; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Broonject variant outbound connection"; flow:to_server, established; content:"puzzleofworld.com"; fast_pattern:only; http_header; content:"Set-Cookie: A"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/22c430fce3cae672c378cdf0508e9ad2f386f27296628634c05fa9a18610af7f/analysis/; classtype:trojan-activity; sid:32373; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Drepitt variant outbound connection"; flow:to_server, established; content:"/getaction2.php?pl="; fast_pattern:only; http_uri; content:"User-Agent: AutoIt"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/50e48a9be8734e8b7eb80988a75bc4fdb4ed8d490ce78919488a0c0c7456a957/analysis/; classtype:trojan-activity; sid:32372; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Orcarat variant outbound connection"; flow:to_server,established; content:"=2|2F|"; fast_pattern:only; http_uri; urilen:100<>150; content:"|2F|"; depth:2; offset:17; http_uri; content:!"|25|"; http_raw_uri; pcre:"/^\x2f[A-Za-z0-9+~=]{16,17}\x2f[A-Za-z0-9+~=]{35,40}\x2f[A-Za-z0-9+~=]{8}\x2f[A-Za-z0-9+~=]*?\x2f[A-Za-z0-9+~=]{12,30}$/I"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/074C472406E38385FE769FBAAA72C7259247F42EF1B9140F31228AFC66AFBC67/analysis/; classtype:trojan-activity; sid:32397; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Orcarat variant outbound connection"; flow:to_server,established; content:"=2 HTTP/1.1|0D 0A|"; fast_pattern:only; urilen:100<>150; content:"|2F|"; depth:2; offset:17; http_uri; content:!"|25|"; http_raw_uri; pcre:"/^\x2f[A-Za-z0-9+~=]{16,17}\x2f[A-Za-z0-9+~=]{35,40}\x2f[A-Za-z0-9+~=]{8}\x2f[A-Za-z0-9+~=]*?\x2f[A-Za-z0-9+~=]{12,30}$/I"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/074C472406E38385FE769FBAAA72C7259247F42EF1B9140F31228AFC66AFBC67/analysis/; classtype:trojan-activity; sid:32396; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Orcarat variant outbound connection"; flow:to_server,established; content:"=1|2F|"; fast_pattern:only; http_uri; urilen:100<>150; content:"|2F|"; depth:2; offset:17; http_uri; content:!"|25|"; http_raw_uri; pcre:"/^\x2f[A-Za-z0-9+~=]{16,17}\x2f[A-Za-z0-9+~=]{35,40}\x2f[A-Za-z0-9+~=]{8}\x2f[A-Za-z0-9+~=]*?\x2f[A-Za-z0-9+~=]{12,30}$/I"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/074C472406E38385FE769FBAAA72C7259247F42EF1B9140F31228AFC66AFBC67/analysis/; classtype:trojan-activity; sid:32395; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Orcarat variant outbound connection"; flow:to_server,established; content:"=1 HTTP/1.1|0D 0A|"; fast_pattern:only; urilen:100<>150; content:"|2F|"; depth:2; offset:17; http_uri; content:!"|25|"; http_raw_uri; pcre:"/^\x2f[A-Za-z0-9+~=]{16,17}\x2f[A-Za-z0-9+~=]{35,40}\x2f[A-Za-z0-9+~=]{8}\x2f[A-Za-z0-9+~=]*?\x2f[A-Za-z0-9+~=]{12,30}$/I"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/074C472406E38385FE769FBAAA72C7259247F42EF1B9140F31228AFC66AFBC67/analysis/; classtype:trojan-activity; sid:32394; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Baccamun variant outbound connection"; flow:to_server,established; content:"|A5 D0 A5 AB 00|"; depth:5; content:"|00 00 00|"; depth:3; offset:13; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/file/054e989864df7e6445d1b3785aff25488e9ac1097cf86792f308f8529c1b85f5/analysis/; classtype:trojan-activity; sid:32379; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Havex outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/5.0 (Windows|3B| U|3B| Windows NT 6.1|3B| en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.36 Safari/525.19"; http_header; content:"php?id="; http_uri; content:"&v2="; http_uri; content:"q=45474bca5c3a10c8e94e56543c2bd"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7933809aecb1a9d2110a6fd8a18009f2d9c58b3c7dbda770251096d4fcc18849/analysis/; classtype:trojan-activity; sid:32513; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [443] (msg:"MALWARE-CNC PCRat variant outbound connection"; flow:to_server,established; content:"HTTPS"; depth:5; nocase; content:"|00 00 78 9C|"; depth:4; offset:11; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/b165bce83216ff95df43acfdb9c7239c1edd9412d4b93487cbae111ceb7be8a5/analysis/; classtype:trojan-activity; sid:32512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [1024:] (msg:"MALWARE-CNC PCRat variant outbound connection"; flow:to_server,established; content:"PCRat"; depth:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/b165bce83216ff95df43acfdb9c7239c1edd9412d4b93487cbae111ceb7be8a5/analysis/; classtype:trojan-activity; sid:32511; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 205 (msg:"MALWARE-CNC Linux.Trojan.PiltabeA outbound connection"; flow:to_server,established; dsize:157; content:"|CE 04 00 00|"; content:"w"; depth:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/a27ae25072d781587bb73783a03d3c0f32953e96da0384c54bd368522117f2d0/analysis/; classtype:trojan-activity; sid:32510; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Secdeskinf outbound connection"; flow:to_server, established; content:"/informer/info.php"; depth:18; http_uri; content:"cmd="; http_uri; content:"data="; http_client_body; content:"uid="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/5f764eea5c48aeeccb25e32c1a999188d3c92cddc7337d3a6e880afd4b195f90/analysis/; classtype:trojan-activity; sid:32506; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Backdoor.Kiler attempted outbound connection"; flow:to_server,established; content:"kill.txt"; http_uri; content:"Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.2|3B|SV1|3B| TencentTraveler |3B| .NET CLR 1.1.4322)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/6bedd1b0716fe7632188932451f75295346836545e6d2bfee1b56121e02ca110/analysis/; classtype:trojan-activity; sid:32505; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Backdoor.Kiler attempted outbound connection"; flow:stateless; content:"MlCROS0FT|7C|"; depth:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/6bedd1b0716fe7632188932451f75295346836545e6d2bfee1b56121e02ca110/analysis/; classtype:trojan-activity; sid:32504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Trojan.SpikeA variant outbound connection"; flow:to_server,established; content:"VERSONEX|3A|"; depth:9; dsize:1024; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/65a2a3e36c842baa12d3115074f19b77f7a21275f6a6750ba0ae3aa3f6a47c94/analysis/; classtype:trojan-activity; sid:32494; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Trojan.SpikeA variant outbound connection"; flow:to_server,established; content:"VERS0NEX|3A|"; depth:9; dsize:1024; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/f2ea67c47fbba006c264419013c8ba6782922422086962d0bb1d9547629ea021/analysis/; classtype:trojan-activity; sid:32493; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Backdoor.Exadog variant outbound connection"; flow:to_server,established; content:"22Kq6Sf"; depth:7; offset:2; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ce09b0c393a461df7c98ba6d33d0a1d4b1a7f4cded653c9335c231b3ea724ec8/analysis/; classtype:trojan-activity; sid:32487; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Backdoor.Exadog outbound connection"; flow:to_server,established; content:"|B0 00 00 00|"; depth:4; content:"|00 00 00 70 2C 53 9D|"; within:7; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6e20a3fd8fdb828df7add41700cd1923a48969d1e8377a85e9dc319a18eeaf90/analysis/; classtype:trojan-activity; sid:32486; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bankeiya outbound connection"; flow:to_server,established; content:"/getp.asp"; fast_pattern:only; http_uri; content:"?MAC="; http_uri; content:"&VER="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6dd4851811656d5aa27b817600f43b7958febabee6464cea939cafcfbff12bc3/analysis/; classtype:trojan-activity; sid:32469; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TorrentLocker variant outbound connection"; flow:to_server,established; content:"/topic.php"; fast_pattern:only; http_uri; content:"Accept: */*|0D 0A|Host: "; http_header; content:"Connection: Keep-Alive|0D 0A|Cache-Control: no-cache|0D 0A 0D 0A|"; distance:0; http_header; content:!"User-Agent: "; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/2e0da054d03fde4e7b2c2057cc4aa410c64b6ab8777ee6d4fd43f031a5170a23/analysis/; classtype:trojan-activity; sid:32464; rev:1;)
alert tcp $EXTERNAL_NET 172 -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Effseart variant inbound connection"; flow:to_client,established; content:"|0D 0A 0D 0A 96 84 84 92 85 83 88 98 9C F6|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d951935b8c65319cb96c512b7f2c99703aef4229052787eb28f03256921ab546/analysis/; classtype:trojan-activity; sid:32457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 172 (msg:"MALWARE-CNC Win.Backdoor.Effseart variant outbound connection"; flow:to_server,established; content:"|0D 0A 0D 0A 9F 98 85 84 92 88 96 84 84 92 85 83 F6|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d951935b8c65319cb96c512b7f2c99703aef4229052787eb28f03256921ab546/analysis/; classtype:trojan-activity; sid:32456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Backoff initial outbound connection"; flow:to_server,established; content:"&oprat=1&uid="; depth:13; http_client_body; content:"&uinfo="; within:7; distance:7; http_client_body; content:"&grup="; distance:0; http_client_body; content:"&ver="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3a40b3fcb0707e9b5ae6dd9c7b4370b101c37c0b48fa56a602a39e6d7d5d0de5/analysis/; classtype:trojan-activity; sid:32451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"MALWARE-CNC Win.Backdoor.Kivars outbound connection"; flow:to_server,established; dsize:190<>350; content:"|00 00 9B 4F|"; depth:4; offset:2; content:!"|00 00|"; depth:2; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/f78750b137ad1cb37cbb9ef79f360c7f232d1c7eb347a67f75a9fb6648d99018/analysis/; classtype:trojan-activity; sid:32401; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1604 (msg:"MALWARE-CNC Win.Backdoor.Parama attempted outbound connection"; flow:to_server, established; content:"|01 41 37|"; depth:3; content:"|03|"; distance:0; isdataat:!1,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/21a3384d637c439c1234d9825e2c384a542f55ae047ed83f270d299e29a6689d/analysis/; classtype:trojan-activity; sid:32400; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Vkont variant outbound connection"; flow:to_server,established; content:"xxAIFDV30gCZ4CLxwJX3MUj5X6TjcgcF"; http_client_body; content:"|3B| filename=|22|debug."; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/377c2a22989758ea115c9d151257e90e1d998da0f1c757f04071f2a126e3e875/analysis/; classtype:trojan-activity; sid:32529; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 2.0 possible TOR client retrieval attempt"; flow:to_client,established; file_data; byte_extract:1,0,size; content:"|00 00 00|"; depth:4; offset:1; content:"|00 D3 9C 08 00|"; within:5; distance:size; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3cbc091b52957b84a2131fc14b5117fad5daea36b1fa821ad83711a4781deda2/analysis/; classtype:trojan-activity; sid:32521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Bayoboiz outbound connection"; flow:to_server, established; content:"|0D 0A|TIME: "; depth:9; content:"|0D 0A|USER: "; within:8; distance:24; content:"HOST: "; within:70; content:"OS: "; within:19; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,www.virustotal.com/en/file/a61604db242aa7e4eb26a409eab4e1f279928a0a8490982874ced7930701fdd5/analysis/; classtype:trojan-activity; sid:32557; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Trojan.Bayoboiz outbound connection"; flow:to_server, established; content:"PASS 9437694683"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,www.virustotal.com/en/file/a61604db242aa7e4eb26a409eab4e1f279928a0a8490982874ced7930701fdd5/analysis/; classtype:trojan-activity; sid:32556; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Coreshell variant outbound connection"; flow:to_server,established; content:"/~xh/sn.cgi?"; depth:12; http_uri; content:"T0s=|0D 0A|"; depth:6; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/423a0799efe41b28a8b765fa505699183c8278d5a7bf07658b3bd507bfa5346f/analysis/; classtype:trojan-activity; sid:32551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Extant variant outbound connection"; flow:to_server,established; content:"/img/member.php?id="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (compatible|3B| MSIE 9.0|3B| Windows NT 6.1|3B| Trident/5.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/71114a8841731332f6316640add414eb231ab40f6e62176bf7e1be7e7f0df1e0/analysis/; classtype:trojan-activity; sid:32550; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Mac.Backdoor.iWorm attempted outbound connection"; flow:to_server,established; urilen:26,norm; content:"HTTP/1.0|0D 0A|Host|3A| www.reddit.com|0D 0A|Accept|3A| text/html|0D 0A 0D 0A|"; fast_pattern:only; content:"/search?q="; depth:10; http_uri; content:!"User-Agent"; http_header; pcre:"/^\/search\x3fq=[A-F0-9]{16}$/U"; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d8a313afd2789b853b05cb897871ae4438170216e9ea5d4060670065e7ec34e5/analysis/; classtype:trojan-activity; sid:32548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:8; content:"/ify.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 6.0|3B| SLCC1"; http_header; content:!"Referer"; http_header; content:!"Content-Type"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f7740e0de807b00f9f851644cc742f14e43d376ab59f9a1fddca93caa5ec5b6c/analysis/; classtype:trojan-activity; sid:32586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:19; content:"/"; depth:1; offset:9; http_uri; content:"/"; within:2; distance:7; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B|MSIE 7.0|3B|Windows NT 6.0)"; fast_pattern:only; http_header; content:!"Referer"; http_header; content:!"Content-Type"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f7740e0de807b00f9f851644cc742f14e43d376ab59f9a1fddca93caa5ec5b6c/analysis/; classtype:trojan-activity; sid:32585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"plug=NAO"; fast_pattern:only; http_client_body; content:".php HTTP/1.0|0D 0A|"; content:"Content-Length: 8"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malwr.com/analysis/NDUwYTczYzQ0YWMwNGM2Yjk5MDc5YmU4Yjg5MzY5OWY/; reference:url,www.virustotal.com/en/file/d34644047c451081e9332e18600dba25aed42ff76f96fc51cb3eada95ba57e59/analysis/; classtype:trojan-activity; sid:32584; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; urilen:16; content:"/cbrry/cbre.html"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7c110c2d125a4100322bd9c4328d0a01259cb00a4e3709815711b8b364a58bdd/analysis/1415285838/; classtype:trojan-activity; sid:32583; rev:2;)
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Regin outbound connection"; itype:0; content:"shit"; content:"shit"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/c0cf8e008fbfa0cb2c61d968057b4a077d62f64d7320769982d28107db370513/analysis/; classtype:trojan-activity; sid:32624; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Regin outbound connection"; flow:to_server,established; content:"WINKER="; fast_pattern:only; content:"WINKER="; http_cookie; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/c0cf8e008fbfa0cb2c61d968057b4a077d62f64d7320769982d28107db370513/analysis/; classtype:trojan-activity; sid:32623; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Regin outbound connection"; flow:to_server,established; content:"AST.NET_SessionId="; fast_pattern:only; content:"AST.NET_SessionId="; http_cookie; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/c0cf8e008fbfa0cb2c61d968057b4a077d62f64d7320769982d28107db370513/analysis/; classtype:trojan-activity; sid:32622; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Regin outbound connection"; flow:to_server,established; content:" TW="; fast_pattern:only; content:" TW="; http_cookie; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c0cf8e008fbfa0cb2c61d968057b4a077d62f64d7320769982d28107db370513/analysis/; classtype:trojan-activity; sid:32621; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Jadowndec attempted outbound connection"; flow:to_server,established,only_stream; content:"Mozilla/3.0 (compatible|3B| Indy Library)"; http_header; content:"/2help/"; depth:7; fast_pattern; http_uri; content:".hlp"; within:14; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f7f334515f0b6ee9fe92ccf0774748d933a82e297d5bf82c9e0d05bd8762d84f/analysis/; classtype:trojan-activity; sid:32614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Jadowndec attempted outbound connection"; flow:to_server,established; content:"/works/"; http_uri; urilen:7; content:"Mozilla/3.0 (compatible|3B| Indy Library)"; http_header; content:"OPC=10"; depth:6; fast_pattern; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f7f334515f0b6ee9fe92ccf0774748d933a82e297d5bf82c9e0d05bd8762d84f/analysis/; classtype:trojan-activity; sid:32613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"; flow:to_server,established; content:"|01 00 00 00 02|"; depth:5; dsize:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:32610; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant registration message"; flow:to_server,established; content:"|41 00 00 00 03|"; depth:5; dsize:<160; metadata:impact_flag red, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:32609; rev:3;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"; flow:to_client,established; file_data; dsize:<194; content:"BRASIL"; depth:6; content:!"Content-Length"; http_header; content:"Transfer-Encoding: chunked"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0290c3900445dc00ca24888924e37fa6ac17ecaddc60591e32b81536b9f5ef7/analysis/; classtype:trojan-activity; sid:32608; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"; flow:to_client,established; file_data; dsize:<194; content:"INTERNACIONAL"; depth:13; content:!"Content-Length"; http_header; content:"Transfer-Encoding: chunked"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0290c3900445dc00ca24888924e37fa6ac17ecaddc60591e32b81536b9f5ef7/analysis/; classtype:trojan-activity; sid:32607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sodebral variant outbound connection"; flow:to_server,established; content:"/verifica/index.php?id="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A 0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0290c3900445dc00ca24888924e37fa6ac17ecaddc60591e32b81536b9f5ef7/analysis/; classtype:trojan-activity; sid:32606; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Jenxcus variant outbound connection"; flow:to_server,established; content:"/seo.php?username=MAREYOLE&format=ptp"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/8538cbb2271f90c57f57150d714ec92e59869f52c7060bb2ab1f57ef6757321d/analysis/; classtype:trojan-activity; sid:32605; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Geodo variant outbound connection"; flow:to_server,established; urilen:1; content:"User-Agent: Mozilla/4.0 (compatible|3B|MSIE 7.0|3B|Windows NT 6.0)|0D 0A|"; fast_pattern:only; http_header; content:!"Accept-Language:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/330b408173d45365dd6372bc659ebdd54b9eb18b323079da9552c4e3d8e62d1e/analysis/; classtype:trojan-activity; sid:32604; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Mysayad file wipe attempt"; flow:to_server,established; content:"HEAD"; http_method; content:"all.wipe"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6f5f12a2157d4f67fc3730c4531a75325c94a9bfb75302fabbd513ee78f223b2/analysis/; classtype:trojan-activity; sid:32600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Mysayad outbound connection"; flow:to_server,established,only_stream; content:"dir="; depth:4; http_client_body; content:"&data="; within:6; distance:36; http_client_body; pcre:"/^dir=[0-9A-F]{8}(-[0-9A-F]{4}){4}[0-9A-F]{8}&data=/Pi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6f5f12a2157d4f67fc3730c4531a75325c94a9bfb75302fabbd513ee78f223b2/analysis/; classtype:trojan-activity; sid:32599; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Mysayad file wipe attempt"; flow:to_server,established; content:"HEAD"; http_method; content:".wipe"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; pcre:"/[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}.wipe$/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6f5f12a2157d4f67fc3730c4531a75325c94a9bfb75302fabbd513ee78f223b2/analysis/; classtype:trojan-activity; sid:32598; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET [8000,8080] (msg:"MALWARE-CNC Win.Trojan.Wiper variant outbound connection"; flow:to_server,established; dsize:42; content:"(|00|"; depth:2; content:"|04 00 00 00|"; within:4; distance:36; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a/analysis/; classtype:trojan-activity; sid:32674; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Ch variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/tasks.php"; fast_pattern:only; http_uri; content:"Content-length:"; http_header; content:"Content-type:"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/3d8f05f45f8335198e5488716be2a9c5cebead7d0321bc371fa475d689ffe658/analysis/; classtype:trojan-activity; sid:32670; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Chopstick variant outbound request"; flow:to_server,established; content:"/webhp?rel="; http_uri; content:"hl="; distance:0; http_uri; content:"ai="; distance:0; http_uri; content:!"."; depth:20; http_client_body; content:!"|22|"; depth:20; http_client_body; content:!"|3A|"; depth:20; http_client_body; isdataat:500,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/7f6f9645499f5840b59fb59525343045abf91bc57183aae459dca98dc8216965/analysis/; classtype:trojan-activity; sid:32667; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Chopstick variant outbound request"; flow:to_server,established; content:"/search?btnG="; http_uri; content:"utm="; distance:0; http_uri; content:"ai="; distance:0; http_uri; content:!"."; depth:20; http_client_body; content:!"|22|"; depth:20; http_client_body; content:!"|3A|"; depth:20; http_client_body; isdataat:500,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/7f6f9645499f5840b59fb59525343045abf91bc57183aae459dca98dc8216965/analysis/; classtype:trojan-activity; sid:32665; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Kuluoz variant outbound connection"; flow:to_server,established; content:"POST "; depth:5; content:"index.php HTTP"; content:"|0D 0A 0D 0A 80 00 00 00|"; distance:0; fast_pattern; content:!"|0D 0A|Referer"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/85afe62c13bd4a6304da7ef18e958156ddd872ac600bfcb802e1b4faac065cf1/analysis/; classtype:trojan-activity; sid:32706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Win.Trojan.Dridex variant outbound connection"; flow:to_server,established; content:"Mozilla/5.0 (Windows NT 6.1|3B| Trident/7.0|3B| rv:11.0) like Gecko"; fast_pattern:only; http_header; content:"POST"; http_method; content:"Content-Type|3A| octet/binary"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/a4583318c3328204f56810ca3b22f5e4c0a74b173b1a12c5f9e35c70982a1138/analysis/; classtype:trojan-activity; sid:32678; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Win.Trojan.Dridex variant outbound connection"; flow:to_server,established; content:"/stat/lld.php"; fast_pattern:only; http_uri; urilen:13; content:"Host"; http_header; content:":8080|0D 0A|"; within:30; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/a4583318c3328204f56810ca3b22f5e4c0a74b173b1a12c5f9e35c70982a1138/analysis/; classtype:trojan-activity; sid:32677; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC FIN4 VBA Macro credentials upload attempt"; flow:to_server, established; content:"POST"; http_method; content:"/report.php?msg="; fast_pattern:only; http_uri; content:"&uname="; http_uri; content:"&pword="; http_uri; content:"Content-Length|3A 20|0|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/url/536ed7236769b9a5f09b2a31ab138fbad7331108cb65e1f4c77d129df7fb7764/analysis/; classtype:trojan-activity; sid:32776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Win.Trojan.Androm variant outbound connection"; flow:to_server,established; content:"Mozilla/4.0 (compatible|3B|MSIE 7.0|3B|Windows NT 6.0)"; fast_pattern:only; http_header; content:"/"; depth:1; offset:9; http_uri; content:"/"; within:1; distance:8; http_uri; content:"Host:"; http_header; content:":8080"; within:30; http_header; content:"POST"; http_method; dsize:<480; pcre:"/^\/[a-f0-9]{8}\/[a-f0-9]{8}\/$/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/27c298c77e16bbc3f056653034c2d918418f877bb0193a9ca533b5527d830a94/analysis/; classtype:trojan-activity; sid:32770; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.WOWCheckC Attempted CNC"; flow:to_server,established; content:"/add.jsp?uid=001&ver=0307&mac="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9D3D80DADEA99809E835072C5452F47581ECD0C57854A743BA7448B9332401B1/analysis/; classtype:attempted-user; sid:32769; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 6667 (msg:"MALWARE-CNC Win.Trojan.Ragebot variant outbound connection"; flow:to_server,established; content:"NICK raGe|7C|"; depth:10; content:".net|22| |22|rage|22|"; distance:0; nocase; content:"JOIN #scan# rage"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/33a9b8f61e717f5bad87481667a52c911111d29d2bc00d811146578d8719daa7/analysis/; classtype:trojan-activity; sid:32747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 2015 (msg:"MALWARE-CNC VGABot IRC communication attempt"; flow:to_server,established; content:"JOIN |23|websites g0dl1k3"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/f6dfea954b4cb6fd0e737a7b806039e5490224e692123105fbf947541d73550b/analysis/1417795347/; classtype:trojan-activity; sid:32743; rev:1;)
alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CryptoPHP variant outbound connection"; flow:to_server,established; content:"Content-Disposition: form-data|3B| name=|22|serverKey|22|"; fast_pattern:only; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|key|22|"; http_client_body; content:!"User-Agent: "; http_header; content:!"Referer: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7c4381d282964d4f0918412aa3fe3384fe8ee8409dd0c79e734d2bd643fac40e/analysis/; classtype:trojan-activity; sid:32736; rev:1;)
alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CryptoPHP variant outbound connection"; flow:to_server,established; content:"serverKey="; depth:10; http_client_body; content:"&data="; within:10; distance:10; http_client_body; content:!"User-Agent: "; http_header; content:!"Referer: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7c4381d282964d4f0918412aa3fe3384fe8ee8409dd0c79e734d2bd643fac40e/analysis/; classtype:trojan-activity; sid:32735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Typideg variant outbound connection"; flow:established,to_server; urilen:>240; content:"/?"; depth:2; http_uri; content:"Referer|3A| http|3A|//www.google.com"; pcre:"/^\/\x3f[1-9][A-Za-z0-9~_-]{240}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3cd6ad651257f66e9a68d9c89f14666941886e4251983fe7f9bff898b435827e/analysis/; classtype:trojan-activity; sid:32734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9090 (msg:"MALWARE-CNC Win.Trojan.Olegb variant outbound connection"; flow:established,to_server; content:"|00|"; depth:1; content:"|04 00 00 00 25 05 90 19 03|"; within:9; distance:3; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/3cc83ea209348c83b6349d08d1b0aade8d09a34e05f87a5aadc687445eadac2b/analysis/; classtype:trojan-activity; sid:32728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Win.Backdoor.Uclinu variant outbound connection"; flow:to_server,established; content:"|A1 AD A4 E2 E7 AE CA D0 72 C5 F2 D0 87 D7 B5|"; depth:15; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/765cefb36c47598a711e00f1cb9a64cde9014b0984ac5ae8ff7b462e757d8eb2/analysis/; classtype:trojan-activity; sid:32727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Eskaetee outbound connection"; flow:to_server,established; content:".asp|20|HTTP"; content:"Cookie|3A| MC1=V=3&GUID=57ee8df6bd36496e8f36f103d8261984"; fast_pattern:only; content:"|78 9C|"; depth:2; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e1074398baf00c37067b9717e90758bb0708897a447f9e887cc7a0ecd9acdb85/analysis/; classtype:trojan-activity; sid:32781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Eskaetee outbound connection"; flow:to_server,established; content:".asp|20|HTTP"; content:"|7C|RunTime|3A|"; http_header; content:"|7C|Proxy|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e1074398baf00c37067b9717e90758bb0708897a447f9e887cc7a0ecd9acdb85/analysis/; classtype:trojan-activity; sid:32780; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Darkhotel response connection attempt"; flow:to_client,established; file_data; content:"DEXT87"; pcre:"/DEXT87(no|up|\d+\x2e\d+\x2e\d+\x2e\d+)/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2014/11/darkhotel_kl_07.11.pdf; reference:url,securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf; classtype:trojan-activity; sid:32827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Darkhotel data upload attempt"; flow:to_server,established; content:"POST"; http_method; content:"/html/docu.php"; http_uri; content:"User-Agent|3A 20|"; http_header; content:"Media Center PC 6.0"; within:175; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2014/11/darkhotel_kl_07.11.pdf; reference:url,securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf; classtype:trojan-activity; sid:32826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Darkhotel outbound connection"; flow:to_server,established; content:"/bin/read_i.php?"; http_uri; content:"a1="; http_uri; content:"&a2=step2-down"; fast_pattern:only; http_uri; content:"&a3="; http_uri; content:"&a4="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2014/11/darkhotel_kl_07.11.pdf; reference:url,securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf; classtype:trojan-activity; sid:32825; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Darkhotel variant outbound connection"; flow:to_server,established; content:"/txt/read.php"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|"; http_header; content:"Media Center PC 6.0"; within:175; http_header; content:!"Accept|3A 20|"; http_header; content:!"Referer|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2014/11/darkhotel_kl_07.11.pdf; reference:url,securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf; classtype:trojan-activity; sid:32824; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Darkhotel outbound connection"; flow:to_server,established; content:"/images/view.php"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|"; http_header; content:"Media Center PC 6.0"; within:175; http_header; content:!"Accept|3A 20|"; http_header; content:!"Referer|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2014/11/darkhotel_kl_07.11.pdf; reference:url,securelist.com/files/2014/11/darkhotelappendixindicators_kl.pdf; classtype:trojan-activity; sid:32823; rev:2;)
alert tcp $EXTERNAL_NET 9999 -> $HOME_NET any (msg:"MALWARE-CNC Win.Virus.Ransomlock inbound connection"; flow:to_client,established; dsize:4; content:"|74 01 00 00|"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/ip-address/200.119.204.12/information/; classtype:trojan-activity; sid:32792; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9999 (msg:"MALWARE-CNC Win.Virus.Ransomlock outbound connection"; flow:to_server,established; dsize:4; content:"|94 00 00 00|"; fast_pattern:only; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/ip-address/200.119.204.12/information/; classtype:trojan-activity; sid:32791; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Loodir outbound connection"; flow:to_server,established; content:"/run11_1st.txt"; fast_pattern:only; http_uri; content:"Range|3A| bytes=0-"; http_header; content:"Connection|3A|Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/cf9d1db362903af1631af9d426b9cd722ce4c78ab52817746775a26f237cb6f7/analysis/; classtype:trojan-activity; sid:32854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poolfiend variant outbound connection"; flow:to_server, established; content:"/11/feed.php"; fast_pattern:only; http_uri; content:"POST"; http_method; content:!"Accept"; http_header; pcre:"/[a-z\d\x2f\x2b\x3d]{100}/AGPi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/12a803cd2f67d2dbdc3fb1a6940b9a11b61f6d8455f139e6e90893d9a4eb455a/analysis/; classtype:trojan-activity; sid:32853; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poolfiend variant outbound connection"; flow:to_server, established; content:"/11/form.php"; fast_pattern:only; http_uri; content:"POST"; http_method; content:!"Accept"; http_header; pcre:"/[a-z\d\x2f\x2b\x3d]{100}/AGPi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/12a803cd2f67d2dbdc3fb1a6940b9a11b61f6d8455f139e6e90893d9a4eb455a/analysis/; classtype:trojan-activity; sid:32852; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ksypypro outbound connection"; flow:to_server,established; content:"/contact/about.php"; fast_pattern:only; http_uri; content:"px="; depth:3; http_client_body; content:"¬e="; within:21; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c40f6c7a8bafc99ce8a36879b05dd97ced9b96c2060f5812c9c58e461da59225/analysis/; classtype:trojan-activity; sid:32882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Finforst outbound connection"; flow:to_server,established; content:"/reporter.php?msg="; fast_pattern:only; http_uri; content:"&uname"; http_uri; content:"&pword="; within:20; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2d7fbaa5bc21f86b7554430c700e4506d1b2a66fa5c48517e9ca285edd2ef999/analysis/; classtype:trojan-activity; sid:32893; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TorLocker variant outbound connection"; flow:to_server, established; content:"/fc8zs.exe"; fast_pattern:only; http_uri; content:"User-Agent:"; http_header; content:"Media Center PC 6.0"; within:155; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c54d01f58d99ffbf25b118968721c06f4f91fb53f35b047a26885007cc78d43a/analysis/; classtype:trojan-activity; sid:32892; rev:2;)
alert tcp $HOME_NET 80 -> $EXTERNAL_NET any (msg:"MALWARE-CNC Php.Malware.SoakSoakRedirect Malware traffic containing WordPress Administrator credentials"; flow:to_client,established; file_data; content:" $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TinyZBot response connection attempt"; flow:to_client, established; file_data; content:"[ALL]__"; within:75; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/0d1f479842cd5bde4f18ab8c85a099da39e13a4051a7c21334e33d55b6f18d76/analysis/; classtype:trojan-activity; sid:32958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TinyZBot outbound SOAP connection attempt"; flow:to_server,established; content:"POST"; http_method; urilen:17; content:"/checkupdate.asmx"; fast_pattern:only; http_uri; content:"SOAPAction|3A 20|"; http_header; content:"User-Agent|3A 20|Mozilla/4.0|20 28|compatible|3B 20|MSIE 6.0|3B 20|MS Web Services Client Protocol"; pcre:"/SOAPAction\x3a[^\r\n]*Get(ServerTime|FileList|File)\x22/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/0d1f479842cd5bde4f18ab8c85a099da39e13a4051a7c21334e33d55b6f18d76/analysis/; classtype:trojan-activity; sid:32957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Android.CoolReaper.Trojan outbound connection"; flow:to_server, established; content:"POST"; http_method; content:"/dmp/api/"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|UAC/1.0.0 (Android "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/94b3d27488d10ec2dd73f39513a6d7845ab50b395d6b3adb614b94f8a8609f0e/analysis/; classtype:trojan-activity; sid:32956; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bladabindi variant outbound connection"; flow:to_server,established; content:"Host: pastebin.com"; fast_pattern:only; http_header; content:!"User-Agent"; http_header; content:"download.php"; http_uri; metadata:impact_flag red, policy security-ips drop; reference:url,attack.mitre.org/techniques/T1102; reference:url,www.virustotal.com/en/file/b9cf049a38d52f79e2a9c2d84b9bbc5ad39263a8b663cceda5cae12a3bdb65b8/analysis/; classtype:trojan-activity; sid:32950; rev:2;)
alert tcp $HOME_NET any -> $SMTP_SERVERS [25,2525,587] (msg:"MALWARE-CNC Win.Trojan.TinyZBot outbound connection"; flow:to_server,established; content:"|3A| |0D 0A|"; fast_pattern:only; content:"Content-Disposition|3A| attachment|3B 0D 0A 09|filename="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/CD75664EDEA18E3AA303763E6F6C639B3E90EAD4B51C2B3E41C808E3D968C848/analysis/; classtype:trojan-activity; sid:32910; rev:2;)
alert tcp $HOME_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.TinyZBot outbound connection"; flow:to_server,established; content:"|3A| |0D 0A|"; fast_pattern:only; content:"Content-Disposition|3A| attachment|3B 0D 0A 09|filename="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/CD75664EDEA18E3AA303763E6F6C639B3E90EAD4B51C2B3E41C808E3D968C848/analysis/; classtype:trojan-activity; sid:32909; rev:2;)
alert tcp $HOME_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.TinyZBot outbound connection"; flow:to_server,established; content:"|3A| |0D 0A|"; fast_pattern:only; content:"Content-Disposition|3A| attachment|3B 0D 0A 09|filename="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/CD75664EDEA18E3AA303763E6F6C639B3E90EAD4B51C2B3E41C808E3D968C848/analysis/; classtype:trojan-activity; sid:32908; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Toopu outbound connection"; flow:to_server,established; content:"|0D 0A|Referer|3A 20 0D 0A|Accept-Language|3A|"; fast_pattern:only; http_header; content:"Cookie|3A 20 0D 0A|"; http_raw_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/331177E4FBDE6C98620F1C9927962C79D4C027807357F42002A14A2DC22B4044/analysis/; classtype:trojan-activity; sid:32990; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Graftor outbound connection"; flow:to_server,established; content:"xml_lost_ad.asp"; fast_pattern:only; http_uri; content:"ad_url="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/331177E4FBDE6C98620F1C9927962C79D4C027807357F42002A14A2DC22B4044/analysis/; classtype:trojan-activity; sid:32989; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Graftor outbound connection"; flow:to_server,established; content:"click_log2.asp"; fast_pattern:only; http_uri; content:"ad_url="; http_uri; content:"cr=yes"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/331177E4FBDE6C98620F1C9927962C79D4C027807357F42002A14A2DC22B4044/analysis/; classtype:trojan-activity; sid:32988; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Graftor outbound connection"; flow:to_server,established; content:"/get_ad3.asp"; fast_pattern:only; http_uri; content:"type=loadall"; http_uri; content:"machinename="; http_uri; content:"cr=yes"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/331177E4FBDE6C98620F1C9927962C79D4C027807357F42002A14A2DC22B4044/analysis/; classtype:trojan-activity; sid:32987; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Toopu dll embedded in png download attempt"; flow:to_client,established; flowbits:isset,file.png; file_data; content:"|00 00 00 00|IEND"; content:"MZ"; within:2; distance:4; byte_jump:4,58,relative,little; content:"PE|00 00|"; within:4; distance:-64; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/331177E4FBDE6C98620F1C9927962C79D4C027807357F42002A14A2DC22B4044/analysis/; classtype:trojan-activity; sid:32986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kuluos variant outbound connection"; flow:to_server, established; content:"POST"; http_method; content:"/w1/form.php"; fast_pattern:only; http_uri; urilen:12; content:!"Connection|3A 20|"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/48936d3242ccd9decedf1057b08eacf5f952efeb1b7bb2f354bb02028a361ac2/analysis/; classtype:trojan-activity; sid:32977; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kuluos variant outbound connection"; flow:to_server, established; content:"POST"; http_method; content:"/w1/feed.php"; fast_pattern:only; http_uri; urilen:12; content:!"Connection|3A 20|"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/48936d3242ccd9decedf1057b08eacf5f952efeb1b7bb2f354bb02028a361ac2/analysis/; classtype:trojan-activity; sid:32976; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Twerket variant outbound connection"; flow:to_server,established; content:"/classes/functions.php"; fast_pattern:only; http_uri; content:"?functionname="; nocase; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/de79809054839419556a9a706409b6e0785559cb093fe3e8c7828991194d4c95/analysis/; classtype:trojan-activity; sid:32973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Tosct variant outbound connection"; flow:to_server,established; content:"Y3vaR7-V0Vj6gdni"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/d9eb155c016dc105c2290dd72a003894e71cc854a1c9cc75bd37432c6db45634/analysis/; classtype:trojan-activity; sid:33084; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nocpos information disclosure attempt"; flow:to_server,established; urilen:6; content:"/check"; nocase; http_uri; content:"User-Agent|3A| something|0D 0A|"; fast_pattern:only; http_header; content:"address="; depth:8; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/09ca7be86f517f2e3238e1d52115d29fb2dd079a4d9fc60c18ddc823c137a940/analysis/; classtype:trojan-activity; sid:33083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nocpos initial outbound connection"; flow:to_server,established; urilen:11; content:"/check/echo"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; nocase; http_header; content:!"Content-Length|3A|"; nocase; http_header; content:!"Content-Type|3A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/09ca7be86f517f2e3238e1d52115d29fb2dd079a4d9fc60c18ddc823c137a940/analysis/; classtype:trojan-activity; sid:33082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC OnionDuke variant outbound connection"; flow:to_server,established; content:"/forum/phpBB3/menu.php?"; fast_pattern:only; http_uri; urilen:150; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/19972cc87c7653aff9620461ce459b996b1f9b030d7c8031df0c8265b73f670d/analysis/; classtype:trojan-activity; sid:33081; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Lagulon.A outbound connection"; flow:established,to_server; content:"Content-Disposition|3A| inline|3B| comp="; fast_pattern:only; http_header; content:"/contador/server.php"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e401340020688cdd0f5051b7553815eee6bc04a5a962900883f1b3676bf1de53/analysis/; classtype:trojan-activity; sid:33061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Medusa variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"CNN_Mirror/EN"; http_uri; content:"search?id="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:33060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Medusa variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/bbc_mirror/"; http_uri; content:"search?id="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:33059; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Medusa variant inbound connection"; flow:to_client,established; dsize:<510; content:"|00|U|00|n|00|d|00|e|00|r|00 20 00|C|00|o|00|n|00|s|00|t|00|r|00|u|00|c|00|t|00|i|00|o|00|n|00|<|00|/"; content:"|00 22 00 3E 00|w|00|w|00|w|00|.|00|m|00|i|00|c|00|r|00|o|00|s|00|o|00|f|00|t|00 2E 00|c|00|o|00|m|00 3C|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:33058; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Joanap outbound connection"; flow:to_server, established; content:"|C0 10 CE 82 EA 6B 6B 1D E0 E4 5C F8|"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop; reference:url,www.virustotal.com/en/file/dc030c478d783044dfbf68de54ca6f36e154f60f65dc92f2c6d724078402e738/analysis/; classtype:trojan-activity; sid:33054; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Heur variant outbound connection"; flow:to_server, established; content:"GET"; http_method; urilen:17; content:"/01/WindowsUpdate"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2fb5c3859df3b46cc7e2e2176654cb7e5f739f2bc9faf3e813736b37c6d3b6bc/analysis/; classtype:trojan-activity; sid:33153; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nurjax.A outbound connection"; flow:to_server,established; content:"&dummy="; fast_pattern:only; content:"/services/update.php"; http_uri; content:"&key="; http_uri; pcre:"/&key=[a-z0-9]{32}&dummy=\d{3,5}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ebbc48847066b530924592977226238ab60861740a95aaa4129431c3d8b07ca8/analysis/; classtype:trojan-activity; sid:33152; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 5551 (msg:"MALWARE-CNC Win.Worm.Ultramine outbound connection"; flow:established,to_server; content:"asdfgcod1asdfg"; depth:14; content:"asdfg"; within:20; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/d5933d8e7d445880e59884520f85a41cd2ad7ed8f9e8b38a48c1279e681ea6df/analysis/; classtype:trojan-activity; sid:33149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 587 (msg:"MALWARE-CNC Win.Trojan.Agent variant SMTP reporting attempt"; flow:to_server,established; content:"Subject: Logger - Server Ran"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:33148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 587 (msg:"MALWARE-CNC Win.Trojan.Agent variant SMTP reporting attempt"; flow:to_server,established; content:"Subject: Logger - Recovery Log"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:33147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"|41 11 12 1C 19 18 0F 43 41 1A 18 09 22 10 12 19 08 11 18|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33145; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poweliks outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/q"; http_uri; urilen:2; content:"|0D 0A|Connection|3A| close|0D 0A|Content-Type|3A| application/x-www-form-urlencoded|0D 0A|Content-Length|3A| "; fast_pattern:only; http_header; content:!"User-Agent|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3B99A5C4CAF5B634AEAE0450556E8638EB2976BF17B234229F5D9096E434B9E5/analysis/; classtype:trojan-activity; sid:33165; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Spyware.Rombertik outbound connection"; flow:to_server,established; content:"User-Agent: runscope/0.1"; fast_pattern:only; http_header; content:"name="; http_client_body; content:"&host="; http_client_body; content:"&browser="; http_client_body; content:"&host="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/298234d69f5789de6d092cae131fe9830e61324d591b55cd9079b2fab6d82cd2/analysis/; classtype:attempted-user; sid:33161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Upatre variant outbound connection"; flow:to_server,established; content:"GET "; content:"Accept|3A 20|text/*|2C 20|application/*|0D 0A|User-Agent|3A 20|"; fast_pattern:only; http_header; content:!"Sling/4."; pcre:"/Accept\x3a\x20text\/\*\x2c\x20application\/\*\x0d\x0aUser-Agent\x3a\x20[^\n]+\x0d\x0aHost\x3a[^\n]+\x0d\x0a(Pragma|Cache-Control)\x3a\x20no-cache\x0d\x0a(Connection\x3a Keep-Alive\x0d\x0a)?(\x0d\x0a)?$/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9f30d351418eb0d55d75eec46e6679d715c287ff0bfbfdcb98d91f06c3714d52/analysis/; classtype:trojan-activity; sid:33211; rev:6;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Pisces variant outbound connection"; flow:to_server,established; content:"|00 00 43 50 00 00 2D B0 00 00|"; depth:10; offset:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/136e709cc83cbda0cd8ca6e46fe9e57202bd2699ca063f9d1a51602394c06ef3/analysis/1421953374/; classtype:trojan-activity; sid:33200; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Sabeba outbound connection"; flow:established,to_server; content:"/panel/request.php?action="; fast_pattern:only; http_uri; content:!"Accept"; http_header; content:!"User-Agent|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/20cb36f3f9ac51b0cdd826008902923a469e1b8e5bcd1e64eca7457181a8990c/analysis/; classtype:trojan-activity; sid:33199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kovter variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/form2.php"; fast_pattern:only; http_uri; content:!"Accept"; http_header; pcre:"/[a-z\d\x2f\x2b\x3d]{100,300}/Pi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/599dc4c4dae2d12f8c8ea00114c1cbddecbc171c552e7fbe5aba516ef11b08f0/analysis/; classtype:trojan-activity; sid:33228; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Agent.BHHK variant outbound connection"; flow:to_server,established; dsize:136; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 6.0)|0D 0A|Host: windowsupdate.microsoft.com|0D 0A|Connection: Close|0D 0A 0D 0A|"; fast_pattern:only; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/cab1fffe7a34b5bb7dab2cacd406cf15628d835ab63502d28df78c2faeaad366/analysis/1421677054/; classtype:trojan-activity; sid:33227; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"; flow:to_server,established; flowbits:isset,hawk.lgr; content:"name=screenshot"; fast_pattern:only; pcre:"/name\x3dscreenshot\d+\x2e/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4499928a6fee5d37fb711ed6d68708bf116cfc7f284d3295dd30ded7ecf64b2/analysis/; classtype:trojan-activity; sid:33223; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"; flow:to_server,established; flowbits:isset,hawk.lgr; content:"=0D=0AClipboard"; fast_pattern:only; content:"=0D=0AKeyboard"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4499928a6fee5d37fb711ed6d68708bf116cfc7f284d3295dd30ded7ecf64b2/analysis/; classtype:trojan-activity; sid:33222; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"; flow:to_server,established; content:"Subject|3A 20|=?utf-8?B?"; fast_pattern; content:"=?=|0D 0A|"; within:150; flowbits:set,hawk.lgr; flowbits:noalert; metadata:ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4499928a6fee5d37fb711ed6d68708bf116cfc7f284d3295dd30ded7ecf64b2/analysis/; classtype:trojan-activity; sid:33221; rev:6;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.HawkEye keylogger exfiltration attempt"; flow:to_server,established; content:"HawkEye Keylogger"; fast_pattern:only; content:"Subject: =?utf-8?B"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4499928a6fee5d37fb711ed6d68708bf116cfc7f284d3295dd30ded7ecf64b2/analysis/; classtype:trojan-activity; sid:33220; rev:5;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gamarue variant outbound connection"; flow:to_server,established; urilen:9; content:"POST"; http_method; content:"/2ldr.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/eefe5370b09a32a7b295c136073a8560958c4a58822a7da5b501a10543266c6e/analysis/1421697833/; classtype:trojan-activity; sid:33219; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cendode system information disclosure attempt"; flow:to_server,established; urilen:15; content:"/start/list.php"; nocase; http_uri; content:"|5C|SunDevPackUpdate|5C|JSO"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2fd8af5dcada8d29328437b9f6c13ca73bd766396cc6f6088c83cbba422a112a/analysis/; classtype:trojan-activity; sid:33218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Nuovoscor variant outbound connection"; flow:to_server,established; content:"/|7C|*|7C 5C|"; depth:5; content:"CONNECTED|7C|+|7C|"; within:12; distance:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/cbc08614283cf04ebc62ca05b507bf2c559fcedc96abf154c90ffd72aee2fdf9/analysis/; classtype:trojan-activity; sid:33217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bavload outbound download request attempt"; flow:to_server,established; urilen:12; content:"/juan_sd.txt"; fast_pattern:only; content:!"Referer|3A|"; nocase; content:"Connection: Keep-Alive|0D 0A 0D 0A|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c56fd6fadce1d870a7006c13264ee7782930ad7699523fad6142d3a1d586e504/analysis/; classtype:trojan-activity; sid:33285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OnLineGames variant outbound connection"; flow:to_server,established; urilen:>12; content:"/C8C/gl/cnzz"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8fa888dc56a10e3d103342b7bd22e46c7e020f4cc66efc74c328abe0fcb9c773/analysis/; classtype:trojan-activity; sid:33284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Upatre variant outbound connection"; flow:to_server,established; content:"/js/jquery-"; fast_pattern; http_uri; content:".js?"; within:15; distance:1; http_uri; pcre:"/\x2ejs\x3f[a-zA-Z0-9]{9,20}=Mozilla\x2f/UGi"; content:"Referer|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a06565bb9d49aa92084b5bc32cf59d04dc1d60d63827099ca7c14063f54967a/analysis/1421616162/; classtype:trojan-activity; sid:33282; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [$HTTP_PORTS,443] (msg:"MALWARE-CNC Win.Trojan.Rubinurd variant outbound connection"; flow:to_server,established; content:"GET "; depth:4; content:".php?id="; within:8; distance:6; fast_pattern; content:"Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| SV1)"; distance:0; pcre:"/^GET\s\/[a-z]{5}\.php\?id=[A-Z0-9]{18}\sHTTP\/1\.[0-1]\r\n/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a4d8b0c93faf5d159359ad86b80c7c96f687640c51ec3565f54a059138f7b530/analysis/; classtype:trojan-activity; sid:33305; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Foxy variant outbound connection"; flow:to_server,established; urilen:>80; content:"index.php?admin="; http_uri; content:"&arch_type="; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c85940369a8028803460baf600203c435179611769a9850a2aef7fb45d2c86d7/analysis/; classtype:trojan-activity; sid:33299; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 3373 (msg:"MALWARE-CNC Win.Trojan.Rawpos incoming backdoor connection attempt"; flow:to_server,established; dsize:10; content:"bartalamy!"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/74d5dd1a64b66bd74fc4bdc67354535c349b06b96f024a03b098f886740ec884/analysis/; classtype:trojan-activity; sid:33289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 3.0 variant outbound connection"; flow:to_server,established; content:"POST http://proxy5-5-5.i2p/"; depth:30; fast_pattern; content:"Host: proxy5-5-5.i2p|0D 0A|"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9e06d2ce0741e039311261acc3d3acbaba12e02af8a8f163be926ca90230fa89/analysis/; classtype:trojan-activity; sid:33435; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 3.0 variant outbound connection"; flow:to_server,established; content:"POST http://proxy4-4-4.i2p/"; depth:30; fast_pattern; content:"Host: proxy4-4-4.i2p|0D 0A|"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9e06d2ce0741e039311261acc3d3acbaba12e02af8a8f163be926ca90230fa89/analysis/; classtype:trojan-activity; sid:33434; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 3.0 variant outbound connection"; flow:to_server,established; content:"POST http://proxy3-3-3.i2p/"; depth:30; fast_pattern; content:"Host: proxy3-3-3.i2p|0D 0A|"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9e06d2ce0741e039311261acc3d3acbaba12e02af8a8f163be926ca90230fa89/analysis/; classtype:trojan-activity; sid:33433; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 3.0 variant outbound connection"; flow:to_server,established; content:"POST http://proxy2-2-2.i2p/"; depth:30; fast_pattern; content:"Host: proxy2-2-2.i2p|0D 0A|"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9e06d2ce0741e039311261acc3d3acbaba12e02af8a8f163be926ca90230fa89/analysis/; classtype:trojan-activity; sid:33432; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall 3.0 variant outbound connection"; flow:to_server,established; content:"POST http://proxy1-1-1.i2p/"; depth:30; fast_pattern; content:"Host: proxy1-1-1.i2p|0D 0A|"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9e06d2ce0741e039311261acc3d3acbaba12e02af8a8f163be926ca90230fa89/analysis/; classtype:trojan-activity; sid:33431; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Doc.Downloader.Dridex outbound connection"; flow:established,to_server; urilen:16; content:"/mopsi/popsi.php"; fast_pattern:only; http_uri; content:!"Referer|3A 20|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/182c055ed50804e47ad3916b2d3f21e06719545d11b117f2ca17b52750207eaf/analysis/; classtype:attempted-user; sid:33411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Doc.Downloader.Dridex outbound connection"; flow:established,to_server; urilen:11; content:"/js/bin.exe"; fast_pattern:only; http_uri; content:!"Referer|3A 20|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/048714ed23c86a32f085cc0a4759875219bdcb0eb61dabb2ba03de09311a1827/analysis/; classtype:attempted-user; sid:33342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Yinli outbound connection"; flow:to_server; content:"/doxc/aqw.php?yin="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/69504c5b18f4c6347b5921d2a676abf841aecbefad67cafa2ea4d97960d10614/analysis/; classtype:attempted-user; sid:33330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Yinli outbound connection"; flow:to_server; content:"/soz.php?dis="; fast_pattern:only; http_uri; content:"&pat="; http_uri; content:"&cname="; http_uri; content:"&len="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/69504c5b18f4c6347b5921d2a676abf841aecbefad67cafa2ea4d97960d10614/analysis/; classtype:attempted-user; sid:33329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Yinli outbound connection"; flow:to_server; content:"/scong/cong.php?Lien="; fast_pattern:only; http_uri; content:"&Chin="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/77fbe90d2a6b73aa869b13cccab9e645110dc75859c89763ec7732fa18a358ac/analysis/; classtype:attempted-user; sid:33328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dynamer variant outbound connection"; flow:to_server,established; content:"/index.php?email="; fast_pattern:only; http_uri; content:"@"; http_uri; content:"&len"; http_uri; content:!"User-Agent|3A| "; http_header; content:!"Referer"; http_header; content:!"Accept-"; http_header; pcre:"/\x0d\x0aHost\x3a\x20[^\x0d\x0a\x2e]+\x2e[^\x0d\x0a\x2e]+(\x3a\d{1,5})?\x0d\x0a\x0d\x0a$/H"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/73461d1fb355ba0ed4d9bc36b36333be58bd1f863f92d6c39131be6f4b656511/analysis/; classtype:trojan-activity; sid:33464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"GET"; http_method; content:"User-Agent: http://www.pershop.com.br/"; fast_pattern:only; http_header; content:".php"; http_uri; content:!"Referer:"; http_header; content:!"Accept-"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/609c2c8ab60a30822689a3955fb84f06b5c3962e0d2b894f4794ac8ee5eee2eb/analysis/; classtype:trojan-activity; sid:33457; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"MALWARE-CNC Doc.Downloader.Dridex outbound connection"; flow:established,to_server; urilen:14; content:"/mops/pops.php"; fast_pattern:only; http_uri; content:!"Referer|3A 20|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b018c37bd4b27d8fcfc543d05ef5c0f0477551afe4a396584c6f1b83aeacfa92/analysis/; classtype:attempted-user; sid:33456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kovter variant outbound connection"; flow:to_server,established; urilen:13; content:"POST"; http_method; content:"/12/index.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| Trident/7.0|3B| rv:11.0) like Gecko|0D 0A|"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/db8952943708f4eefa72ad04ff01bdf9acb33fdd89a5ad98b0ec2649fb116a52/analysis/1422981882/; classtype:trojan-activity; sid:33453; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FileEncoder variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"="; depth:2; http_client_body; content:"Content-Length: 128|0D 0A|"; fast_pattern:only; http_header; content:"Content-Type: application/x-www-form-urlencoded|0D 0A|"; http_header; content:"|3B 20|MSIE|20|"; http_header; content:!"Accept-Language:"; http_header; pcre:"/[a-z]\x3d[a-f\d]{126}/P"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/17edf82c40df6c7268191def7cbff6e60e78d7388018408800d42581567f78cf/analysis/; classtype:trojan-activity; sid:33450; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FileEncoder IP geolocation checkin attempt"; flow:to_server,established; dsize:214; urilen:1; content:"GET / HTTP/1.1|0D 0A|User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| SV1|3B| .NET4.0C|3B| .NET4.0E|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.0.4506.2152|3B| .NET CLR 3.5.30729)|0D 0A|Host: ip-addr.es|0D 0A|Cache-Control: no-cache|0D 0A 0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/17edf82c40df6c7268191def7cbff6e60e78d7388018408800d42581567f78cf/analysis/; classtype:trojan-activity; sid:33449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.SpyBanker variant outbound connection"; flow:to_server,established; content:"/m343ff4ufbnmm4uu4nf34m443frr/"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/66e69ff2c4881a1c95eccd287af3b8db692fd5c9df3caee464f8b4125d46c1a4/analysis/; classtype:trojan-activity; sid:33444; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"/r1xpr/r1xe.html"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/4ca26daa7cfb81c8ee05c955f19ef527a9452f2dad3c63674afa7f6796d96f02/analysis/; classtype:trojan-activity; sid:33443; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gefetroe variant outbound connection"; flow:to_server,established; content:"/GFDTroj/GFD.php?PC="; fast_pattern:only; http_uri; content:"&action=initialize"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/94c8c98d0f171c9713adc785e057b35da452b66770fe7e14a57cfb5dc3e947fa/analysis/; classtype:trojan-activity; sid:33439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DNSChanger variant outbound connection"; flow:to_server,established; content:"/updateb.xml?"; fast_pattern:only; http_uri; content:"rnd="; http_uri; content:"&spfail="; within:20; http_uri; content:"&guid="; within:15; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2b16bd74ed6cf86938a7108b6a6fa9343ac4f890f0228b964a98c45428cb4e3c/analysis/; reference:url,www.virustotal.com/en/file/e5cbca1c1cca4ce5ef8beddca38869bdb18e089b969171e5ba337aa756371c36/analysis/; classtype:trojan-activity; sid:33524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DNSChanger variant outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|NSIS_Inetc (Mozilla)|0D 0A|"; fast_pattern:only; http_header; content:"/postinstall.php?"; http_uri; content:"src="; within:5; http_uri; content:"&medium="; within:15; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2b16bd74ed6cf86938a7108b6a6fa9343ac4f890f0228b964a98c45428cb4e3c/analysis/; reference:url,www.virustotal.com/en/file/e5cbca1c1cca4ce5ef8beddca38869bdb18e089b969171e5ba337aa756371c36/analysis/; classtype:trojan-activity; sid:33523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zusy variant outbound connection"; flow:to_server,established; content:"&pcname="; fast_pattern:only; http_client_body; content:"hwid="; depth:5; http_client_body; content:"&mode="; within:50; http_client_body; content:"&system="; within:32; http_client_body; content:"&version="; within:60; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/958c004400ca2a736473c68d842cbea9038bde940d1e44fb08cf08c4352c5f55/analysis/; classtype:trojan-activity; sid:33521; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Zusy inbound CNC response"; flow:to_client,established; file_data; content:"|0A|Array|0A 28 0A 20 20 20 20 5B|"; fast_pattern; content:"] => "; within:20; pcre:"/\x0aArray\x0a\x28\x0a\x20{4}\x5b[a-z\d]{11}\x5d\x20\x3d\x3e\x20\d{16}\x0a\x29/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/958c004400ca2a736473c68d842cbea9038bde940d1e44fb08cf08c4352c5f55/analysis/; classtype:trojan-activity; sid:33520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Andromeda variant outbound connection"; flow:to_server,established; content:"POST"; nocase; http_method; content:".php"; http_uri; content:"User-Agent|3A| Mozilla/4.0|0D 0A|"; fast_pattern:only; http_header; content:"Content-Length|3A 20|"; http_header; content:"Connection|3A 20|close|0D 0A 0D 0A|"; within:21; distance:4; http_header; pcre:"/Content-Length\x3a\x20(?:(8(8|4|0)?)|40|76)\x0d\x0aConnection\x3a\x20close\x0d\x0a\x0d\x0a/H"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7bafad92d862aab418553ab69b974644eda3144b304bb1a3d06fba231b64b3ad/analysis/; classtype:trojan-activity; sid:33496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Enosch variant outbound connection"; flow:to_server,established; content:"/index.html"; http_uri; content:"User-Agent|3A 20|gtalk|0D 0A|"; fast_pattern:only; http_header; content:"Host|3A 20|www.google.com|0D 0A 0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/27A8198B85A2BDB6185BC0D4697554CF767479C64ACF46A8075A6C7C86866C0A/analysis/; classtype:trojan-activity; sid:33482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Linux.Backdoor.Xnote outbound connection"; flow:to_server,established; content:"|11 00 00 00 01 00 00 00 78 9C 4B 05 00 00 66 00 66|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy connectivity-ips drop; reference:url,www.virustotal.com/en/file/9ba52d6a5df217e1bd6dcc92895ccfa1a1426a8b6fb062e4712fae4e483dd877/analysis/; classtype:trojan-activity; sid:33481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Equation outbound connection"; flow:to_server,established; content:"?qq="; http_uri; content:"&rr="; distance:0; http_uri; content:"&h="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1b0eb1a1591140175d1ac111a98c89472b196599baf13ef67ee7f63d0052b00e/analysis/; classtype:trojan-activity; sid:33546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Equation outbound connection"; flow:to_server,established; urilen:9; content:"/cgi-bin/"; http_uri; content:"User-Agent|3A| Mozilla/4.0 |28|compatible|3B| MSIE 8.0|3B| Windows NT 5.1|29 0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1b0eb1a1591140175d1ac111a98c89472b196599baf13ef67ee7f63d0052b00e/analysis/; classtype:trojan-activity; sid:33545; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Equation outbound connection"; flow:to_server,established; urilen:9; content:"/cgi-bin/"; http_uri; content:"User-Agent|3A| Mozilla/4.0 |28|compatible|3B| MSIE 6.0|3B| Win32|29 0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1b0eb1a1591140175d1ac111a98c89472b196599baf13ef67ee7f63d0052b00e/analysis/; classtype:trojan-activity; sid:33543; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Turla outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"?uid="; http_uri; content:"&context="; distance:0; http_uri; content:"&mode=text"; distance:0; fast_pattern; http_uri; content:"&data="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1065; reference:url,www.virustotal.com/en/file/1a488c6824bd39f3568346b2aaf3f6666f41b1d4961a2d77360c7c65c7978b5e/analysis/; classtype:trojan-activity; sid:33547; rev:3;)
alert tcp any any -> any 443 (msg:"MALWARE-CNC Unix.Trojan.lubot outbound connection"; flow:to_server,established; content:"|20 3A 03|7-shell|20 03|14@|03|3"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/d46d95c0be8b62c195d70a7219e6d6487d9624b21057ff4d9cb107ff9023a808/analysis/; classtype:trojan-activity; sid:33621; rev:1;)
alert tcp any any -> any 443 (msg:"MALWARE-CNC Unix.Trojan.lubot outbound connection"; flow:to_server,established; content:"NICK|20|[-]"; depth:8; content:"|0A|"; within:6; content:"PASS|20 0A|USER [-]|20|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/d46d95c0be8b62c195d70a7219e6d6487d9624b21057ff4d9cb107ff9023a808/analysis/; classtype:trojan-activity; sid:33620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [443,446,447] (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound detected"; flow:to_server,established; isdataat:!7; content:"|00 FF|"; depth:2; content:"|00 00 00|"; within:3; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/59852c486e6842b1901527baa3d96088065c1fac8a490031e7683c5d18340855/analysis/; reference:url,www.virustotal.com/en/file/83F75C8D52B84795A526CA7DAEA29186CDC2CDD4A33871A942BB00D673BB0E20/analysis/; classtype:trojan-activity; sid:33600; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Upatre variant outbound connection"; flow:established,to_server; content:"GET|20|"; depth:4; content:"/0/"; distance:0; fast_pattern; content:!".gzip"; content:"HTTP/1.1|0D 0A|User-Agent"; distance:0; content:!"Referer|3A|"; distance:0; content:!"Accept-"; distance:0; pcre:"/^Host\x3a[^\x0d\x0a]+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}\x0d?$/mi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c626804d99195bb0c74e276c49ad48278c8f3723180323c767c60cc8c9f43f7d/analysis/; classtype:trojan-activity; sid:33594; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vawtrak variant outbound connection"; flow:to_server,established; urilen:35; content:"/stats/"; nocase; http_uri; content:"/counter/"; within:9; distance:2; nocase; http_uri; pcre:"/^\/stats\/\d{2}\/counter\/\w{8}\/\w{8}$/Ui"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/66d758dbdffb51460fbc47492de070cb03345e5587f480a7100e32c0a63ff2b8/analysis/; classtype:trojan-activity; sid:33660; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Carbanak data exfiltration attempt"; flow:to_server,established; content:"Content-Disposition: form-data|3B| name="; http_client_body; content:"upload"; within:10; http_client_body; content:"filename="; within:50; http_client_body; content:"listprocess.txt"; within:20; fast_pattern; http_client_body; urilen:168<>184; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,www.virustotal.com/en/file/d843ea21ed8259248f06a6cb39ad9ee07a8a5fd5c481de57865dee64e22bcf08/analysis/; classtype:trojan-activity; sid:33656; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tinba outbound connection"; flow:to_server,established; content:"POST"; http_method; urilen:9; content:"/preview/"; http_uri; content:"Content-Length: 157|0D 0A|"; http_header; content:!"User-Agent|3A 20|"; http_header; content:"|00 80 00 00 00|"; depth:5; offset:24; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/8eb2c85abe7acee219e344ae0592a2b1c159bdafa037be39ac062bdaeeb1f621/analysis/; classtype:trojan-activity; sid:33650; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:>100; content:"/compiler.action?iid="; http_uri; content:"&username="; within:10; distance:32; http_uri; content:"&password="; within:30; distance:1; http_uri; content:"&kernel="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e8cb63cc050c952c1168965f597105a128b56114835eb7d40bdec964a0e243dc/analysis/; classtype:trojan-activity; sid:33648; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:>100; content:"POST"; http_method; content:"/submit.action?username="; http_uri; content:"&password="; within:30; http_uri; content:".tgz"; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e8cb63cc050c952c1168965f597105a128b56114835eb7d40bdec964a0e243dc/analysis/; classtype:trojan-activity; sid:33647; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:<64; content:"/check.action?iid="; http_uri; content:"&kernel="; within:8; distance:32; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e8cb63cc050c952c1168965f597105a128b56114835eb7d40bdec964a0e243dc/analysis/; classtype:trojan-activity; sid:33646; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"|44 14 17 19 1C 1D 0A 46 44 1F 1D 0C 27 15 17 1C 0D 14 1D|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33704; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Carbanak connection to server"; flow:to_server,established; content:"Content-Type: application/x-www-form-urlencoded"; http_header; content:"Accept: */*|0D 0A|"; fast_pattern:only; http_header; content:!"Accept-Language:"; http_header; urilen:168<>184; isdataat:500; isdataat:!601; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/d843ea21ed8259248f06a6cb39ad9ee07a8a5fd5c481de57865dee64e22bcf08/analysis/; classtype:trojan-activity; sid:33681; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FannyWorm outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B|)|0D 0A|"; fast_pattern:only; http_header; content:"/ads/QueryRecord"; http_uri; content:".html"; within:25; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9/analysis/; classtype:trojan-activity; sid:33678; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Babar outbound connection"; flow:to_server,established; content:"/bb/index.php"; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSI 6.0|3B|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf/analysis/; classtype:trojan-activity; sid:33677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Athena variant outbound connection"; flow:to_server,established; content:"/premium-load2/BTC.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c09075245b525dfb565a257ab483b3434684ba9dd941e327ae865de8e2288043/analysis/; classtype:trojan-activity; sid:33675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Athena variant outbound connection"; flow:to_server,established; content:"/premium-load2/82ii.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c09075245b525dfb565a257ab483b3434684ba9dd941e327ae865de8e2288043/analysis/; classtype:trojan-activity; sid:33674; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection"; flow:established,to_server; urilen:>150; content:"Cookie|3A| disclaimer_accepted=true"; fast_pattern:only; content:"disclaimer_accepted=true"; http_cookie; content:!"?"; http_uri; content:"="; http_uri; pcre:"/^\/([a-zA-Z0-9-&+ ]+[^\/?]=){5}/Ui"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/f8549c7f866cc31c7ee379134383f96ff38c0a6d7ffbfe93ffedf97351cf254f/analysis/; classtype:trojan-activity; sid:33757; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection"; flow:established,to_server; urilen:>150; content:"Cookie|3A| onion2web_confirmed=true"; fast_pattern:only; content:"onion2web_confirmed=true"; http_cookie; content:!"?"; http_uri; content:"="; http_uri; pcre:"/^\/([a-zA-Z0-9-&+ ]+[^\/?]=){5}/Ui"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/f8549c7f866cc31c7ee379134383f96ff38c0a6d7ffbfe93ffedf97351cf254f/analysis/; classtype:trojan-activity; sid:33756; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" in|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33755; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" me|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33754; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" co|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33753; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" eu|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33752; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" it|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33751; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" edu|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33750; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" us|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33749; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" org|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33748; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" biz|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33747; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" net|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33746; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" com|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,0,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,4,eChar,relative; byte_test:1,=,eChar,4,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33745; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/service/related?sector="; fast_pattern:only; http_uri; content:"Mozilla|2F|4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/50d7dab7095d5b84a6ccb11769d82cc105b519d84ab7aef4d540ed3703ae3e45/analysis/; classtype:trojan-activity; sid:33822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"; flow:to_server,established; content:!"Accept:"; http_header; content:!"Connection:"; http_header; content:"/report"; depth:7; http_uri; content:"_payload"; fast_pattern:only; http_uri; content:"Mozilla|2F|4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/50d7dab7095d5b84a6ccb11769d82cc105b519d84ab7aef4d540ed3703ae3e45/analysis/; classtype:trojan-activity; sid:33821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"; flow:to_server,established; content:!"Accept:"; http_header; content:!"Connection:"; http_header; content:"/report"; depth:7; http_uri; content:"_image"; fast_pattern:only; http_uri; content:"Mozilla|2F|4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/50d7dab7095d5b84a6ccb11769d82cc105b519d84ab7aef4d540ed3703ae3e45/analysis/; classtype:trojan-activity; sid:33820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"; flow:to_server,established; content:!"Accept:"; http_header; content:!"Connection:"; http_header; content:"/report"; depth:7; http_uri; content:"_step"; fast_pattern:only; http_uri; content:"Mozilla|2F|4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/50d7dab7095d5b84a6ccb11769d82cc105b519d84ab7aef4d540ed3703ae3e45/analysis/; classtype:trojan-activity; sid:33819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"; flow:to_server,established; content:!"Accept:"; http_header; content:!"Connection:"; http_header; content:"/report"; depth:7; http_uri; content:"_process"; fast_pattern:only; http_uri; content:"Mozilla|2F|4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/50d7dab7095d5b84a6ccb11769d82cc105b519d84ab7aef4d540ed3703ae3e45/analysis/; classtype:trojan-activity; sid:33818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" in|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33868; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" me|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33867; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" co|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33866; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" eu|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33865; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" it|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33864; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" edu|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33863; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" us|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33862; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" org|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33861; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" biz|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33860; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex3 initial outbound connection"; flow:to_server,established; content:"Host: "; http_header; content:" net|0D 0A|"; within:35; distance:5; fast_pattern; http_header; content:"|0D 0A 0D 0A|"; distance:0; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/59e49cd21ff679582fbd65dd904ac9197c0b3d9d38de64184f67aecdd2b24f84/analysis/; classtype:trojan-activity; sid:33859; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-CNC Win.Trojan.PwnPOS data exfiltration attempt"; flow:to_server,established; content:"From|3A| "; nocase; content:"Drone"; within:10; nocase; content:"Subject|3A| "; nocase; content:"Drone|0D 0A|"; within:100; nocase; content:"filename="; nocase; content:"syshealth.7z"; within:20; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,virustotal.com/file/fd5c89b46f099891a7152123a546e00ec8b68a6556f70039fd6e10d67e3c090e/analysis/1425883762; classtype:trojan-activity; sid:33857; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.LogPOS variant outbound connection"; flow:to_server,established; content:"?encoding="; nocase; http_uri; content:"&process="; distance:0; nocase; http_uri; content:"&track="; distance:0; nocase; http_uri; content:!"User-Agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,morphick.com/blog/2015/2/27/mailslot-pos; reference:url,www.virustotal.com/en/file/686dbe5eb148db706e48a74eba627270055ed1ba534a98d5d00690577eb42e49/analysis/; classtype:trojan-activity; sid:33854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poseidon outbound connection"; flow:established,to_server; content:"Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 6.1|3B| Trident/4.0|3B| SLCC2|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.5.30729|3B| .NET CLR 3.0.30729|3B| Media Center PC 6.0)"; http_header; content:"oprat="; depth:6; http_client_body; content:"&uinfo="; within:10; distance:23; http_client_body; content:"&win="; distance:0; http_client_body; content:"&vers="; within:6; distance:3; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blogs.cisco.com/security/talos/poseidon; classtype:trojan-activity; sid:33852; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poseidon outbound connection"; flow:established,to_server; content:"Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 6.1|3B| Trident/4.0|3B| SLCC2|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.5.30729|3B| .NET CLR 3.0.30729|3B| Media Center PC 6.0)"; fast_pattern:only; http_header; content:"uid="; depth:4; http_client_body; content:"&uinfo="; within:26; http_client_body; content:"&win="; distance:0; http_client_body; content:"&bits="; within:6; distance:3; http_client_body; content:"&build="; within:20; distance:8; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blogs.cisco.com/security/talos/poseidon; classtype:trojan-activity; sid:33851; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadtre variant outbound connection"; flow:to_server,established; content:"?v=2"; nocase; http_uri; content:"&p=db"; distance:0; nocase; http_uri; content:"&ip="; distance:0; nocase; http_uri; content:"&old_svrid="; fast_pattern:only; http_uri; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7afc3aa4453603d6b11315c3a6a1d80fd36b42fc03f17116c92bc465680b0089/analysis/; classtype:trojan-activity; sid:33883; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MALWARE-CNC Win.Backdoor.Casper outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/css/images/_cgi/index.php"; fast_pattern:only; http_uri; content:"PREF="; http_cookie; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/daa56e7acd5fb69ecefdbf5179c5ef4776ccc41ebe7e14920f11b84678c83a00/analysis/; classtype:trojan-activity; sid:33880; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Meowner runtime detection"; flow:to_server,established; content:"post.php?type=notification&machinename="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0efc3c54f61515ba7531a3207f93d95d0638151f9b4584c4897ce91bb001294e/analysis/; classtype:trojan-activity; sid:33879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Meowner runtime detection"; flow:to_server,established; content:"post.php?type=keystrokes&machinename="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0efc3c54f61515ba7531a3207f93d95d0638151f9b4584c4897ce91bb001294e/analysis/; classtype:trojan-activity; sid:33878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Meowner runtime detection"; flow:to_server,established; content:"post.php?type=passwords&machinename="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0efc3c54f61515ba7531a3207f93d95d0638151f9b4584c4897ce91bb001294e/analysis/; classtype:trojan-activity; sid:33877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Meowner runtime detection"; flow:to_server,established; content:"post.php?type=clipboard&machinename="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0efc3c54f61515ba7531a3207f93d95d0638151f9b4584c4897ce91bb001294e/analysis/; classtype:trojan-activity; sid:33876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tepoyx outbound connection detection"; flow:to_server,established; content:".php?id="; http_uri; content:"&ver="; within:21; distance:23; http_uri; pcre:"/\.php\?id=(\d{5}-\d{3}-\d{7}-\d{5}|0[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}1)&ver=\d{7}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/bb5fc186c65880eb1528048847ad6706ce4d3dcf72f712db2df4db8bccaf022e/analysis/; classtype:trojan-activity; sid:33873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Worm.Urahu outbound connection"; flow:to_server,established; dsize:184; content:"|B0 00 00 00 77 00 00 00|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/043ce80cb94351fda5a03c742f5ea6111c97877ed0ce49e11c61d151fc82c728/analysis/; classtype:trojan-activity; sid:33872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt outbound connection"; flow:to_server,established; urilen:>300,norm; content:"Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0|3B| .NET CLR 2.0.50727|3B| .NET CLR 3.0.4506.2152|3B| .NET CLR 3.5.30729)"; fast_pattern:only; http_header; content:".php?"; http_uri; pcre:"/^\/[A-Za-z0-9]+\.php\?[A-Za-z0-9\x2B\x2F\x3D]{300}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/65c8fa84a707c0e3c0cd5d135d35eed15e1291d3223916e4bad7e91176d04a54/analysis/; classtype:trojan-activity; sid:33893; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Xerq outbound connection"; flow:to_server,established; content:"/mathi/io/"; fast_pattern:only; http_uri; content:"Content-Type: application/x-www-form-urlencoded"; nocase; http_header; content:"name="; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7a69cf34e8259a89c12ebae7fed7bfe906590e5e12434cefbecd49588f2ed318/analysis/; classtype:trojan-activity; sid:33892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Amasages variant outbound connection"; flow:to_server,established; content:"/log/index.php"; fast_pattern:only; http_uri; content:"Content-Type: application/x-www-form-urlencoded"; nocase; http_header; content:"text="; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e17ef5ccc61aaba3b8e2e38c376f91a5408376c1a94116d46710ec8ce9634cf/analysis/; classtype:trojan-activity; sid:33891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC WIn.Trojan.HawkEye keylogger variant outbound connection"; flow:to_server,established; content:"STOR HawkEye_"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/ab7a8e2e7ca3fb87da79774e93be4c9a7a50a6a6f6b479c4cc13dc72416895fa/analysis/; classtype:trojan-activity; sid:33886; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Gh0st variant outbound connection"; flow:to_server,established; content:"KrisR"; depth:5; content:"|00 00 00|"; within:3; distance:1; content:"|00 00 78 9C|"; within:4; distance:2; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/a4fd37b8b9eabd0bfda7293acbb1b6c9f97f8cc3042f3f78ad2b11816e1f9a59/analysis/1425053730/; classtype:trojan-activity; sid:33885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Concbak outbound connection"; flow:established,to_server; content:"User-Agent|3A 20|Firefox.3.5"; fast_pattern:only; http_header; content:"Accept-Encoding|3A 20|identity"; http_header; content:"mode="; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6b2cc3d64aa719c4910b89dc841f7ae07a5eab481d9ad2ed75059ac5173092b1/analysis/; classtype:trojan-activity; sid:33913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Cryptofortress Decryption Software Purchase Tor Website"; flow:to_server,established; content:"Host: h63rbx7gkd3gygag.tor2web.org"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2b1f36a4c856b989a941f454fcce3a5e9670b21de105c5014450cbdaa27ed1cb/analysis/; classtype:trojan-activity; sid:33912; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Mafusc variant outbound connection"; flow:to_server,established; content:"/webpanel/connect2.php"; fast_pattern:only; http_uri; content:"JJ="; http_client_body; content:"&NN="; http_client_body; content:"&EE="; http_client_body; content:"&GG="; http_client_body; content:"&QQ="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0d8edc077940c96f585f5db423143ea4efa3c77fc45252665cdcbdd1ddca0274/analysis/; reference:url,www.virustotal.com/en/file/9903b5eb5be3e2a8c4f8e5240b74eee71580920ba2dd427d2fdb18782b9c7052/analysis/; classtype:trojan-activity; sid:33966; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Penget variant outbound connection"; flow:to_server,established; content:"v="; http_uri; content:"a="; http_uri; content:"u="; http_uri; content:"User-Agent: IE|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/668c7a22614985ae40c79928edf0b1d8423a8b33b59283995e198d24dca1ba41/analysis/; classtype:trojan-activity; sid:33933; rev:2;)
alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"MALWARE-CNC Win.Trojan.Tempedreve Samba probe"; flow:to_server,established; content:"|FF|SMB2"; content:"|03 01|"; distance:0; content:"|5C 00|T|00|e|00|m|00|p|00|.|00|e|00|x|00|e|00 00 00|"; within:20; distance:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service netbios-ssn; reference:url,www.virustotal.com/en/file/b7ef98319be0c33e1660a0ca65eb3904c460095083e6d6eccce4ecdabea61f22/analysis/; classtype:trojan-activity; sid:33932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Goldrv variant outbound connection"; flow:to_server,established; content:"/wp-includes/Text/Diff/Engine/engine/dlversion.php?id="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1c5b2f9ea64d3de85b18570299b56f5215c45cbf77dab9c98bbcc12e62425af2/analysis/; classtype:trojan-activity; sid:33931; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Vicepass outbound connection initial request to the CNC sending system information"; flow:to_server,established; content:"/index.php?data="; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; content:!"Accept:"; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3999c879a255b7611e07ed9314348cddc739b59fb1c14d8a9808a0be06ea9775/analysis/; classtype:misc-activity; sid:33930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ayuther variant outbound connection"; flow:to_server,established; content:"|00|u|00|i|00|f|00|k"; content:"|00|W|00|i|00|n|00|"; within:60; distance:80; content:"2|00|0|00|"; content:"|00|-|00|"; within:3; distance:3; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/file/548a5532364dded2bf7e08f68692a0b50f2626331def9bdf6152a481dc1201c4/analysis/; classtype:trojan-activity; sid:34013; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"/micro/data/index.php?micro="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34012; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"/microsoft/index.php?win="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34011; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"/microsoft/ie.php?win="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34010; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"/ex/ie.php?win="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34009; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"/44"; http_uri; content:"index.php?win="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34008; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"|3C 92 7C 92 3E 45 78 70 6C 6F 73 69 76 65|"; depth:14; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34007; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"|3C 2A 60 21 51 40 57 23 45 34 92 2A 3E|"; depth:13; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34006; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"//v"; http_raw_uri; content:"index.php?win="; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 2.0.50727)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34005; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Explosive variant outbound connection"; flow:to_server,established; content:"==gKg5XI+BmK"; depth:12; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/07529fae9e74be81fd302d022603d9f0796b4b9120b0d6131f75d41b979bbca5/analysis/; classtype:trojan-activity; sid:34004; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Picommex outbound connection"; flow:to_server,established; content:"/susbonlmk"; fast_pattern:only ; http_uri; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; content:"fetchingid="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/02626be37b0f2bb0d1246da8216a29552467197487ff0724c0b463164ceb6bc7/analysis/; classtype:trojan-activity; sid:34003; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Picommex outbound connection"; flow:to_server,established; content:"/updateversion"; fast_pattern:only ; http_uri; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; content:"compid8ausd="; http_client_body; content:"&version"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/02626be37b0f2bb0d1246da8216a29552467197487ff0724c0b463164ceb6bc7/analysis/; classtype:trojan-activity; sid:34002; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Picommex outbound connection"; flow:to_server,established; content:"/check_version.txt"; fast_pattern:only ; http_uri; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/02626be37b0f2bb0d1246da8216a29552467197487ff0724c0b463164ceb6bc7/analysis/; classtype:trojan-activity; sid:34001; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pwexes variant outbound connection"; flow:to_server,established; content:"/sd.php?dt=ftp"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:"Connection: Close"; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; content:"dr="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7a7d1a2667eed09e6fb6b34fc67c3f89a86f452ecbf5f8c6b8df8c8a6e2bbc6c/analysis/; classtype:trojan-activity; sid:33997; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pwexes variant outbound connection"; flow:to_server,established; content:"/dlx.php?f=ftppd"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:"Connection: Close"; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7a7d1a2667eed09e6fb6b34fc67c3f89a86f452ecbf5f8c6b8df8c8a6e2bbc6c/analysis/; classtype:trojan-activity; sid:33996; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Beshida outbound connection"; flow:to_server,established; content:"/seb/downloader/dl.php?"; fast_pattern:only ; http_uri; content:"User-Agent: Microsoft Internet Explorer|0D 0A|"; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/807058e59d0c8271bfc0afae70699a85e33292182f30d1243a28b849ac5336fc/analysis/; classtype:misc-activity; sid:33994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Insidious outbound connection"; flow:to_server,established; content:"/test/update/bin.exe"; fast_pattern:only ; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/13412F4DCFF96ABD1E90825719D8B6464B8F58A730575E187D5177D3A1A50D77/analysis/; classtype:trojan-activity; sid:33993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Insidious outbound connection"; flow:to_server,established; content:"/test/inout/out.php"; fast_pattern:only ; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/13412F4DCFF96ABD1E90825719D8B6464B8F58A730575E187D5177D3A1A50D77/analysis/; classtype:trojan-activity; sid:33992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trioptid outbound connection"; flow:to_server,established; content:"/resolve.conf"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:"Connection: Close"; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d2cfa68d61a92f998d24a9f4b70083afcd0f468ff250d0ca532ea9da9e2f01c6/analysis/; classtype:trojan-activity; sid:33990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trioptid outbound connection"; flow:to_server,established; content:"/update.php"; fast_pattern:only; http_uri; content:"id={"; content:"&vs="; within:37; distance:37; content:"&mdate="; within:7; distance:2; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d2cfa68d61a92f998d24a9f4b70083afcd0f468ff250d0ca532ea9da9e2f01c6/analysis/; classtype:trojan-activity; sid:33989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Trojan.ChinaZ outbound connection"; flow:established,to_server; dsize:168; content:" * "; depth:4; offset:69; content:"MHz|00|"; depth:5; offset:76; content:" MB|00|"; depth:6; offset:103; fast_pattern; content:"VIP|00|"; depth:4; offset:132; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html; classtype:trojan-activity; sid:33985; rev:1;)
alert tcp $HOME_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Expilan variant outbound connection"; flow:to_server,established; content:"--__MESSAGE__ID__54yg6f6h6y456345"; content:"Content-Type: application/x-msdownload|3B| name=|22|mxtd|22|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/73eb2e407a95bb9001b60e18357cc53484aee7da94cc4c06a8a1760eaf2ece96/analysis/; classtype:trojan-activity; sid:34046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Eitenckay initial outbound connection"; flow:to_server,established; content:"/admin/data/member/1/index.php?page=08&enckey="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/807058e59d0c8271bfc0afae70699a85e33292182f30d1243a28b849ac5336fc/analysis/; classtype:trojan-activity; sid:34045; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Exacrytion variant outbound connection"; flow:to_server,established; content:"/cryptotolarance/add.php"; fast_pattern:only; http_uri; content:"hwid="; nocase; http_uri; content:"winversion="; nocase; http_uri; content:"pswd="; nocase; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/95a11858d6b385e3d7c0f65df2f209b8cf4816260af34117a955054d4b6b7512/analysis/; classtype:trojan-activity; sid:34044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Igliveforg variant outbound connection"; flow:to_server,established; content:"/LIVE/signed.php?m="; fast_pattern:only; http_uri; content:"&u="; nocase; http_uri; content:"&v="; distance:0; nocase; http_uri; content:"&h="; distance:0; nocase; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/6083bdfc82aacf53f91b588a8b599f759fadcbd198fe66c095644f55dba44faa/analysis/; classtype:trojan-activity; sid:34042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Igliveforg variant initial outbound connection"; flow:to_server,established; urilen:14,norm; content:"/LIVE/HOST.php"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/6083bdfc82aacf53f91b588a8b599f759fadcbd198fe66c095644f55dba44faa/analysis/; classtype:trojan-activity; sid:34041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banklaed variant outbound connection"; flow:to_server,established; content:"/clientes.php?"; depth:14; http_uri; content:"A1="; within:4; http_uri; content:"&A2="; distance:0; http_uri; content:"&A3="; distance:0; http_uri; content:"&Campo1="; distance:0; http_uri; content:"&Campo2="; distance:0; http_uri; content:"&Campo3="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7cefdb99d1c626d8a3f2dcc0424a37bc30957a07aff69a6c94336693bb4d7bcc/analysis/; classtype:trojan-activity; sid:34039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://pinterest.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34038; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://twitter.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1102; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34037; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: http://www.bing.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34036; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: http://www.msn.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34035; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://aol.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34034; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://yahoo.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34033; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://google.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34032; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: http://youtube.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34031; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex4 initial outbound connection"; flow:to_server,established; urilen:1; content:"Referer: https://facebook.com/|0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A 0D 0A|"; byte_extract:1,4,lessthanChar,relative; byte_test:1,=,lessthanChar,7,relative; byte_extract:1,0,lChar,relative; byte_test:1,=,lChar,15,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7c9d5724064693dfeef76fd4da8d6f159ef0e6707e67c4a692a03e94f4a6e27a/analysis/; classtype:trojan-activity; sid:34030; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/pki/mscorp/crl/msitwww2.crl"; fast_pattern:only; http_uri; content:"Check|3A 20|"; http_header; content:"User-Agent: Microsoft-CryptoAPI/6.3|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c37a0c45fbec9dca672eb82e83c5bf006f5f17f345d1d4b95cce08e63015132d; classtype:trojan-activity; sid:34029; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bruecimig variant outbound connection"; flow:to_server,established; content:"/adminke/"; http_uri; content:"1="; depth:2; http_client_body; content:"&300=0&303=0&304=0&305=0&"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/13221d6f3f8035caa4b97a9c1bd336b44292ed5716f36d7e4840a1b498171854/analysis/; classtype:trojan-activity; sid:34028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Endstar variant outbound connection"; flow:to_server,established; content:"/updata.php?t="; http_uri; content:"m="; within:2; distance:2; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/20cb36f3f9ac51b0cdd826008902923a469e1b8e5bcd1e64eca7457181a8990c/analysis/; classtype:trojan-activity; sid:34026; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Endstar variant outbound connection"; flow:to_server,established; content:"/list.rar"; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 5.01|3B| Windows NT 5.0)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/20cb36f3f9ac51b0cdd826008902923a469e1b8e5bcd1e64eca7457181a8990c/analysis/; classtype:trojan-activity; sid:34025; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.NewPos outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/4.0(compatible|3B| MSIE 7.0b|3B| Windows NT 6.0)|0D 0A|"; fast_pattern:only; http_header; content:"cs="; depth:3; http_client_body; content:"p="; within:15; http_client_body; content:"m="; within:200; http_client_body; content:"v="; within:20; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6be45edda8a4295eca613f2355464617f0467c7e06f3605d80719f92e02d2877/analysis/; classtype:trojan-activity; sid:34052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Nepigon variant outbound connection"; flow:to_server,established; content:"/lightserver/Default.aspx"; depth:25; fast_pattern; http_uri; content:"|0D 0A|Msg|3A| "; http_header; content:"name"; distance:0; http_header; content:"delay"; distance:0; http_header; content:"Server1"; distance:0; http_header; content:"Ver"; distance:0; http_header; content:"Proxy"; distance:0; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/42b8898c07374b1fc6a4a33441aadf10e47f226d9d3bf3368a459c0e221dff73/analysis/; reference:url,www.virustotal.com/en/file/721676d529a0c439594502f1d53fec697adc80fa1301d2bf20c2600d99ceed4e/analysis/; classtype:trojan-activity; sid:34050; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.EvilBunny variant outbound connection"; flow:to_server,established; content:"/images/php/test.php?"; http_uri; content:"rec=11206-01"; within:12; fast_pattern; http_uri; content:"u="; within:3; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc/analysis/; classtype:trojan-activity; sid:34049; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.VBPasswordStealer variant outbound connection"; flow:to_server,established; content:"/index.php?"; http_uri; content:"action=add"; fast_pattern; http_uri; content:"&username="; distance:0; http_uri; content:"&password="; distance:0; http_uri; content:"&app="; distance:0; http_uri; content:"&pcname="; distance:0; http_uri; content:"&sitename="; distance:0; http_uri; content:!"Accept"; http_header; content:!"Connection"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/4f0988ac590d52b97b1a162f5ee098c38f6e640be783a511049d8e5006cac011/analysis/; classtype:trojan-activity; sid:34047; rev:1;)
alert tcp $EXTERNAL_NET 1433 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Banload variant MSSQL response"; flow:to_client,established; content:"|0B|m|00|a|00|c|00|a|00|v|00|e|00|r|00|d|00|e|00|m|00|2|00 06|m|00|a|00|s|00|t|00|e|00|r|00|"; fast_pattern:only; content:"|08|D|00|B|00|S|00|Q|00|0|00|0|00|1|00|7|00|"; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/22ccd94c7e99a17753218708cea1abe162d289b7a0105c3be9620bf224f36f3f/analysis/; classtype:trojan-activity; sid:34136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Erotimpact variant outbound connection"; flow:to_server,established; content:"/index.php?c="; fast_pattern; http_uri; content:"&r="; distance:0; http_uri; content:"&u=1"; distance:0; http_uri; content:"&t="; within:3; http_uri; content:"User-Agent|3A| Mozilla/5.0|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/12072db321799801bbba1c4999cc1f4c477cc7697c9301c7370a3c823ad16ccc/analysis/; classtype:trojan-activity; sid:34132; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload variant outbound connection"; flow:to_server,established; content:"/avisos.php?IDMAQ="; fast_pattern:only; http_uri; content:"&DATA="; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/38d15b78067b137ab750cb01024d5327947a10ae38a6baa01e6819402b2383ed/analysis/; classtype:trojan-activity; sid:34130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.WIntruder outbound connection"; flow:to_server,established; content:"/image.php?id="; http_uri; content:"&act=1"; within:15; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2fcc46e4e34b77205adcd0023dd17a4bf4d54d23aafd0b0efcd3627511f392ed/analysis/; classtype:trojan-activity; sid:34128; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Zupdax variant outbound connection"; flow:to_server,established; content:"/index.php?a=getinfo"; http_uri; content:"User-Agent|3A| Agent"; http_header; content:"CPU%3A"; http_client_body; content:"MHZ"; distance:0; http_client_body; content:"GBmem%3A"; distance:0; http_client_body; content:"MB&ip=127%2E0%2E0%2E1&rem=hi&sid="; distance:0; fast_pattern; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4f8905c6e60ff76041603401ddb1e10dd137ed1755828c6ed93b1b65f033c7eb/analysis/; classtype:trojan-activity; sid:34117; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC MacOS.Trojan.Wirelurker variant outbound connection"; flow:to_server,established; content:"/app/app.php?sn="; http_uri; content:"pn="; distance:0; http_uri; content:"mn="; distance:0; http_uri; content:"pv="; distance:0; http_uri; content:"os="; distance:0; http_uri; content:"pt="; distance:0; http_uri; content:"msn="; distance:0; http_uri; content:"yy="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2ff598efa7fadd4044d97fe1685034a02f3d414bd29a57722889c5915692b662/analysis/; reference:url,www.virustotal.com/en/file/f2a86a80a094bb51a53f1766b1dd7f8e2c8f1fe6f53c96a1184ea81c902ca095/analysis/; classtype:trojan-activity; sid:34116; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC MacOS.Trojan.Wirelurker variant outbound connection"; flow:to_server,established; content:"/mac_log/?appid="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2ff598efa7fadd4044d97fe1685034a02f3d414bd29a57722889c5915692b662/analysis/; reference:url,www.virustotal.com/en/file/f2a86a80a094bb51a53f1766b1dd7f8e2c8f1fe6f53c96a1184ea81c902ca095/analysis/; classtype:trojan-activity; sid:34115; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Agent beacon reply attempt"; flow:to_client,established; file_data; content:"#-START-#"; depth:9; content:"#-END-#"; distance:0; pcre:"/#-START-#([A-Za-z0-9+\x2f]{4})*([A-Za-z0-9+\x2f]{2}==|[A-Za-z0-9+\x2f]{3}=)?#-END-#/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/37b6eda4a259fa4b653ab557bda366c571824fa16686ae6a3eef9140387b0237/analysis/; classtype:trojan-activity; sid:34113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Chrozil variant outbound connection"; flow:to_server,established; content:"/novo/A.php"; http_uri; content:"A=Chrome%3A"; depth:11; http_client_body; content:"%0D%0A%0D%0AFilezilla%3A%"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/118ac7571acc17e2b7a0ce6e7314095dd3d8c6d6365128d2d55f5ea05eb631f1/analysis/; classtype:trojan-activity; sid:34111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Scarsi variant outbound connection"; flow:to_server,established; content:"/topic.php"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache|0D 0A 0D 0A|"; http_header; content:"|00|"; depth:1; offset:1; http_client_body; content:"|00|-|00|"; distance:0; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/97f915ea23eb08cb0a18530f30430afc467bb080108d9ea2176112a1f6b82765/analysis/; classtype:trojan-activity; sid:34108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Punkey outbound connection"; flow:to_server,established; content:"User-Agent|3A| Mozilla/4.0|28|compatible|3B| MSIE 7.0b|3B| Windows NT 6.0|29 0D 0A|"; fast_pattern:only; http_header; content:"cs="; depth:3; http_client_body; content:"&p="; distance:0; http_client_body; content:"&m="; distance:0; http_client_body; content:"&v="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3928e7352daa88d1b5480e96173e2f3e3b1e89ad0a94cced2fb3483a9b0a5d44/analysis/; classtype:trojan-activity; sid:34161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"MALWARE-CNC MacOS.Backdoor.Xslcmd outbound connection"; flow:to_server,established; content:"compose.aspx?s="; fast_pattern:only; http_uri; content:"Accept-Language: zh-cn"; http_header; content:"Referer: http://www.appleupdate.biz/windows/cartoon"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1db30d5b2bb24bcc4b68d647c6a2e96d984a13a28cc5f17596b3bfe316cca342/analysis/; classtype:trojan-activity; sid:34155; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Crypvault outbound connection"; flow:to_server,established; content:"/p.vlt"; fast_pattern:only; http_uri; content:"Host:"; http_header; content:".onion.city"; within:40; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c1d0513317ff36763e3919bfcba138e3ee2fbe301799cad62478c1db6fb234fb/analysis/; classtype:trojan-activity; sid:34143; rev:1;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dyre publickey outbound connection"; flow:to_client,established; content:"|00 DE C5 45 99 14 1E F5 7E 56 78 DF 23 CE 8A 12|"; fast_pattern:only; content:"LvtfOWStYYHNbdiE15aNsOyg"; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl; reference:url,www.virustotal.com/en/file/417c9cd7c8abbd7bbddfc313c9f153758fd11bda47f754b9c59bc308d808c486/analysis/; classtype:trojan-activity; sid:34140; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Downloader.Netkrypt inbound response"; flow:to_client,established; file_data; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/5475615.png"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6d897527f2f741c3b3ba7a6e56ddf1aa4782f902fc4a4ed692416447951f410a/analysis/; classtype:trojan-activity; sid:34183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/5484831.png"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6d897527f2f741c3b3ba7a6e56ddf1aa4782f902fc4a4ed692416447951f410a/analysis/; classtype:trojan-activity; sid:34182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/tmp/lo.jpg"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6d897527f2f741c3b3ba7a6e56ddf1aa4782f902fc4a4ed692416447951f410a/analysis/; classtype:trojan-activity; sid:34181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:<64; content:"/upload/module"; http_uri; content:"build.tgz"; within:9; distance:32; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86/analysis/; classtype:trojan-activity; sid:34263; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:>100; content:"/compiler?iid="; http_uri; content:"&username="; within:10; distance:32; http_uri; content:"&password="; within:30; distance:1; http_uri; content:"&kernel="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86/analysis/; classtype:trojan-activity; sid:34262; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"; flow:to_server,established; urilen:<64; content:"/check?iid="; http_uri; content:"&kernel="; within:8; distance:32; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86/analysis/; classtype:trojan-activity; sid:34261; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.AAEH variant outbound connection"; flow:to_server,established; urilen:<15; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B| SV1)"; fast_pattern:only; content:"Host: "; nocase; http_header; content:"|3A|"; within:16; http_header; content:!"Referer: "; nocase; http_header; content:!"Accept"; nocase; http_header; metadata:impact_flag red, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/0ccade380fd3a9ef7635e5c4e54b82c4ccd434c0bc3bbf76af3a99d744a1c5e7/analysis/; classtype:trojan-activity; sid:34246; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Yebot variant outbound connection"; flow:established,to_server; content:"some_magic_code1"; depth:16; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/4fb6e9c2279f059262a2c419b74bbf0cf4ecb0fceb8cbb5d44f65b6a588d0734/analysis/; classtype:trojan-activity; sid:34223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nanocore variant outbound connection"; flow:to_server,established; content:"/NanoStats/NanoStats.php"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:"Username="; http_client_body; content:"FileName="; distance:0; http_client_body; content:"Status="; distance:0; http_client_body; content:"ClientGUID="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0baa57e91deedf732da0edb2e4750006660e9fb4c6ba4be170f92031b8bc0e28/analysis/; classtype:trojan-activity; sid:34219; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Aytoke variant outbound connection"; flow:to_server,established; content:"/u/up.php"; http_uri; content:"User-Agent: HTTP|0D 0A|"; http_header; content:"boundary=53416846135184646"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0e0a7056024c00f95470a4e56ee8a2f67c717414ad38c28f30476c0462822e4f/analysis/; classtype:trojan-activity; sid:34217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FighterPOS variant outbound connection"; flow:to_server,established; content:"/BrFighter/bot/"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d2fcc755406c8d3c773a4aecd0284d32747776a51f9bfd9297badcbc62a0e1e4/analysis/; classtype:trojan-activity; sid:34216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Capimac variant outbound connection"; flow:to_server,established; urilen:<23; content:"x-shockwave-falsh"; nocase; http_header; content:"Mozilla/4.0 (compatible|3B|MSIE 8.0|3B|Windows NT 5.1|3B|Trident/4.0)"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f491ce57548290f05c4d3b9796eeb6247d8bd69e13b1a00bdaafbe89f1815105/analysis/; classtype:trojan-activity; sid:34214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/raw.php?i=hcitN3Lt"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b4512bb3f68521a0c52e6e351c235616b1379c82987ed8022b185cf838acc6c5/analysis/; classtype:trojan-activity; sid:34283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/raw.php?i=ZTdFDHX6"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b4512bb3f68521a0c52e6e351c235616b1379c82987ed8022b185cf838acc6c5/analysis/; classtype:trojan-activity; sid:34282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection"; flow:to_server,established; content:"/5551872.png"; fast_pattern:only; http_uri; content:"Connection: Keep-Alive"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b4512bb3f68521a0c52e6e351c235616b1379c82987ed8022b185cf838acc6c5/analysis/; classtype:trojan-activity; sid:34281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt outbound connection"; flow:to_server,established; urilen:>300; content:"/state1.php?"; depth:12; nocase; http_uri; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; pcre:"/\/state1\.php\?[A-Za-z0-9\x2B\x2F\x3D]{300}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6c6f88ebd42e3ef5ca6c77622176183414d318845f709591bc4117704f1c95f4/analysis/; classtype:trojan-activity; sid:34280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Klogwjds variant outbound connection"; flow:to_server,established; content:"/w.php"; fast_pattern:only; http_uri; content:"User-Agent|3A| Mozilla|0D 0A|"; http_header; content:"maxv="; http_client_body; content:"minv="; within:5; distance:2; http_client_body; content:"Build|3A|"; within:6; distance:2; http_client_body; content:"SP|3A|"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e499d455a6560974bea8131f85fa93815999ffc3675d78b3bde5e3cb69865ea1/analysis/; classtype:trojan-activity; sid:34319; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CryptoWall variant outbound connection"; flow:to_server,established; urilen:<130; content:".php?"; nocase; http_uri; content:"|3D|"; within:1; distance:1; http_uri; content:"Cache-Control: no-cache|0D 0A 0D 0A|"; nocase; http_header; content:!"|0D 0A|Accept-"; http_header; content:"Content-Type: application/x-www-form-urlencoded|0D 0A|"; fast_pattern:only; http_header; content:"|3D|"; depth:2; offset:1; http_client_body; pcre:"/^[a-z]\x3d[a-f\d]{80,140}$/Pi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/d14f1d1e07bd116ed0faf5896438177f36a05adacf5af4f32910e313e9c1fd93/analysis/; classtype:trojan-activity; sid:34318; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/aadd_rtemp.php?n="; fast_pattern:only; http_uri; content:"User-Agent|3A 20|SK"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/gget_rtemp.php?n="; fast_pattern:only; http_uri; content:"User-Agent|3A 20|SK"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/flupdate/"; http_uri; content:".html"; within:7; http_uri; pcre:"/\/flupdate\/\d\.html/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/new/all_file_info1.php?"; http_uri; content:"name="; distance:0; http_uri; content:"&user="; distance:0; http_uri; content:"&file="; distance:0; http_uri; content:"&type="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/new/add_tree.php?"; http_uri; content:"name="; distance:0; http_uri; content:"&date="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/new/get_tree.php?"; http_uri; content:"name="; distance:0; http_uri; content:"&date="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/new/"; http_uri; content:"_flash"; within:12; http_uri; content:".php?"; within:15; http_uri; content:"name="; distance:0; http_uri; content:"&serial="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/add_user.php?name="; http_uri; content:"&user="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/products/file_order"; http_uri; content:".php?"; within:8; http_uri; content:"name="; distance:0; http_uri; content:"&path="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/products/fupdates.php?"; http_uri; content:"account="; distance:0; http_uri; content:"&name="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"; flow:to_server,established; content:"/get_status.php?name="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/015fbc0b216d197136df8692b354bf2fc7bd6eb243e73283d861a4dbbb81a751/analysis/; classtype:trojan-activity; sid:34307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Simda variant outbound connection"; flow:to_server,established; urilen:>150; content:"/?"; depth:2; http_uri; content:"="; within:1; distance:2; http_uri; content:"=="; distance:0; http_uri; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre|0D 0A|"; fast_pattern:only; http_header; content:!"Referer"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/00bd4109e8a8d51bb0e46fcd491a9170741688213817f1dec106245cc1f8f09f/analysis/; classtype:trojan-activity; sid:34297; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Simda variant outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Trident/4.0|3B| .NET CLR 2.0.50727|3B| .NET CLR 1.1.4322|3B| .NET CLR 3.0.04506.590|3B| .NET CLR 3.0.04506.648|3B| .NET CLR 3.5.21022|3B| .NET CLR 3.0.4506.2152|3B| .NET CLR 3.5.30729)|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/00bd4109e8a8d51bb0e46fcd491a9170741688213817f1dec106245cc1f8f09f/analysis/; classtype:trojan-activity; sid:34296; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kraken outbound connection"; flow:to_server,established; content:"/idcontact.php?"; http_uri; content:"&steam="; within:35; http_uri; content:"&origin="; within:10; http_uri; content:"&webnavig="; within:12; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,itsjack.cc/blog/2015/02/krakenhttp-not-sinking-my-ship-part-1; reference:url,www.virustotal.com/en/file/27fa65a3166def75feb75f8feb25dd9784b8f2518c73defcc4ed3e9f46868e76/analysis/; classtype:trojan-activity; sid:34292; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Plez outbound connection"; flow:to_server,established; content:"|7E 7E|"; depth:2; offset:8; http_client_body; content:"|EA|"; depth:1; offset:84; http_client_body; content:"|7E 7E 7E|"; depth:3; offset:85; http_client_body; content:"|7E 7E 7E|"; depth:3; offset:89; http_client_body; content:"|7E|"; depth:1; offset:75; http_client_body; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Windows NT"; fast_pattern; http_header; content:"|3B| SV1"; distance:3; content:".php"; http_uri; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; pcre:"/[0-9a-fA-F]{8}[a-z]{6}.php/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2c10918f898220fe427b66d89dc8c4ca078e2de17827a64eb15b14a92e251c35/analysis/; classtype:trojan-activity; sid:34290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Plez outbound connection"; flow:to_server,established; content:"addr.asp"; fast_pattern:only ; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Windows NT"; http_header; content:"|3B| SV1"; distance:3; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2c10918f898220fe427b66d89dc8c4ca078e2de17827a64eb15b14a92e251c35/analysis/; classtype:trojan-activity; sid:34289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mudrop variant outbound connection"; flow:to_server,established; content:"/v1/count.asp?mac="; fast_pattern:only; http_uri; content:"&ver="; http_uri; content:"&os="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4bb9ab08ec20a0331a08aee894aadea81175e70619732c2a3b79e4bab398ed92/analysis/1395425759/; classtype:trojan-activity; sid:34286; rev:2;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Cryptolocker variant inbound connection"; flow:to_client,established; ssl_state:server_hello; content:"|16|"; depth:1; content:"|00 EA A3 3C B6 6E 62 16 33|"; within:9; distance:108; metadata:impact_flag red; reference:url,www.virustotal.com/en/file/d94e68a2d43a373808c56964259ea020d39781aa71628672ecf3240f59fdcf03/analysis/; classtype:trojan-activity; sid:34329; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bedepshel variant outbound connection"; flow:to_server,established; content:"?action="; nocase; http_uri; content:"&pubid="; distance:0; nocase; http_uri; content:"&subid="; distance:0; nocase; http_uri; content:"&systemhash="; distance:0; nocase; http_uri; content:"&ver="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/34c831b33621d869fe9ae6b0ecd816476d4bec59ff5ad6123cbce7706b2b93ae/analysis/; classtype:trojan-activity; sid:34327; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9000 (msg:"MALWARE-CNC Win.Trojan.Sanhotan variant outbound connection"; flow:to_server,established; content:"MODE #purgatorio +k 25679 +s"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/4792690be2d81c69d8618790a42a9abf6c1c7f5bfde18d5f32fd78f29449e442/analysis/; classtype:trojan-activity; sid:34326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9000 (msg:"MALWARE-CNC Win.Trojan.Sanhotan variant outbound connection"; flow:to_server,established; content:"MODE #Ocultismo +k 25679 +s"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/4792690be2d81c69d8618790a42a9abf6c1c7f5bfde18d5f32fd78f29449e442/analysis/; classtype:trojan-activity; sid:34325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Siromost variant outbound connection"; flow:to_server,established; content:"/help24/java/read.php?id="; depth:25; http_uri; content:"&file="; within:6; distance:40; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4b44f3b2644278620283953593072306aa9e15693a3f2de5f38f61bfa46d1517/analysis/; classtype:trojan-activity; sid:34324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fulairo variant outbound connection"; flow:to_server,established; content:"/asa/index.php?secue="; depth:21; http_uri; content:"&pro="; within:6; distance:4; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9a0349c3e843a0a43db2fb260f7b4a8e1ec8bf0b99dd62d1dfb3f85e1d7bcdf2/analysis/; classtype:trojan-activity; sid:34323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Farfli outbound connection"; flow:to_server,established; content:"GET /php.php"; depth:12; content:"|0D 0A|User-Agent: Mozilla/4.0 (compatible)|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1e31d6d9a9b0280d56dd9fb7de551d595422bf68ba9176da7cc20761f4d87f8a/analysis/; classtype:trojan-activity; sid:34322; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cheprobnk variant outbound connection"; flow:to_server,established; content:".php?plug="; http_uri; content:"&GBS="; within:5; distance:3; http_uri; content:"&SYS="; distance:0; http_uri; content:"&USERPC="; distance:0; http_uri; content:"&AVS="; distance:0; http_uri; content:"&NAV="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/123a2a462fadd7667bf4fc9c824807c51ecc8527ec4454efc3cdf756912e02f0/analysis/; classtype:trojan-activity; sid:34347; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Backspace outbound connection"; flow:established,to_server; content:"User-Agent|3A| Mozilla/4.0 |28|compatible|3B| MSIE 6.0|3B| Win32|29 0D 0A|"; fast_pattern:only; http_header; content:"|0D 0A|HOST|3A| "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c50a48ef605b1f57f37afb883d643d69233cf506065d2bf806dae639cac8c264/analysis/; classtype:trojan-activity; sid:34346; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Cybergate outbound connection"; flow:to_server,established; dsize:<22; content:"myversion|7C|"; depth:10; content:"|2E|"; within:2; distance:1; content:"|0D 0A|"; depth:10; offset:13; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.cyber-planet.org/products/cybergate-excel/; classtype:trojan-activity; sid:34339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Backdoor.Win32.Chkngrbot.A outbound connection"; flow:to_server,established; content:"PRIVMSG "; depth:8; nocase; content:" attack (ReferenceId|3A| "; within:128; distance:5; nocase; content:") (Host|3A| "; within:32; distance:1; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/596b0224551fab492e74d64065a2399cea44e15f9bef64bbeeccda2d2bc7b9d6/analysis/; classtype:trojan-activity; sid:34338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Backdoor.Win32.Chkngrbot.A outbound connection"; flow:to_server,established; content:"MODE "; depth:5; nocase; content:" +piwksT-x|0D 0A|"; within:46; distance:20; nocase; pcre:"/MODE\sd?u?n?\x7b[AU]\x5c[LD]\x5c(86|64)\x5c\w{0,8}\x5c\w{2,16}\x7d[a-z]{8}\s\x2BpiwksT\x2Dx\x0D\x0A/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/596b0224551fab492e74d64065a2399cea44e15f9bef64bbeeccda2d2bc7b9d6/analysis/; classtype:trojan-activity; sid:34337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload variant outbound connection"; flow:to_server,established; urilen:19; content:"/arquivo/cookie.txt"; fast_pattern:only; http_uri; content:"Accept: text/html, */*|0D 0A|Accept-Encoding: identity|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/fc2cc624c2357bad23eaff951c4eac3a1f1c1c3ec5133665c7e101f4f4e3bbba/analysis/1430145774/; classtype:trojan-activity; sid:34368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload variant outbound connection"; flow:to_server,established; urilen:16; content:"/arquivo/vrs.txt"; fast_pattern:only; http_uri; content:"Accept: text/html, */*|0D 0A|Accept-Encoding: identity|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/fc2cc624c2357bad23eaff951c4eac3a1f1c1c3ec5133665c7e101f4f4e3bbba/analysis/1430145774/; classtype:trojan-activity; sid:34367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Beebone outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B| SV1)|0D 0A|"; fast_pattern:only; content:"GET"; pcre:"/GET \/[a-z]{8,12}\?[a-z] HTTP\/1.1/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/b06c6ac1174a6992f423d935ccba6f34f107b6591768a743d44d66423312d33a/analysis/; classtype:trojan-activity; sid:34366; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mantal variant outbound connection"; flow:to_server,established; content:"|3C|Information|3E 0D 0A 3C|id|3E|"; depth:19; http_client_body; content:"|3C 2F|Version|3E 0D 0A 3C|profile|3E 0D 0A 3C|UserDisplayName|3E|"; distance:0; http_client_body; content:"|3C 2F|OutgoingUseAuthentication|3E 0D 0A 3C|OutgoingLoginName|3E|"; fast_pattern:only; http_client_body; content:"|3C 2F|profile|3E 0D 0A|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6c74cb120e3bfa6976aa9cce8a63c114afe7e6515c4409bf7b81c69bf37fd06b/analysis/; classtype:trojan-activity; sid:34362; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Downloader.Mumblehard variant outbound connection"; flow:to_server,established; urilen:1; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| rv:7.0.1) Gecko/20100101 Firefox/7.0.1|0D 0A|"; fast_pattern:only; http_header; content:"Accept: text/html,application/xhtml+xml,application/xml|3B|q=0.8,*/*|3B|q=0.9|0D 0A|"; http_header; content:"Accept-Language: en-us,en|3B|q=0.5|0D 0A|"; distance:0; http_header; content:"Accept-Encoding: gzip, deflate|0D 0A|"; distance:0; http_header; content:"Accept-Charset: ISO-8859-1,utf-8|3B|q=0.7,*|3B|q=0.7|0D 0A|"; distance:0; http_header; content:"Connection: close|0D 0A 0D 0A|"; distance:0; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/file/84dfe2ac489ba41dfb25166a983ee2d664022bbcc01058c56a1b1de82f785a43/analysis/1430849540/; classtype:trojan-activity; sid:34462; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25] (msg:"MALWARE-CNC Linux.Trojan.Mumblehard variant outbound connection"; flow:to_server,established; content:"POST / HTTP/1.0|0D 0A|Host: "; depth:28; content:"Content-type: application/x-www-form-urlencoded|0D 0A|Content-Length: "; within:100; content:"|0D 0A 0D 0A 0F 0F 09|"; within:25; fast_pattern; content:!"User-Agent: "; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/file/9512cd72e901d7df95ddbcdfc42cdb16141ff155e0cb0f8321069212e0cd67a8/analysis/1430996623; classtype:trojan-activity; sid:34461; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Mozibe variant outbound connection"; flow:to_server,established; content:"/php/zombieHandShake.php"; fast_pattern:only; http_uri; content:"hash="; http_client_body; content:"&sysInfo="; distance:0; http_client_body; content:"|20 2D 20|"; distance:0; http_client_body; content:"&lastConnection="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f1d46bff496c9d520d68fe2c1ba45b7edf8604f68305f9ad7698db89f948d299/analysis/; classtype:trojan-activity; sid:34460; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pvzin variant outbound connection"; flow:to_server,established; content:"/js/jquery/default.aspx"; http_uri; content:"Content-Disposition|3A| inline|3B| Comp=KAKTOOS|3B| User=Send|3B| Op=sos|3B| var= 0.0.3 |3B|"; fast_pattern:only; http_header; content:"User-Agent|3A| Mozila|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2e32c6c9179750df7f1ab35536f09c6b09c73faccea7325fe5c79b5087f5dd6f/analysis/; classtype:trojan-activity; sid:34459; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tendrit variant outbound connection"; flow:to_server,established; content:"/favicon?"; http_uri; content:"="; within:6; distance:1; http_uri; content:"&Done"; distance:0; fast_pattern; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/3d6ea8b12778b6714648e5c33ee11f7cc720ccdc9803f713229b10ccef23e84c/analysis/; classtype:trojan-activity; sid:34458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bancos variant outbound connection"; flow:to_server,established; content:"sname="; depth:6; http_client_body; content:".php HTTP/1.0|0D 0A|"; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A 0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/6ca7047c377ad26b9db86c4028b59aa2f6600bfbdb74f1af3519ebf10314b3a6/analysis/; classtype:trojan-activity; sid:34453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bancos variant outbound connection"; flow:to_server,established; content:"/poppxr/popi.html"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A 0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/6ca7047c377ad26b9db86c4028b59aa2f6600bfbdb74f1af3519ebf10314b3a6/analysis/; classtype:trojan-activity; sid:34452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Odlanor information exfiltration attempt"; flow:to_server,established; content:"/r.php?m=2&v="; fast_pattern:only; http_uri; content:"&os="; nocase; http_uri; content:"&c="; within:50; nocase; http_uri; content:"&u="; within:50; nocase; http_uri; content:"Connection: close|0D 0A 0D 0A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,virustotal.com/en/file/32c59db32252e9eafc4a21bbb0cdacf4020da9f4c43950c6bf18a98b2092d5d7/analysis/; classtype:trojan-activity; sid:34446; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kriptovor variant outbound connection"; flow:to_server,established; content:"/loader.php?name="; depth:17; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4FB71EAB872476B7AC8B66401EE28F88602902F737A7163C5CF5C6B099DEDED0/analysis/; classtype:trojan-activity; sid:34476; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Nirunte variant outbound connection"; flow:to_server,established; urilen:12,norm; content:"/sp/info.php"; fast_pattern:only; http_uri; content:"sid="; depth:4; http_client_body; content:"929%2E"; distance:0; http_client_body; content:"appliction"; distance:0; http_client_body; content:"sidfile"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/05912af9f0f569f1a80a5d0799c5a85d61653ab5b3ac05afaecd49f994b8a411/analysis/; classtype:trojan-activity; sid:34470; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Nirunte variant outbound connection"; flow:to_server,established; content:"/sp/command.php?sid="; depth:20; http_uri; content:"929."; distance:0; http_uri; content:"&compname"; distance:0; http_uri; content:"user"; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/05912af9f0f569f1a80a5d0799c5a85d61653ab5b3ac05afaecd49f994b8a411/analysis/; classtype:trojan-activity; sid:34469; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pushdo variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:!"Referer|3A 20|"; http_header; content:"Accept|3A| */*|0D 0A|Accept-Language|3A| en-us|0D 0A|Content-Type|3A| application/octet-stream|0D 0A|Content-Length|3A| "; depth:93; http_header; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| SV1)|0D 0A|Host|3A|"; distance:0; fast_pattern:34,20; http_header; content:"Connection|3A| Keep-Alive|0D 0A|Cache-Control|3A| no-cache|0D 0A|"; distance:0; http_header; metadata:policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:29891; rev:7;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Keylogger inbound connection"; flow:to_client,established; file_data; content:"787**KB"; depth:7; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:cve,2014-0497; reference:url,attack.mitre.org/techniques/T1056; classtype:trojan-activity; sid:29616; rev:10;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Keylogger outbound connection"; flow:to_server,established; content:"/sizemore/css5.php?a"; depth:20; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:cve,2014-0497; reference:url,attack.mitre.org/techniques/T1056; classtype:trojan-activity; sid:29615; rev:9;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Dapato banking Trojan variant outbound connection"; flow:to_server,established; urilen:21; content:"/pics/_vti_cnf/00.inf"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ebcff32473d032041bd69e9599fbff4ad295128003f76d1f452ba7cb6e2d20d4/analysis/1364314446/; classtype:trojan-activity; sid:26264; rev:6;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Renos.FH variant outbound connection"; flow:to_server,established; content:"|2F|help|2F|hc|2F|images|2F|chrome32|2E|gif"; nocase; http_uri; content:"image-big-library|2E|com"; fast_pattern:only; http_header; metadata:policy max-detect-ips drop, service http; reference:url,www.virustotal.com/#/file/3b4209251d36994d7efce922cbb8a4fd/detection; classtype:trojan-activity; sid:19803; rev:11;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dalexis variant outbound connection"; flow:to_server,established; content:"/random/run.jpg"; fast_pattern:only; http_uri; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/64b213090ee1e1b05395e4cc71e0cd85ad3eac8adf24c0c61b114ad8fd22b34c/analysis/; classtype:trojan-activity; sid:34541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dalexis variant outbound connection"; flow:to_server,established; content:"/language/run.jpg"; fast_pattern:only; http_uri; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/64b213090ee1e1b05395e4cc71e0cd85ad3eac8adf24c0c61b114ad8fd22b34c/analysis/; classtype:trojan-activity; sid:34540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Wekby Torn variant outbound connection"; flow:established, to_server; dsize:16; content:"|00 00 00 11 D0 00 00 00|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/1D6BCF409C85887861D587C8AABFC8C8393EA692FE93C0A6836BE507A7F75985/analysis/; classtype:trojan-activity; sid:34501; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MalPutty variant outbound connection"; flow:to_server,established; content:"/index.php?record=c3NoOi8v"; fast_pattern:only; http_uri; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d3e866e5bf18f2d9c667563de9150b705813e03377312b6974923f6af2e56291/analysis/; classtype:trojan-activity; sid:34491; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nalodew variant outbound connection"; flow:to_server,established; content:"Connection|3A|---|3A|www|3A|---|3A|NEW"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/53a6a73efc57ffd75a8a7d4c7abe635a1078ec2443a0f2f291488daa3573eb34/analysis/; classtype:trojan-activity; sid:34489; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mathanuc outbound connection"; flow:to_server,established; content:"/wp-content/upgrade/kk.php?"; fast_pattern:only; http_uri; content:"ud="; http_uri; content:"iud="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/299cac70dd0ab4c6047008689798cdcdea169acb865c6a0f9b529ba399e1e80a/analysis/; classtype:trojan-activity; sid:34581; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zinnemls variant outbound connection"; flow:to_server,established; urilen:12,norm; content:"/wab/wab.php"; fast_pattern:only; http_uri; content:"tipo=&tip=WB"; depth:12; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7d8888933bd616ab59229d8ffc11b6519949e7b7ed72ea55e0b55ecc2e620509/analysis/; classtype:trojan-activity; sid:34572; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC MacOS.Trojan.MacVX outbound connection"; flow:to_server,established; content:"/?dp="; http_uri; content:"&cb="; within:4; distance:50; http_uri; pcre:"/\x2f\x3fdp\x3d[A-Z0-9]{50}&cb\x3d[0-9]{9}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c0a0c4ca87d1f6b4be7f5f549fce531fbf0df871cc9f1eb38aa12a8273ad7e81/analysis/1432225808/; classtype:trojan-activity; sid:34567; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC possible Conficker.C HTTP traffic 2 "; flow:established,to_server; content:"Accept-Language|3A| en-GB,es-US|3B|q=0.5"; reference:url,mtc.sri.com/Conficker/; classtype:trojan-activity; sid:15452; rev:7;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC possible Conficker.C HTTP traffic 1 "; flow:established,to_server; content:"Accept-Language|3A| en-US,de-DE|3B|q=0.5"; reference:url,mtc.sri.com/Conficker/; classtype:trojan-activity; sid:15451; rev:7;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bancos variant outbound connection"; flow:to_server,established; content:"/popkx3/popi.html"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A 0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/d6beeae945d570d98784bdea68310ddef17f4a03534632dec48c691677c67402/analysis/; classtype:trojan-activity; sid:34622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 587 (msg:"MALWARE-CNC Win.Trojan.Enkalogs outbound connection"; flow:to_server,established; file_data; content:"[Enter]|0D 0A|"; content:"[Enter]|0D 0A|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/7ba2d2ae6c44c1e13cfe04b45074bb35d34a688c9fae3b8e4b0259e53e782495/analysis/; classtype:trojan-activity; sid:34614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dujfudg outbound connection"; flow:to_server,established; content:"/img/seperator?"; fast_pattern:only; http_uri; content:"id="; http_uri; content:"action="; http_uri; content:"run="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a8f6371ff921ffba35722ee508b3b545e07a87f2402b0dfc67a9b1acaed561cf/analysis/; classtype:trojan-activity; sid:34611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"MALWARE-CNC Win.Trojan.Kayfcbk outbound connection"; flow:to_server,established; content:"S|00|E|00|L|00|E|00|C|00|T|00| |00|i|00|m|00|g|00| |00|F|00|R|00|O|00|M|00| |00|d|00|b|00|o|00|.|00|n|00|o|00|v|00|o|00|s|00|l|00|o|00|a|00|d|00| |00|W|00|H|00|E|00|R|00|E|00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5e9f38b53cdf5381c4f8c4b2a7fcccbea6efe7741034d2b809ca823a2f32b0ee/analysis/; classtype:trojan-activity; sid:34610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Trojan.NitLove variant outbound connection"; flow:to_server,established; content:"User-Agent: nit_love"; fast_pattern:only; http_header; content:"/derpos/gateway.php"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/136c0e357dfa7d2497e937cc256ad58e063b70cd413d262e3e3dc1da8b0bc9cc/analysis/; classtype:trojan-activity; sid:34609; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Punkey variant outbound connection"; flow:to_server,established; content:"/h4g2v34hk/"; depth:11; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e0c4696093c71a8bbcd2aef357afca6c7b7fbfe787406f6797636a67ae9b975d/analysis/; classtype:trojan-activity; sid:34608; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teqimp outbound connection"; flow:to_server,established; content:"/images/image.gif?"; http_uri; content:"b8a34ad="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4742abba9f94176cf4aa40edfb836c0657ffcc698fd67700e2569edea1469182/analysis/; classtype:trojan-activity; sid:34601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 4000 (msg:"MALWARE-CNC Win.Trojan.Kjdoom outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|SiR-DoOoM"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8d2cc4c32d19c6eaa43e92679e8d8c66b866027f7c21583f858774f2f0848068/analysis/; classtype:trojan-activity; sid:34600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1010 (msg:"MALWARE-CNC Win.Trojan.Kjdoom outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|KJw0rm"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8d2cc4c32d19c6eaa43e92679e8d8c66b866027f7c21583f858774f2f0848068/analysis/; classtype:trojan-activity; sid:34599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1991 (msg:"MALWARE-CNC Win.Trojan.Kjdoom outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|XKSHHACKERX"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/362454c019d71539287d50d763260dc586c0a8834952cf90e8e58341cd668550/analysis/; classtype:trojan-activity; sid:34598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Atrax variant outbound connection"; flow:to_server,established; content:"/auth.php?a="; fast_pattern:only; http_uri; content:"h="; depth:2; http_client_body; content:"&m=y"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/0bc2db99f5277ddc89409a8c487298df5dbf34108146c58885ad0c804422c27f/analysis/; classtype:trojan-activity; sid:34597; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Atrax variant outbound connection"; flow:to_server,established; content:"/auth.php?a="; fast_pattern:only; http_uri; content:"h="; depth:2; http_client_body; content:"&m=n"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/0bc2db99f5277ddc89409a8c487298df5dbf34108146c58885ad0c804422c27f/analysis/; classtype:trojan-activity; sid:34596; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Flactionbot outbound connection"; flow:to_server,established; content:"/img/new/n.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/43861501e7e7bb546b55a9323d1cff132dddb750b3e86823af7ea08d45357e28/analysis/; classtype:trojan-activity; sid:34637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Flactionbot outbound connection"; flow:to_server,established; content:"/img/new/ref.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/43861501e7e7bb546b55a9323d1cff132dddb750b3e86823af7ea08d45357e28/analysis/; classtype:trojan-activity; sid:34636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Crypaura variant outbound connection"; flow:to_server,established; urilen:<14; content:"script.php"; depth:14; offset:3; http_uri; content:"number=128"; http_client_body; content:"&id="; distance:0; http_client_body; content:"&pc="; distance:0; http_client_body; content:"&tail=.id"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/78854da147fc6f7327448a807de6f102b6799a0e59d4c66cf7eadf8690515ef9/analysis/; classtype:trojan-activity; sid:34624; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Logreaz variant outbound connection"; flow:to_server,established; content:"ReaLLogger v"; nocase; content:"by Van32"; within:12; nocase; metadata:impact_flag red, policy security-ips drop, service ftp-data; reference:url,virustotal.com/en/file/b448f97efa38411c4d4c6755d050a34e0f335063dbb84355cc55bd994a3b0d21/analysis/; classtype:trojan-activity; sid:34871; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Logreaz variant outbound connection"; flow:to_server,established; content:"User-Agent: Uploador"; fast_pattern:only; http_header; content:"name="; nocase; http_client_body; content:"filename="; distance:0; nocase; http_client_body; content:"Log_"; within:5; nocase; http_client_body; content:"ReaLLogger v"; distance:0; nocase; http_client_body; content:"by Van32"; within:12; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b448f97efa38411c4d4c6755d050a34e0f335063dbb84355cc55bd994a3b0d21/analysis/; classtype:trojan-activity; sid:34870; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.XTalker outbound connection"; flow:to_server,established; content:"|0D 0A|User-Agent|3A 20|Testing|0D 0A|"; fast_pattern:only; content:"/docs/kernel32.dat"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e335585810975e43c1a489001d8c7e2f59c0d80a0f787b9f97ae0ec92ed0dd8d/analysis/; classtype:trojan-activity; sid:34869; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/vbulletin/post.php?qu="; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a184775757cf30f9593977ee0344cd6c54deb4b14a012a7af8e3a2cdbb85a749/analysis/; classtype:trojan-activity; sid:34868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Xobtide outbound connection"; flow:to_server,established; content:"/index.html"; http_uri; content:"editbox=Darks123!@#"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/40ada5e49ebd1fea39087c1d932398fd2caf962634b982ae9e9acacdf920bc37/analysis/; classtype:trojan-activity; sid:34867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Saibipoc outbound connection"; flow:to_server,established; content:"/wp-admin/maint/hat.php"; fast_pattern:only; http_uri; content:"name="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4d1e1747c4a4f24c6dc4f15fa173520fa9fefa2e4213a9f63349589b5bcbf0e7/analysis/; classtype:trojan-activity; sid:34866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Saibipoc outbound connection"; flow:to_server,established; content:"/wp-admin/maint/push.php"; fast_pattern:only; http_uri; content:"ff="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4d1e1747c4a4f24c6dc4f15fa173520fa9fefa2e4213a9f63349589b5bcbf0e7/analysis/; classtype:trojan-activity; sid:34865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wheelsof variant outbound connection"; flow:to_server,established; content:"|05|i|06|e|0E|k|19|7T$TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTeeee"; fast_pattern:only; http_client_body; content:"/dilly/"; depth:8; nocase; http_uri; content:"index6.php"; within:10; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6fa0388fc7bf56600d5b0bc1b0651b3ecc927377250d0156bc6538bd032e551a/analysis/; classtype:trojan-activity; sid:34863; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wheelsof variant outbound connection"; flow:to_server,established; content:"|05|i|06|e|0E|k|19|7T$TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTeeee"; fast_pattern:only; http_client_body; content:"/dilly/"; depth:8; nocase; http_uri; content:"get_ip.php"; within:10; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6fa0388fc7bf56600d5b0bc1b0651b3ecc927377250d0156bc6538bd032e551a/analysis/; classtype:trojan-activity; sid:34862; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fanny outbound connection"; flow:to_server,established; content:"/results/QueryRecord"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B|)|0D 0A|"; http_header; content:!"Accept|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:cve,2010-2568; reference:url,virustotal.com/en/file/003315b0aea2fcb9f77d29223dd8947d0e6792b3a0227e054be8eb2a11f443d9/analysis/; classtype:trojan-activity; sid:34857; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Trojan.ChinaZ outbound connection"; flow:established,to_server; dsize:296; content:"|20 2A 20|"; depth:3; offset:65; content:"MK64|00|"; depth:5; offset:128; fast_pattern; content:"Status|3A|"; depth:7; offset:169; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:cve,2014-6271; reference:url,blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html; classtype:trojan-activity; sid:34847; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Adelinoq outbound connection"; flow:to_server,established; content:"POST /link.php"; depth:14; content:"|0D 0A 0D 0A|PKEY|00 00 00|"; distance:0; fast_pattern; content:!"User-Agent|3A|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/bfe430e6aaa6e6e601d8b9e846998a5b2653f034895ac73d7ea1a367546b166f/analysis/; classtype:trojan-activity; sid:34844; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownExecute outbound connection"; flow:established,to_server; urilen:9; content:"/dw/setup"; fast_pattern:only; http_uri; content:"Content-Type|3A| multipart/form-data|3B| boundary=------------------------"; http_header; content:"ci_session="; http_cookie; content:!"User-Agent|3A|"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/ecc240f1983007177bc5bbecba50eea27b80fd3d14fd261bef6cda10b8ffe1e9/analysis/; classtype:trojan-activity; sid:34842; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownExecute outbound connection"; flow:established,to_server; urilen:7; content:"/dw/gtk"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Referer|3A|"; http_header; content:"Accept|3A| */*"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ecc240f1983007177bc5bbecba50eea27b80fd3d14fd261bef6cda10b8ffe1e9/analysis/; classtype:trojan-activity; sid:34841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownExecute outbound connection"; flow:established,to_server; urilen:>150; content:"/setup/"; depth:7; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Referer|3A|"; http_header; content:!"Accept"; http_header; pcre:"/\/setup\/[a-z0-9!-]{50}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ecc240f1983007177bc5bbecba50eea27b80fd3d14fd261bef6cda10b8ffe1e9/analysis/; classtype:trojan-activity; sid:34840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,465,587,2525,2526] (msg:"MALWARE-CNC Win.Trojan.Neos outbound connection"; flow:to_server,established; content:"Victim Computer Name:"; fast_pattern:only; content:"Victim Username:"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/63cdfbfbbbc50b06acb75e6059cf63721cb814cd825b9e5d29b7a0b50bc8d78b/analysis/; classtype:trojan-activity; sid:34835; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Werdlod variant outbound connection"; flow:to_server,established; content:"/counter.php?vtrtvrvtrtvertvr"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; content:!"Accept: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f27690e8c1b3619fd3e53cdafed363a6a71e31c57e888a8c62a1242ba40dc605/analysis/; classtype:trojan-activity; sid:34833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cozybear variant outbound connection"; flow:to_server,established; content:"/galeria/index.php?"; fast_pattern:only; http_uri; urilen:19; content:!"Accept: "; http_header; content:"User-Agent: iTunes/12.0.1 (Windows|3B| N)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/bc5625c674f08cca18e73eb661eed0182ef16e27983098cf1c61892ca621d60b/analysis/; classtype:trojan-activity; sid:34832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cozybear variant outbound connection"; flow:to_server,established; content:"/galeria/index.php?"; fast_pattern:only; http_uri; urilen:19; content:!"Accept: "; http_header; content:"User-Agent: Java/1.8.0_26"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/bc5625c674f08cca18e73eb661eed0182ef16e27983098cf1c61892ca621d60b/analysis/; classtype:trojan-activity; sid:34831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Emdivi outbound connection"; flow:to_server,established; content:"&date=%2BBQF.4"; fast_pattern:only; http_client_body; content:"%1Dh%1DYQY.4"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4a2a9b6a5fedd8de12a963effb7b800b7953c017c8a73a8ef353d661c879d137/analysis/; classtype:attempted-user; sid:34818; rev:2;)
alert tcp $EXTERNAL_NET 21 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Critroni certificate exchange"; flow:to_client,established; content:"|00 D3 62 47 DA 62 4A A1 34|"; content:"|3B 02 49 86 4B DF D7 D7 6C E2 2F 36 81 01 24 3F|"; within:400; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/af7a9f581653394955bec5cf10a7dbafbf64f42d09918807274b5d25849a1251/analysis/; classtype:trojan-activity; sid:34917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sojax variant outbound connection"; flow:to_server,established; content:"@.c HTTP"; fast_pattern:only; content:"/count/"; depth:7; nocase; http_uri; content:"GET"; nocase; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/004a262e3b5fb008adeba5949a285e3c18b0191a98f4387e1ca5a34f94dfb83b/analysis/; classtype:trojan-activity; sid:34888; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sojax variant outbound connection"; flow:to_server,established; content:"/count/count.php"; fast_pattern:only; http_uri; content:"m="; nocase; http_uri; content:"n="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/004a262e3b5fb008adeba5949a285e3c18b0191a98f4387e1ca5a34f94dfb83b/analysis/; classtype:trojan-activity; sid:34887; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET [9000,9001] (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"|DD AA 99 66|"; depth:4; content:"|E0 06 93 E0 06 00|"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop; reference:url,www.virustotal.com/en/file/af03acfce9fd219176144a978a785576c886eab49f613be04a5a3f9e2ddfb961/analysis/; classtype:trojan-activity; sid:34886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jemerr variant outbound connection"; flow:to_server,established; content:"/up.asp"; fast_pattern:only; http_uri; content:"id="; http_client_body; content:"&jjm="; within:40; nocase; http_client_body; content:"&wjm="; within:25; nocase; http_client_body; content:"&err="; within:10; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4c6f9a15dcf938e4f572d2502fa67dd091cf6fd0a99b51c0c9bcb7e058826c08/analysis/; classtype:trojan-activity; sid:34877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Fudu outbound variant connection "; flow:to_server,established; content:"X-ID: 00"; fast_pattern:only; http_header; pcre:"/X-ID\x3a\s\x30\x30+[0-9a-f]{20}(\r\n)+/iH"; content:"/p/pu"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1c9af096e4c7daa440af136f2b1439089a827101098cfe25b8c19fc7321eaad9/analysis/; classtype:trojan-activity; sid:34876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Compfolder variant outbound connection"; flow:to_server,established; content:"/bbs/data/intro.php?type=up"; fast_pattern:only; http_uri; content:"Content-Disposition|3A| form-data|3B| name=|22|image1|22 3B| filename=|22|"; http_client_body; content:"Content-Disposition|3A| form-data|3B| name=|22|upUrl|22 0D 0A|"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/dbed3a1fd186daf714dac7f0e664a0c37ed1604be0242141937e75fd66b2bd41/analysis/; classtype:trojan-activity; sid:34872; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Swaylib outbound variant connection "; flow:to_server,established; content:"form-data|3B| name=|22|i|22 0D 0A 0D 0A|"; nocase; http_client_body; content:"form-data|3B| name=|22|c|22 0D 0A 0D 0A|"; distance:0; nocase; http_client_body; byte_test:1, <=, 2, 0, relative, string, dec; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6d02fb18691835e331c2815cbd4a31813437cf5b728fde6e0db5192a92e4c552/analysis/; classtype:trojan-activity; sid:34936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [1024:65535] (msg:"MALWARE-CNC Win.Trojan.Zutwoxy outbound connection"; flow:to_server,established; content:"SERVER|7C|Final-"; depth:13; nocase; content:"|7C|Idle..|7C|"; distance:0; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/e3af86400e2373dca0753712c78434ed120766f53a173234478d5a1e2a05eb39/analysis/; classtype:trojan-activity; sid:34935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8585 (msg:"MALWARE-CNC Win.Trojan.Pheloyx outbound connection"; flow:to_server,established; content:"YY4.X"; depth:9; nocase; dsize:260; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5bda7a527260e8f1bb83c169a4739f9fb7ed87befa6e8e878110a87d1cdb8015/analysis/; classtype:trojan-activity; sid:34934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 3330 (msg:"MALWARE-CNC Win.Trojan.Shindo outbound connection"; flow:to_server,established; content:"|7C|#$A"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/7d6f0d2681c5d837b3645618f8345e6907f185de012dfb9e0d3ea08a41f0ad5d/analysis/; classtype:trojan-activity; sid:34932; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bancos variant outbound connection"; flow:to_server,established; content:"ID_MAQUINA="; fast_pattern:only; http_client_body; content:"&VERSAO="; nocase; http_client_body; content:"&WIN="; within:50; nocase; http_client_body; content:"&NAVEGADOR="; within:200; nocase; http_client_body; content:"&PLUGIN="; within:50; nocase; http_client_body; content:"&AV="; within:50; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7816d2b6507950177cf1af596744abe523cad492f4d78e230962602b1b269044/analysis/; classtype:trojan-activity; sid:34931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cyvadextr variant outbound connection"; flow:to_server,established; content:"/encourage/help?pointed=855444"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/33774900681b25519d0b023d6d78a043cc2dff0a21d6f6df89e314c91118c0fd/analysis; classtype:trojan-activity; sid:34966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cryptolocker outbound connection"; flow:to_server, established; content:"hwid="; depth:5; http_client_body; content:"&func="; within:6; distance:39; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a4657b0a2cdb3caf405c344f81e7afaacfe2df1558d1e470be6822e2e3666533/analysis/; classtype:trojan-activity; sid:34965; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Threebyte outbound connection"; flow:to_server,established; urilen:<90; content:"/UID"; depth:4; nocase; http_uri; content:".jsp?"; within:11; nocase; http_uri; pcre:"/UID[0-9]{0,5}\x2ejsp\x3f[a-z0-9]{0,64}[\x3d]{0,2}+/Ii"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/63615ce2294ea65a061bdb51ab0771c12efcf4e77770f03a2826d57354f843ff/analysis/; classtype:trojan-activity; sid:34963; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.SpyBanker variant outbound connection"; flow:to_server,established; content:"texto=%0D%0A"; depth:12; http_client_body; content:"/consulta"; http_uri; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)|0D 0A 0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/33b598e185ba483c5c1571651a03b90359fb1f56b55e902c7038baf315c5dad9/analysis/; classtype:trojan-activity; sid:34959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Androm variant outbound connection"; flow:to_server,established; urilen:16; content:"POST"; http_method; content:"/forum/image.php"; fast_pattern:only; http_uri; content:"|0D 0A|User-Agent: Mozilla/4.0|0D 0A|"; http_header; content:"|0D 0A|Content-Type: application/x-www-form-urlencoded|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/38c7d403660c98ceb0246192d7d89cd66e126c6721008f6b347d4d53b4dc063b/analysis/; classtype:trojan-activity; sid:34958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sysmain outbound connection"; flow:to_server,established; content:"/wp-content/plugins/akismet/iddx.php?id="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1176; reference:url,virustotal.com/en/file/d5e3122a263d3f66dcfa7c2fed25c2b8a3be725b2c934fa9d9ef4c5aefbc6cb9/analysis/; classtype:trojan-activity; sid:34957; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Prok variant outbound connection"; flow:to_server,established; content:"/prok/"; http_uri; content:"Content-Type: multipart/form-data, boundary=7DF051D"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ada4a63abae42266f9d472f1d4ebd0bd22702270f8b38ad7a824a16ce449ea2b/analysis/; classtype:trojan-activity; sid:34950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Msnmm variant outbound connection"; flow:to_server,established; content:"/systen&cp="; fast_pattern:only; http_uri; content:"&log="; nocase; http_uri; content:"&index="; within:20; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/801a2d0e09076f42d93692efca7b67028f17604ae9330c186dad8c21d2ec1d0d/analysis/; classtype:trojan-activity; sid:34982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Bossabot outbound connection"; flow:to_server,established; content:"NICK BOSS-"; depth:10; content:"USER BOSS-"; within:10; distance:16; pcre:"/(USER|NICK)\x20BOSS\x2d[A-Z0-9\x5b\x5d\x2d]{15}/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,virustotal.com/en/file/9c72791d54ddfb20a6c07c986fc4190b7bf09befad2a339a7ca8723f218b8049/analysis/; classtype:trojan-activity; sid:34998; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Graftor variant HTTP Response"; flow:to_client,established; dsize:<54; content:"HTTP/1.1 200 OK|0D 0A|Content-Length: "; content:"|0D 0A 0D 0A|session:"; within:15; fast_pattern; pcre:"/\r\n\r\nsession\x3a\d{1,7}$/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/1ed49a78ee46c4a0d2eeb3b9ab707b40d3c87448c6f399d7fceefc0c16c66d38/analysis/; classtype:trojan-activity; sid:34997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent-ALPW variant outbound connection"; flow:to_server,established; content:"|0D 0A|Accept: text/html, */*|0D 0A|Accept-Encoding: identity|0D 0A|User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:12.0) Gecko/20100101 Firefox/12.0|0D 0A 0D 0A|"; fast_pattern:only; http_header; content:"A="; depth:2; http_client_body; content:".php"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/6452bea82dbef796eaed8d2403ffa7141e4379bb052fdb7b63a21400c04b0334/analysis/; classtype:trojan-activity; sid:34996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banbra HTTP Header Structure"; flow:to_server,established; content:"|0D 0A|Accept: text/html, */*|0D 0A|Accept-Encoding: identity|0D 0A|User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:12.0) Gecko/20100101 Firefox/12.0|0D 0A 0D 0A|"; fast_pattern:only; http_header; content:".php HTTP/1.1|0D 0A|Content-Type: text/html|0D 0A|Host: "; content:".php"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/078f4f7bbd0a7fc3f1934a4988997e9f3b69ca8b9dc1bfd37a6c85b44fb50b48/analysis/; classtype:trojan-activity; sid:34995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banbra variant outbound connection"; flow:to_server,established; urilen:43; content:"/imagens/nacional/new/1/2/3/br/contador.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:12.0) Gecko/20100101 Firefox/12.0"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/078f4f7bbd0a7fc3f1934a4988997e9f3b69ca8b9dc1bfd37a6c85b44fb50b48/analysis/; classtype:trojan-activity; sid:34994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.Benloader variant outbound connection"; flow:to_server,established; urilen:>420; content:"/ad.php?id="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (Macintosh|3B| Intel Mac OS X 10_10_2) AppleWebKit/600.4.10 (KHTML, like Gecko) Version/8.0.4 Safari/600.4.10"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.malwaremustdie.org/2015/06/mmd-0034-2015-new-elf.html; classtype:trojan-activity; sid:34993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vcaredrix variant outbound connection"; flow:to_server, established; content:"/zoerr"; fast_pattern:only; http_uri; content:"source="; depth:7; http_client_body; content:"&value="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/684f2faf0498c42861c92ebd8eef751fc82493ae60766ad65177c25c9fd1fbd6/analysis/; classtype:trojan-activity; sid:35005; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Elise variant outbound connection"; flow:to_server,established; urilen:28; content:"Mozilla/4.0 (compatible|3B| MSIE 8.0|3B| Win32)"; fast_pattern:only; http_header; content:"/page_"; depth:6; offset:9; nocase; http_uri; content:".html"; within:5; distance:8; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/2c2eb2eaadf9253a78265ac4655a6ec5935aa2673ff5e4fe3bb6753803c7fe59/analysis/; classtype:trojan-activity; sid:35050; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Scar variant outbound connection"; flow:to_server, established; content:"/zom/index.php"; fast_pattern:only; http_uri; content:"start&helo_zombie=1&name="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/cb9044c42808421534f6a9ba1b80dde4bbca2fc700c0ef8035e862cadfa71213/analysis/; classtype:trojan-activity; sid:35047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 3502 (msg:"MALWARE-CNC Trojan.Linux.Linuxor outbound variant connection "; flow:to_server,established; content:"BB2FA36AAA9541F0BB2FA36AAA9541F0"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/834eb864a29471d0abe178068c259470e4403eb546554247e2f5832acf9586ab/analysis/; classtype:trojan-activity; sid:35039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Backdoor.Perl.Santy outbound variant connection "; flow:to_server,established; content:"PRIVMSG #new :|02|"; depth:15; pcre:"/PRIVMSG #new :\x02\x5b(GOOGLE|SCAN)\x5d\x02\x20Scanning/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,virustotal.com/en/file/c17f4dc4bd1f81ca7f9729fd2f88f6e3e9738c4cc8ec38426eaed9f919eecf2d/analysis/; classtype:trojan-activity; sid:35037; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Backdoor.Perl.Santy inbound variant connection "; flow:to_client,established; content:"PRIVMSG #new :.say @"; offset:17; content:"flood"; within:10 ; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,virustotal.com/en/file/c17f4dc4bd1f81ca7f9729fd2f88f6e3e9738c4cc8ec38426eaed9f919eecf2d/analysis/; classtype:trojan-activity; sid:35036; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Taleretzbj outbound connection"; flow:to_server,established; content:"/nicc/index.asp?M00="; fast_pattern:only; http_uri; content:"MP="; depth:3; http_cookie; content:"M10="; http_cookie; content:"M11="; http_cookie; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/a9b8c6dcc7840eb829d2b871c586015a603934645723635e81638f96c77af076/analysis/; classtype:trojan-activity; sid:35035; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Downloader.Boltolog variant outbound connection download request"; flow:to_server,established; content:"Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.2|3B| Kew="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/58dbf8b66db544f2b0b418e8ef2674d20e027c1076052f4ddf01483f2a5e0f1e/analysis/; classtype:trojan-activity; sid:35034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Konus outbound connection"; flow:to_server, established; content:"/refund/cart/connect.php"; fast_pattern:only; http_uri; content:"Content-Length: 74"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/62f3dd9edc80bd9f62e72cd7912099d22090f3086088204371c111e50649aed7/analysis/; classtype:trojan-activity; sid:35031; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:9; content:"/diff.php"; fast_pattern:only; http_uri; content:"|0D 0A|User-Agent: Mozilla/4.0|0D 0A|"; http_header; content:"|0D 0A|Content-Type: application/octet-stream|0D 0A|"; http_header; content:"|A0 CD 37 A4 5B|"; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a7009a6ed3ff0191e3c8e7f8b27b9b16afe2a82d1eb131ecd27d8f8a5b17e819/analysis/1433243075/; classtype:trojan-activity; sid:35030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Keylogger.Lotronc variant outbound connection"; flow:to_server,established,no_stream; content:"USER killer0709"; depth:15; detection_filter:track by_dst, count 2, seconds 3; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/953524dda217572280dfc14dff377f4bec0ea78cca599257fa24e90175cb7c19/analysis/; classtype:trojan-activity; sid:35029; rev:3;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC known malicious SSL certificate - Troldesh C&C"; flow:to_client,established; ssl_state:server_hello; content:"|16 03|"; content:"|0B|"; within:1; distance:3; content:"|00 8F 77 DF 9C F4 D2 43 19|"; within:50; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/a8b27aa4fe7df15a677f9ab9b62764d557525059a9da5f4196f1f15049e2b433/analysis/; classtype:trojan-activity; sid:35027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Regiskazi outbound connection"; flow:to_server,established; content:"/feicivan/atak.php?os="; fast_pattern:only; http_uri; content:"&osbit="; nocase; http_uri; content:"&antiv="; within:7; distance:2; nocase; http_uri; content:"&kart="; distance:0; nocase; http_uri; content:"&core="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f824cb869dddf7668a26558d7334ada78fcb66973dbc3b93282701d8959ee404/analysis/; classtype:trojan-activity; sid:35083; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 58275 (msg:"MALWARE-CNC Backdoor.Linux.Qenerek outbound connection"; flow:to_server,established; dsize:1024; content:"666|7C 7C 7C|"; depth:6; content:"|7C|0.00:0.00"; within:18; distance:22; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/9e2a77775babf1d6e83d94e53c345d76f0274f30a333b76e30bff72f59e3ce28/analysis/; classtype:trojan-activity; sid:35082; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 15525 (msg:"MALWARE-CNC Win.Trojan.Tenbus outbound connection"; flow:to_server,established; dsize:8; content:"|05 00 00 00|"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/95c65d44a2dd717b27c8008470f95fe46637f624b20d9e19e0c06573b94d20f9/analysis/; classtype:trojan-activity; sid:35081; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 15525 (msg:"MALWARE-CNC Win.Trojan.Tenbus outbound connection"; flow:to_server,established; dsize:5; content:"G|00|F|00|I"; depth:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/95c65d44a2dd717b27c8008470f95fe46637f624b20d9e19e0c06573b94d20f9/analysis/; classtype:trojan-activity; sid:35080; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Zusy variant outbound connection"; flow:to_server,established; urilen:21; content:"POST"; http_method; content:"/siganofi/rounder.php"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:"Pragma|3A| no-cache|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.www.virustotal.com/en/file/857ae380e297f840b88146ec042286ef459a1c4dc53680b117a9677b189e6c68/analysis/; classtype:trojan-activity; sid:35076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dino variant outbound connection"; flow:to_server,established; urilen:35<>42; content:"/postal.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| .NET CLR 1.0.3705|3B| .NET CLR 1.1.4322)"; http_header; content:"BO4n="; nocase; http_client_body; content:"&u0qVv23I="; within:20; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7ba09403e9d7122a20fa510de11f7809822e6e11efb164414e2148b762cf4e75/analysis/; classtype:trojan-activity; sid:35069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 9003 (msg:"MALWARE-CNC Linux.Backdoor.Powbot outbound variant connection "; flow:to_server,established; dsize:5; content:"Vypor"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 25565 (msg:"MALWARE-CNC Linux.Backdoor.Powbot outbound variant connection "; flow:to_server,established; content:"mineloris.se"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35066; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Linux.Backdoor.Powbot inbound variant connection "; flow:to_client, established; content:"tcpamp "; depth:7; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35065; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Linux.Backdoor.Powbot inbound variant connection "; flow:to_client, established; content:"mineloris "; depth:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35064; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Linux.Backdoor.Powbot inbound variant connection "; flow:to_client, established; content:"kill "; depth:5; nocase; pcre:"/^kill\s(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]?|[0-9])$/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35063; rev:3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Linux.Backdoor.Powbot inbound variant connection "; flow:to_client, established; dsize:<40; content:"dildos "; depth:7; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/5565e6a57837ff2c3e474486313fd8e0c9e623453954c24bc44a03fc4e5e91b2/analysis/; classtype:trojan-activity; sid:35062; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent variant outbound connection"; flow:to_server, established; content:"/updater.php"; http_uri; content:"mac="; http_client_body; content:"&comp="; distance:17; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e3a12bb9ca44de17d6e49b3d964e5fb46c6cdbea4a84aab2b2f7a83b1663f9bc/analysis/; classtype:trojan-activity; sid:35104; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Dridex Microsoft Word document dropper download attempt"; flow:to_server,established; flowbits:isset,file.ole; file_data; content:"u2i3yruiyui32 hri32 hi32 ru2i3hr 2u3hruk3 2j32hr23r"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/594144c336c58f52c2f633175c005568d55528b1036a045ef52a3687885f9f6b/analysis/; classtype:trojan-activity; sid:35103; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex Microsoft Word document dropper download attempt"; flow:to_client,established; flowbits:isset,file.ole; file_data; content:"u2i3yruiyui32 hri32 hi32 ru2i3hr 2u3hruk3 2j32hr23r"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/594144c336c58f52c2f633175c005568d55528b1036a045ef52a3687885f9f6b/analysis/; classtype:trojan-activity; sid:35102; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex variant outbound connection"; flow:to_server,established; content:"/wp-content/uploads/2015/06/"; http_uri; content:".txt"; nocase; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| Win32|3B| WinHttp.WinHttpRequest.5)"; fast_pattern:only; http_header; metadata:impact_flag red; reference:url,www.virustotal.com/en/file/594144c336c58f52c2f633175c005568d55528b1036a045ef52a3687885f9f6b/analysis/; classtype:trojan-activity; sid:35101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.trojan.Seaduke outbound connection"; flow:to_server,established; content:"User-Agent: SiteBar/3.3.8 (Bookmark Server|3B| http|3A|//sitebar.org/)|0D 0A 0D 0A|"; fast_pattern:only; content:"/rss.php"; http_uri; urilen:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/3eb86b7b067c296ef53e4857a74e09f12c2b84b666fc130d1f58aec18bc74b0d/analysis/; classtype:trojan-activity; sid:35254; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Dropper.Agent inbound connection"; flow:to_client, established; content:"start1qaz"; depth:9; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7543d55d9daf87ffdc1863a11a65be7b97177dcedf8ea134a038fcab0e6c053e/analysis/; classtype:trojan-activity; sid:35221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ProxyChange"; flow:to_server, established; content:"/images/menu/include2.php"; http_uri; content:"pcnome="; depth:7; fast_pattern; http_client_body; content:"%2F+"; within:5; distance:10; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/84132f8b894648547cc6c0745f2af748ea834458ad986aa42e48b5241392792e/analysis/; classtype:trojan-activity; sid:35303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Lpdsuite POST request"; flow:to_server,established; content:"/SecuritySuite/insert_record.php"; fast_pattern:only; http_uri; content:"name="; depth:5; http_client_body; content:"value="; depth:128; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/fdb5690878b7d3db067120eed5e4418654619bb7f8d51e54e34179f882da48d8/analysis/; classtype:trojan-activity; sid:35301; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Lpdsuite GET request"; flow:to_server,established; content:"/SecuritySuite/lpd_suite"; fast_pattern:only; http_uri; content:"AutoIt|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/fdb5690878b7d3db067120eed5e4418654619bb7f8d51e54e34179f882da48d8/analysis/; classtype:trojan-activity; sid:35300; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Cryptowall click fraud response"; flow:to_client,established; file_data; content:"2|7C|http://"; depth:9; content:"/search.php|7C|http://"; within:60; content:"|7C|Mozilla/4.0 "; within:100; content:"/r.php?key="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/3b78dd891a81c18cffa5031e52f9c2329e2986ba83c5c75a67dc4ae3d1f0bec3/analysis/; classtype:trojan-activity; sid:35344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jemerr outbound connection"; flow:to_server, established; content:"id="; depth:3; http_client_body; content:"&jjm="; within:5; distance:32; http_client_body; content:"err="; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4c6f9a15dcf938e4f572d2502fa67dd091cf6fd0a99b51c0c9bcb7e058826c08/analysis/; classtype:trojan-activity; sid:35318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Directate outbound connection"; flow:to_server,established; content:"/plugin/update/?user="; fast_pattern; http_uri; content:"&usersid="; within:45; http_uri; content:"&version="; within:193; http_uri; content:"&osbit="; distance:0; http_uri; content:"&state="; within:10; http_uri; content:"User-Agent|3A| EI Plugin updater"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1176; reference:url,www.virustotal.com/en/file/9b0f613228ad8b71a1ab44efbf6c0ed5df06cca4988d6fd094a34f867838cc54/analysis/; classtype:trojan-activity; sid:35317; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Downloader.Comsteal outbound connection"; flow:to_server,established; content:"/index.php?os=linux&hostname="; http_uri; content:"&msg="; within:260; http_uri; content:"&user="; distance:0; http_uri; content:"User-Agent|3A| curl"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9b0f613228ad8b71a1ab44efbf6c0ed5df06cca4988d6fd094a34f867838cc54/analysis/; classtype:trojan-activity; sid:35315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8889 (msg:"MALWARE-CNC Win.Trojan.Agent variant outbound connection"; flow:to_server, established; content:"/uniquexe/service/GetNewData"; fast_pattern:only; content:"pkgna="; content:"opkgna="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/efe2682d260a462e460e37b56b85dd588e8d8a96bd1526647ed668c8c6c3b699/analysis/; classtype:trojan-activity; sid:35313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif outbound connection"; flow:to_server,established; content:"/photoLibrary/?user="; http_uri; content:"&ver="; http_uri; content:"&os2="; fast_pattern:only; http_uri; content:"&type="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.html; classtype:trojan-activity; sid:35312; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Trojan.Win32.Cigamve request"; flow:to_server,established; content:"Accept: , , , , , , , , , , , ,"; fast_pattern:only; http_header; content:"User-Agent: Mozilla/4.0|0D 0A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/62d08b513a7d0f1b937371344ce9bc44de6022294937e690d0f926cc3eaac5c1/analysis/; classtype:trojan-activity; sid:35306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Usteal outbound connection"; flow:established,to_server; content:"UFR!"; depth:4; content:"|08 02 00 00 10 66 00 00 20 00 00 00|"; within:12; distance:16; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data; reference:url,www.virustotal.com/en/file/7B1C27FE8394A07AEF87FAFB002F9E96355854932B2B387755C740876F115A48/analysis/; classtype:trojan-activity; sid:35355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Elise.B variant outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSIE 8.0)"; fast_pattern:only; http_header; urilen:28; content:"/page_"; depth:6; offset:9; nocase; http_uri; content:".html"; within:5; distance:8; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/9a226eeae1fc51a2bc2e72b098d5654238d0cc8eae29c0cdaacb49ae9d997d04/analysis/; classtype:trojan-activity; sid:35353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Trojan.Win32.Ralminey POST request"; flow:to_server,established; content:"Referer:|20|XXX"; fast_pattern:only; http_header; content:"mac="; depth:5; nocase; http_client_body; content:"&ip="; within:8; distance:32; http_client_body; content:"&name="; within:8; distance:30; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/69849339d126ebddfa5a1bc2751071a574d3e5d0cbd06b0cd6f921edccdf74b8/analysis/; classtype:trojan-activity; sid:35348; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mivast outbound connection"; flow:to_server,established; content:"/newimage.asp?imageid="; fast_pattern:only; http_uri; content:"&type="; offset:20; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d/analysis/; classtype:trojan-activity; sid:35416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sakurel outbound connection"; flow:to_server,established; content:"/script.asp?imageid="; fast_pattern:only; http_uri; content:"&type="; offset:30; http_uri; content:"&resid="; distance:0; http_uri; content:"&nmsg="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6b6e92be036b1a67c383d027bafc7eb63cf515006bb3b3c6ca362a2332542801/analysis/; classtype:trojan-activity; sid:35415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Inexsmar variant outbound connection"; flow:to_server,established; urilen:8; content:"/wnctprx"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/026cf8b7aa8976588d98a9587e3b4188871936dadff27a4c7ffd2d19fb1b314b/analysis/; classtype:trojan-activity; sid:35400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TorrentLocker/Teerac payment page request"; flow:to_server,established; content:".php?user_code="; http_uri; content:"&user_pass="; fast_pattern:only; http_uri; content:"Referer|3A|"; http_header; content:"tor"; within:30; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/4072beeaf09fe6fef48365f1c14fd800e21b32cfa2af561f515bc45372dd590d/analysis/; classtype:trojan-activity; sid:35394; rev:1;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TorrentLocker/Teerac self-signed certificate"; flow:to_client,established; ssl_state:server_hello; content:"|16 03 01 00 51 02|"; content:"|55 04 06 13 02|XX"; fast_pattern:only; content:"|55 04 07 0C 0C|Default City"; content:"|55 04 0A 0C 13|Default Company Ltd"; distance:6; metadata:impact_flag red, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/4072beeaf09fe6fef48365f1c14fd800e21b32cfa2af561f515bc45372dd590d/analysis/; classtype:trojan-activity; sid:35393; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Andromeda download request"; flow:to_server,established; content:".mod"; http_uri; pcre:"/[a-z]{2}_[a-z0-9]{8}\.mod/Ui"; content:"User-Agent|3A 20|Mozilla/4.0|0D 0A|"; fast_pattern:only; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.html; classtype:trojan-activity; sid:35388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Andromeda initial outbound connection"; flow:to_server,established; content:"/forum.php"; depth:10; http_uri; content:"User-Agent|3A 20|Mozilla/4.0|0D 0A|"; fast_pattern:only; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.html; classtype:trojan-activity; sid:35387; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bedep initial outbound connection"; flow:to_server,established; content:"protocolVersion|22|"; offset:2; http_client_body; content:"|22|rev|22|"; within:10; http_client_body; content:"|22|buildId|22|"; within:15; http_client_body; content:"|22|tags|22 3A|"; distance:0; http_client_body; content:"|22|type|22 3A 22|"; within:10; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.html; classtype:trojan-activity; sid:35386; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"MALWARE-CNC Win.Trojan.MSIL-Pwsfcbk SQL connection"; flow:to_server,established; content:"I|00|N|00|S|00|E|00|R|00|T|00 20 00|I|00|N|00|T|00|O|00|"; depth:24; offset:48; nocase; content:"d|00|b|00|o|00|.|00|i|00|n|00|f|00|e|00|c|00|t|00|"; distance:2; nocase; content:"N|00|o|00|m|00|e|00|P|00|C|00|,|00 20 00|I|00|d|00|P|00|C|00|,|00 20 00|W|00|i|00|n|00|d|00|o|00|w|00|s|00|P|00|C|00|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/it/file/9cc947dc604f8f25308076c5fb09cc646f30521206091912963c5da905624d50/analysis/; classtype:trojan-activity; sid:35385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Heur outbound connection"; flow:to_server, established; content:"ProductName="; offset:10; http_uri; content:"&Mac="; http_uri; content:"&Volume="; distance:17; http_uri; content:"&Security="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f4597e3c4aa1750fbbba0115dc4d814aefdfe6de3b3ab178dbad86d3a8e9d78e/analysis/; classtype:trojan-activity; sid:35426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bergard outbound connection"; flow:to_server, established; content:"__VIEWSTATE=IWluZm8"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6ea06c9581cad86e438d96a8cfc38b20eb2884bcb3202ad3430739f7fb6ac626/analysis/; classtype:trojan-activity; sid:35472; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 6666 (msg:"MALWARE-CNC Win.Trojan.Baisogu outbound connection"; flow:to_server; content:"/9hao/count.asp?"; fast_pattern:only; content:"mac="; depth:4; offset:21; content:"&ver="; within:25; content:"&tjuser="; within:35; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1065; reference:url,www.virustotal.com/en/file/ee28d4f4b8dc64f8268adce1b17a2ad6054c6a58942d97a58e15a4361e820e98/analysis/; classtype:trojan-activity; sid:35471; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bedep variant outbound connection"; flow:to_server,established; content:"Content-Length|3A| 192|0D 0A|"; fast_pattern:only; http_header; content:"Pragma|3A| no-cache"; http_header; content:!"User-Agent"; http_header; pcre:"/^([A-Z0-9+\x2f]{190}={2}|[A-Z0-9+\x2f]{191}=|[A-Z0-9+\x2f]{192})$/Pmi"; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/35f29550bcdb0c72de1e541d05ce6772dba2da89fb5c080af7118b91d68d7179/analysis/; classtype:trojan-activity; sid:35448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Jrml variant outbound connection"; flow:to_server, established; content:"wp-includes/wpconfig.php?mode="; fast_pattern:only; http_uri; content:"|0D 0A|Content-Disposition:|20|form-data|3B 20|name="; http_client_body; content:"|0D 0A|[System Process]|0D 0A|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3d3c8c883c1fb972c5c50a7b2b4eccef72dba479657ee462260242d4c66cdc54/analysis/; classtype:trojan-activity; sid:35437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.BlackCoffee outbound connection"; flow:to_server,established; content:"/commander.php?mt="; fast_pattern:only; http_uri; content:"&r="; depth:15; offset:50; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/dfd363e2811f6d56fe50362d250592104f2a08f945f903d203d9289e5cb2981d/analysis/; classtype:trojan-activity; sid:35436; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.BlackCoffee outbound connection"; flow:to_client,established; file_data; content:"@MICR0S0FT"; fast_pattern; content:"C0RP0RATI0N"; within:11; distance:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7ad8944573fe10ad74b09c964d65c1dadad11b67b18dff8f5ea3bc6fe6c9afbf/analysis/; classtype:trojan-activity; sid:35551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:10; content:"/order.php"; http_uri; content:"|0D 0A|User-Agent: Mozilla/4.0|0D 0A|"; http_header; content:"|0D 0A|Content-Type: application/octet-stream|0D 0A|"; http_header; content:"|A0 CD 37 A4 5B|"; depth:5; fast_pattern; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a7009a6ed3ff0191e3c8e7f8b27b9b16afe2a82d1eb131ecd27d8f8a5b17e819/analysis/1433243075/; classtype:trojan-activity; sid:35549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Nibagem outbound variant connection"; flow:to_server,established; content:"/pagenotfound2/de0ad7c0a5dd117372cd/raw/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/en/file/f9432e1185b0d67e81e81debc2858ec83389e0b9d5ef61fea7e87f0fef49302b/analysis/; classtype:trojan-activity; sid:35597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Nibagem outbound variant connection"; flow:to_server,established; content:"/images/xml.php?v="; fast_pattern; content:"&id="; distance:0; content:"&p="; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/en/file/f9432e1185b0d67e81e81debc2858ec83389e0b9d5ef61fea7e87f0fef49302b/analysis/; classtype:trojan-activity; sid:35596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.NetEagle variant outbound connection"; flow:to_server,established; content:"/yzstmfa/allupdate.xml"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/bbf138cfc11226d1b1d9935bb4c01541db344c78abb4f9275cdaa1bc5b36c07e/analysis/; classtype:trojan-activity; sid:35570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.IsSpace initial outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/STTip.asp"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,publicintelligence.net/fbi-hack-tools-opm/; classtype:trojan-activity; sid:35750; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.IsSpace outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/SNews.asp?HostID="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,publicintelligence.net/fbi-hack-tools-opm/; classtype:trojan-activity; sid:35749; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:11; content:"/atomic.php"; fast_pattern:only; http_uri; content:"|0D 0A|User-Agent: Mozilla/4.0|0D 0A|"; http_header; content:"|A0 CD 37 A4 5B|"; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a7009a6ed3ff0191e3c8e7f8b27b9b16afe2a82d1eb131ecd27d8f8a5b17e819/analysis/; classtype:trojan-activity; sid:35746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Potao outbound connection"; flow:to_server,established; content:"|3C|methodName|3E|10a7d030-1a61-11e3-beea-001c42e2a08b|3C 2F|methodName|3E|"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/c66955f667e9045ea5591ebf9b59246ad86227f174ea817d1398815a292b8c88/analysis/; classtype:trojan-activity; sid:35733; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Naberkalara variant outbound connection"; flow:to_server,established; content:"/log.php"; nocase; http_uri; content:"pcadi="; depth:6; fast_pattern; nocase; http_client_body; content:"&ip="; distance:0; nocase; http_client_body; content:"&key="; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f0f16d52aa0ea72b0cd4026617d5ed8987041886f040338d09c0e62bed783f63/analysis/; classtype:trojan-activity; sid:35732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Seyelifon variant outbound connection"; flow:to_server,established; content:"gateway.php?action=cw"; fast_pattern:only; http_uri; content:"Connection: close"; nocase; http_header; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b14b0dbee18052b9ea63b8bc688b63b8c0c5beb8b2dcb30ddbaaad3ee71dee26/analysis/; classtype:trojan-activity; sid:35804; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt outbound connection"; flow:to_server,established; content:"/wp-content/themes/"; nocase; http_uri; content:".php"; within:5; nocase; http_uri; pcre:"/^\x2fwp-content\x2fthemes\x2f[A-Za-z0-9]\.php\?[A-Za-z0-9\x2B\x2F\x3D]{300}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/64e3c5e0157c43f7c5ee94a36bd58b1b5ea376498ce1272f078d0d92fe5e668c/analysis/; classtype:trojan-activity; sid:35794; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jiripbot variant outbound connection"; flow:to_server,established; content:"User-Agent|3A| Mozilla/5.0 (compatible|3B| MSIE 10.0|3B| Windows NT 6.1|3B| Trident/5.0)"; fast_pattern:only; http_header; content:"SSID="; http_cookie; content:"A="; within:2; distance:45; http_cookie; pcre:"/^SSID=[a-zA-Z\d]{43}\x3B\x20A=[0-3]$/C"; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45/analysis/; classtype:trojan-activity; sid:35783; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Namospu variant outbound connection"; flow:to_server,established; content:"/listener.php?pcnaam="; fast_pattern:only; http_uri; content:"&uni="; nocase; http_uri; content:"&winos="; nocase; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ce7e8f8e86cdefb5abeeea8e030e8843fe054042540e44777fa1dcdccc8e9090/analysis/; classtype:trojan-activity; sid:35842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/css.ashx?nly="; fast_pattern:only; http_uri; content:"TNRLR|1F 13|"; http_uri; content:"|18|RMU"; within:4; distance:2; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/bfc5fe7eedccfff4ea017963f165b33705e2a81e4beb4f19103973882df58c7b/analysis/; classtype:trojan-activity; sid:36048; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Ios.Backdoor.SYNful inbound connection"; flow:to_server,established; content:"text"; depth:4; offset:78; content:"|00 00 00|"; within:3; distance:1; content:"|45 25 6D|"; within:3; distance:1; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1205; reference:url,blogs.cisco.com/security/synful-knock; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=40411; classtype:trojan-activity; sid:36054; rev:5;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/4.0 (compatible|3B| MyApp)|0D 0A 0D 0A|"; fast_pattern:only; http_header; content:"windows="; depth:8; http_client_body; content:"&av="; within:50; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/1fbe27602da7de2ce95254ffd409f70635179371354b4914997de273f6be9422/analysis/; classtype:trojan-activity; sid:36066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"; flow:to_server,established; content:"/offers_new?v="; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:"&a="; http_uri; content:"&i="; distance:0; http_uri; content:"&f="; distance:0; http_uri; content:"&u="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/049bc9beeba4acd2a558dc695f65ad284b0ae1ff89f69a38f743510d6ab640c0/analysis; classtype:trojan-activity; sid:36065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"; flow:to_server,established; content:"/rp?v="; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; content:"&u="; http_uri; content:"&c="; within:3; distance:32; http_uri; content:"&f="; distance:0; http_uri; content:"&a="; distance:0; http_uri; content:"&d="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/049bc9beeba4acd2a558dc695f65ad284b0ae1ff89f69a38f743510d6ab640c0/analysis; classtype:trojan-activity; sid:36064; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Shifu variant outbound connection"; flow:to_server,established; content:"/news/userlogin.php"; fast_pattern:only; http_uri; content:"|9D 0D F7 8B 8A 6A|"; depth:6; http_client_body; metadata:impact_flag red, service ssl; reference:url,www.virustotal.com/en/file/4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737/analysis/; classtype:trojan-activity; sid:36060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [3030,1150] (msg:"MALWARE-CNC Win.Trojan.Mitozhan initial outbound connection"; flow:to_server,established; dsize:22; content:"|16 00 00 00 56 56 56 41 5A 01 00 00 00 78 9C 4B 05 00 00 66 00 66|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a/analysis/; classtype:trojan-activity; sid:36134; rev:1;)
alert tcp $EXTERNAL_NET [3030,1150] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Mitozhan initial outbound connection server response"; flow:to_client,established; dsize:22; content:"|16 00 00 00 56 56 56 41 5A 01 00 00 00 78 9C 63 00 00 00 01 00 01|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a/analysis/; classtype:trojan-activity; sid:36133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 81 (msg:"MALWARE-CNC Win.Trojan.Mitozhan initial outbound connection"; flow:to_server,established; dsize:22; content:"|15 02 03 02 55 76 55 72 54 03 03 02 03 7A 9F 49 06 02 03 64 03 64|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a/analysis/; classtype:trojan-activity; sid:36132; rev:1;)
alert tcp $HOME_NET [1234,3340,3433,33911,64111] -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Liudoor outbound connection"; flow:to_client,established; dsize:4; content:"pass"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc/analysis/; classtype:trojan-activity; sid:36115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nimisi variant outbound connection"; flow:to_server,established; content:!"User-Agent"; http_header; content:"/logs.php?&prog="; fast_pattern:only; http_uri; content:"&url="; http_uri; content:"&user="; distance:0; http_uri; content:"&pass="; distance:0; http_uri; content:"&comp="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a1f8f8b509001e5bca811a168455a89517000a2534d271018c0c87c6210bd69f/analysis/; classtype:trojan-activity; sid:36108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FakeAV variant outbound connection"; flow:to_server,established; content:"/purchase.php?a="; fast_pattern:only; http_uri; content:"&v="; http_uri; content:"&u="; distance:0; http_uri; content:"&bgload="; within:8; distance:32; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f4c10d33b8c46cc7922a6eebc9f14858a01b2f573ee99dd1dc02a4534b537e18/analysis; classtype:trojan-activity; sid:36107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Hodoor APT variant outbound connection"; flow:to_server,established; content:"/ajax.php"; http_uri; content:"username="; depth:9; http_client_body; content:"password="; http_client_body; content:"valicode="; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1b6fadccac914201d9184559310afa5e6dc60ed6279ebeff4a12ec7484de455b/analysis/; classtype:trojan-activity; sid:36106; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Hodoor APT variant"; flow:to_client,established; file_data; content:"if|28 27|N|27|==workFlag.text|28 29 29|return|3B|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,grifsec.com/fr_report.pdf; classtype:trojan-activity; sid:36105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Yakes variant outbound connection"; flow:to_server,established; file_data; content:"5595|7C|6|7C 7C|CM01|7C|CM02|7C|CM03|7C|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/cb075bae8236d70651e03baabac63662b45f9326ebb7dd291a296d1b365c5889/analysis/; classtype:trojan-activity; sid:36199; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Yakes variant certificate"; flow:to_client,established; content:"C00230-01..yiba6p"; fast_pattern; content:"|55 04 03 13 1E|C00230-01-f002 VPN Certificate"; within:35; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,attack.mitre.org/techniques/T1021; reference:url,attack.mitre.org/techniques/T1133; reference:url,attack.mitre.org/techniques/T1210; reference:url,www.virustotal.com/en/file/cb075bae8236d70651e03baabac63662b45f9326ebb7dd291a296d1b365c5889/analysis/; classtype:trojan-activity; sid:36198; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qytags variant outbound connection"; flow:to_server,established; content:"/asp0/Count.asp?mac="; fast_pattern:only; http_uri; content:"&ver="; nocase; http_uri; content:"&os="; within:7; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/da83aaebe0f7a1e170fba04fa117a2c24bf262450c9672ec175397e4fc32c9c8/analysis/; classtype:trojan-activity; sid:36186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Trojan.Kapento variant outbound connection"; flow:to_server,established; content:"127.0.0.1Com.txt"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,virustotal.com/en/file/8e00c4d1cd6b9b5db47793e4df5634347fb70709dac904fbd83a4763ef6a0cf3/analysis/; classtype:trojan-activity; sid:36234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kapento variant outbound connection"; flow:to_server,established; content:"127.0.0.1Com.txt"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8e00c4d1cd6b9b5db47793e4df5634347fb70709dac904fbd83a4763ef6a0cf3/analysis/; classtype:trojan-activity; sid:36233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kapento variant outbound connection"; flow:to_server,established; content:"/intolerence/toro.php?"; fast_pattern:only; http_uri; content:"commande="; nocase; http_uri; content:"securisation="; distance:0; nocase; http_uri; content:"passtille="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8e00c4d1cd6b9b5db47793e4df5634347fb70709dac904fbd83a4763ef6a0cf3/analysis/; classtype:trojan-activity; sid:36232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.SdBot variant outbound connection"; flow:to_server,established; file_data; content:"USER basic{"; content:"|20 2A 20 30 20 3A|"; within:32; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/6a0378f6a64706213e615a3c8862d7f3099da7c9d0c7533e339e39df6e883401/analysis/; classtype:trojan-activity; sid:36231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Yakes variant dropper"; flow:to_server,established; content:"/document.php?rnd="; fast_pattern:only; http_uri; content:"&id="; depth:4; offset:22; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ff0ae81f0dece17baf8480d866c9462c9f3d49be9adde8b16f105e244eb31d67/analysis/; classtype:trojan-activity; sid:36202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Corebot variant outbound connection"; flow:to_server,established; urilen:7; content:"/verify"; nocase; http_uri; content:"GET /verify HTTP/1.1|0D 0A|Host|3A| "; fast_pattern:only; content:"Mozilla/5.0 (compatible|3B| MSIE 10.0|3B| Windows NT 6.1|3B| WOW64|3B| Trident/6.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e414f0662f915aef89c93c3d615b24a540910ec9dac387ee5a2b4144c5a2aed/analysis/; classtype:trojan-activity; sid:36276; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Corebot variant outbound connection"; flow:to_server,established; urilen:7; content:"/client"; nocase; http_uri; content:"AQAAAPY="; fast_pattern:only; http_client_body; content:"Mozilla/5.0 (compatible|3B| MSIE 10.0|3B| Windows NT 6.1|3B| WOW64|3B| Trident/6.0)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e414f0662f915aef89c93c3d615b24a540910ec9dac387ee5a2b4144c5a2aed/analysis/; classtype:trojan-activity; sid:36275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rusrushel variant outbound connection"; flow:to_server,established; content:"/shell/reg.php?s="; fast_pattern:only; http_uri; content:"&m="; nocase; http_uri; content:"User-Agent: user agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1cb6230019902c977e849783a38629fdbb74a67c31039c0208a098715e4e49f7/analysis/; classtype:trojan-activity; sid:36269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rusrushel variant outbound connection"; flow:to_server,established; content:"/shell/out.php?s="; fast_pattern:only; http_uri; content:"User-Agent: user agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1cb6230019902c977e849783a38629fdbb74a67c31039c0208a098715e4e49f7/analysis/; classtype:trojan-activity; sid:36268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rusrushel variant outbound connection"; flow:to_server,established; content:"/shell/in.php?s="; fast_pattern:only; http_uri; content:"User-Agent: user agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1cb6230019902c977e849783a38629fdbb74a67c31039c0208a098715e4e49f7/analysis/; classtype:trojan-activity; sid:36267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/g.aspx?guid="; fast_pattern:only; http_uri; content:"&gate="; nocase; http_uri; content:"&good="; distance:0; nocase; http_uri; content:"&bad="; distance:0; nocase; http_uri; content:"&unlucky="; distance:0; nocase; http_uri; content:"&ip="; distance:0; nocase; http_uri; content:"&fn="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/g.aspx?cfg="; fast_pattern:only; http_uri; content:"&gid="; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36328; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/g.aspx?"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36327; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/files/mx.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36326; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/files/bl.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36325; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.WinPlock variant outbound connection"; flow:to_server,established; content:"/wp-content/plugins/WPCoreLog/log.php?rnd="; fast_pattern:only; http_uri; content:"WinHttp.WinHttpRequest.5"; http_header; content:"Run as Admin"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1176; reference:url,virustotal.com/en/file/11c31494aabe8036fa57486fed143f7eb3acea27b16b3c7293d631a53c33bd6a/analysis/; classtype:trojan-activity; sid:36304; rev:2;)
alert tcp $EXTERNAL_NET 81 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Mitozhan initial outbound connection server response"; flow:to_client,established; dsize:28; content:"HTTP/1.0 200|0D 0A|Content-Type|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a/analysis/; classtype:trojan-activity; sid:36303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Nisinul variant outbound connection"; flow:to_server,established; content:"?pid="; depth:10; http_uri; content:"&data="; within:6; distance:17; http_uri; content:"User-Agent|3A| WinHTTP Example/1.0|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4f67945f3c130d19970fa36fb3da8b7a988ed0a0a54ee50834150a56bd37320b/analysis/; classtype:trojan-activity; sid:36294; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Alina variant outbound connection"; flow:to_server,established; content:"|DF DA CE CB DE CF AA AA|"; depth:8; offset:28; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/082000f79439600b162e6a6ff5e6815b4bd3f041f42c6c2478feba3f5eb81894/analysis/; classtype:trojan-activity; sid:36331; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DustySky variant outbound connection"; flow:to_server,established; content:"upex/Wor"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8ee73d4aeb88106ba0b6ff4f98ff7da8dc942a8ec429e579b373f6c458547464/analysis/; classtype:trojan-activity; sid:36397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DustySky variant outbound connection"; flow:to_server,established; urilen:>150; content:"php?Pn="; fast_pattern:only; http_uri; content:"&GR="; nocase; http_uri; content:"&ID="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8ee73d4aeb88106ba0b6ff4f98ff7da8dc942a8ec429e579b373f6c458547464/analysis/; classtype:trojan-activity; sid:36396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Kemoge outbound connection"; flow:to_server,established; content:"/v1.jsp?e"; fast_pattern:only; http_uri; content:"platform"; http_uri; content:"osVersion"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/intelligence/blog/post/use-case:-searching-for-kemoge-android-adware/5430957313660468210-4022109835298466466/; classtype:trojan-activity; sid:36471; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.AridViper variant outbound connection"; flow:to_server,established; content:"php?p="; nocase; http_uri; content:"User-Agent: AudioDrive"; fast_pattern:only; http_header; content:"REMOTE_USER:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1f3b4ceea2e3054162260bb827a5c867d5615b15c68e065d97a99a892d5cad4e/analysis/; classtype:trojan-activity; sid:36469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.AridViper variant outbound connection"; flow:to_server,established; content:"/designs/"; depth:9; nocase; http_uri; content:"php?s1="; distance:0; nocase; http_uri; content:"User-Agent: Realtek"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1f3b4ceea2e3054162260bb827a5c867d5615b15c68e065d97a99a892d5cad4e/analysis/; classtype:trojan-activity; sid:36468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CenterPos outbound connection"; flow:to_server,established; content:"Content-Disposition|3A| form-data|3B| name=|22|userfile|22 3B|filename="; fast_pattern:only; http_client_body; content:!"User-Agent|3A|"; http_header; content:"[data]"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2641bc194d9d59b18a87e361474339cb6b6cb721a710ca3bf958aa3c3a422553/analysis/; classtype:trojan-activity; sid:36460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Misnt variant outbound connection"; flow:to_server,established; content:"/list.php"; fast_pattern:only; http_uri; urilen:9; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/19ad985478251a7a9010cbc38a70d2cac12a8481ff585b275249f398caed0dd6/analysis/; classtype:trojan-activity; sid:36526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banker.NWT variant outbound connection"; flow:to_server,established; content:"/acesso.php"; fast_pattern:only; http_uri; content:"call="; depth:5; http_client_body; content:"&ct="; distance:0; http_client_body; content:"&windows="; distance:0; http_client_body; content:"&dados="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a1b3ada62cb45f8ba3b175b7bbaadad7e76afcc4fa73df8cfd3ea4028484a689/analysis/; classtype:trojan-activity; sid:36522; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Njrat variant outbound connection"; flow:to_server,established; content:"|7C 27 7C 27 7C|Win"; fast_pattern:only; content:"|7C 27 7C 27 7C|No|7C 27 7C 27 7C|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/file/349D85C0CDEA3C6B3467C06AB0AD2AFB53DF091E8FBF71AC4320D565ADD6623A/analysis/; reference:url,www.virustotal.com/file/3c3bd38fb908c4b6b33b3d83595d4bcef974379937f53b7a51e695ba71c1bd50/analysis/; classtype:trojan-activity; sid:36506; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Hangman.A outbound connection"; flow:to_server,established; ssl_state:client_hello; content:"|00 14 00 00 00 10 00 0E 00 00 0B 7E 21 40 23 24 25 5E 26 2A 28 29|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/en/file/8a4f000049ad2a6c4eeac823c087b1c6e68c58b241c70341821cceccdf0f2d17/analysis/; classtype:trojan-activity; sid:36497; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Brolux variant outbound connection"; flow:to_server,established; content:"/data/geditor/1501/"; fast_pattern:only; http_uri; content:".txt"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7f57128698280a8522bb2223e67e3f66aaffc8d846e3c9727b6f340d4fe82787/analysis/; classtype:trojan-activity; sid:36540; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 6667 (msg:"MALWARE-CNC Win.Trojan.Slackbot variant outbound connection"; flow:to_server,established; content:"PRIVMSG mpk"; fast_pattern:only; content:"!Hello|20 3C 3C|mpk|3E 3E|"; nocase; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor:Win32/Slackbot.F; classtype:trojan-activity; sid:36580; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 6667 (msg:"MALWARE-CNC Win.Trojan.Slackbot variant outbound connection"; flow:to_server,established; content:"PRIVMSG mpk"; fast_pattern:only; content:"!MpkPing|20 3C 3C|mpk|3E 3E|"; nocase; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor:Win32/Slackbot.F; classtype:trojan-activity; sid:36579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Stimilik outbound variant connection"; flow:to_server,established; content:"/SERVER/loadAdmins/"; fast_pattern:only; http_uri; urilen:19; content:!"User-Agent"; nocase; http_header; content:"password="; nocase; http_client_body; content:"&category="; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/81c6fa11d46bf173932b067c32a852f048ba51873210c3e24ac367c95e799e42/analysis/; classtype:trojan-activity; sid:36578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Stimilik outbound variant connection"; flow:to_server,established; content:"/SERVER/addToLog/"; fast_pattern:only; http_uri; urilen:17; content:!"User-Agent"; nocase; http_header; content:"password="; nocase; http_client_body; content:"&category="; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/81c6fa11d46bf173932b067c32a852f048ba51873210c3e24ac367c95e799e42/analysis/; classtype:trojan-activity; sid:36577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 20 (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"CWD /php_backdoor/admin/img_screen/"; fast_pattern:only; content:"STOR"; nocase; content:"_trolo_"; within:20; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?windows="; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?upd="; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?status="; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?start"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?image_name="; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSIL.Troloscup outbound variant connection"; flow:to_server,established; content:"/php_backdoor/?get_func"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/55f0e0b709b290fea4299712bc5f8442ddd54d13157309d15b8fc88f71ef0beb/analysis/; classtype:trojan-activity; sid:36566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Panskeg outbound connection"; flow:to_server,established; file_data; dsize:10; content:"|79 40 1F F2 03 3C 20 00 00 00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/81c6fa11d46bf173932b067c32a852f048ba51873210c3e24ac367c95e799e42/analysis/; classtype:trojan-activity; sid:36610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FTP_PORTS (msg:"MALWARE-CNC Win.Trojan.QVKeylogger outbound variant connection"; flow:to_server,established; content:"STOR public_html"; nocase; content:".rar|0D 0A|"; within:25; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/d917c9c1df013f80cd3a6cd6c6a662250d1045991c6ac15ea7074cf9b2a7664b/analysis/; classtype:trojan-activity; sid:36603; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FTP_PORTS (msg:"MALWARE-CNC Win.Trojan.QVKeylogger outbound variant connection"; flow:to_server,established; content:"RETR public_html/updates/version.txt|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/d917c9c1df013f80cd3a6cd6c6a662250d1045991c6ac15ea7074cf9b2a7664b/analysis/; classtype:trojan-activity; sid:36602; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FTP_PORTS (msg:"MALWARE-CNC Win.Trojan.QVKeylogger outbound variant connection"; flow:to_server,established; content:"PASS hUSuphun7*|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/d917c9c1df013f80cd3a6cd6c6a662250d1045991c6ac15ea7074cf9b2a7664b/analysis/; classtype:trojan-activity; sid:36601; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teabevil variant outbound connection"; flow:to_server,established; content:"&syspath="; fast_pattern:only; content:"/script"; http_uri; urilen:7; content:"CONTENT-TYPE:"; http_header; content:"&macid="; nocase; http_client_body; content:"&os1="; distance:0; nocase; http_client_body; content:"&os2="; distance:0; nocase; http_client_body; content:"&syspath="; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9bcf7fbd2123d7085ce5e3e699c9347c48f4c2ec6f26371852a01cf597a96968/analysis/; classtype:trojan-activity; sid:36630; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teabevil variant outbound connection"; flow:to_server,established; content:"&vs="; fast_pattern:only; content:"/script"; http_uri; urilen:7; content:"CONTENT-TYPE:"; http_header; content:"v="; nocase; http_client_body; content:"&id="; distance:0; nocase; http_client_body; content:"&uid="; distance:0; nocase; http_client_body; content:"&vs="; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9bcf7fbd2123d7085ce5e3e699c9347c48f4c2ec6f26371852a01cf597a96968/analysis/; classtype:trojan-activity; sid:36629; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Recodler variant outbound connection"; flow:to_server,established; content:"/count.asp?mac="; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; nocase; http_header; content:!"Accept"; nocase; http_header; reference:url,www.virustotal.com/en/file/4dc77cd5cf55b8f2d4a5f92ba8e66525f242f46127b5c9934cf72581a4fece69/analysis/; classtype:trojan-activity; sid:36628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tanmar outbound connection"; flow:to_server,established; content:"/_file-manager/php/connector.php?access="; fast_pattern:only; http_uri; content:"&cmd="; nocase; http_uri; content:"&target="; distance:0; nocase; http_uri; content:"&download="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9cc3db147a00180e49009597493b5809a0e8f9c2bbc1aabd43f634c9d2d99e62/analysis/; classtype:trojan-activity; sid:36627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1777 (msg:"MALWARE-CNC Windows.Backdoor.Quaverse outbound variant connection"; flow:to_server,established; dsize:5; content:"|AC ED 00 05|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/ea4689ab9e0cb0f6eaca712180e97569548e00bfce6a5e87853d0dff759d3712/analysis/; classtype:trojan-activity; sid:36626; rev:1;)
alert tcp $EXTERNAL_NET 1777 -> $HOME_NET any (msg:"MALWARE-CNC Windows.Backdoor.Quaverse outbound variant connection"; flow:to_client,established; dsize:16; content:"t|00 0D|giveClientMac"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/ea4689ab9e0cb0f6eaca712180e97569548e00bfce6a5e87853d0dff759d3712/analysis/; classtype:trojan-activity; sid:36625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wedots outbound variant connection"; flow:to_server,established; content:"/new/03/ftpindex.txt"; fast_pattern:only; http_uri; urilen:21; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9e461354fc05aff7a0cd90db612eecfdc9d0a54a15f6f2c7d959e6ef72fe28ab/analysis/; classtype:trojan-activity; sid:36624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wedots outbound variant connection"; flow:to_server,established; content:"/new/03/tji.html"; fast_pattern:only; http_uri; urilen:16; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9e461354fc05aff7a0cd90db612eecfdc9d0a54a15f6f2c7d959e6ef72fe28ab/analysis/; classtype:trojan-activity; sid:36623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wedots outbound variant connection"; flow:to_server,established; content:"/new/03/index.txt"; fast_pattern:only; http_uri; urilen:17; content:!"Accept"; http_header; content:!"Connection"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9e461354fc05aff7a0cd90db612eecfdc9d0a54a15f6f2c7d959e6ef72fe28ab/analysis/; classtype:trojan-activity; sid:36622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Stupeval variant outbound connection"; flow:to_server,established; content:"/Uptools/PcInfo.php?inforegctrl="; fast_pattern:only; http_uri; content:"User-Agent|3A| AutoIt|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4fc15e300fe0508318ade43cb545c17f19e04a40eb195a513ce88ccc3a3a9863/analysis/; classtype:trojan-activity; sid:36765; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sefnit variant outbound connection"; flow:to_server,established; urilen:40,norm; content:"/j/"; depth:3; http_uri; content:"/0001"; within:5; distance:32; http_uri; content:!"User-Agent"; http_header; pcre:"/^\x2fj\x2f[a-f0-9]{32}\x2f0001$/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/acddfb0bbbde83deddc8f0e4ca0ff3bd901cae473985c93b84072a874f5b9360/analysis/; classtype:trojan-activity; sid:36732; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sathurbot outbound connection"; flow:to_server,established; content:"|3C|root|3E 0A|"; depth:7; fast_pattern; http_client_body; content:"|3C|cmd action="; within:12; distance:4; http_client_body; content:"winver="; within:7; distance:47; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/65622ddd73b1f9efb83e2389a8f4df0788b1b9ab4839829c4f96240e777658b1/analysis/; classtype:trojan-activity; sid:36670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tentobr outbound connection"; flow:to_server,established; content:"/botnet/suca.php"; fast_pattern:only; http_uri; urilen:16; content:"entradatrasera="; depth:15; nocase; http_client_body; content:"&key="; distance:0; http_client_body; content:"&pais="; distance:0; http_client_body; content:"&timeout="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1065; reference:url,virustotal.com/en/file/75b8930a75bb37f607862fded39289050919b81248be1f45415cc24eff969c80/analysis/; classtype:trojan-activity; sid:36666; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Redcontrole variant outbound connection"; flow:to_server,established; content:"key.php?key="; fast_pattern:only; http_uri; content:"---------------------------------------"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4a182212680a662657114ebee1f064a054a7fdf4fab746c1c39953dc2c3e1d62/analysis/; classtype:trojan-activity; sid:36770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gokawa variant outbound connection"; flow:to_server,established; urilen:67; content:"action=visit.serv.start"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b67c0a24f5e3b14c6b6b5b781b3ffbb1869755f4e9e0536f1c2ae9ad80da69af/analysis/; classtype:trojan-activity; sid:36781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zimwervi variant outbound connection"; flow:to_server,established; content:"/count.asp?type="; fast_pattern:only; http_uri; content:"Accept: Accept:"; http_header; content:"User-Agent: WebServ|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0f947239e00470b7185ca6f5cdda7f2f2355379e769aa5b5ddee45ed6b893800/analysis/; classtype:trojan-activity; sid:36777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ruinmail outbound connection"; flow:to_server,established; content:"/portal/in.php"; fast_pattern:only; http_uri; urilen:14; content:"mail="; nocase; http_client_body; content:"&data="; distance:0; nocase; http_client_body; content:"APC%20Name%3A"; distance:0; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b44daf31fe132cbdc68a849b2c08719f50af564bfd78b5fb6757559142af3487/analysis/; classtype:trojan-activity; sid:36800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nodslit variant outbound connection"; flow:to_server,established; content:"/log/access?modeAct="; nocase; http_uri; content:"&MAC="; distance:0; nocase; http_uri; content:"&PID="; within:5; distance:17; nocase; http_uri; content:"&OS="; distance:0; nocase; http_uri; content:"&BIT="; distance:0; nocase; http_uri; content:"&name="; within:6; distance:2; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4a6b79eb8fb91652cbb166137845c28355311131c4e33093f9b301983b57fc14/analysis/; classtype:trojan-activity; sid:36807; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC OSX.Trojan.Mabouia outbound connection"; flow:to_server,established; content:"/mabouia/catcher.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f4818a2420f53ff90c7232a730a576565311917fd6c72030b26100baf4eac79f/analysis/; classtype:trojan-activity; sid:36810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Leralogs variant outbound connection"; flow:to_server,established; content:"/?DQogLS0tLS0tLSBUaW1lcyg"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/4a217be67cd619ac63d4d0817d30ab32700b42a79ec86f55790111dd78261212/analysis/; classtype:trojan-activity; sid:36841; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Banload inbound connection"; flow:to_server,established; file_data; content:"PK|03 04|"; depth:4; content:"AVKILL.EXE"; within:10; distance:26; fast_pattern; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/d8870e07e63199fabfc704b450fdaeb168d0b7a0fe414905728fc1fb816ed9df/analysis/; classtype:trojan-activity; sid:36835; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Banload outbound connection"; flow:to_client,established; file_data; content:"PK|03 04|"; depth:4; content:"AVKILL.EXE"; within:10; distance:26; fast_pattern; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/d8870e07e63199fabfc704b450fdaeb168d0b7a0fe414905728fc1fb816ed9df/analysis/; classtype:trojan-activity; sid:36834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trfijan outbound connection"; flow:to_server,established; content:"/logs.php?ap="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d1f958c6bf5c1de44010265414a5a547386f964ea5d1b7cb18b582411b31018a/analysis/; classtype:trojan-activity; sid:36893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC AbbadonPOS variant outbound connection"; flow:to_server,established; content:"/image/tools1.ico"; fast_pattern:only; http_uri; content:"Media Center PC 6.0|3B|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/780ada8440b11b76421e5cbbf1720913779b7c4b243b03595ccd69367ede6fce/analysis/; classtype:trojan-activity; sid:36890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC TinyDropper variant outbound connection"; flow:to_server,established; content:"/search.php?aff="; depth:16; http_uri; content:"&saff="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/780ada8440b11b76421e5cbbf1720913779b7c4b243b03595ccd69367ede6fce/analysis/; classtype:trojan-activity; sid:36889; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"MALWARE-CNC GlassRAT handshake beacon"; flow:to_server,established; content:"|CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,blogs.rsa.com/wp-content/uploads/2015/11/GlassRAT-final.pdf; classtype:trojan-activity; sid:36911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nessfi outbound connection"; flow:to_server,established; content:"php?&99="; http_uri; content:"&dll="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/cbb8be245c450a50166853b7fd87e2eb18a6c766af70f3892927d20f75ae3c5a/analysis/; classtype:trojan-activity; sid:37102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nessfi outbound connection"; flow:to_server,established; content:"1="; http_client_body; content:"&2="; http_client_body; content:"&3="; http_client_body; content:"&99="; http_client_body; content:"&^"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/cbb8be245c450a50166853b7fd87e2eb18a6c766af70f3892927d20f75ae3c5a/analysis/; classtype:trojan-activity; sid:37101; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dashikut outbound connection"; flow:to_server,established; content:"/ fsoOJmQW/LbpiQPoTaiqkezlHE9LuGl8="; fast_pattern:only; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6a075743df879bed39f330d11704fa9d3f1baa97e8a5b109e6508b0aeef3e150/analysis/1449861345/; classtype:trojan-activity; sid:37100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 45678 (msg:"MALWARE-CNC Win.Trojan.Flusihoc variant outbound connection"; flow:to_server,established; content:"MHz"; content:"Mb"; content:"Gbpsend"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d3a0f109aad8824b72a9b57523dcfa685e3b4dd46de3032a9e4429839a8a8155/analysis/; classtype:trojan-activity; sid:37068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 18892 (msg:"MALWARE-CNC Win.Trojan.Droot outbound connection"; flow:to_server,established; dsize:4; content:"|7B 2E 77 B9|"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/998c3b096166c285dbfff28942c330c1bcec6085589f958a7a6a524c65e990a4/analysis/; classtype:trojan-activity; sid:37067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload"; flow:to_server,established; content:"/contador/cnt.php?url="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/279486636dc5583cff84fbd9d1af5ab87ae0697a8560b8af1a016ae37f3d28d2/analysis/; classtype:trojan-activity; sid:37066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 803 (msg:"MALWARE-CNC Win.Backdoor.Venik outbound connection"; flow:to_server,established; content:"joy.asp?sid="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3361cece5f1e2920f2eb6029aa844d434f3f265cace7061cc52a0e11a6d1d383/analysis/; classtype:trojan-activity; sid:37065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Telehot outbound connection"; flow:to_server,established; content:"language/en-GB/smtps.php"; fast_pattern:only; http_uri; content:"POST"; http_method; content:"texto="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b38000c690cc5db9cd433d359d250bbaa8edfa6c14aef8e3f87b98279a93e724/analysis/; classtype:trojan-activity; sid:37064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Paligenpo outbound connection"; flow:to_server,established; content:"media/index.php?udid="; fast_pattern:only; http_uri; content:"WinHttp.WinHttpRequest.5"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/46db5ec5ba8a9a1fd100ee422ee4bdecc2686f4bb620073a5eb2c4d37cb557b9/analysis/; classtype:trojan-activity; sid:37063; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Tdrop2 variant dropper download attempt"; flow:to_client,established; file_data; content:"DW"; depth:2; content:"|B4 09 CD 21 B8 01 4C CD 21|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/1dee9b9d2e390f217cf19e63cdc3e53cc5d590eb2b9b21599e2da23a7a636184/analysis/; classtype:trojan-activity; sid:37053; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt outbound connection"; flow:to_server; urilen:>300,norm; content:"Mozilla/5.0 (Windows NT 6.3|3B| WOW64|3B| Trident/7.0|3B| Touch|3B| rv:11.0) like Gecko"; fast_pattern:only; http_header; content:".php?"; http_uri; pcre:"/^\/[A-Z0-9\x2f]+\.php\?[A-Z0-9]{300}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/65c8fa84a707c0e3c0cd5d135d35eed15e1291d3223916e4bad7e91176d04a54/analysis/; classtype:trojan-activity; sid:37052; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC ATSEngine credit card number sent via URL parameter"; flow:to_server,established; content:"/gate.php?action=set_variables"; http_uri; content:"&login="; distance:0; http_uri; content:"&ccnum="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.xylibox.com/2014/05/atsengine.html; classtype:trojan-activity; sid:37051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC ATSEngine initial beacon"; flow:to_server,established; content:"/amazon.js?ssid="; http_uri; content:"&bt="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.xylibox.com/2014/05/atsengine.html; classtype:trojan-activity; sid:37050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Geratid variant outbound connection"; flow:to_server,established; content:"/announce/"; nocase; http_uri; content:"rid="; http_client_body; content:"hwid="; fast_pattern:only; http_client_body; content:"rno="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b38a7ec34ee3f6c24edf3c533b702a2aa72c3e94542b32b8b2c64ea896036dbc/analysis/; classtype:trojan-activity; sid:37049; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bookworm variant outbound connection"; flow:to_server,established; urilen:50; content:"Connection: Keep-Alive|0D 0A 0D 0A|"; fast_pattern:only; content:"/0"; depth:2; http_uri; content:!"User-Agent: "; http_header; content:!"Accept: "; http_header; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/80bfe4c4758a93e315da8bbcbfbc48cd8f280b871e1bcf1cf6a126454895e05a/analysis /; classtype:trojan-activity; sid:37048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vonterra outbound connection"; flow:to_server,established; content:"/sucess/thanks.php"; fast_pattern:only; http_uri; content:!"Referrer|3A|"; http_header; content:"&Cores="; nocase; http_uri; content:"&v="; within:6; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/14dde35ea9ec7e8769e5312563a83b814bd23f0bc6b0cf84d79e024d17022d00/analysis/; classtype:trojan-activity; sid:37047; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kovter outbound connection"; flow:to_server,established; content:"/counter/?"; fast_pattern:only; http_uri; content:"UA-CPU"; http_header; content:"MSIE 7.0|3B|"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/e3da9c7f20e7f24891e0dec594dad6d9deebee145153611a5c05c69593284a27/analysis/; reference:url,www.virustotal.com/en/file/9d6b1bd74848dd0549ad3883b7292d3ba0a4fa06d0aaf562032b0bf6dc198249/analysis/; classtype:trojan-activity; sid:37045; rev:3;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Arfadinf variant outbound connection"; flow:to_server,established; content:"/check/Test11~"; fast_pattern:only; http_uri; content:"cmd.inf"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/65ece5aa5926c7b25b337da895fd5fcd042e43f77bba084a1f1a33570d1a1cdc/analysis/; classtype:trojan-activity; sid:37037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ModPOS outbound connection"; flow:to_server,established; urilen:11; content:"POST"; http_method; content:"/robots.txt"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1159dceabbab2019988cd0da041ed0367c6d5a9ee5077da3d52ea5dc332a0230/analysis/; classtype:trojan-activity; sid:37036; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Alina variant outbound connection"; flow:to_server,established; content:"|FF FA EE EB FE EF AA AA|"; depth:8; offset:28; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/082000f79439600b162e6a6ff5e6815b4bd3f041f42c6c2478feba3f5eb81894/analysis/; classtype:trojan-activity; sid:37027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sofacy outbound connection"; flow:to_server,established; content:"User-Agent: MSIE 8.0|0D 0A|"; fast_pattern:only; http_header; content:"/check/"; http_uri; urilen:7; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45/analysis/; classtype:trojan-activity; sid:37024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gh0st variant outbound connection"; flow:to_server,established; content:"HTTP|5C|1.1 Sycmentec"; depth:18; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3a5876eea86280e660a21564c9a2e2c7a8493b444d710c83a4813152a3c9d21d/analysis/; classtype:trojan-activity; sid:37020; rev:1;)
alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"MALWARE-CNC Milkoad.A First Request"; flow:to_server,established; content:"ldr/client.php?msg=hello"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/30298b8648ae5b5443366a5f40294f16c09a04a76b7949a28feeacf159b135d0/analysis/; classtype:trojan-activity; sid:36916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site"; flow:to_server,established; content:"/wp-admin/"; http_uri; content:".exe|20|HTTP/1."; fast_pattern:only; pcre:"/\.exe$/U"; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:36914; rev:1;)
alert tcp $EXTERNAL_NET 8080 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Collicky variant inbound command attempt"; flow:to_client,established; content:"#$$$"; depth:4; content:"#!!!"; distance:250; pcre:"/\x23\x24\x24\x24[A-F0-9]{250,}\x23\x21\x21\x21/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3ce877266e281bbf00bb57cd02a3abe21ff993c007d405fca412a02bd9b718c/analysis/1450285074/; classtype:trojan-activity; sid:37141; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Batec outbound connection"; flow:to_server,established; content:"/Modulos/BOBY.jpg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a2f9a0c6348c725b3959094967e9c540c93a4b52c266dccf7752a722817e3da6/analysis/; classtype:trojan-activity; sid:37127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cetsiol outbound connection"; flow:to_server,established; content:"|0E 25|"; depth:2; http_client_body; content:"|EE AE 79 31 54 A4|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/dff2e80dc4b43aff2c68d79ba0c55557c317d6d601594634a2a4d9488aecf842/analysis/; classtype:trojan-activity; sid:37117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-CNC Win.Trojan.Hpastal outbound email attempt"; flow:to_server,established; file_data; content:"Passwords Of "; depth:13; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/44bc605f8c6c6035540a65d9c53697d119e76e6bfd9a0ac35f8add970b49ced3/analysis/1450362196/; classtype:trojan-activity; sid:37164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Isniffer outbound connection"; flow:to_server,established; content:"isn_reloadconfig"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/587e784f8c54b49f25c01e0e8f71c205bd422e2b673fb7fbf28d721aa768e055/analysis/1450804558/; classtype:trojan-activity; sid:37228; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Isniffer outbound connection"; flow:to_server,established; content:"isn_logdel"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/587e784f8c54b49f25c01e0e8f71c205bd422e2b673fb7fbf28d721aa768e055/analysis/1450804558/; classtype:trojan-activity; sid:37227; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Isniffer outbound connection"; flow:to_server,established; content:"isn_logpath"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/587e784f8c54b49f25c01e0e8f71c205bd422e2b673fb7fbf28d721aa768e055/analysis/1450804558/; classtype:trojan-activity; sid:37226; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Isniffer outbound connection"; flow:to_server,established; content:"isn_getlog"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/587e784f8c54b49f25c01e0e8f71c205bd422e2b673fb7fbf28d721aa768e055/analysis/1450804558/; classtype:trojan-activity; sid:37225; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pmabot outbound connection"; flow:to_server,established; content:"/myadmin/scripts/setup.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b6df5e40c047624b37bec8ce8b7f60bff11b7b2492ed8f8237163999de938bbd/analysis/1450976284/; classtype:trojan-activity; sid:37215; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pmabot outbound connection"; flow:to_server,established; content:"/pma/scripts/setup.php"; depth:22; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b6df5e40c047624b37bec8ce8b7f60bff11b7b2492ed8f8237163999de938bbd/analysis/1450976284/; classtype:trojan-activity; sid:37214; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pmabot outbound connection"; flow:to_server,established; content:"/phpMyAdmin/scripts/setup.php"; fast_pattern:only; http_uri; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b6df5e40c047624b37bec8ce8b7f60bff11b7b2492ed8f8237163999de938bbd/analysis/1450976284/; classtype:trojan-activity; sid:37213; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Pmabot outbound connection"; flow:to_server,established; content:"/phpTest/zologize/axa.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b6df5e40c047624b37bec8ce8b7f60bff11b7b2492ed8f8237163999de938bbd/analysis/1450976284/; classtype:trojan-activity; sid:37212; rev:2;)
# alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Chopper web shell connection"; flow:to_server,established; content:"=@eval(base64_decode($_POST"; fast_pattern:only; http_client_body; metadata:impact_flag red, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1001; reference:url,attack.mitre.org/techniques/T1100; reference:url,attack.mitre.org/techniques/T1132; reference:url,informationonsecurity.blogspot.com/2012/11/china-chopper-webshell.html; reference:url,www.virustotal.com/en/file/BE24561427D754C0C150272CAB5017D5A2DA64D41BEC74416B8AE363FB07FD77/analysis/; classtype:trojan-activity; sid:37245; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 6667 (msg:"MALWARE-CNC MultiOS.Trojan.Pbot outbound IRC channel join attempt"; flow:to_server, established; content:"JOIN #pma Always"; depth:16; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/86451aa007a260116a1d0d8771fa40971aa393b500d07a1514f93cc4cd2d676d/analysis/1452268107/; classtype:trojan-activity; sid:37360; rev:1;)
alert tcp $EXTERNAL_NET 6667 -> $HOME_NET any (msg:"MALWARE-CNC MultiOS.Trojan.Pbot inbound command attempt"; flow:to_client, established; content:"PRIVMSG #pma :."; depth:40; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,www.virustotal.com/en/file/86451aa007a260116a1d0d8771fa40971aa393b500d07a1514f93cc4cd2d676d/analysis/1452268107/; classtype:trojan-activity; sid:37359; rev:1;)
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.BlackEnergy DropBear SSH server password authentication"; flow:to_client,established; content:"passDs5Bu9Te7"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd/analysis/1452274157/; classtype:trojan-activity; sid:37357; rev:1;)
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.BlackEnergy DropBear SSH public key"; flow:to_client,established; content:"AAAAB3NzaC1yc2EAAAABJQAAAQEAsrGnWG3XPW4tO8tRLhF"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd/analysis/1452274157/; classtype:trojan-activity; sid:37356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Direvex variant outbound connection"; flow:to_server,established; content:"/whereismyentry.php"; fast_pattern:only; http_uri; content:"loader="; depth:7; http_client_body; content:"&token="; distance:0; http_client_body; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f6532b7175669a8eb343950e067f359cfd97f33426b4c4ef67e30d0b440a1365/analysis/; classtype:trojan-activity; sid:37323; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Sakurel variant outbound connection"; flow:to_server,established; content:"/view.asp?cookie="; offset:5; fast_pattern; content:"&type="; within:6; distance:15; content:"&vid="; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0237f92714f28d755025fa6ba0f4759c7797edd73c4ccbd544495941ae0e0bcd/analysis/; classtype:trojan-activity; sid:37320; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Radamant inbound connection"; flow:to_client,established; dsize:>32; content:"[0:unknownID][6:"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9f63e8655da2abb0e7acf7c90a3797826f1b631794c6adf703f6afa55add56a4/analysis/; classtype:attempted-user; sid:37317; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sesramot variant outbound connection"; flow:to_server,established; content:"/content/opbotnet/command.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/261ca01c6432a09a2c4122d3065b558228e235a6cad66067bb6093647c03f97d/analysis/; classtype:trojan-activity; sid:37297; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sesramot variant outbound connection"; flow:to_server,established; content:"/content/opbotnet/accept.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/261ca01c6432a09a2c4122d3065b558228e235a6cad66067bb6093647c03f97d/analysis/; classtype:trojan-activity; sid:37296; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Derkziel variant outbound connection"; flow:to_server,established; content:"/gate.php"; nocase; http_uri; content:"derkziel.txt"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9b026281b5b20df22976e3bed2c926096728cefd6dea86aadd05c1cec16f6811/analysis/; classtype:trojan-activity; sid:37374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25] (msg:"MALWARE-CNC Win.Trojan.Trochulis variant outbound connection"; flow:to_server,established; file_data; content:"|BF BF AF AF 7E 00 00 00|"; fast_pattern:only; dsize:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/da6905d96cc860b443deb5f27271a2cfb2ce17f067a59ca7f0fd12c1d70c4372/analysis/; classtype:trojan-activity; sid:37370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sovfo variant outbound connection"; flow:to_server,established; content:"/post.php?files="; depth:16; nocase; http_uri; content:"&user="; distance:0; nocase; http_uri; content:"&machine="; distance:0; nocase; http_uri; content:"&datetime="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b5814a31742c330cf4cea748bf32e1f9df58116d21c0c2b7980af8bf4195a81a/analysis/; classtype:trojan-activity; sid:37457; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Evilgrab outbound connection"; flow:to_server,established; content:"|DD 00 00 00 20|GET"; depth:8; rawbytes; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/25999b694489d6a1f09f57b89b8ba8fe9bc1f0eeb183ba1cb2693ec27368a293/analysis/; classtype:trojan-activity; sid:37447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vawtrak variant outbound connection"; flow:to_server,established; content:"/rss/feed/stream"; fast_pattern:only; http_uri; content:"|3F|"; depth:1; offset:2; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/6ADFAFFEA064A9F89064FBA300CDFCD7634CFD06802BF250FA1B070CABFBEBF5/analysis/; classtype:trojan-activity; sid:37467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Blackmoon outbound connection"; flow:to_server,established; content:"/board/tj/count.asp?sid="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.0)"; nocase; http_header; content:"Cache-Control: no-cache|0D 0A 0D 0A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9ee043dc2e66447e55e6a8073ba7afb7af383dfb6d6545acf4ee7b5300eda97c/analysis/; classtype:trojan-activity; sid:37466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"; flow:to_server,established; content:"/Recoveries/OSKey.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/84409422426933e6f1ea227f042ff56d1f6686873454959d2e3308b9f5daac61/analysis/; classtype:trojan-activity; sid:37523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"; flow:to_server,established; content:"/Recoveries/Mail.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/84409422426933e6f1ea227f042ff56d1f6686873454959d2e3308b9f5daac61/analysis/; classtype:trojan-activity; sid:37522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"; flow:to_server,established; content:"/Recoveries/Browser.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/84409422426933e6f1ea227f042ff56d1f6686873454959d2e3308b9f5daac61/analysis/; classtype:trojan-activity; sid:37521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sality variant outbound connection"; flow:to_server,established; urilen:15<>30,norm; content:".jpg?"; fast_pattern:only; http_uri; content:"User-Agent"; http_header; content:!"Referer"; http_header; content:!"Accept"; http_header; pcre:"/\.jpg\x3f[a-f0-9]{4,7}\x3d\d{6,8}$/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2A96C520770F5CE46468F1228C508E4DFC1DB958663CE5B473CFC9B94C5837A7/analysis/; classtype:trojan-activity; sid:37516; rev:4;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"MALWARE-CNC Win.Trojan.Derusbi outbound connection"; flow:to_server,established; content:"|00 00 00|"; depth:3; offset:1; content:!"|00|"; within:1; content:"|00 08 02 00 00 00|"; within:6; distance:4; content:!"|00|"; within:1; content:"|00 00|"; within:2; distance:2; content:!"|00|"; within:20; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/de33dfce8143f9f929abda910632f7536ffa809603ec027a4193d5e57880b292/analysis/; classtype:trojan-activity; sid:37536; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"MALWARE-CNC Win.Trojan.Derusbi outbound connection"; flow:to_server,established; content:"|00 00 00|"; depth:3; offset:1; content:!"|00|"; within:1; content:"|00 07 02 00 00 00|"; within:6; distance:4; content:!"|00|"; within:1; content:"|00 00|"; within:2; distance:2; content:!"|00|"; within:20; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/de33dfce8143f9f929abda910632f7536ffa809603ec027a4193d5e57880b292/analysis/; classtype:trojan-activity; sid:37535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Derusbi outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Win32)"; fast_pattern:only; http_header; content:"Referer: "; http_header; content:"google.com"; within:30; http_header; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/de33dfce8143f9f929abda910632f7536ffa809603ec027a4193d5e57880b292/analysis/; classtype:trojan-activity; sid:37534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Latentbot variant outbound connection"; flow:to_server,established; content:"/$rdgate?ACTION=HELLO"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e97b3e1556b3417941b221bc779eeaf9f34ac1fb40a393e4be9f737351e16758/analysis/; classtype:trojan-activity; sid:37618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Engr variant outbound connection"; flow:to_server,established; urilen:7<>8; content:".php"; http_uri; content:"boundary=Xu02=$"; fast_pattern:only; http_header; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/54f6600db99fdab31453f3e23e8fb080438cd1ec36b6fc2868ff86cf88f14bb0/analysis/; classtype:trojan-activity; sid:37552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"/vip.jpg"; fast_pattern:only; http_uri; urilen:8; content:"User-Agent: Mozilla/4.0 (compatible)|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/881bb1538b4d077976cd9b27523cd5af9bd86c0ae3bce4edf453e74bba9f4c1b/analysis/; classtype:trojan-activity; sid:37647; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Symmi variant dropper download connection"; flow:to_client,established; file_data; content:"|A6 4D AA E1 65 52 A5 E1 E3 58 76 E1 81 4D A5 E1 CE 48 9C E1 BB 4D A5 E1 CE 48 A9 E1 A1 4D A5 E1|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/881bb1538b4d077976cd9b27523cd5af9bd86c0ae3bce4edf453e74bba9f4c1b/analysis/; classtype:trojan-activity; sid:37646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Graftor outbound connection"; flow:to_server,established; content:".asp?ip="; fast_pattern:only; nocase; http_uri; content:"&hn="; nocase; http_uri; content:"&gmt="; within:25; nocase; http_uri; content:"&ver="; within:20; nocase; http_uri; pcre:"/\x2easp\x3fip=(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&hn=[a-zA-Z0-9]{3,25}&gmt=(\-[0-9])&ver=/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e8d782ccf061acbc0ead3f96d64959c4ea5a0c66642dbddc3b51410100177bb9/analysis/; classtype:trojan-activity; sid:37637; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Graftor outbound connection"; flow:to_server,established; content:".asp?id="; fast_pattern:only; http_uri; content:"&ver="; nocase; http_uri; pcre:"/\x2easp\x3fid=(code|ProxyFlag|ip|port)&ver=/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e8d782ccf061acbc0ead3f96d64959c4ea5a0c66642dbddc3b51410100177bb9/analysis/; classtype:trojan-activity; sid:37636; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent outbound POST attempt"; flow:to_server,established; content:"|0D 0A|Referer: https://www.google.com|0D 0A|"; fast_pattern:only; http_header; content:"action="; http_client_body; content:"data="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e2c115679bcad87692506d6d9e7a985c59f59e36fd658b8927386474cbcc38ca/analysis/1455286210/; classtype:trojan-activity; sid:37686; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex dropper variant outbound connection"; flow:to_server,established; content:"/gt.jpg?"; fast_pattern; http_uri; content:"="; within:1; distance:15; http_uri; content:"bytes=6433-"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/8a80760f60f42ce5574a8020c08123a6a8fc2a12d28e8802f3d5101f72c2ad0c/analysis/; classtype:trojan-activity; sid:37733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teslacrypt outbound POST attempt"; flow:to_server,established; content:"/dbconnect.php"; fast_pattern:only; http_uri; content:"data="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3b90683a555e73ab11180e13c900a8f21cc2726dd015f9cffb656c1c38e712e9/analysis/1455556019/; classtype:trojan-activity; sid:37719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teslacrypt outbound POST attempt"; flow:to_server,established; content:"/administrator/components/com_akeeba/akeeba/engines/proc/mzsystem.php"; fast_pattern:only; http_uri; content:"data"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3b90683a555e73ab11180e13c900a8f21cc2726dd015f9cffb656c1c38e712e9/analysis/1455556019/; classtype:trojan-activity; sid:37718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Teslacrypt outbound POST attempt"; flow:to_server,established; content:"/mssys.php"; fast_pattern:only; http_uri; content:"data="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3b90683a555e73ab11180e13c900a8f21cc2726dd015f9cffb656c1c38e712e9/analysis/1455556019/; classtype:trojan-activity; sid:37717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.LeChiffre outbound connection"; flow:to_server,established; content:"/sipvoice.php?"; nocase; http_uri; content:"session="; distance:0; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0/analysis/; classtype:trojan-activity; sid:37844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Win32)"; fast_pattern:only; http_header; urilen:15; content:"/images/img.bin"; nocase; http_uri; content:"Pragma: no-cache|0D 0A 0D 0A|"; nocase; http_header; content:!"Referer: "; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b1df8cce007cbfc42697087e3d61452e0534bbf0d3909c1d88f362463430547e/analysis/; classtype:trojan-activity; sid:37838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"/34gf5y/r34f3345g"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ee6abe4a9530b78e997d9c28394356216778eaf2d46aa3503999e7d6bfbefe90/analysis/; classtype:trojan-activity; sid:37835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"/lockycrypt.rar"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ee6abe4a9530b78e997d9c28394356216778eaf2d46aa3503999e7d6bfbefe90/analysis/; classtype:trojan-activity; sid:37834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.Torte variant outbound connection"; flow:to_server,established; content:"(Windows|3B| U|3B| "; fast_pattern:only; http_header; content:"?sessd="; http_uri; content:"&sessc="; distance:0; http_uri; content:"&sessk="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/800f8b125345784d532b29465b5c57d05287235d3535534186b5edf971bc7fe9/analysis/; classtype:trojan-activity; sid:37817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kazy variant outbound connection"; flow:to_server,established; urilen:10; content:"post="; depth:5; fast_pattern; http_client_body; content:"/index.php"; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/522e5d4ea0771f5c0bc300c2d66a0445a66ae85bd4b50c21a502365db0a638d9/analysis/; classtype:trojan-activity; sid:37816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex outbound connection"; flow:to_server,established; content:"|37 76 8A D4 53 C2 57 E2 49 98 7C 04 98 2A C2 EC 31 4C 29 05 1E F5 E0 1A AD C4 E3|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/BA64CEA40FF6F97C638B7A162EF26F5DE685868942D6203C2BBC3D71C17EA348/analysis/; classtype:trojan-activity; sid:38018; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt server reply"; flow:to_client,established; file_data; content:"-!!!INSERTED!!!-"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/362c4acfcf96f5cd923c8c225d1eb968175c57854029154eecd9832e62b1ecf1/analysis/; classtype:misc-activity; sid:38017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Keranger outbound connection"; flow:to_server,established; content:"/osx/ping?user_id="; fast_pattern:only; http_uri; content:"&uuid="; http_uri; content:"&model="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153/analysis/; classtype:trojan-activity; sid:38116; rev:2;)
alert tcp $EXTERNAL_NET 2556 -> $HOME_NET any (msg:"MALWARE-CNC known malicious SSL certificate - Win.Trojan.Adwind"; flow:to_client,established; content:"|16 03|"; content:"|02|"; within:1; distance:3; content:"assylias.Inc"; within:175; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/2a6015cbc160df29cdce35dc7eef062658303c83de82e0a453b929a2dbc7a736/analysis/; classtype:trojan-activity; sid:38134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt variant outbound connection"; flow:to_server,established; content:"Accept|3A 20 F0|"; fast_pattern:only; http_header; content:!"Referer|3A|"; http_header; content:"data="; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/362c4acfcf96f5cd923c8c225d1eb968175c57854029154eecd9832e62b1ecf1/analysis/; classtype:trojan-activity; sid:38150; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kovter variant outbound connection"; flow:to_server,established; content:"/wp-includes/theme-compat/filefile.php"; fast_pattern:only; http_uri; content:"User-Agent: curl|0D 0A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/71b09e7a50487614156a9e918b7cc2491ee28636f0837ae2ef63f6f918269c2d/analysis/; classtype:trojan-activity; sid:38145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FighterPOS variant outbound connection"; flow:to_server,established; content:"imhome=areyousure"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/121ac9d8f31efc54238a72e803f9c91ff32640d13fa0dc4d08d8ab560d4a8fb0/analysis/; classtype:trojan-activity; sid:38235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"GET /news.asp HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:38261; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"GET /login/process.jsp HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:38260; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"/news.php HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:38259; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win/Linux.Trojan.Derusbi variant outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1)|0D 0A|"; fast_pattern:only; http_header; content:"Pragma|3A 20|no-cache"; http_header; content:"Cache-Control|3A 20|no-cache"; http_header; content:"POST"; http_method; content:"/login1.asp"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.fidelissecurity.com/sites/default/files/TA_Fidelis_Turbo_1602%283%29.pdf; classtype:trojan-activity; sid:38258; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1)|0D 0A|"; fast_pattern:only; http_header; content:"Pragma|3A 20|no-cache"; http_header; content:"Cache-Control|3A 20|no-cache"; http_header; content:"GET"; http_method; content:"/Query.asp?loginid="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.fidelissecurity.com/sites/default/files/TA_Fidelis_Turbo_1602%283%29.pdf; classtype:trojan-activity; sid:38257; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"; flow:to_server,established; content:"CONNECT"; http_method; content:"User-Agent|3A 20|Mozilla/4.0|0D 0A|"; fast_pattern:only; http_header; content:"Pragma|3A 20|no-cache"; http_header; content:"Proxy-Connection|3A 20|Keep-Alive|0D 0A|"; http_header; content:"Accept: */*"; http_header; content:"Accept-Encoding|3A| identity"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.fidelissecurity.com/sites/default/files/TA_Fidelis_Turbo_1602%283%29.pdf; classtype:trojan-activity; sid:38256; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"; flow:to_server,established; content:"User-Agent|3A 20|Mozilla/4.0|0D 0A|"; fast_pattern:only; http_header; content:"Pragma|3A 20|no-cache"; http_header; content:"Proxy-Connection|3A 20|Keep-Alive|0D 0A|"; http_header; content:"POST"; http_method; content:"/photos/photo.asp"; http_uri; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.fidelissecurity.com/sites/default/files/TA_Fidelis_Turbo_1602%283%29.pdf; classtype:trojan-activity; sid:38255; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Linux.Trojan.Bifrose outbound connection"; flow:to_server; content:"|9B 4F B0 75 E2 76 96 04 5A F1 F9 43 D4 A2 6B|"; depth:15; offset:4; content:"|76 13 85 45 17 1B|"; within:6; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/0a0d7bed3c8aa0e0e87e484a37e62b0bd0e97981b0bea55f6f3607316831ba5d/analysis/; classtype:trojan-activity; sid:38333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/main.php"; fast_pattern:only; http_uri; urilen:9,norm; content:!"|0D 0A|Accept|2D|Language|3A|"; http_header; content:!"|0D 0A|Referer|3A|"; http_header; content:!"|0D 0A|Cookie|3A|"; http_header; content:"Content-Length|3A 20|"; http_raw_header; byte_test:10,>,95,0,relative,string,dec; byte_test:10,<,115,0,relative,string,dec; content:"Connection|3A 20|Keep-Alive|0D 0A|Cache-Control|3A 20|no-cache"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/33ab0605b83356e065459559bb81ec5e7464be563059fce607760517fedaf603/analysis/; classtype:trojan-activity; sid:38331; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant send mail credentials"; flow:to_server,established; content:"|01 00 00 00 41|"; depth:5; dsize:<10; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant send logs"; flow:to_server,established; content:"|87 00 00 00 36|"; depth:5; dsize:100<>150; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38358; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant send credentials"; flow:to_server,established; content:"|01 00 00 00 3D|"; depth:5; dsize:5; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant read logs"; flow:to_server,established; content:"|05 00 00 00 3A|"; depth:5; dsize:<10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38356; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"; flow:to_server,established; content:"|01 00 00 00 01|"; depth:5; dsize:5; metadata:impact_flag red, ruleset community; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38355; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant failed read logs"; flow:to_server,established; content:"|01 00 00 00 3C|"; depth:5; dsize:5; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38354; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant connection setup"; flow:to_server,established; content:"|43 00 00 00 05|"; depth:5; dsize:<80; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant check logs"; flow:to_server,established; content:"|10 00 00 00 38|"; depth:5; dsize:20; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:38352; rev:1;)
alert tcp $HOME_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Dridex file download attempt"; flow:to_server,established; file_data; content:"FeintedEscalator"; fast_pattern:only; content:"InkingGrange"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/en/file/f4bf52759270fa4fc4e5745d51dd8d73b49feae9de5bedfd8f4e0a865e8047c4/analysis/1459264179/; classtype:trojan-activity; sid:38380; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex file download attempt"; flow:to_client,established; file_data; content:"FeintedEscalator"; fast_pattern:only; content:"InkingGrange"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/f4bf52759270fa4fc4e5745d51dd8d73b49feae9de5bedfd8f4e0a865e8047c4/analysis/1459264179/; classtype:trojan-activity; sid:38379; rev:1;)
alert tcp $EXTERNAL_NET 4043 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|0B|"; distance:3; content:"|55 04 07 0C 06|Lisbon"; content:"|55 04 0A 0C 10|Souppi Otiop SEM"; distance:6; content:"|55 04 03 0C 0E|wthcethesmw.ph"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/f4bf52759270fa4fc4e5745d51dd8d73b49feae9de5bedfd8f4e0a865e8047c4/analysis/1459264179/; classtype:trojan-activity; sid:38378; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Bedep.variant CNC server response"; flow:to_client,established; content:"Set-Cookie|3A| PHPSESSID="; content:"Set-Cookie|3A| splices="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.broadanalysis.com/2016/03/21/angler-ek-sends-teslacrypt-and-bedep-ad-fraud/; classtype:trojan-activity; sid:38367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FTPKeyLogger geolocation check"; flow:to_server,established; urilen:16; content:"/geoip/geoip.php"; fast_pattern:only; http_uri; content:!"Accept"; http_header; content:!"User-Agent"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/44f956d41f5aea97884f88f60c1e28dc246b4b7318a87b332367e7f0476ca8fc/analysis/1459279340/; classtype:trojan-activity; sid:38388; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"; flow:to_server,established; content:"STOR Screenshot from|3A 20|"; fast_pattern; content:"|29|.png"; within:80; metadata:impact_flag red, ruleset community, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/44f956d41f5aea97884f88f60c1e28dc246b4b7318a87b332367e7f0476ca8fc/analysis/1459279340/; classtype:trojan-activity; sid:38387; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"; flow:to_server,established; content:"PASS Goodman1986|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/44f956d41f5aea97884f88f60c1e28dc246b4b7318a87b332367e7f0476ca8fc/analysis/1459279340/; classtype:trojan-activity; sid:38386; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"; flow:to_server,established; content:"USER obitex@benfoods.tk|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/44f956d41f5aea97884f88f60c1e28dc246b4b7318a87b332367e7f0476ca8fc/analysis/1459279340/; classtype:trojan-activity; sid:38385; rev:2;)
# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC VBS Trojan Downloading Encoded Executable"; flow:to_client,established; content:"Content-Type: image/jpeg"; http_header; file_data; content:"|30 0C 0D 17 44 14 16 0B 03 16 05 09 44 07 05 0A 0A 0B 10 44 06 01 44 16 11 0A 44 0D 0A 44 20 2B 37 44 09 0B 00 01|"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/19f7eb767cb83d29a9262288390f23bab90dd25a594639d9bc1e1182461c75d5/analysis/1460560153/; classtype:trojan-activity; sid:38542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Obfuscated Javascript Attack runtime detection"; flow:to_server,established; content:"/system/logs/87yhb54cdfy.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b04865eedf942078b123b13347930b871a75a02a982c71e68abaac2def7bd1ce/analysis/; classtype:trojan-activity; sid:38530; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET [8021,8022] (msg:"MALWARE-CNC XBot Command Request get_action"; flow:to_server,established; file_data; content:"eyJhY3Rpb24iOiJnZXRfYWN0aW9uIiwiZGV2aWNlSUQi"; depth:75; metadata:impact_flag red, policy security-ips drop; reference:url,researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/; classtype:trojan-activity; sid:38528; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC binary download while video expected"; flow:to_client,established; content:"Content-Type|3A 20|video/quicktime|0D 0A 0D 0A|"; http_header; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; within:4; distance:-64; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/38221267218184b17a78d8814d1bd06b12143be859488ae15ca0d754f32d60fc/analysis/1460472611/; classtype:trojan-activity; sid:38517; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Sweeper outbound connection"; flow:to_server,no_stream; dsize:24; content:"|61 63 36 62 66 34 64 30 66 35 36 30 30 30 34 36 32 37 31 31 30 33 39 39|"; fast_pattern:only; detection_filter:track by_src, count 1000, seconds 1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/38221267218184b17a78d8814d1bd06b12143be859488ae15ca0d754f32d60fc/analysis/1460472611/; classtype:trojan-activity; sid:38516; rev:3;)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Sweeper outbound connection"; flow:to_server,no_stream; dsize:24; content:"|39 64 30 33 66 65 66 35 30 30 62 39 30 30 34 36 32 37 31 31 30 33 32 35|"; fast_pattern:only; detection_filter:track by_src, count 1000, seconds 1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/38221267218184b17a78d8814d1bd06b12143be859488ae15ca0d754f32d60fc/analysis/1460472611/; classtype:trojan-activity; sid:38515; rev:3;)
alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Sweeper outbound connection"; flow:to_server,no_stream; dsize:9; content:"hi00"; fast_pattern:only; pcre:"/hi00[0-9]{5}/"; detection_filter:track by_src, count 1000, seconds 1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/38221267218184b17a78d8814d1bd06b12143be859488ae15ca0d754f32d60fc/analysis/1460472611/; classtype:trojan-activity; sid:38514; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpySoft variant exfiltration attempt"; flow:to_server,established; urilen:11; content:"POST"; http_method; content:"/api?upload"; fast_pattern:only; http_uri; content:"Expect|3A 20|"; http_header; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,www.virustotal.com/en/file/146889acc9c4a5dbda2de339320159560567b14f846653df727284076f092e63/analysis/1460466642/; classtype:trojan-activity; sid:38510; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Boaxxe variant outbound connection"; flow:to_server,established; content:"|7C 7C|CM01|7C|CM02|7C|CM03|7C|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/efd9036e675507da76cd0946408aedb814aff9da62d23de4f0680a4e7186a75c/analysis/1460471360/; classtype:trojan-activity; sid:38509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TreasureHunter variant outbound connection"; flow:to_server,established; content:"/gate.php?report=true"; fast_pattern:only; http_uri; content:"report="; depth:7; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/046d0b8024cea9c6aea2ef04b51ce9fd482214fbb3ef068a85c0f91f193f248f/analysis/; classtype:trojan-activity; sid:38574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TreasureHunter variant handshake beacon"; flow:to_server,established; content:"/gate.php?request=true"; fast_pattern:only; http_uri; content:"request="; depth:8; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/046d0b8024cea9c6aea2ef04b51ce9fd482214fbb3ef068a85c0f91f193f248f/analysis/; classtype:trojan-activity; sid:38573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Coverton variant outbound connection"; flow:to_server,established; urilen:>13; content:"/idea.php?ch="; depth:13; http_uri; content:"Content-length: 0"; http_header; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/423524fa48a5139aaf7125073e98cf2204e56e43349360b05d665278e2841232/analysis/1460160722/; classtype:trojan-activity; sid:38567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sweeper variant dropper download attempt"; flow:to_server,established; content:".bin"; fast_pattern:only; content:"User-Agent|3A 20|Microsoft BITS"; http_header; content:"Accept-Encoding|3A 20|identity|0D 0A|"; content:"If-Unmodified-Since"; http_header; content:"Range"; http_header; pcre:"/\/[a-f0-9]{32}\/\w+\.bin/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,www.virustotal.com/en/file/70e6df66c76700afef596e2dd7c956f4f476acca5b935b3f067084241638d182/analysis/1460636221/; classtype:trojan-activity; sid:38566; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sweeper variant dropper initial download attempt"; flow:to_server,established; content:"HEAD"; http_method; content:".bin"; fast_pattern:only; content:"User-Agent|3A 20|Microsoft BITS"; http_header; content:"Accept-Encoding|3A 20|identity|0D 0A|"; content:!"Content-Length"; http_header; pcre:"/\/[a-f0-9]{32}\/\w+\.bin/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,www.virustotal.com/en/file/70e6df66c76700afef596e2dd7c956f4f476acca5b935b3f067084241638d182/analysis/1460636221/; classtype:trojan-activity; sid:38565; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger keylog exfiltration attempt"; flow:to_server,established; content:"/post.php?"; fast_pattern:only; http_uri; content:"pl="; http_uri; content:"&education="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38564; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.GateKeylogger fake 404 response"; flow:to_client,established; file_data; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:">404 Not Found<"; fast_pattern:only; content:" requested URL / was not found "; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38563; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger initial exfiltration attempt"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; content:"pc="; nocase; http_client_body; content:"&admin="; distance:0; nocase; http_client_body; content:"&os="; distance:0; nocase; http_client_body; content:"&hid="; distance:0; nocase; http_client_body; content:"&arc="; distance:0; nocase; http_client_body; content:"User-Agent|3A 20|"; http_header; pcre:"/User-Agent\x3a\x20[A-F0-9]{32}\x0d\x0a/H"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38562; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger plugins download attempt"; flow:to_server,established; content:".p HTTP/1.1"; fast_pattern:only; content:"/plugins/"; http_uri; pcre:"/\/plugins\/[a-z]{3,10}\.p/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,attack.mitre.org/techniques/T1176; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38561; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger outbound connection - screenshot"; flow:to_server,established; content:"/News/gate.php?"; fast_pattern:only; http_uri; content:"JFIF"; http_client_body; pcre:"/\/News\/gate\.php\x3f[a-f0-9]{32}\x3d\d/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38560; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger outbound connection - keystorkes"; flow:to_server,established; content:"/News/gate.php?"; fast_pattern:only; http_uri; content:"
"; http_client_body; pcre:"/\/News\/gate\.php\x3f[a-f0-9]{32}\x3d\d/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38559; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger outbound connection"; flow:to_server,established; content:"/News/gate.php"; fast_pattern:only; http_uri; content:"="; depth:4; http_client_body; content:"User-Agent|3A 20|"; http_header; pcre:"/User-Agent\x3a\x20[A-F0-9]{32}\x0d\x0a/H"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38558; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GateKeylogger outbound connection"; flow:to_server,established; content:"/News/gate.php"; fast_pattern:only; http_uri; content:"Connection|3A 20|Keep-Alive"; http_header; content:!"Accept"; http_header; content:!"Content-Type"; http_header; content:"User-Agent|3A 20|"; http_header; pcre:"/User-Agent\x3a\x20[A-F0-9]{32}\x0d\x0a/H"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/77c802db1731fa8dae1b03d978f89b046309adfa1237b1497a69ccb9c2d82c16/analysis/1459520578/; classtype:trojan-activity; sid:38557; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"; flow:to_server,established; urilen:>185,norm; content:".php?d="; fast_pattern:only; http_uri; content:"Accept|3A 20|*/*"; http_header; content:!"User-Agent"; http_header; content:!"Referer"; pcre:"/\.php\x3fd=[A-F0-9]{174}/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a32e9d01e66f68461e410a29e38e147fb8a3d3695f1e55f4cf0d2ad789d5b2d/analysis/1460564508/; classtype:trojan-activity; sid:38588; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.DFSCook variant temporary redirect attempt"; flow:to_client,established; content:"307"; http_stat_code; content:"Temporary Redirect"; http_stat_msg; content:"Set-Cookie|3A 20|DFSCOOK="; fast_pattern:only; content:"Location: "; content:"/api.php?d="; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a32e9d01e66f68461e410a29e38e147fb8a3d3695f1e55f4cf0d2ad789d5b2d/analysis/1460564508/; classtype:trojan-activity; sid:38587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"; flow:to_server,established; urilen:>180,norm; content:"/api.php?d="; fast_pattern:only; http_uri; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|close|0D 0A|"; http_header; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a32e9d01e66f68461e410a29e38e147fb8a3d3695f1e55f4cf0d2ad789d5b2d/analysis/1460564508/; classtype:trojan-activity; sid:38586; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"; flow:to_server,established; urilen:139<>200,norm; content:"/wp-includes.php?d="; fast_pattern:only; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"Connection|3A 20|close|0D 0A|"; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a32e9d01e66f68461e410a29e38e147fb8a3d3695f1e55f4cf0d2ad789d5b2d/analysis/1460564508/; classtype:trojan-activity; sid:38585; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.DFSCook variant JS dropper outbound connection"; flow:to_server,established; content:"/img/script.php?"; fast_pattern:only; content:"Accept|3A 20|*/*|0D 0A|"; http_header; content:"UA-CPU|3A 20|"; http_header; content:!"Referer"; http_header; content:!"Accept-Language"; http_header; pcre:"/\/img\/script\.php\x3f.*\.mov$/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7a32e9d01e66f68461e410a29e38e147fb8a3d3695f1e55f4cf0d2ad789d5b2d/analysis/1460564508/; classtype:trojan-activity; sid:38584; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|0B|"; distance:3; content:"|55 04 07 0C 09|Bujumbura"; content:"|55 04 0A 0C 10|Wiqur Hitin ehf."; distance:6; content:"|55 04 03 0C 11|puppeitursilth.cz"; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/fc25709c4e05dbfbcc6ae0cf8a7c06e80156ae05179203021838259aeda9801a/analysis/1461600547/; classtype:trojan-activity; sid:38621; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|0B|"; distance:3; content:"|55 04 07 0C 0B|Ouagadougou"; content:"|55 04 0A 0C 16|Tiongon Wledb A.M.B.A."; distance:6; content:"|55 04 03 0C 10|ina.themanyag.zm"; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/fc25709c4e05dbfbcc6ae0cf8a7c06e80156ae05179203021838259aeda9801a/analysis/1461600547/; classtype:trojan-activity; sid:38620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wallex variant outbound connection"; flow:to_server,established; content:"php?sn="; nocase; http_uri; content:"&ob=obj_"; distance:0; fast_pattern; nocase; http_uri; content:"User-agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9c40bd71680049814ed521d43c3772a92cbf02e33dce61c9a8f7d31942a624f8/analysis/; classtype:trojan-activity; sid:38613; rev:1;)
# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Godzilla downloader successful base64 binary download"; flow:to_client,established; content:"GODZILLA="; fast_pattern:only; content:"GODZILLA="; http_cookie; metadata:impact_flag red, ruleset community, service http; reference:url,www.virustotal.com/en/file/f597634ff5e2623baff35d99bfdb2aac1725c9f49805b4903c13093c43172cb7/analysis/1461593386; classtype:trojan-activity; sid:38610; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.RockLoader variant outbound connection"; flow:to_server,established; urilen:5; content:"/api/"; fast_pattern:only; http_uri; content:"Content-Type|3A 20|octet-stream"; http_header; content:"Cache-Control|3A 20|no-cache|0D 0A|"; http_header; content:!"User-Agent"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/d3cd3630b5709535f9bfa59c4ec75c8061262985919a43a175ec9d7e15c9419a/analysis/1461598531/; classtype:trojan-activity; sid:38608; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qakbot variant outbound connection"; flow:to_server,established; urilen:30<>35,norm; content:"btst="; http_cookie; content:"snkz="; http_cookie; content:"Accept|3A 20|application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*|0D 0A|"; fast_pattern:only; http_header; content:"Cache-Control|3A 20|no-cache|0D 0A|"; http_header; content:!"Connection"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, ruleset community, service http; reference:url,www.virustotal.com/en/file/1826dba769dad9898acd95d6bd026a0b55d0a093a267b481695494f3ab547088/analysis/1461598351/; classtype:trojan-activity; sid:38607; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qakbot variant network speed test"; flow:to_server,established; content:"/random750x750.jpg?x="; fast_pattern:only; http_uri; content:"&y="; http_uri; content:"Accept|3A 20|application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*|0D 0A|"; http_header; content:"Cache-Control|3A 20|no-cache|0D 0A|"; http_header; content:!"Accept-"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/1826dba769dad9898acd95d6bd026a0b55d0a093a267b481695494f3ab547088/analysis/1461598351/; classtype:trojan-activity; sid:38606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.UP007 variant outbound connection"; flow:to_server,established; urilen:10; content:"/index.asp"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| MSIE 7.0|3B| Windows NT 5.1|3B|)"; http_header; content:"Accept-Language|3A 20|en-us|0D 0A|"; http_header; content:"UP007"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,citizenlab.org/2016/04/between-hong-kong-and-burma/; classtype:trojan-activity; sid:38603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadowndec outbound connection"; flow:to_server,established; content:"BootMemori.jmp"; fast_pattern:only; http_uri; content:"Accept-Encoding|3A 20|gzip, deflate"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b7337ab543cdb3df2b8fb2930dd88ade6f9c70162852bb7a73af0a1b8ad72f2b/analysis/1451936129/; classtype:trojan-activity; sid:38647; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadowndec outbound connection"; flow:to_server,established; content:"ExtrMail.jmp"; fast_pattern:only; http_uri; content:"Accept-Encoding|3A 20|gzip, deflate"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b7337ab543cdb3df2b8fb2930dd88ade6f9c70162852bb7a73af0a1b8ad72f2b/analysis/1451936129/; classtype:trojan-activity; sid:38646; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadowndec outbound connection"; flow:to_server,established; content:"look.jmp"; fast_pattern:only; http_uri; content:"Accept-Encoding|3A 20|gzip, deflate"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b7337ab543cdb3df2b8fb2930dd88ade6f9c70162852bb7a73af0a1b8ad72f2b/analysis/1451936129/; classtype:trojan-activity; sid:38645; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadowndec outbound connection"; flow:to_server,established; content:"Boot.jmp"; fast_pattern:only; http_uri; content:"Accept-Encoding|3A 20|gzip, deflate"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b7337ab543cdb3df2b8fb2930dd88ade6f9c70162852bb7a73af0a1b8ad72f2b/analysis/1451936129/; classtype:trojan-activity; sid:38644; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Jadowndec outbound connection"; flow:to_server,established; content:"Evolution.jmp"; fast_pattern:only; http_uri; content:"Accept-Encoding|3A 20|gzip, deflate"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b7337ab543cdb3df2b8fb2930dd88ade6f9c70162852bb7a73af0a1b8ad72f2b/analysis/1451936129/; classtype:trojan-activity; sid:38643; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GozNym variant outbound connection"; flow:to_server,established; urilen:16<>21; content:"/index.php"; offset:7; http_uri; content:"|3D|"; depth:8; http_client_body; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/\/(?=[a-z0-9]*[0-9])(?=[a-z0-9]*[a-z])[a-z0-9]{5,10}\/index\.php/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/55f9cd6cbed53ccc26d6d570807a18f91d9d8c10db352524df424f356d305a6e/analysis/; classtype:trojan-activity; sid:38638; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Koohipa outbound beacon attempt"; flow:to_server; content:"SNAKE:"; depth:6; content:"B|7C|"; distance:0; content:"|7C|Beta 2.0"; fast_pattern:only; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/a462356722e6b10ad0be72105d7b9381d8a65b1b7563da707deb33cad983899c/analysis/1458243240/; classtype:trojan-activity; sid:38674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"X-Umeng-Sdk:"; http_header; content:"com.android.googleUpdate"; http_header; content:"564a982767e58ea4fa00660c"; depth:24; offset:7; fast_pattern; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ac7d44e34633d75148bc5e3e1f309ab93d16d965bcb80f528a1efd6e602b44c9/analysis/; classtype:trojan-activity; sid:38668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.BBSwift variant outbound connection"; flow:to_server,established; content:"/al?---"; depth:7; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a/analysis/1461910569/; classtype:trojan-activity; sid:38676; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ransom variant outbound connection"; flow:to_server,established; content:"/pass/index.php"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:"Content-Length|3A 20|"; http_header; content:"guid="; http_client_body; content:"|40|aol.com"; http_client_body; pcre:"/\x26guid=[a-f0-9]{8}\-[a-f0-9]{40}/Pi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/85ad1270a7ef2637cdf56f9deeab2a7bb88488be1b19babe7e6372e57a0d7b6d/analysis/; classtype:trojan-activity; sid:38733; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 2012: (msg:"MALWARE-CNC Win.Trojan.VBDos Runtime Detection"; flow:to_server,established; content:"Status|3A| "; depth:8; content:" |2D| Attacks Enabled |7C| "; within:25; distance:1; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/ca64911882c27481ff1b8401adc825248f0984d0f2078af63829bfb031188488/analysis/; classtype:trojan-activity; sid:38732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Renegin outbound GET attempt"; flow:to_server,established; content:"Logger%20Details|3A|%20%0D%0AServer%20Name|3A|%20"; fast_pattern:only; content:"%0D%0AKeylogger%20Enabled|3A|%20"; content:"0D%0AClipboard-Logger%20Enabled|3A|%20"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd/analysis/1462282274/; classtype:trojan-activity; sid:38724; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tooka POST attempt"; flow:to_server,established; content:"di.asp?id"; http_uri; content:"ASPSESSIONIDSSDBBRAC"; http_cookie; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/46267991aa61d0d3991a59fd847b90ce1c211bd3c76ccb3ab36a3c865892c323/analysis/1462218582/; classtype:trojan-activity; sid:38681; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tooka GET attempt"; flow:to_server,established; content:"tp=|0D 0A|Time|3A|"; fast_pattern:only; http_uri; content:"|0A|Agent|3A|"; http_uri; content:"|0D 0A|url|20|"; http_uri; content:"|0D 0A|Next|3A|"; http_uri; content:"|0A|delay|3A|"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/46267991aa61d0d3991a59fd847b90ce1c211bd3c76ccb3ab36a3c865892c323/analysis/1462218582/; classtype:trojan-activity; sid:38680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC CryptXXX initial outbound connection"; flow:to_server,established; content:"|20|"; depth:1; content:"|91 70 00 00 00 00 00 00 00 00 00 00|"; within:12; distance:35; metadata:impact_flag red, policy balanced-ips alert, policy security-ips alert; reference:url,virustotal.com/en/file/0b12584302a5a72f467a08046814593ea505fa397785f1012ab973dd961a6c0e/analysis/; classtype:trojan-activity; sid:38784; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex variant CNC traffic"; flow:to_client,established; file_data; content:"User-agent: Mediapartners-Google"; fast_pattern:only; content:"Disallow: /|0A|"; nocase; content:"Allow: /jsc/c"; within:300; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/87225c142a540789709a69dd3ce55ef9788e75d80e5ef650d02773e18db29c1f/analysis/; classtype:trojan-activity; sid:38917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dridex download attempt"; flow:to_server,established; content:"/system/logs/"; http_uri; content:".exe"; within:100; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/3eb08a5604d693d2d4489dfcde4085c62a5233085b3f4e8042e01a674bae14c2/analysis/; classtype:trojan-activity; sid:38916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.Kirts initial registration"; flow:to_server,established; content:"Subject|3A 20|=?utf-8?B?SGF3a0V5ZSBMb2dnZXIg"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/en/file/f81128f3b9c0347f4ee5946ecf9a95a3d556e8e3a4742d01e5605f862e1d116d/analysis/1462888129/; classtype:trojan-activity; sid:38891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kirts exfiltration attempt"; flow:to_server,established; content:".php?fname=Hawkeye_Keylogger"; fast_pattern:only; http_uri; content:"&data="; http_uri; content:!"User-Agent"; http_header; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f81128f3b9c0347f4ee5946ecf9a95a3d556e8e3a4742d01e5605f862e1d116d/analysis/1462888129/; classtype:trojan-activity; sid:38890; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; urilen:13; content:"/userinfo.php"; fast_pattern:only; content:"Cache-Control|3A 20|no-cache|0D 0A|"; http_header; content:"Content-Type|3A 20|application/x-www-form-urlencoded|0D 0A|"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2d766d57bc549b3ac7b87b604e2103318eaf41b526086ffe0201d5778521c1b6/analysis/1462906540/; classtype:trojan-activity; sid:38888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky JS dropper outbound connection"; flow:to_server,established; content:"/log.php?"; fast_pattern:only; http_uri; content:"UA-CPU"; http_header; content:"Accept|3A 20|*/*"; http_header; content:!"Referer"; http_header; pcre:"/\/log\.php\x3f[a-z]\x3d\d{3}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/11180a0ff4576e0dbbe48d77ed717e72678520516ff13f523cad832d1b9fa9ac/analysis/1462906326/; classtype:trojan-activity; sid:38887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Bayrob variant outbound connection"; flow:to_server,established; dsize:8; content:"|4C 48 42 80 71 C2 A5 DF|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/6b6b91cd104f4a6d32b5187131d9053911607672076e6ed26ed51369e5329cad/analysis/1462889491/; classtype:trojan-activity; sid:38886; rev:2;)
alert udp $HOME_NET any -> $EXTERNAL_NET 6892 (msg:"MALWARE-CNC Win.Trojan.Cerber outbound registration attempt"; flow:to_server; dsize:9; content:"hi0"; fast_pattern:only; pcre:"/hi0[0-9a-f]{6}/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/a5ff5f861bbb1ac7c6fd44f303f735fac01273ce2ae43a8acb683076192fcfcc/analysis/1462465221/; classtype:trojan-activity; sid:38885; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.PassStealer passwords exfiltration attempt"; flow:to_server; file_data; content:"Passwords Recorded On "; fast_pattern; content:"Time of Recording:"; within:20; distance:22; content:"IP Address"; within:12; distance:15; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ftp; reference:url,attack.mitre.org/techniques/T1020; reference:url,virustotal.com/en/file/5780e8408c8d5c84d1fbe5c53eeb77832a6af54fd41fab7f720c89fc10989340/analysis/1463495191/; classtype:trojan-activity; sid:38950; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt variant outbound connection"; flow:to_server,established; content:"Accept: */*, Crypted, Ping, data=%s, POST, INSERTED"; fast_pattern:only; http_header; content:!"Referer|3A|"; http_header; content:"data="; depth:5; http_client_body; isdataat:100,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/362c4acfcf96f5cd923c8c225d1eb968175c57854029154eecd9832e62b1ecf1/analysis/; classtype:trojan-activity; sid:38949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TeslaCrypt variant outbound connection"; flow:to_server,established; content:"Accept: e|0D 0A|"; fast_pattern:only; http_header; content:"data="; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8e997b1e114c3b994eee0fc2435bf8bd5360847f0c9fafc82dea07a1c6f3a5fb/analysis/; classtype:trojan-activity; sid:39040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; urilen:1; content:"GET / HTTP/1.1|0D 0A|Accept: */*|0D 0A|Cookie: "; depth:37; content:"|0D 0A|Connection: Close|0D 0A 0D 0A|"; fast_pattern:only; content:"google.com|0D 0A|"; http_header; content:"|3B 20|MSIE|20|"; http_header; content:!"Accept-Encoding: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9bb57a0b59d97a1d9bc4e08efb041156095b28b9148d26a8c0e143d1ef3077f7/analysis/; classtype:trojan-activity; sid:38995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus config file download"; flow:to_server,established; content:"/config.jpg"; fast_pattern:only; http_uri; content:"Connection: Close"; http_header; content:!"Referer:"; http_header; content:!"Accept-"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/cbd0c9fcbde3627773da3ff2c8dc516e0107a8a12e442768ab2341a3b5142295/analysis/; classtype:trojan-activity; sid:38994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.7ev3n variant outbound connection"; flow:to_server,established; content:"SSTART="; http_uri; content:"CRYPTED_DATA="; distance:0; http_uri; content:"ID="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974/analysis/; reference:url,virustotal.com/file/7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5/analysis/; classtype:trojan-activity; sid:39053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Adialer variant outbound connection"; flow:to_server,established; content:"/perl/invoc_oneway.pl?"; fast_pattern:only; http_uri; content:"nom_exe="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/EF7D19870822E461D218069EDB16EFDD1298A03F268470F0AD99B514823ADD45/analysis/; classtype:trojan-activity; sid:39052; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sinrin initial JS dropper outbound connection"; flow:to_server,established; urilen:<31; content:"Accept|3A 20|*/*|0D 0A|UA-CPU|3A 20|"; fast_pattern:only; http_header; content:"Connection|3A 20|Keep-Alive|0D 0A|"; http_header; content:"Accept-Encoding|3A 20|gzip, deflate|0D 0A|"; http_header; content:!"Referer"; http_header; pcre:"/\/[a-z0-9]{8,10}\x3f[A-Za-z]{7,10}\x3d[A-Za-z]{6,10}/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e0f8b6fd78c724b688f6467baf37f08c5ed198ea1b4224f31f50c8acbad49742/analysis/; classtype:trojan-activity; sid:39064; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qakbot outbound POST attempt"; flow:to_server,established; content:"/odin/si.php?get&"; fast_pattern:only; http_uri; content:"news_slist"; http_uri; content:"comp="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/478132b5c80bd41b8c11e5ed591fdf05d52e316d40f7c4abf4bfd25db2463dff/analysis/1464186685/; classtype:trojan-activity; sid:39063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rofin variant outbound connection"; flow:to_server,established; content:"|2F|?sid="; http_uri; content:"&uv="; within:4; distance:32; http_uri; content:"&tm="; within:4; distance:1; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/E018D0041750C2C333EC538B0903623226AD98670C366E38E988E1BB5A08D237/analysis/; classtype:trojan-activity; sid:39056; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.LuminosityLink RAT variant inbound connection"; flow:to_client,established; content:"=P4CK3T="; depth:32; content:"8_=_8"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/0a6ee066b27f5f8dfeedb8e5f19659e47b70296a49a627e2ce9d3d9456287051/analysis/; classtype:trojan-activity; sid:39107; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.LuminosityLink RAT variant outbound connection"; flow:to_server,established; content:"=P4CK3T="; depth:32; content:"8_=_8"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/0a6ee066b27f5f8dfeedb8e5f19659e47b70296a49a627e2ce9d3d9456287051/analysis/; classtype:trojan-activity; sid:39106; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cript outbound connection"; flow:to_server,established; content:"/receive.php"; http_uri; content:"User-Agent: Microsoft Internet Explorer|0D 0A|"; fast_pattern:only; content:"pcid="; http_client_body; content:"disk="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/085f7a9aecc11759405ed010101d4ce33f08c9dc51716730ed9065fbc2d6f7b0/analysis/1464018911/; classtype:trojan-activity; sid:39086; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cript outbound connection"; flow:to_server,established; content:"/getkey.php"; http_uri; content:"User-Agent: Microsoft Internet Explorer|0D 0A|"; fast_pattern:only; content:"pcid="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/085f7a9aecc11759405ed010101d4ce33f08c9dc51716730ed9065fbc2d6f7b0/analysis/1464018911/; classtype:trojan-activity; sid:39085; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cript outbound connection"; flow:to_server,established; content:"/reg.php"; http_uri; content:"User-Agent: Microsoft Internet Explorer|0D 0A|"; fast_pattern:only; content:"message="; http_client_body; content:"pcid="; http_client_body; content:"buildid="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/085f7a9aecc11759405ed010101d4ce33f08c9dc51716730ed9065fbc2d6f7b0/analysis/1464018911/; classtype:trojan-activity; sid:39084; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant connection setup"; flow:to_server,established; content:"|3B 00 00 00 05|"; depth:5; dsize:<65; metadata:impact_flag red, ruleset community; reference:url,www.virustotal.com/en/file/5db3b9ce06e334cb61279dd936a40be75df6732228bb692a7a84b1299eb09071/analysis/1464362377/; classtype:trojan-activity; sid:39080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Symmi variant outbound connection"; flow:to_server,established; content:"/themes/twentythirteen/stats.php"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:39117; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DMALocker variant outbound connection"; flow:to_server,established; content:"/crypto/gate?"; http_uri; content:"action="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/e3cf8b37af9f19fe6cdf5068d757a57c1fe0d5d3da128e032edb662cceae64cc/analysis/; classtype:trojan-activity; sid:39116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Helminth variant outbound connection"; flow:to_server,established; content:"UIET9fWR"; fast_pattern:only; content:"User-Agent: Mozilla/5.0"; http_header; content:"|20|Trident/5.0|0D 0A|"; within:14; distance:39; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/632be0a3d8d298f2ded928a4ac27846904ed842ad08b355acab53132d31eaf24/analysis/; classtype:trojan-activity; sid:39176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.BlackShades Crypter outbound connection"; flow:to_server,established; content:"insert_data_"; nocase; http_uri; content:"pass="; distance:0; http_uri; content:"pc_name="; depth:8; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/fc2ad7ae3d6d4bd08d77443942ebb7fe219bace7c7beb8e837672da412baca11/analysis/; classtype:trojan-activity; sid:39173; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|59|"; distance:3; content:"|55 04 06 13 02|PW"; content:"|55 04 07 0C 08|Melekeok"; distance:6; content:"|55 04 0A 0C 0E|Merwh Whena NL"; distance:6; content:"|55 04 03 0C 16|pepa634.omeewengreq.mz"; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/6467418eea0564f77c66844e30a17c8561089f2b8301a7d306a71a34e4fef693/analysis/; classtype:trojan-activity; sid:39164; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|59|"; distance:3; content:"|55 04 06 13 02|BN"; content:"|55 04 07 0C 13|Bandar Seri Begawan"; distance:6; content:"|55 04 0A 0C 12|Cowchi Aromep LTD."; distance:6; content:"|55 04 03 0C 17|tsre131.eollaieefi.jprs"; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/6467418eea0564f77c66844e30a17c8561089f2b8301a7d306a71a34e4fef693/analysis/; classtype:trojan-activity; sid:39163; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.JRat inbound self-signed SSL certificate"; flow:to_client,established; content:"|16 03 01|"; content:"|02|"; distance:2; content:"|03 01|"; distance:3; content:"|55 04 06 13 02|US"; content:"|55 04 08 13 0A|California"; distance:6; content:"|55 04 07 13 0E|Redwood Shores"; distance:6; content:"|55 04 0A 13 14|Oracle America, Inc."; distance:6; content:"|55 04 0B 13 13|Code Signing Bureau"; distance:6; content:"|55 04 03 13 14|Oracle America, Inc."; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/9d54565f8fb7cf50df11bf9745f7efd04a49abb03e85a3aafbf9a5b5fcd065c9/analysis/; classtype:trojan-activity; sid:39160; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.JRat inbound self-signed SSL certificate"; flow:to_client,established; content:"|16 03 01|"; content:"|02|"; distance:2; content:"|03 01|"; distance:3; content:"|55 04 06 13 02|FR"; content:"|55 04 0A 13 0C|assylias.Inc"; distance:6; content:"|55 04 03 13 08|assylias"; distance:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,www.virustotal.com/en/file/45e8df88b177cec3972f36284290eab652fb21806ef7e9575be853fb30528f28/analysis/; classtype:trojan-activity; sid:39159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.GozNym variant outbound connection"; flow:to_server,established; content:"/index.php?r=site/js&ref="; fast_pattern:only; http_uri; content:"&rnd="; offset:90; http_uri; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/55f9cd6cbed53ccc26d6d570807a18f91d9d8c10db352524df424f356d305a6e/analysis/; classtype:trojan-activity; sid:39322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FastPOS update request"; flow:to_server,established; content:"/cdosys.php?"; fast_pattern:only; http_uri; content:"update&username="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4542b18e102dea691474d6d4acbc97c80cc14e0949b0c37d9395d4bf1b189306/analysis/; classtype:trojan-activity; sid:39345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FastPOS status update"; flow:to_server,established; content:"/cdosys.php?"; fast_pattern:only; http_uri; content:"statuslog&log="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4542b18e102dea691474d6d4acbc97c80cc14e0949b0c37d9395d4bf1b189306/analysis/; classtype:trojan-activity; sid:39344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FastPOS keylog exfiltration"; flow:to_server,established; content:"/cdosys.php?"; fast_pattern:only; http_uri; content:"key&log=TWND"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/4542b18e102dea691474d6d4acbc97c80cc14e0949b0c37d9395d4bf1b189306/analysis/; classtype:trojan-activity; sid:39343; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FastPOS initial outbound connection"; flow:to_server,established; content:"/cdosys.php?"; fast_pattern:only; http_uri; content:"new&username="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4542b18e102dea691474d6d4acbc97c80cc14e0949b0c37d9395d4bf1b189306/analysis/; classtype:trojan-activity; sid:39342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.FastPOS credit card data exfiltration"; flow:to_server,established; content:"/cdosys.php?"; fast_pattern:only; http_uri; content:"add&log="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,virustotal.com/en/file/4542b18e102dea691474d6d4acbc97c80cc14e0949b0c37d9395d4bf1b189306/analysis/; classtype:trojan-activity; sid:39341; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CryptoRoger outbound POST attempt"; flow:to_server,established; content:"/wp-data.php"; fast_pattern:only; http_uri; content:"pc_id="; http_client_body; content:"ip="; http_client_body; content:"os="; http_client_body; content:"country="; http_client_body; content:"time_start="; http_client_body; content:"work_time="; http_client_body; content:"count="; http_client_body; content:"filesize="; http_client_body; content:"c="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/791f56a48891558c545fc7fc0a18c06aa4704b46bc42892059d2464c2646b785/analysis/1466609832/; classtype:trojan-activity; sid:39327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Lorozoad variant outbound connection"; flow:to_server,established; urilen:>30,norm; content:"/almaciat/"; fast_pattern:only; http_uri; content:".txt"; nocase; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e92aeffc99f1add2e005deff36d29063d18048fea0e5f93dbd69d9deca2c24bc/analysis/; classtype:trojan-activity; sid:39369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"/upload/_dispatch.php"; fast_pattern:only; http_uri; urilen:21; content:"x-requested-with: XMLHttpRequest"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/F438A40ED3531511FB14F8066C5312E012E117FBBFDFFC0D5BC1D8E45B8CDC7F/analysis/; classtype:trojan-activity; sid:39360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.Furtim variant outbound connection"; flow:to_server,established; urilen:7; content:"/22.php"; fast_pattern:only; http_uri; content:"Content-type: "; http_header; content:"Content-length: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/014b10de65ceceab0c9006df266e5e57ae1516091e2e16c94c5dbec07038d9d2/analysis/; classtype:trojan-activity; sid:39430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qbot variant outbound connection"; flow:to_server,established; content:"zwlviewforumogaf.php"; fast_pattern:only; http_uri; content:"Host|3A| a.topgunnphoto.com"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/020356457e95f7607c1941e03294b4c16e23daa402d7e79cfd2ba91b23969480/analysis/1463667519/; classtype:trojan-activity; sid:39411; rev:1;)
alert tcp $HOME_NET any -> $SMTP_SERVERS [25,587] (msg:"MALWARE-CNC Win.Trojan.iSpy variant exfiltration outbound connection"; flow:to_server,established; content:"=0D=0A"; fast_pattern:only; content:"iSpy Keylogger"; content:"=0D=0ABrowser"; content:"=0D=0AWebsite"; within:70; content:"=0D=0AUsername"; within:70; content:"=0D=0APassword"; within:70; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4e902c1c2647e79167262bf948fe41368bab4d3876255eb3d9edb5ae02097b7/analysis/; classtype:trojan-activity; sid:39410; rev:2;)
alert tcp $HOME_NET any -> $SMTP_SERVERS [25,587] (msg:"MALWARE-CNC Win.Trojan.iSpy variant initial outbound connection"; flow:to_server,established; content:"=0D=0A=0D=0A"; fast_pattern:only; content:"iSpy Keylogger"; content:"Computer Information"; content:"Username:"; within:30; content:"Installed"; within:50; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4e902c1c2647e79167262bf948fe41368bab4d3876255eb3d9edb5ae02097b7/analysis/; classtype:trojan-activity; sid:39409; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Renos variant outbound connection"; flow:to_server,established; content:"/1wave.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.0)|0D 0A|"; http_header; content:"data="; depth:5; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ba4ef026d2ed2d35b88c0aa6d2dfebdf88982f914e37f016e322037c9a0874df/analysis/; classtype:trojan-activity; sid:39448; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zcryptor variant outbound connection"; flow:to_server,established; urilen:<124; content:".php?computerid="; fast_pattern:only; http_uri; content:"&private=1"; nocase; http_uri; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8e068d74ea9fc87fe2d5bd0394851e69ce5489ff413d6a2a4952c304c9903f71/analysis/; classtype:trojan-activity; sid:39434; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zcryptor variant outbound connection"; flow:to_server,established; urilen:<124; content:".php?computerid="; fast_pattern:only; http_uri; content:"&public=1"; nocase; http_uri; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8e068d74ea9fc87fe2d5bd0394851e69ce5489ff413d6a2a4952c304c9903f71/analysis/; classtype:trojan-activity; sid:39433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Unlock92 outbound connection"; flow:to_server,established; content:"cgi-bin/addcl.pl?"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e216b2e3ec82ff4d0f1a60fa36bfbb7653b96f9ae6f0a5cdcf90385f5939e705/analysis/1467816074/; classtype:trojan-activity; sid:39465; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NanoBot/Perseus client heartbeat response attempt"; flow:to_server,established; dsize:52; content:"|30 00 00 00 2B FF 4B F4|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/4b16d1e205f198222bd2b2bb8dbd55886a9e2b79de484eec0d8cce5db376d3c8/analysis/; classtype:trojan-activity; sid:39583; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.NanoBot/Perseus server heartbeat request attempt"; flow:to_client,established; dsize:36; content:"|20 00 00 00 2B FF 4B F4|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/4b16d1e205f198222bd2b2bb8dbd55886a9e2b79de484eec0d8cce5db376d3c8/analysis/; classtype:trojan-activity; sid:39582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NanoBot/Perseus initial outbound connection"; flow:to_server,established; dsize:60; content:"|38 00 00 00 F5 13 89 53|"; depth:8; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/4b16d1e205f198222bd2b2bb8dbd55886a9e2b79de484eec0d8cce5db376d3c8/analysis/; classtype:trojan-activity; sid:39581; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:68; content:"|40 00 00 00 FE A5 0D 55 BB 10 A4 09 7A D9 86 FF 6C 81 E6 97 7C 91 BC DA EE 89 08 2A|"; depth:28; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/0a19499dec07ca2ade3aefdf910e13231d63d7a2e238776272b4fffd0ff3a527/analysis/1467727738/; classtype:trojan-activity; sid:39580; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:60; content:"|38 00 00 00 FE A5 0D 55 BB 10 A4 09 7A D9 86 FF 6C 81 E6 97 7C 91 BC DA EE 89 08 2A|"; depth:28; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/0a19499dec07ca2ade3aefdf910e13231d63d7a2e238776272b4fffd0ff3a527/analysis/1467727738/; classtype:trojan-activity; sid:39579; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant inbound connection"; flow:to_client,established; dsize:36; content:"|20 00 00 00 FE A5 0D 55 BB 10 A4 09 7A D9 86 FF 6C 81 E6 97 7C 91 BC DA EE 89 08 2A|"; depth:28; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/0a19499dec07ca2ade3aefdf910e13231d63d7a2e238776272b4fffd0ff3a527/analysis/1467727738/; classtype:trojan-activity; sid:39578; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:12; content:"|08 00 00 00 86 CC 02 89 8F F7 A6 67|"; depth:12; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/0a19499dec07ca2ade3aefdf910e13231d63d7a2e238776272b4fffd0ff3a527/analysis/1467727738/; classtype:trojan-activity; sid:39577; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [9000:] (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:36; content:"|20 00 00 00 AD|"; depth:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/d74fcf6b8f2f1c3a1ed742feb3f323f7826e9fc79a3d642082cee46770a4697a/analysis/1461003042/; classtype:trojan-activity; sid:39576; rev:3;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET [9000:] (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:68; content:"|40 00 00 00|"; depth:4; byte_test:1,>,2,0,relative; content:!"|0A|"; within:1; distance:1; metadata:impact_flag red, ruleset community; reference:url,www.virustotal.com/en/file/d74fcf6b8f2f1c3a1ed742feb3f323f7826e9fc79a3d642082cee46770a4697a/analysis/1461003042/; classtype:trojan-activity; sid:39575; rev:5;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:12; content:"|08 00 00 00 D7 75 FF F7 C7 62 B9 82|"; depth:12; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/d74fcf6b8f2f1c3a1ed742feb3f323f7826e9fc79a3d642082cee46770a4697a/analysis/1461003042/; classtype:trojan-activity; sid:39574; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"; flow:to_server,established; dsize:12; content:"|08 00 00 00 27 C7 CC 6B C2 FD 13 0E|"; depth:12; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/d74fcf6b8f2f1c3a1ed742feb3f323f7826e9fc79a3d642082cee46770a4697a/analysis/1461003042/; classtype:trojan-activity; sid:39573; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mangit initial outbound connection"; flow:to_server,established; file_data; content:"mErro=DATA"; depth:10; fast_pattern; content:"ABERTURA"; within:50; content:"IP"; within:50; content:"Operacional"; within:50; content:"AVs"; within:200; content:"Navegador"; within:75; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/7367a4762e881cd14c9ccd88ebd90b776f2b9d50fd357cf97fa1b74a3490c14f/analysis/1465917801/; classtype:trojan-activity; sid:39653; rev:1;)
alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Kirts variant CNC IRC response attempt"; flow:to_client,established; content:":x.x 332 `|7C|"; fast_pattern:only; content:":x.x 333 `|7C|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/8e972ef147b54da29d8d2185cd1c51c11b4bfc44286cae51f39c22f46400eaff/analysis/1468849475/; classtype:trojan-activity; sid:39650; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Ransomware.Ranscam request.html response"; flow:to_client,established; content:"src=|22|http|3A 2F 2F|crypted.site88.net/contactform.htm"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9541fadfa0c779bcbae5f2567f7b163db9384b7ff6d44f525fea3bb2322534de/analysis/; classtype:trojan-activity; sid:39636; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Zeus variant inbound connection"; flow:to_client,established; content:"attachment|3B|"; http_header; content:"filename="; http_header; content:"/us.xml"; within:20; fast_pattern; http_header; content:"Content-Type|3A 20|application/octet-stream|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/292c12a4c9cf8724c7bfa9ec73e1b703bd51720ea18cd4528e9be516d05b5628/analysis/1468961317/; classtype:trojan-activity; sid:39705; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/images"; depth:17; http_uri; urilen:>150; content:!"Referer:"; http_header; content:!"Accept-Encoding:"; http_header; content:!"Accept:"; http_header; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:"/"; within:25; http_uri; content:".gif"; within:15; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/3374f144acf7e8f555131019284dfff3e8a1659256b6f672f17d306b9110c6d8/analysis/; classtype:trojan-activity; sid:39686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tinba variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"|20 2F|"; distance:0; content:"|2F 20|HTTP|2F|1.0"; within:30; content:"Host|3A 20|"; within:8; distance:2; content:"Content-Length: 157|0D 0A|"; http_header; content:!"User-Agent|3A 20|"; http_header; content:!"Accept|3A 20|"; content:"|00 80 00 00 00|"; depth:5; offset:24; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e4e1e525c171444cbfff0cc6cd841e369fcf23e50df18d8e07b79ea95a30ca2f/analysis/1468532483/; classtype:trojan-activity; sid:39685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Adware.Xiazai outbound connection"; flow:to_server,established; content:"/api.php?id="; fast_pattern:only; http_uri; content:"qid="; http_uri; content:"rand="; distance:0; http_uri; content:"title="; distance:0; http_uri; content:"t="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/E9FFDB0EA3D9CD388C39330065E2E368231E633EADA0AD358BCB3B5D598ED180/analysis/; classtype:trojan-activity; sid:39730; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trans variant outbound connection"; flow:to_server,established; content:"/site/images/banners/casecor21.gif"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a4c1234bb748f9bcabeb9ab990614fd4c1035135c5f5068fd42bace4b75fff0e/analysis/; classtype:trojan-activity; sid:39738; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qarallax initial outbound connection"; flow:to_server,established; content:"/qarallax-lib/bridj/bridj"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0d5785f13649c1ffdcf9d72d3d75ba634dcfe7c4d95ba33c7fb414639992c461/analysis/1470074002/; classtype:trojan-activity; sid:39774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Alfa outbound connection"; flow:to_server,established; urilen:25; content:".ru|0D 0A|"; fast_pattern:only; http_header; content:!"User-Agent|3A|"; http_header; content:!"Accept"; http_header; pcre:"/^\x2f\w{24}$/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/606a9e10404805fd67180adf9bbbf43e74f9c4784ad2d41d825c4e64bfccba85/analysis/; classtype:trojan-activity; sid:39767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 900 (msg:"MALWARE-CNC Win.Trojan.Spyrat variant outbound connection"; flow:to_server,established; content:"myversion|7C|2.5.2."; depth:19; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/e64f536556739d50a673a952da7f110f1156fad0f7360d401794e5a8d65ce63a/analysis/; classtype:trojan-activity; sid:39801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Hancitor variant outbound connection"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; http_uri; content:"GUID="; depth:122; http_client_body; content:"BUILD="; depth:122; http_client_body; content:"INFO="; depth:122; http_client_body; content:"IP="; depth:122; http_client_body; content:"TYPE="; depth:122; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48/analysis/1469201551/; classtype:trojan-activity; sid:39800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Lientchtp variant outbound connection"; flow:to_server,established; content:"/default.aspx?tmp="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/4.0 (Compatible|3B| MSIE 6.0|3B|Windows NT 5.1)|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/fe012c0975c0287e4b164efe2b43dd4602bf40686d1e010ffd1023bc7e397fe2/analysis/; classtype:trojan-activity; sid:39785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.NanHaiShu variant outbound connection"; flow:to_server,established; content:"/common.php"; nocase; http_uri; content:"action=aaa&data="; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/b0de26080a84ba0b15ea3f471fe6be5392efe770c53dbe5c0a8ed439b05731c6/analysis/; classtype:trojan-activity; sid:39861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant executable download"; flow:to_server,established; content:"/limbomail"; http_uri; content:".exe"; within:30; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant executable download"; flow:to_server,established; content:".exe 1.1|0D 0A|User-Agent: "; depth:100; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant connectivity check"; flow:to_server,established; content:"POST"; http_method; urilen:8; content:"/autoit3"; fast_pattern:only; http_uri; content:!"Referer: "; http_header; content:!"Accept"; http_header; content:"Host: www.autoitscript.com|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant connectivity check"; flow:to_server,established; content:"POST"; http_method; urilen:24; content:"/go/flashplayer_support/"; fast_pattern:only; http_uri; content:!"Referer: "; http_header; content:!"Accept"; http_header; content:"Host: www.adobe.com|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant connectivity check"; flow:to_server,established; content:"POST"; http_method; urilen:18; content:"/support/shockwave"; fast_pattern:only; http_uri; content:!"Referer: "; http_header; content:!"Accept"; http_header; content:"Host: www.adobe.com|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sharik variant connectivity check"; flow:to_server,established; content:"POST"; http_method; urilen:18; content:"/support/main.html"; fast_pattern:only; http_uri; content:!"Referer: "; http_header; content:!"Accept"; http_header; content:"Host: www.adobe.com|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/505c34a8a4516586d2b7ecacf4082cf62937fe3ad1b85c713d6126fa603081f2/analysis/; classtype:trojan-activity; sid:39852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vibro outbound connection detected"; flow:to_server,established; content:"/images/karma-autumn/bg-footer-bottom.jpg"; fast_pattern:only; http_uri; content:"ObIpcVG"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/0B06282B4F87F0F32CABF34AABD1003905A077BF701B805F15E8042D864ACEF1/analysis/; classtype:trojan-activity; sid:39882; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Toga variant outbound connection"; flow:to_server,established; content:"/install.php"; fast_pattern:only; http_uri; content:"{|22|installer|22 3A|"; nocase; http_client_body; content:"{|22|action|22 3A|"; within:20; nocase; http_client_body; content:"|22|downloadID|22 3A|"; within:30; nocase; http_client_body; content:"|22|installerVersion|22 3A|"; within:50; nocase; http_client_body; content:"|22|os|22 3A|"; within:20; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/131EC876DE25E767F03DE1DFE228E921F58CF25C8906497F9C37A6E814E3233A/analysis/; classtype:trojan-activity; sid:39887; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Adnel outbound connection detected"; flow:to_server,established; content:"/wlogo.jpg"; fast_pattern:only; http_uri; content:"H6h6="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/AA676D2C92FC96BE5D6C70FF7E1C9CB57164BF6860A4FD71AFC96CF0E97EE7F8/analysis/; classtype:trojan-activity; sid:39909; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.BlackEnergy outbound connection"; flow:to_server,established; content:"POST|20|/getcfg.php"; content:"id=x"; distance:210; content:"build_id="; within:60; metadata:impact_flag red, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/bc062acda428f55782710f9c4f2df88c26dfbc004b94b479459f8572b1219444/analysis/; classtype:trojan-activity; sid:39931; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Neutrino outbound connection"; flow:to_server,established; content:"/getdata.php"; fast_pattern:only; http_uri; content:"clientid="; http_client_body; content:"clienturl="; http_client_body; content:"templatename="; http_client_body; metadata:impact_flag red, policy security-ips drop, service http; classtype:trojan-activity; sid:39921; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Neutrino outbound connection"; flow:to_server,established; content:"/getdata.php"; http_uri; content:"clientid="; http_uri; content:"clienturl="; fast_pattern:only; http_uri; content:"templatename="; http_uri; metadata:impact_flag red, policy security-ips drop, service http; classtype:trojan-activity; sid:39920; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"MALWARE-CNC Win.Trojan.HawkEye keylogger exfiltration attempt"; flow:to_server,established; content:"Subject: HawkEye Keylogger |7C|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/f4499928a6fee5d37fb711ed6d68708bf116cfc7f284d3295dd30ded7ecf64b2/analysis/; classtype:trojan-activity; sid:39911; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Shakti variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/external/update"; fast_pattern:only; http_uri; content:"MSMQ"; depth:4; http_client_body; metadata:impact_flag red, policy balanced-ips drop, service http; reference:url,virustotal.com/en/filed6d64c61dada8b5ccfa970356057a6c2c7697f084922744c5a2e29aff079647b/analysis/; classtype:trojan-activity; sid:40027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Madeba outbound connection detected"; flow:to_server,established; content:"/yISVfed/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:40016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; urilen:14; content:"/data/info.php"; fast_pattern:only; http_uri; content:"x-requested-with: XMLHttpRequest"; http_header; content:"Referer|3A| http|3A|"; http_header; content:"/data"; within:25; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f29ce76169727ff5a43ef7baa5c4e04f7d3302189e3d2a31cfc9dec39e84ad03/analysis/; classtype:trojan-activity; sid:40011; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nemim outbound connection detected"; flow:to_server,established; content:"/bin/read_i.php"; fast_pattern:only; http_uri; content:"a1="; nocase; http_uri; content:"a2="; nocase; http_uri; content:"a3="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5A116B4ABBAC55622C6DA389E6A3F485334DCDDE05AFBB9F2F65C63DE8B55DA1/analysis/; classtype:trojan-activity; sid:40007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Donoff outbound connection detected"; flow:to_server,established; content:"/wp.jpg"; nocase; http_uri; content:"JdTIv="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/D286523C14B40ABC73D2A451843A265E6095500936C57F4AEC362764FE383C13/analysis/; classtype:trojan-activity; sid:39969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Donoff outbound connection detected"; flow:to_server,established; content:"/newera/walkthisland/greenland.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/D286523C14B40ABC73D2A451843A265E6095500936C57F4AEC362764FE383C13/analysis/; classtype:trojan-activity; sid:39968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Folyris outbound connection detected"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; http_uri; content:"a="; nocase; http_client_body; content:"%"; within:5; http_client_body; content:"b="; nocase; http_client_body; content:"c="; nocase; http_client_body; content:"%"; within:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/59BC587065503644E7528C5AD633A01A660C90DAB2C8448CD285DA27BC4F1951/analysis/; classtype:trojan-activity; sid:39958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Fantom post encryption outbound connection"; flow:to_server,established; content:"/falssk/fksgieksi.php"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; content:"username="; depth:500; content:"pcname="; depth:500; content:"aesencrypted="; depth:500; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b/analysis/; classtype:trojan-activity; sid:40045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Fantom post encryption outbound connection"; flow:to_server,established; content:"/users/Gurudrag/folders/Default/media/9289aabe-7b4a-4c7f-b3bb-bdf3407e7a2f/fantom1.jpg"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b/analysis/; classtype:trojan-activity; sid:40044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Fantom outbound connection"; flow:to_server,established; content:"/themes/prestashop/cache/stats.php"; fast_pattern:only; http_uri; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b/analysis/; classtype:trojan-activity; sid:40043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fareit outbound connection"; flow:to_server,established; content:"/nimda.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/682fa75de9a2c11d5bdc9545ebc914af00921c807be5bb86296321bc55e08c86/analysis/1473171128/; classtype:trojan-activity; sid:40067; rev:2;)
# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Morel variant inbound connection"; flow:established, to_client; content:"|C0 00|"; depth:2; content:"|00|"; within:1; distance:1; byte_jump:4,4,relative, post_offset -1; isdataat:!1,relative; metadata:impact_flag red; reference:url,www.virustotal.com/en/file/a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f/analysis/; classtype:trojan-activity; sid:40062; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Morel variant outbound connection"; flow:established, to_server; content:"|C0 00|"; depth:2; content:"|00|"; within:1; distance:1; byte_jump:4,4,relative, post_offset -1; isdataat:!1,relative; metadata:impact_flag red; reference:url,www.virustotal.com/en/file/a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f/analysis/; classtype:trojan-activity; sid:40061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Hadsruda outbound connection detected"; flow:to_server,established; content:"v="; nocase; http_uri; content:"subver="; nocase; http_uri; content:"pcrc="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/46F379E47B19AD658A1B08A83D322AAE8B480A936B4758DBD6A55202DE5D960D/analysis/; classtype:trojan-activity; sid:40060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Hadsruda outbound connection detected"; flow:to_server,established; content:"/KMPlayer/"; fast_pattern:only; http_uri; content:"v="; nocase; http_uri; content:"c="; nocase; http_uri; content:"t="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/46F379E47B19AD658A1B08A83D322AAE8B480A936B4758DBD6A55202DE5D960D/analysis/; classtype:trojan-activity; sid:40059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Ogimant outbound connection detected"; flow:to_server,established; content:"data_files="; fast_pattern:only; http_uri; content:"name="; nocase; http_uri; content:"rnd="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/576e6b9302d4c633133d37b189d4cb0c77f9e10b945ec7ed73c23d830a8a93d9/analysis/; classtype:trojan-activity; sid:40215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Ogimant outbound connection detected"; flow:to_server,established; content:"/aj.get_bin_domain.pl"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/576e6b9302d4c633133d37b189d4cb0c77f9e10b945ec7ed73c23d830a8a93d9/analysis/; classtype:trojan-activity; sid:40214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DarkShell external connection attempt"; flow:to_server,established; content:"/ad1in.htm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7bfdaf8eb794f5180dea83200b3975f230d9b30c13e0f0845ee87be426e3299e/analysis/; classtype:trojan-activity; sid:40213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1395 (msg:"MALWARE-CNC Win.Trojan.Bulta external connection attempt"; flow:to_server,established; content:"/avlove.exe"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6ff1c09d9069e604b8c5b1d6c48aa2a24aa310c30d0b6dd7c1f5e2fb800bc48e/analysis/; classtype:trojan-activity; sid:40209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Comisproc outbound connection detected"; flow:to_server,established; content:"/res/s60.v3.php"; fast_pattern:only; http_uri; content:"ckfub="; http_uri; content:"cid="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/60e95207b932a0574ab673bd2c3eaf39f3befae1d78730d1ce9d8ddc836f3793/analysis/; classtype:trojan-activity; sid:40207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Comisproc outbound connection detected"; flow:to_server,established; content:"/pab.php"; fast_pattern:only; http_uri; content:"b="; http_uri; content:"idf="; http_uri; content:"v="; http_uri; content:"o="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/60e95207b932a0574ab673bd2c3eaf39f3befae1d78730d1ce9d8ddc836f3793/analysis/; classtype:trojan-activity; sid:40206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Comisproc outbound connection detected"; flow:to_server,established; content:"az.php"; fast_pattern:only; http_uri; content:"step="; http_uri; content:"o="; http_uri; content:"id="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/60e95207b932a0574ab673bd2c3eaf39f3befae1d78730d1ce9d8ddc836f3793/analysis/; classtype:trojan-activity; sid:40205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Qiwmonk outbound connection detected"; flow:to_server,established; content:"/youxi/index_1_1.htm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/775c7bd9e820c4dfd0fabdfeade2de901414bd46d2691ea5020a818f6a42eb83/analysis/; classtype:trojan-activity; sid:40204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Drolnux variant outbound connection"; flow:to_server, established; content:"TWFpbE91IEF0IFRoaXMgQ29tcHV0ZXIgTmFtZSA6"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c726d216e9195b7ac0bb73ff57f2e68bba297b4aac868a5d73743ec617e2d8c7/analysis/; classtype:trojan-activity; sid:40203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malex variant outbound connection"; flow:to_server,established; content:"/test/lib/md.sys"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b9d5d42b3c68908d326d278d4c03a932754f3dbea903d1b042b4c9900a2ec7a9/analysis/; classtype:trojan-activity; sid:40183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Injector external connection attempt"; flow:to_server,established; content:"WinHttp.WinHttpRequest.5"; fast_pattern:only; http_header; content:".php?m="; http_uri; content:"h="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/93632d83a1f1f0aaea0ea0b6bf31cf4400cefbfcffb8440c8d906793465fcc70/analysis/; classtype:trojan-activity; sid:40223; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Keylogger.AgentTesla variant outbound connection"; flow:to_server,established; content:"/post.php"; fast_pattern:only; http_uri; content:"type="; nocase; http_client_body; content:"hwid="; nocase; http_client_body; content:"pcname="; nocase; http_client_body; content:"username="; nocase; http_client_body; content:"password="; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/db144f38a8f57940fc80cf0dca3e8f722817aacd769511336424f2ad6f231293/analysis/; reference:url,zscaler.com/blogs/research/agent-tesla-keylogger-delivered-using-cybersquatting; classtype:trojan-activity; sid:40238; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CeeInject external connection"; flow:to_server,established; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Windows NT 5.1|3B| SV1)|0D 0A|"; fast_pattern:only; http_header; content:"Cache-Control|3A| no-cache|0D 0A|"; http_header; content:".htm?"; depth:5; offset:2; http_uri; content:!"="; distance:0; http_uri; pcre:"/^\/[a-z]\.htm\?[a-zA-Z0-9]{16}/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ae3a86a7338acb6e76442ecd40b473659a3be72c829e6f4bf9c8d8b92424aabd/analysis/; classtype:trojan-activity; sid:40232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Perseus variant outbound connection"; flow:to_server,established; content:"mashine="; fast_pattern:only; http_client_body; content:"publickey="; http_client_body; content:"user="; http_client_body; content:"os="; http_client_body; content:"processor="; http_client_body; content:"mac="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/e88709501e6c8923c7c9bf112f7a824f241f86b001dd824eb12a4284778c8137/analysis/; classtype:trojan-activity; sid:40252; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.QuantLoader external connection attempt"; flow:to_server,established; content:"/q/index.php?"; fast_pattern:only; http_uri; content:"id="; http_uri; content:"c="; http_uri; content:"mk="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1e278e78a4261ebd65d2fc9b2d477bb8c19e15a22aea669947b531859cd12216/analysis/; classtype:trojan-activity; sid:40249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpy variant outbound connection"; flow:to_server,established; content:"/panel/insert"; fast_pattern:only; http_uri; content:"key="; nocase; http_client_body; content:"pcname="; nocase; http_client_body; content:"log="; nocase; http_client_body; content:"Username"; nocase; http_client_body; content:"Password"; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/84409422426933e6f1ea227f042ff56d1f6686873454959d2e3308b9f5daac61/analysis/; classtype:trojan-activity; sid:40242; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant backdoor detected"; flow:to_server,established; flowbits:isset,file.macho64le; file_data; content:"ASS7"; content:"|B9 06 0D 22 00 00 00 00 20 14 01 00 20 14 01 00 D0 09 00 00 1D 03 00 00 02 00 00 00 6C 2E B7 FF CF FA ED FE|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/23296f664e9d40be3a20f6bb4e5bb328556e0aa0408fb006725f9db72ae4682c/analysis/; reference:url,www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/; classtype:trojan-activity; sid:40262; rev:3;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant backdoor detected"; flow:to_client,established; flowbits:isset,file.macho64le; file_data; content:"ASS7"; content:"|B9 06 0D 22 00 00 00 00 20 14 01 00 20 14 01 00 D0 09 00 00 1D 03 00 00 02 00 00 00 6C 2E B7 FF CF FA ED FE|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/23296f664e9d40be3a20f6bb4e5bb328556e0aa0408fb006725f9db72ae4682c/analysis/; reference:url,www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/; classtype:trojan-activity; sid:40261; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant initial backdoor download attempt"; flow:to_server,established; content:"/icloudsyncd"; fast_pattern:only; http_uri; content:"Accept|3A 20|*/*"; http_header; content:!"User-Agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.malwarebytes.com/cybercrime/2016/07/mac-malware-osx-keydnap-steals-keychain/; reference:url,www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/; classtype:trojan-activity; sid:40260; rev:2;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant backdoor detected"; flow:to_server,established; flowbits:isset,file.macho64le; file_data; content:"ASS7"; content:"|B9 06 0D 22 00 00 00 00 40 03 01 00 40 03 01 00 D0 09 00 00 22 03 00 00 02 00 00 00 6C 2E B7 FF CF FA ED FE|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/8d2bd504125d815339af52558a38f804048a56a213424378af83fd3c0d4c131c/analysis/; reference:url,www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/; classtype:trojan-activity; sid:40259; rev:3;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant backdoor detected"; flow:to_client,established; flowbits:isset,file.macho64le; file_data; content:"ASS7"; content:"|B9 06 0D 22 00 00 00 00 40 03 01 00 40 03 01 00 D0 09 00 00 22 03 00 00 02 00 00 00 6C 2E B7 FF CF FA ED FE|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/8d2bd504125d815339af52558a38f804048a56a213424378af83fd3c0d4c131c/analysis/; reference:url,www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/; classtype:trojan-activity; sid:40258; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Philadelphia variant status update outbound connection"; flow:to_server,established; content:"s=Encrypting"; fast_pattern:only; http_uri; content:"p=Ping"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-9th-2016-crypy-crylocker-philadelphia-and-more/; reference:url,www.virustotal.com/en/file/160cb44b1bc8fa8780e558f1aed686fed83d47208a9ec5cb9a3fa1b8b57f9988/analysis/; classtype:trojan-activity; sid:40290; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Philadelphia variant initial outbound connection"; flow:to_server,established; content:"User-Agent: AutoIt"; fast_pattern:only; http_header; content:"ucd="; nocase; http_uri; content:"osinfo="; nocase; http_uri; content:"user="; nocase; http_uri; content:"p="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:40289; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poxters external connection"; flow:to_server,established; content:"page="; depth:5; fast_pattern; http_client_body; content:"&opt="; distance:0; http_client_body; content:"&view="; distance:0; http_client_body; content:"&var="; distance:0; http_client_body; content:"&val="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/382b99aec353f9d07eebea4cce588bad18802ec14666d224631f1ceefc69fdfe/analysis/; classtype:trojan-activity; sid:40288; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant dropper detected"; flow:to_server,established; flowbits:isset,file.macho64le; file_data; content:"/tmp/com.apple.icloudsyncd"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,malwarebytes.com/cybercrime/2016/07/mac-malware-osx-keydnap-steals-keychain/; classtype:trojan-activity; sid:40311; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Osx.Trojan.Keydnap variant dropper detected"; flow:to_client,established; flowbits:isset,file.macho64le; file_data; content:"/tmp/com.apple.icloudsyncd"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,malwarebytes.com/cybercrime/2016/07/mac-malware-osx-keydnap-steals-keychain/; classtype:trojan-activity; sid:40310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Randrew variant outbound connection"; flow:to_server, established; content:"/narquad.php?"; fast_pattern:only; http_uri; content:"User-Agent"; nocase; http_header; content:"AutoIt"; within:20; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ddcd92dd52d288035c5f14602e9f655989408b56257169221518b861f262cecf/analysis/; classtype:trojan-activity; sid:40309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Backdoor.MSIL.Kazybot.A botnet server connection attempt"; flow:to_server, established; content:"/kazybot/add.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d2e5d0614b9aded4c4f0398333ec4f90420fbe740d3bd8b56981ef7f73df9658/analysis/; classtype:trojan-activity; sid:40308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sality variant outbound connection"; flow:to_server,established; content:"/plat/appdirgame/images/app_ico/AppID"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c1c7293064d5711fcfde17ff62cf1021c6184f5fb8301a09d1ce2d7fe323c3f4/analysis/; classtype:trojan-activity; sid:40334; rev:2;)
alert udp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"MALWARE-CNC Win.Trojan.Cry variant outbound connection"; flow:to_server,no_stream; content:"|84 A1 76 01 A1 63 C4 14|"; depth:8; detection_filter:track by_src,count 100, seconds 20; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:40340; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cry variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/upload"; http_uri; content:"r9o2uqc7l1m4mje165k24ikvg2"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:40339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bartallex outbound connection detected"; flow:to_server,established; content:"rara.txt"; fast_pattern; http_uri; content:"Mozilla/4.0 (compatible|3B| Win32|3B| WinHttp.WinHttpRequest.5)"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/1ad1da5b93b59267a6ce72d7613ac1c973fd2c416c44d280351373d059e2879d/analysis/; classtype:trojan-activity; sid:40338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Marsjoke variant post infection beacon"; flow:to_server,established; urilen:1; content:"signature="; nocase; http_client_body; content:"ver="; nocase; http_client_body; content:"gcdata="; fast_pattern:only; http_client_body; content:!"User-Agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7e60a0d9e9f6a8ad984439da7b3d7f2e2647b0a14581e642e926d5450fe5c4c6/analysis/; classtype:trojan-activity; sid:40433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Marsjoke variant post infection beacon"; flow:to_server,established; urilen:1; content:"live=1|0D 0A|"; fast_pattern:only; http_client_body; content:!"User-agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7e60a0d9e9f6a8ad984439da7b3d7f2e2647b0a14581e642e926d5450fe5c4c6/analysis/; classtype:trojan-activity; sid:40432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Deshacop variant outbound connection"; flow:to_server,established; content:"/cgi-bin/r_add.pl"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b6c227b53cc592f01a3c3fdae0453afb969066a3fb5490b1dde34457be4da6ca/analysis/; classtype:trojan-activity; sid:40461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Doc.Downloader.Agent file download attempt"; flow:to_server,established; content:"/fr/mso/onedrive"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1102; reference:url,virustotal.com/en/file/e9473e7e548cad4614d0da1231755d4e8350028c115615107f218846645a5dc3/analysis/1476116981/; classtype:trojan-activity; sid:40450; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"/apache_handler.php"; fast_pattern:only; http_uri; content:"x-requested-with: XMLHttpRequest"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/fa53964b04cfbbc41129ff8c3422e5049c863982ed415ddab4567ddd702aae04/analysis/; classtype:trojan-activity; sid:40449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Doc.Dropper.Agent variant outbound connection"; flow:to_server,established; content:"User-Agent"; http_header; content:"WinHttp.WinHttpRequest"; fast_pattern; http_header; content:"/images"; http_uri; content:".php"; within:10; distance:1; http_uri; pcre:"/\x2fimages\d+\x2ephp/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4454bc71e652122a15f86e0750a875b7dc0877adcb471f5b887c8bd23bf978a4/analysis/; classtype:trojan-activity; sid:40445; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Doc.Dropper.Agent variant outbound connection"; flow:to_server,established; content:"User-Agent"; http_header; content:"WinHttp.WinHttpRequest"; fast_pattern; http_header; content:"/apps"; http_uri; content:".php"; within:10; distance:1; http_uri; pcre:"/\x2fapps\d+\x2ephp/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/ccbe08990d7208826196ba927bff8f2952bb7d239abf18c5bb8c0c33671acc0c/analysis/; classtype:trojan-activity; sid:40444; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Hades outbound connection"; flow:established,to_server; content:"hwid="; depth:5; http_client_body; content:"&tracking_id="; distance:0; http_client_body; content:"&usercomputername="; within:22; http_client_body; content:"&ip="; within:83; http_client_body; content:"&country="; within:24; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/068524c96e6643bcd97d61dd8bc1a0c2b229666ab610f688f1ab96ae4a10c02c/analysis/; classtype:trojan-activity; sid:40467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kapahyku variant outbound connection"; flow:to_server,established; content:"program="; nocase; http_uri; content:"tid="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"b_typ="; fast_pattern; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/eeda68acf62e32b232cedd5d51338e899e217a512c8a255cfda3400e106d5b71/analysis/; classtype:trojan-activity; sid:40466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kapahyku variant outbound connection"; flow:to_server,established; content:"p="; nocase; http_uri; content:"tid="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"b_typ="; fast_pattern; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/eeda68acf62e32b232cedd5d51338e899e217a512c8a255cfda3400e106d5b71/analysis/; classtype:trojan-activity; sid:40465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [$HTTP_PORTS,8000] (msg:"MALWARE-CNC Andr.Tool.Snowfox Androidbauts/snowfox outbound connection"; flow:to_server, established; content:"clientmobile:"; fast_pattern:only; nocase; http_header; content:"mobileimsi:"; nocase; http_header; content:"mobileimei:"; nocase; http_header; content:"User-Agent: Apache-HttpClient/UNAVAILABLE"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.anubisnetworks.com/blog/androidbauts-advertising-with-a-bit-more-than-expected; classtype:trojan-activity; sid:40501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [8088,18001,18088] (msg:"MALWARE-CNC Andr.Tool.Snowfox Androidbauts/snowfox outbound connection"; flow:to_server, established; content:"POST"; depth:4; content:"/sdk/api/"; within:60; fast_pattern; content:"Expect: 100-continue"; content:!"User-Agent:"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.anubisnetworks.com/blog/androidbauts-advertising-with-a-bit-more-than-expected; classtype:trojan-activity; sid:40500; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Satana ransomware outbound connection"; flow:to_server,established; content:"/add.php"; fast_pattern:only; http_uri; content:"id="; http_client_body; content:"code="; http_client_body; content:"sdata="; http_client_body; content:"name="; http_client_body; content:"md5="; http_client_body; content:"dlen="; http_client_body; content:!"Connection"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96/analysis/1477327210/; classtype:trojan-activity; sid:40541; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/linuxsucks.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/0fae0d66d3df6cdf8ab777d2df6b7ddc07f917d3d89040947d48d3ef7271b699/analysis/; classtype:trojan-activity; sid:40527; rev:2;)
alert tcp any any -> any 23 (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise echo loader attempt"; flow:to_server,established; content:"echo -"; content:"e"; within:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40523; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET [23,2323,5555,7547] (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise fingerprinting"; flow:to_server,established; content:"/bin/busybox "; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40522; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise download"; flow:to_server,established; content:"arm"; fast_pattern:only; http_uri; content:"Host: "; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"|0A|"; within:5; http_header; pcre:"/[\x2e\x5c\x2f\x2dyx]armv?\d?\w?$/U"; flowbits:set,trojan.mirai; flowbits:noalert; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40521; rev:7;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise download"; flow:to_server,established; content:"sh4"; fast_pattern:only; http_uri; content:"Host: "; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"|0A|"; within:5; http_header; pcre:"/[\x2e\x5c\x2f\x2dyx]sh4$/U"; flowbits:set,trojan.mirai; flowbits:noalert; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40520; rev:6;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise download"; flow:to_server,established; content:"mips"; fast_pattern:only; http_uri; content:"Host: "; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"."; within:4; http_header; content:"|0A|"; within:5; http_header; pcre:"/[\x2e\x5c\x2f\x2dyx]mips$/U"; flowbits:set,trojan.mirai; flowbits:noalert; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40519; rev:6;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC known malicious SSL certificate - Odinaff C&C"; flow:to_client,established; ssl_state:server_hello; content:"|55 04 03 0C 1C|selfsigned.cloudwaysapps.com"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/2503bdaeaa264bfc67b3a3603ee48ddb7b964d6466fac0377885c6649209c098/analysis/1477342434/; classtype:trojan-activity; sid:40567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.iSpy variant outbound connection"; flow:to_server,established; content:"iSpyKelogger"; fast_pattern:only; http_uri; content:"gate="; http_client_body; content:"token="; distance:0; http_client_body; content:"name="; distance:0; http_client_body; content:!"User-Agent"; http_header; content:!"Connection"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/11e611585bfb6ff1f823e3c035ef6cfae39dfe2209e15ed01a8db8b3f9526519/analysis/1477417828/; classtype:trojan-activity; sid:40559; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dexter Banker variant successful installation report attempt"; flow:to_server,established; content:"/LetsGo.php?A="; fast_pattern:only; http_uri; content:"Sytem="; http_uri; content:"qual="; http_uri; content:!"Accept"; http_header; content:!"referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/25657a5b4e65add11d42c59aa854834977ddb3fe969f10efa2fa637b0329b3bb/analysis/1477407128/; classtype:trojan-activity; sid:40551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dexter Banker variant second stage download attempt"; flow:to_server,established; content:"/images/"; fast_pattern:only; http_uri; content:".rar"; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| Synapse)|0D 0A|"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/25657a5b4e65add11d42c59aa854834977ddb3fe969f10efa2fa637b0329b3bb/analysis/1477407128/; classtype:trojan-activity; sid:40550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CryPy ransomware variant outbound connection"; flow:to_server,established; content:"/victim.php?info="; fast_pattern:only; http_uri; content:"&ip="; http_uri; content:"info="; http_uri; content:"User-Agent|3A 20|Python-urllib/"; http_header; content:!"Accept"; http_header; content:!"Connection"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/de6da70478e7f84cd06ace1a0934cc9d5732f35aa20e960dc121fd8cf2388d6e/analysis/1477329470/; classtype:trojan-activity; sid:40549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Redosdru variant outbound connection"; flow:to_server,established; content:"/NetSyst88.dll"; fast_pattern:only; content:"User-Agent: Mozilla/4.0 (compatible)|0D 0A|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/3d83997bbb28d6bf468be27471f5d97bc20631a5c2e8a9e73d635f6bf906f743/analysis/; classtype:trojan-activity; sid:40548; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sality variant outbound connection"; flow:to_server,established; urilen:>18,norm; content:"Cache-Control"; nocase; http_header; content:"no-cache"; within:20; nocase; http_header; content:!"http"; depth:4; nocase; http_uri; content:".jpg?"; fast_pattern; nocase; http_uri; content:"="; within:8; distance:4; http_uri; pcre:"/\.jpg\x3f[a-f0-9]{4,7}\x3d\d{6,8}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/22fc19a6d9e0ef40812d05c357beabfed6f7cb9fe72af826947acb458b911213/analysis/; classtype:trojan-activity; sid:40606; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sality variant outbound connection"; flow:to_server,established; content:"/t_100_v400/"; fast_pattern:only; http_uri; content:"rnd="; nocase; http_uri; content:"User-Agent|3A 20|"; depth:12; http_header; content:!"proxy"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/22fc19a6d9e0ef40812d05c357beabfed6f7cb9fe72af826947acb458b911213/analysis/; classtype:trojan-activity; sid:40605; rev:2;)
alert tcp any any -> any 23 (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise activity"; flow:to_server,established; content:"wget"; fast_pattern:only; content:"curl"; nocase; content:"tftp"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40601; rev:1;)
alert tcp any any -> any 23 (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise echo loader attempt"; flow:to_server,established; content:"|5C|177|5C|105|5C|114|5C|106"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40600; rev:1;)
alert tcp any any -> any 23 (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise echo loader attempt"; flow:to_server,established; content:"|5C|x7F|5C|x45|5C|x4C|5C|x46"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Berbew variant outbound connection"; flow:to_server,established; content:"/index.php"; nocase; http_uri; content:"vvpupkin0="; fast_pattern:only; nocase; http_client_body; content:"vvpupkin1="; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5d613287da418539b8bcb65e03ed9510d044d0a8ebf50d9716784b5836005df0/analysis/; classtype:trojan-activity; sid:40596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise download attempt"; flow:to_server,established; content:"/bins/mirai"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:40612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant download attempt"; flow:to_server,established; content:"/img/temp/head.png?pr="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f7cada38c0dfcda63c506298972d3a96723d7983266100ee087b5bf486c5480c/analysis/1477669084/; classtype:trojan-activity; sid:40611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Komplex outbound connection"; flow:to_server, established; content:"User-Agent: kextd (unknown version)"; fast_pattern; http_header; content:"CFNetwork/"; within:20; http_header; content:"Darwin/"; within:20; http_header; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/227b7fe495ad9951aebf0aae3c317c1ac526cdd255953f111341b0b11be3bbc5/analysis/; classtype:trojan-activity; sid:40710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.Komplex outbound connection"; flow:to_server, established; content:"User-Agent: kextd (unknown version)"; fast_pattern; http_header; content:"CFNetwork/"; within:20; http_header; content:"Darwin/"; within:20; http_header; content:"POST"; http_method; pcre:"/(\/[0-9a-z]{1,6}){1,5}\/[0-9a-z]{1,7}(\.zip|\.xml|\.htm|\.pdf)\/\?[0-9a-z]{1,3}=[0-9a-z\/+]*=?=?/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/227b7fe495ad9951aebf0aae3c317c1ac526cdd255953f111341b0b11be3bbc5/analysis/; classtype:trojan-activity; sid:40709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Autoit-73 configuration file download attempt"; flow:to_server, established; content:"/setting.xls"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/31ce41f68808d96898652641ed5ab4ec408d289db4dc1065238b48aa3c151937/analysis/; classtype:trojan-activity; sid:40752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Autoit-73 configuration file download attempt"; flow:to_server, established; content:"/setting.doc"; fast_pattern:only; http_uri; content:"Cache-Control: no-cache"; http_header; content:!"User-Agent:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/31ce41f68808d96898652641ed5ab4ec408d289db4dc1065238b48aa3c151937/analysis/; classtype:trojan-activity; sid:40751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banker variant outbound connection"; flow:to_server,established; content:"point.php"; nocase; content:"GENERAL="; nocase; http_client_body; content:"VERSAO="; nocase; http_client_body; content:"NAVEGADOR="; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7629176ec200138dc19d7fc04954d1a1563070f7549522bc25f0f46508971ea0/analysis/; classtype:trojan-activity; sid:40775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Miuref variant outbound connection"; flow:to_server,established; content:"/7dphr-support/"; fast_pattern:only; http_uri; content:"ref="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/fb0db4bcf2ea296937f9eb2dbbd3fa433b3200703a6b74336c3a99f15bf4d406/analysis/; classtype:trojan-activity; sid:40771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Android.Trojan.SpyNote RAT variant getContacts command response"; flow:to_server,established; content:"send|7C|G|7C 7C|Cont|7C|acts|7C|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/14eb51b26fa4932fc660daf7e803600bf29a8a46fe3f1d652194bc48e9617bd9/analysis/1478720273/; classtype:trojan-activity; sid:40764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Android.Trojan.SpyNote RAT variant getSMS command response"; flow:to_server,established; content:"|7C|ge|7C|t|7C|SM|7C|S|7C|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/14eb51b26fa4932fc660daf7e803600bf29a8a46fe3f1d652194bc48e9617bd9/analysis/1478720273/; classtype:trojan-activity; sid:40763; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Android.Trojan.SpyNote RAT variant inbound connection"; flow:to_client,established; content:"Server Prent |0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/14eb51b26fa4932fc660daf7e803600bf29a8a46fe3f1d652194bc48e9617bd9/analysis/1478720273/; classtype:trojan-activity; sid:40762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 12421 (msg:"MALWARE-CNC Win.Trojan.Syscan outbound connection"; flow:to_server,established; content:"POST /manual_result"; depth:19; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/31833c4b179c4e4de44932c57debfb6562bb6e833d9fd1415fee6411aacea45b/analysis/; classtype:trojan-activity; sid:40761; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Nesxlh variant outbound connection"; flow:to_server,established; content:"/personLog.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/cb98cc92d68aee3c216c9e183189dc7803b0d182883ddaa71d21a6fe2e1de8ac/analysis/; classtype:trojan-activity; sid:40797; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Nesxlh variant outbound connection"; flow:to_server,established; content:"/personSettings.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/cb98cc92d68aee3c216c9e183189dc7803b0d182883ddaa71d21a6fe2e1de8ac/analysis/; classtype:trojan-activity; sid:40796; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Nesxlh variant outbound connection"; flow:to_server,established; content:"/commonSettings2.txt"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/cb98cc92d68aee3c216c9e183189dc7803b0d182883ddaa71d21a6fe2e1de8ac/analysis/; classtype:trojan-activity; sid:40795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Rtf.Trojan.Mauris outbound download attempt"; flow:to_server,established; content:"/hf.db"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/f0c53400fd601f197a96b07edc77b70363985ca8f25fb83615d3496032f1eb2c/analysis/1479309350/; classtype:trojan-activity; sid:40812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [15963,1114,9999,80,81,1177,1100] (msg:"MALWARE-CNC Logbro variant outbound connection"; flow:to_server,established; content:"AW|5C|WORM/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/4caea86e8e2a5ae89c114a3d6cd58ea9e2f1d6000f4ddf1e9de6bec490bed3b1/analysis/; classtype:trojan-activity; sid:40824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gendwndrop variant outbound connection"; flow:to_server,established; content:"r=site/GCE"; fast_pattern:only; http_uri; content:"|2F 2F|"; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2cee41404ca3a8be608cda9343a4c772259ed20fd25af01f35e281f734f896d4/analysis/; classtype:trojan-activity; sid:40823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; urilen:12; content:"/message.php"; fast_pattern:only; http_uri; content:"x-requested-with|3A 20|XMLHttpRequest|0D 0A|"; http_header; content:"Referer|3A 20|"; http_header; content:"Accept|3A 20|*/*|0D 0A|Accept-Language|3A 20|en-us|0D 0A|"; http_header; content:"Cache-Control|3A 20|no-cache|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ab082d6047fb73b9de7ebc59fb12fa1f8c2d547949d4add3b7a573d48172889b/analysis/1479147777/; classtype:trojan-activity; sid:40816; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant file enumeration inbound init/root/faf command attempt"; flow:to_client,established; dsize:23; content:"file_manager_"; depth:13; offset:4; pcre:"/file_manager_(init|root|faf)\x0d\x0a/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:40836; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant screen_thumb inbound init command attempt"; flow:to_client,established; content:"screen_thumb|0D 0A|"; depth:14; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:40835; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant screenshot inbound silence command attempt"; flow:to_client; dsize:24; content:"silence_screenshot|0D 0A|"; depth:20; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:40834; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant screenshot inbound init command attempt"; flow:to_client; content:"screenshot_init|0D 0A|"; depth:17; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:40833; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant keylogger inbound init command attempt"; flow:to_client,established; dsize:23; content:"silence_keylogger|0D 0A|"; depth:19; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,attack.mitre.org/techniques/T1056; classtype:trojan-activity; sid:40832; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Houdini variant initial outbound connection"; flow:to_server,established; content:"new_houdini|0D 0A|"; depth:13; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:40831; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.Disttrack variant outbound connection"; flow:to_server,established; content:"/category/page.php"; http_uri; content:"shinu="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842/analysis/; classtype:trojan-activity; sid:40906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Rootkit.Sednit variant outbound connection"; flow:to_server,established; urilen:11; content:"/search.php"; fast_pattern:only; http_uri; content:"as_ft="; http_client_body; content:"as_q="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1014; reference:url,virustotal.com/en/file/471fbdc52b501dfe6275a32f89a8a6b02a2aa9a0e70937f5de610b4185334668/analysis/1480953133/; classtype:trojan-activity; sid:40911; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; urilen:16; content:"POST"; http_method; content:"/information.cgi"; depth:16; fast_pattern; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:40910; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 31337 (msg:"MALWARE-CNC Linux.DDoS.D93 outbound connection"; flow:to_server; content:"|4E 0F 42 07 27|"; depth:5; dsize:25; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/2c017c94d9f40cba9a20e92c7c636e98de15c599bf004fa06508d701ab9e3068/analysis/; classtype:trojan-activity; sid:40991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sality variant outbound connection"; flow:to_server,established; content:"/images/image.gif"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|"; depth:12; http_header; content:!"proxy"; nocase; http_header; content:!"Accept"; nocase; http_header; content:!"Via"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/22fc19a6d9e0ef40812d05c357beabfed6f7cb9fe72af826947acb458b911213/analysis/; classtype:trojan-activity; sid:41034; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Proteus outbound connection"; flow:to_server,established; content:"/api/register"; fast_pattern:only; http_uri; content:"{|22|m|22|:|22 5C 5C|"; depth:8; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d23b4a30f6b1f083ce86ef9d8ff434056865f6973f12cb075647d013906f51a2/analysis/; classtype:trojan-activity; sid:41033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Athena variant outbound connection"; flow:to_server,established; content:"User-Agent: Go-http-client"; fast_pattern:only; http_header; content:"/cmd/"; depth:5; http_uri; pcre:"/^\x2Fcmd\x2F[\-a-zA-Z0-9_+]{650,}={0,3}/U"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/af385c983832273390bb8e72a9617e89becff2809a24a3c76646544375f21d14/analysis/; classtype:trojan-activity; sid:41031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ostap out bound communication attempt"; flow:to_server,established; content:"/ostap.php"; fast_pattern:only; http_uri; content:"/ostap.php"; depth:20; offset:2; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:41089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MrWhite out bound communication attempt"; flow:to_server,established; content:"/GOLD/bender.php"; http_uri; content:"User-Agent: Mr.White|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:41088; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Agent variant compromise download attempt"; flow:to_server,established; file_data; content:"|36 36 30 32 64 30 32 30 65 39 61 62 34 31 31 36 62 65 38 31 33 63 32 32 37 37 38 34 64 61 30 38|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/7dac01e818bd5a01fe75c3324f6250e3f51977111d7b4a94e41307bf463f122e/analysis/; classtype:trojan-activity; sid:41136; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Agent variant compromise download attempt"; flow:to_client,established; content:"|36 36 30 32 64 30 32 30 65 39 61 62 34 31 31 36 62 65 38 31 33 63 32 32 37 37 38 34 64 61 30 38|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7dac01e818bd5a01fe75c3324f6250e3f51977111d7b4a94e41307bf463f122e/analysis/; classtype:trojan-activity; sid:41135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent variant compromise download attempt"; flow:to_server,established; content:"/eFax/37486.ZIP"; fast_pattern:only; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7dac01e818bd5a01fe75c3324f6250e3f51977111d7b4a94e41307bf463f122e/analysis/; classtype:trojan-activity; sid:41134; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Agent variant compromise download attempt"; flow:to_client,established; file_data; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant post compromise download attempt"; flow:to_server,established; content:"/port/login.asp"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant post compromise download attempt"; flow:to_server,established; content:"/network/outlook.asp"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/port/jp/gate/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41178; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/network/port10/gate/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41177; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/exchange/port10/gate/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41176; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/exchange/owalogon.asp"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41175; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/config/install/gate/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41174; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.August variant outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/catalog/core/gate/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e/analysis/; classtype:trojan-activity; sid:41173; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Js.Trojan.Nemucod variant "; flow:to_client,established; file_data; content:") {return WScript["; fast_pattern; content:"(|22|13"; within:10; distance:5; content:"22"; within:2; distance:1; content:"35"; within:2; distance:1; content:"31"; within:2; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/1baae89b483f02681a6d7f26d00f01f90ef12129ee29b6e7d9709ed3e3969435/analysis/; classtype:trojan-activity; sid:41162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DragonOK variant outbound connection"; flow:to_server,established; content:"/mus/Sen"; http_uri; content:".asp"; distance:0; nocase; http_uri; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DragonOK variant outbound connection"; flow:to_server,established; content:"/index.php"; fast_pattern:only; http_uri; content:"type="; nocase; http_uri; content:"id="; nocase; http_uri; content:"pageinfo="; nocase; http_uri; content:"lang="; nocase; http_uri; content:"User-Agent: "; depth:12; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DragonOK variant outbound connection"; flow:to_server,established; content:"/news/Sen"; http_uri; content:".asp"; distance:0; nocase; http_uri; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Sysch variant outbound connection"; flow:to_server,established; content:"GZIPOK|3A 20|"; fast_pattern:only; http_header; content:"CompGZ|3A 20|"; http_header; content:"ReqType|3A 20|"; http_header; content:".do"; http_uri; content:!"Accept"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/5a0bb7bba9153801fa88ef1bedfad564d95d2d61a23de8cb87af8b589207277f/analysis/1484684079/; reference:url,virustotal.com/en/file/82da35ab3b0a47fe8de8b0cc24d53711e17960f5887a16769e76650d9556b399/analysis/1484684069/; classtype:trojan-activity; sid:41337; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Sysch variant outbound connection"; flow:to_server,established; content:"time|3A 20|"; fast_pattern:only; http_header; content:"User-Agent|3A 20|HttpEngine"; http_header; content:".do"; http_uri; pcre:"/\.(do|jar)$/Umi"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/5a0bb7bba9153801fa88ef1bedfad564d95d2d61a23de8cb87af8b589207277f/analysis/1484684079/; reference:url,virustotal.com/en/file/82da35ab3b0a47fe8de8b0cc24d53711e17960f5887a16769e76650d9556b399/analysis/1484684069/; classtype:trojan-activity; sid:41336; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; urilen:12; content:"/checkupdate"; fast_pattern:only; http_uri; content:"x-requested-with|3A 20|"; http_header; content:"Referer"; http_header; content:"="; depth:15; http_client_body; content:"%"; within:2; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/b9cf176ddb51fa60c7512cdbafc5a598929ac3d0b3d0443a80a7f33259aa70f2/analysis/1484673198/; classtype:trojan-activity; sid:41335; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky variant outbound connection"; flow:to_server,established; content:"/admin.php?f="; fast_pattern:only; http_uri; content:"UA-CPU|3A 20|"; http_header; content:"MSIE 7.0|3B|"; http_header; content:"Accept|3A 20|*/*"; http_header; content:!"Accept-Language"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/b9cf176ddb51fa60c7512cdbafc5a598929ac3d0b3d0443a80a7f33259aa70f2/analysis/1484673198/; classtype:trojan-activity; sid:41334; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Scudy outbound connection"; flow:to_server,established; content:"/online.php?c="; fast_pattern:only; http_uri; content:"&u="; offset:15; http_uri; content:"&p="; distance:1; http_uri; content:"&hi="; distance:1; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/f3f7de201ce8dde02ebd33f4eb83a5e7404808f669a7f15a0b6b3cedab878188/analysis; classtype:trojan-activity; sid:41331; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"; flow:to_server,established; content:"|01 00 00 00 81|"; depth:5; dsize:5; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/6f179a4dc1c0393b6f2dac5aaa9c20b120ced4e82ba257bb45e693472c56a88b/analysis/1484683135/; classtype:trojan-activity; sid:41376; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant check logs"; flow:to_server,established; content:"|38 00 00 00 85|"; depth:5; dsize:<80; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/6f179a4dc1c0393b6f2dac5aaa9c20b120ced4e82ba257bb45e693472c56a88b/analysis/1484683135/; classtype:trojan-activity; sid:41375; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant registration message"; flow:to_server,established; content:"|41 00 00 00 83|"; depth:5; dsize:<80; metadata:impact_flag red, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/6f179a4dc1c0393b6f2dac5aaa9c20b120ced4e82ba257bb45e693472c56a88b/analysis/1484683135/; classtype:trojan-activity; sid:41374; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Locky payload download - result"; flow:to_client,established; file_data; content:"Li7KnnQThYEQbX57IV4Zt2yMbO6Htv5FLi7KnnQThYEQbX57IV4Zt2yMbO6Htv5FLi7KnnQThYEQbX57IV4Zt2yMbO6Htv5FLi7KnnQThYEQbX57IV4Zt2yMbO6Htv5F"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/eb38955990abcaaa3d2b248ffb28157c87f8adf7585c1f9d197487c094aea429/analysis/; classtype:trojan-activity; sid:41478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vibrio file download - 4g3vg334"; flow:to_server,established; content:"/4g3vg334"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/62ce8b7b4f5f5cbc285657fec9958c3395290897a210faa3afdc753babe79f60/analysis; classtype:trojan-activity; sid:41477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky payload download - 987t67g"; flow:to_server,established; content:"/987t67g"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/488270c6262c0ac8510d7152b49510e3a48029a6fc8644d16dcdf39bfb2a3884/analysis/; classtype:trojan-activity; sid:41476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Keylogger.Elite variant outbound connection"; flow:to_server,established; content:"/Mac/getInstallerSpecs/"; fast_pattern:only; http_uri; content:"channel="; nocase; http_uri; content:"info="; nocase; http_uri; content:"enc-info="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41461; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Keylogger.Elite variant outbound connection"; flow:to_server,established; content:"/Mac/getInstallScript/"; fast_pattern:only; http_uri; content:"clickid="; nocase; http_uri; content:"software="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41460; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Keylogger.Elite variant outbound connection"; flow:to_server,established; content:"/tracking/cm_mac.php"; fast_pattern:only; http_uri; content:"clickid="; nocase; http_uri; content:"funnel="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41459; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Keylogger.Elite variant outbound connection"; flow:to_server,established; content:"/read-mip.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/e23cae7189d6ca9c649afc22c638a45fd94f19ef6b585963164cca52c7b80f9b/analysis/; classtype:trojan-activity; sid:41458; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Swf.Tool.Agent flash file in a word document uploading system capabilities"; flow:to_server,established; content:"PT=ActiveX"; fast_pattern:only; http_uri; content:!"Referer|3A 20|"; http_header; content:!"Cookie|3A 20|"; http_header; content:"x-flash-version|3A 20|"; http_header; content:"ACC="; http_uri; content:"DEB="; http_uri; content:"OS="; http_uri; content:"PR32="; http_uri; metadata:impact_flag red, service http; reference:url,malware.prevenity.com/2017/01/ataki-na-instytucje-rzadowe-grudzien.html; reference:url,www.virustotal.com/en/file/ffd5bd7548ab35c97841c31cf83ad2ea5ec02c741560317fc9602a49ce36a763/analysis/; classtype:trojan-activity; sid:41452; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.X-Mas variant keylogger outbound connection"; flow:to_server,established; content:"/gate.php?"; fast_pattern:only; http_uri; content:"|3C|br|3E 3C|br|3E 3C|b|3E 3C|big|3E 3C|font color=|22|"; http_client_body; content:"|22 3E 20 5B|"; within:12; http_client_body; content:!"Accept-"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/b49d2b3c6978584408f3c668863cc88e892bd333a9db9c3de14964d59fc3298f/analysis/1484847208/; classtype:trojan-activity; sid:41444; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.X-Mas variant keylogger outbound connection"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; http_uri; content:"163="; http_client_body; content:"&x="; distance:0; http_client_body; content:"&z="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/b49d2b3c6978584408f3c668863cc88e892bd333a9db9c3de14964d59fc3298f/analysis/1484847208/; classtype:trojan-activity; sid:41443; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Ransomware.X-Mas outbound connection"; flow:to_server,established; content:"WebKitFormBoundary"; content:"|20|form-data|3B 20|name=|22|uid|22|"; fast_pattern; content:"|20|form-data|3B 20|name=|22|uname|22|"; distance:0; content:"|20|form-data|3B 20|name=|22|cname|22|"; distance:0; content:"|20|form-data|3B 20|name=|22|ltime|22|"; distance:0; content:"|20|form-data|3B 20|name=|22|uright|22|"; distance:0; content:"|20|form-data|3B 20|name=|22|sysinfo|22|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/2aa91ed4e591da10499708bde44b1f9d0000eaee9a81018cb0f36bd44844df7a/analysis/1484847335/; reference:url,virustotal.com/en/file/83a2b429b969fc5cd38b6c5072391c3513b3b914f54ea80e245b243dbd5377be/analysis/1484847306/; classtype:trojan-activity; sid:41442; rev:2;)
alert tcp $EXTERNAL_NET 6667 -> $HOME_NET any (msg:"MALWARE-CNC Dos.Tool.LOIC variant IRC command detected"; flow:established,to_client; content:"!lazor"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service irc; reference:url,github.com/NewEraCracker/LOIC; classtype:trojan-activity; sid:41439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oilrig variant outbound connection"; flow:to_server,established; content:"/index.aspx?id="; fast_pattern:only; http_uri; content:"/index.aspx?id="; depth:15; http_raw_uri; content:"%5Cb"; within:14; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/40182c3b3c556f89a997a88af72292840a8527fb51beee03edde674cd7abcdd4/analysis/; classtype:trojan-activity; sid:41438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oilrig variant outbound connection"; flow:to_server,established; content:"/index.aspx?id="; fast_pattern:only; http_uri; content:"/index.aspx?id="; depth:15; http_raw_uri; content:"%5Cu"; within:14; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/40182c3b3c556f89a997a88af72292840a8527fb51beee03edde674cd7abcdd4/analysis/; classtype:trojan-activity; sid:41437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oilrig variant outbound connection"; flow:to_server,established; content:"/index.aspx?id="; fast_pattern:only; http_uri; content:"/index.aspx?id="; depth:15; http_raw_uri; content:"%5Cd"; within:14; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/40182c3b3c556f89a997a88af72292840a8527fb51beee03edde674cd7abcdd4/analysis/; classtype:trojan-activity; sid:41436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oilrig variant outbound connection"; flow:to_server,established; content:"User-Agent: Microsoft BITS/7.7"; fast_pattern:only; http_header; content:"Referer: https://www.google.com"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,www.virustotal.com/en/file/a367ccb9ca5a958d012e94ae8122feda9a1a7f23a0c84e2bc5ee35c834900b61/analysis/; classtype:trojan-activity; sid:41435; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oilrig variant outbound connection"; flow:to_server,established; content:"/update-index.aspx?req="; depth:23; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8cb80ac1f955bac9ccf67e843ddc15322b4aa70e8c98269a8a98a02df4cbd8b7/analysis/; classtype:trojan-activity; sid:41434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cerber outbound connection"; flow:to_server, established; content:"Referer: file://C:|5C|"; nocase; http_header; content:".hta|0D 0A|"; distance:1; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1170; reference:url,www.virustotal.com/file/a6b00feeecee72f12843885a76919bc6049c644bcb63c0dce5ba4492443cd90c/analysis/; classtype:trojan-activity; sid:41424; rev:5;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Ransomware.CryptoLocker binary download response attempt"; flow:to_client,established; content:"Set-Cookie|3A 20|mediaplanBAK|3D|"; fast_pattern:only; content:"Set-Cookie|3A 20|mediaplan|3D|"; content:"Content-Type|3A 20|text/plain"; http_header; file_data; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; within:4; distance:-64; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/571a7014d1ee4e359e7eb5d2c7b3e6c527f4fcef322781f1c56a1b5bf28c8eb2/analysis/1485884599/; classtype:trojan-activity; sid:41498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.Disttrack variant outbound connection"; flow:to_server,established; urilen:14; content:"/sam/index.php"; fast_pattern:only; http_uri; content:!"Accept: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/dbdea08e7b970d395236b8e0aada6fc07fb23e6181485d86f65da1e73ab2ba2e/analysis/; classtype:trojan-activity; sid:41540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MagicHound variant outbound connection"; flow:to_server,established; content:"/WebService.asmx"; nocase; http_uri; content:"SOAPAction|3A|"; nocase; http_header; content:"SetLog2"; distance:0; nocase; http_header; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; urilen:<60; content:"_put.jpg"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; pcre:"/\x2F[0-9A-F]{8,10}_put\.jpg$/Uim"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; content:"/news2/news_dir/index.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; content:"/images/banners/temp/index.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; content:"/bbs/data/image/work/webproxy.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; content:"/admin/data/bbs/review2/board/index.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Malear variant outbound connection"; flow:to_server,established; content:"/admin/data/bbs/review2/board/123.php"; fast_pattern:only; http_uri; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/281828d6f5bd377f91c6283c34896d0483b08ac2167d34e981fbea871893c919/analysis/; classtype:trojan-activity; sid:41682; rev:1;)
alert tcp $EXTERNAL_NET [4431,4432,4433] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"; flow:to_client,established; content:"|55 04 08 0C 0E|Ckeidet airop"; fast_pattern:only; content:"|55 04 03 0C 1E|huraroparmqus.bivess7hanare.si"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/103a9e26e8d69cbbde4e871dd6cb1b0ee863a8265746aa7d77cd1106025c2d7c/analysis/; classtype:trojan-activity; sid:41676; rev:1;)
alert tcp $EXTERNAL_NET [4431,4432,4433] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"; flow:to_client,established; content:"|55 04 08 0C 0F|Mamsugt mantyn11"; fast_pattern:only; content:"|55 04 03 0C 1B|Dyingerecer.pedrdfinteek.tr0"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/103a9e26e8d69cbbde4e871dd6cb1b0ee863a8265746aa7d77cd1106025c2d7c/analysis/; classtype:trojan-activity; sid:41675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"MALWARE-CNC Win.Trojan.Mirai variant outbound connection"; flow:to_server,established; urilen:8; content:"/ups.rar"; http_uri; content:!"Referer|3A 20|"; http_header; content:!"Cookie|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,vms.drweb.com/virus/?_is=1&i=14934685; reference:url,www.virustotal.com/en/file/4856706c088f66965d714fe09af22ee56d84483278582ff3dd8f98bc3c5862ab/; classtype:trojan-activity; sid:41665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Downloader.MacDownloader variant outbound connection"; flow:to_server,established; urilen:14; content:"/Servermac.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7/analysis/; classtype:trojan-activity; sid:41663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Downloader.MacDownloader variant outbound connection"; flow:to_server,established; content:"SKeychain.zip"; fast_pattern:only; http_uri; content:"p1="; http_uri; content:"filename="; http_uri; content:"data="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7/analysis/; classtype:trojan-activity; sid:41662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Downloader.MacDownloader variant outbound connection"; flow:to_server,established; content:"SKeychain.zip"; fast_pattern:only; http_client_body; content:"p1="; http_client_body; content:"filename="; http_client_body; content:"data="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7/analysis/; classtype:trojan-activity; sid:41661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Houdini backdoor file download request"; flow:to_server,established; content:"/ChromeSetup.bat"; fast_pattern:only; http_uri; content:"User-Agent|3A| Microsoft BITS"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,virustotal.com/en/file/8d75e47c04bb2cc0f4c2e973475d4ff1fc8f32039794e3ea5ca2494c66d80d3f/analysis/; classtype:trojan-activity; sid:41712; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Houdini variant initial outbound connection"; flow:to_server,established; content:"new_slave|0D 0A|"; depth:11; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,virustotal.com/en/file/8d75e47c04bb2cc0f4c2e973475d4ff1fc8f32039794e3ea5ca2494c66d80d3f/analysis/; classtype:trojan-activity; sid:41711; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Adware.Winwrapper outbound connection"; flow:to_server,established; content:"/advplatform/api.cgi?"; fast_pattern:only; nocase; http_uri; content:"act="; nocase; http_uri; content:"&appid"; distance:0; nocase; http_uri; content:"&pnid"; distance:0; nocase; http_uri; content:"&proto"; distance:0; nocase; http_uri; content:"WinWrapper"; nocase; http_header; metadata:impact_flag red, policy security-ips drop, service http; reference:url,virustotal.com/en/file/77b9f24a454183f76364e1d3312b5801042e55423e372f9600cfc4096eb50a4e/analysis/; classtype:trojan-activity; sid:41702; rev:1;)
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.PowerMacro DNS query response"; flow:to_client; byte_test:1,&,0x80,2; content:"|00 01 00 01 00 00 00 00|"; depth:8; offset:4; content:"|00 10 00 01 00 00 00 01|"; distance:0; content:"|7C|"; within:1; distance:4; content:"|7C|"; within:1; distance:1; content:"|7C|"; within:1; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/49e50e340bf9853d39d8b4d626530b234abfb15e620a39cf3d76ef844d5f540a/analysis/; classtype:trojan-activity; sid:41789; rev:1;)
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.PowerMacro DNS query response"; flow:to_client; byte_test:1,&,0x80,2; content:"|00 01 00 01 00 00 00 00|"; depth:8; offset:4; content:"|00 10 00 01 00 00 00 01|"; distance:0; byte_test:2,>,200,0,relative; content:"@"; within:1; distance:3; pcre:"/\x00\x10\x00\x01\x00\x00\x00\x01.{3}\x40[a-z0-9\x2b\x2f]+\x40$/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/49e50e340bf9853d39d8b4d626530b234abfb15e620a39cf3d76ef844d5f540a/analysis/; classtype:trojan-activity; sid:41788; rev:1;)
alert tcp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.PowerMacro TCP DNS query response"; flow:to_client,established; byte_test:1,&,0x80,4; content:"|00 01 00 01 00 00 00 00|"; depth:8; offset:6; content:"|00 10 00 01 00 00 00|"; distance:0; byte_test:2,>,200,1,relative; content:"|24|e|3D 27|"; within:4; distance:4; fast_pattern; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/49e50e340bf9853d39d8b4d626530b234abfb15e620a39cf3d76ef844d5f540a/analysis/; classtype:trojan-activity; sid:41787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ratankba variant outbound connection"; flow:to_server,established; content:"/View.jsp"; fast_pattern:only; http_uri; content:"action="; nocase; http_uri; content:"u="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7c77ec259162872bf9ab18f6754e0e844157b31b32b4a746484f444b9f9a3836/analysis/; classtype:trojan-activity; sid:41780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/pilot/api"; fast_pattern:only; http_uri; content:"User-Agent|3A| Apache-HttpClient"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42031; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant file download attempt"; flow:to_server,established; content:"/file/"; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:"Accept-Encoding|3A| identity"; http_header; content:"HTTP/1.0"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42030; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant file download attempt"; flow:to_server,established; content:"/admin201506/uploadApkFile"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant file download attempt"; flow:to_server,established; content:"/elfdown/"; depth:9; http_uri; urilen:>23,norm; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/root/put"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42027; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/sm/sr/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42026; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/gcview/api"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42025; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/qmsg/api"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42024; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/pmsg/api"; fast_pattern:only; http_uri; content:"User-Agent|3A| Apache-HttpClient"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42023; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 18080 (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"User-Agent|3A| HTTP GET/1.0"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42022; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Agent variant outbound connection"; flow:to_server,established; content:"/wroot/v3"; fast_pattern:only; http_uri; content:".do"; http_uri; content:"uuid="; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/a3a849ef491a40c0fc1cb4c5e4769447da27ca02552a5fd270b9c2b8dbc0ff70/analysis/; classtype:trojan-activity; sid:42021; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Sage variant outbound connection"; flow:to_server,established; content:"Host: mbfce24rgn65bx3g."; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/c1c31129a39441607c060a7da57855d3969cf47ce4119cda9beaf65b63faca60/analysis/; classtype:trojan-activity; sid:42059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Downeks variant initial outbound connection"; flow:to_server,established; content:"sGryWZwgElaAor9PesTf2xVTd0LWfDx6"; fast_pattern:only; http_client_body; content:"Content-Length|3A| 728"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9a8d73cb7069832b9523c55224ae4153ea529ecc50392fef59da5b5d1db1c740/analysis/; classtype:trojan-activity; sid:42083; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Jenxcus outbound POST request attempt"; flow:to_server,established; content:"User-Agent:"; depth:200; nocase; content:"POST /im-azerty HTTP/1.1"; depth:30; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/DF7A4ED22BE71C4C2C993413E90FC5C9734672B3D3D8938B8A31E89A26D92305/analysis/; classtype:trojan-activity; sid:42081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Jenxcus outbound connection with unique User-Agent"; flow:to_server,established; content:"User-Agent:"; depth:200; nocase; content:"<|7C|>"; within:30; distance:1; content:"<|7C|>false - "; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/DF7A4ED22BE71C4C2C993413E90FC5C9734672B3D3D8938B8A31E89A26D92305/analysis/; classtype:trojan-activity; sid:42080; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Jenxcus outbound connection with unique User-Agent"; flow:to_server,established; content:"User-Agent:"; depth:200; nocase; content:"<|7C|>"; within:30; distance:1; content:"<|7C|>true - "; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/DF7A4ED22BE71C4C2C993413E90FC5C9734672B3D3D8938B8A31E89A26D92305/analysis/; classtype:trojan-activity; sid:42079; rev:2;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Winpud encoded payload download attempt"; flow:to_server,established; file_data; content:"sfrayHOwwTJJldvrSHHJCMQTtviXQh7AoqTA0n0wduhTROgrvdomW40F1cejuz75G"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/7b726bff91d41da540b37b9f706643b4249baa9a27d4c12f0122f69615344160/analysis/; reference:url,virustotal.com/en/file/a9758e120f0f7703743e006b9e2d3dcf7f50d8c6d34bbbb0dab6bcd6ae7568e3/analysis/; classtype:trojan-activity; sid:42099; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Winpud encoded payload download attempt"; flow:to_client,established; file_data; content:"sfrayHOwwTJJldvrSHHJCMQTtviXQh7AoqTA0n0wduhTROgrvdomW40F1cejuz75G"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/7b726bff91d41da540b37b9f706643b4249baa9a27d4c12f0122f69615344160/analysis/; reference:url,virustotal.com/en/file/a9758e120f0f7703743e006b9e2d3dcf7f50d8c6d34bbbb0dab6bcd6ae7568e3/analysis/; classtype:trojan-activity; sid:42098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [23,2323,5555,7547] (msg:"MALWARE-CNC Unix.Trojan.Mirai variant new bot registered"; flow:to_server,established; stream_size:client,=,5; content:"|00 00 00 01|"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:42114; rev:1;)
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"MALWARE-CNC Unix.Trojan.Mirai variant post compromise download"; flow:to_client,established; flowbits:isset,trojan.mirai; file_data; content:"|7F|ELF"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/22b45a675883c392e3ef271c53ec875a0a69e393a391f7aff6ff2d6809cd035f/analysis/; classtype:trojan-activity; sid:42113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Acronym variant outbound connection"; flow:to_server,established; content:"/acr/update.php"; fast_pattern:only; http_uri; urilen:15; content:"="; depth:1; offset:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4a91289e99d3597f4c9e54a3d1d311dfb66aa92fd476463834e4d1f8df651762/analysis/; classtype:trojan-activity; sid:42126; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ismdoor variant outbound connection"; flow:to_server,established; content:"commandId="; fast_pattern:only; http_uri; content:"/Home/"; depth:6; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.vectranetworks.com/blog/an-analysis-of-the-shamoon-2-malware-attack; classtype:trojan-activity; sid:42129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ismdoor variant outbound connection"; flow:to_server,established; content:"User-Agent|3A| WinHttpClient"; fast_pattern:only; http_header; content:"//Home/"; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.vectranetworks.com/blog/an-analysis-of-the-shamoon-2-malware-attack; classtype:trojan-activity; sid:42128; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Downloader.Agent variant certificate negotiation"; flow:to_client,established; content:"|55 04 0A 0C 03|Dis"; fast_pattern:only; content:"|55 04 08 0C 06|Denial1"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/fda3ed4522d98aee5b2bfed624c7a27a27dfa5eaf501673c6b0087b5994a5609/analysis/; classtype:trojan-activity; sid:42172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Agent variant outbound connection"; flow:to_server,established; content:"?showforum="; fast_pattern:only; http_uri; content:"/file/"; depth:6; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/fda3ed4522d98aee5b2bfed624c7a27a27dfa5eaf501673c6b0087b5994a5609/analysis/; classtype:trojan-activity; sid:42171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dimnie outbound connection"; flow:to_server,established; content:"Host: toolbarqueries.google.com"; fast_pattern:only; http_header; content:"User-Agent: Opera/9.80 (Windows NT 6.1|3B| WOW64) Presto/2.12.388 Version/12.15"; http_header; content:"Accept-Language: ru-RU,ru|3B|q=0.9,en|3B|q=0.8"; http_header; content:"ch="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/7d8ec31d9d98802e9b1ebc49c4b300fa901934b3d2d602fa36cc5d7c5d24b3bc/analysis/; classtype:trojan-activity; sid:42243; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Dimnie file download attempt"; flow:to_server,established; content:"/wp-content/margin2601_onechat_word.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6b9af3290723f081e090cd29113c8755696dca88f06d072dd75bf5560ca9408e/analysis/; classtype:trojan-activity; sid:42242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 799 (msg:"MALWARE-CNC Win.Trojan.Mikcer variant outbound connection"; flow:to_server,established; content:"/cj"; depth:3; offset:4; content:"/k1.rar HTTP/1.1|0D 0A|"; within:19; fast_pattern; content:!"Referer|3A|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b72f47440e43b5c468c04e4d54a95a66c541b33df7a8d745689eb01ae0754583/analysis/; classtype:trojan-activity; sid:42233; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DocumentCrypt variant outbound connection"; flow:to_server,established; content:"/supersubs.php"; fast_pattern:only; http_uri; content:"guid="; http_client_body; content:"ver="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e6591a9389c7b82d59949b8c5660e773b86dff1fa3909f780cb8c88bbc85646c/analysis/; classtype:trojan-activity; sid:42228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [995,80,53,443] (msg:"MALWARE-CNC Win.Trojan.RedLeaves outbound connection"; flow:established,to_server; dsize:12; content:"|7A 8D 9B DC|"; depth:4; offset:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Red%20Leaves%20technical%20note%20v1.0.pdf; classtype:trojan-activity; sid:42225; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kuaibu outbound file download attempt"; flow:to_server,established; content:"/iniuser/"; fast_pattern:only; http_uri; content:".ini"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/005dce6a8cec1d41513239517f1fae32bf2dbaba6bf6b4b8149c0510a889bf2e/analysis; reference:url,virustotal.com/en/file/2935d99dafcbb49851c6737d9723a34c8bcaeca6e8697a1d816055ab6e1421f2/analysis; classtype:trojan-activity; sid:42303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kuaibu outbound connection"; flow:to_server,established; content:"/server/server.txt"; fast_pattern:only; http_uri; urilen:18; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/005dce6a8cec1d41513239517f1fae32bf2dbaba6bf6b4b8149c0510a889bf2e/analysis; reference:url,virustotal.com/en/file/2935d99dafcbb49851c6737d9723a34c8bcaeca6e8697a1d816055ab6e1421f2/analysis; classtype:trojan-activity; sid:42302; rev:2;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Kuaibu inbound server configuration response"; flow:to_client,established; file_data; content:"|0A|kuaibu"; content:"|3D|"; within:2; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/005dce6a8cec1d41513239517f1fae32bf2dbaba6bf6b4b8149c0510a889bf2e/analysis; reference:url,virustotal.com/en/file/2935d99dafcbb49851c6737d9723a34c8bcaeca6e8697a1d816055ab6e1421f2/analysis; classtype:trojan-activity; sid:42301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.QQPass variant outbound connection"; flow:to_server,established; urilen:21; content:"Accept-Language|3A 20|zh-cn|0D 0A|"; fast_pattern:only; http_header; content:".png"; http_uri; content:"Referer: "; http_header; content:".png|0D 0A|"; within:50; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/167de5d0edcbfb54a65deed0dc9059088e45a6009d74afe2a6df33c4d7c9a73e/analysis/; classtype:trojan-activity; sid:42348; rev:2;)
alert tcp any any -> $HOME_NET 445 (msg:"MALWARE-CNC Win.Trojan.Doublepulsar variant ping command"; flow:to_server,established; content:"|FF|SMB|32 00 00 00 00|"; depth:9; offset:4; content:"|41 00|"; within:2; distance:21; content:"|0E 00 0D 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; within:17; distance:29; flowbits:set,smb.trans2.mid65; flowbits:noalert; metadata:policy max-detect-ips alert, ruleset community, service netbios-ssn; reference:url,countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/; reference:url,www.virustotal.com/file/15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13/analysis/; classtype:trojan-activity; sid:42332; rev:6;)
alert tcp any any -> $HOME_NET 445 (msg:"MALWARE-CNC Win.Trojan.Doublepulsar variant process injection command"; flow:to_server,established; content:"|FF|SMB|32 00 00 00 00|"; depth:9; offset:4; content:"|42 00|"; within:2; distance:21; content:"|0E 00|"; within:2; distance:29; content:!"|00 00|"; within:2; flowbits:set,smb.trans2.mid66; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips alert, policy security-ips drop, ruleset community, service netbios-ssn; reference:url,attack.mitre.org/techniques/T1055; reference:url,countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/; reference:url,www.virustotal.com/file/15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13/analysis/; classtype:trojan-activity; sid:42331; rev:4;)
alert tcp $HOME_NET 445 -> any any (msg:"MALWARE-CNC Win.Trojan.Doublepulsar variant successful injection response"; flow:to_client,established; flowbits:isset,smb.trans2.mid66; content:"|FF|SMB|32 02 00 00 C0|"; depth:9; offset:4; content:"|52 00 00 00 00|"; within:5; distance:21; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service netbios-ssn; reference:url,countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/; reference:url,www.virustotal.com/file/15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13/analysis/; classtype:trojan-activity; sid:42330; rev:1;)
alert tcp $HOME_NET 445 -> any any (msg:"MALWARE-CNC Win.Trojan.Doublepulsar variant successful ping response"; flow:to_client,established; flowbits:isset,smb.trans2.mid65; content:"|FF|SMB|32 02 00 00 C0|"; depth:9; offset:4; content:"|51 00 00 00 00|"; within:5; distance:21; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service netbios-ssn; reference:url,countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/; reference:url,www.virustotal.com/file/15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13/analysis/; classtype:trojan-activity; sid:42329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [995,80,53,443] (msg:"MALWARE-CNC Win.Trojan.RedLeaves outbound connection"; flow:to_server,established; content:"856"; depth:3; offset:1; content:"856|9A F3 EC 89|"; within:7; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Red%20Leaves%20technical%20note%20v1.0.pdf; classtype:trojan-activity; sid:42398; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Oddjob outbound connection"; flow:to_server,established; urilen:80<>120; content:"HEAD"; http_method; content:"User-Agent: Microsoft BITS"; fast_pattern:only; http_header; content:"Accept-Encoding: identity"; nocase; http_header; pcre:"/\x2f[A-Z0-9\x3d\x2d\x2b\x2e\x20]{80,120}\x20/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,virustotal.com/en/file/7c5bf83dfbd95b4d469cb54f292354d8f4f6b28bd77538b5876d1915c6542a1b/analysis/; classtype:trojan-activity; sid:42395; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Moarider variant outbound connection"; flow:to_server,established; urilen:7; content:"/aa.txt"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f9a5b18e4da82b462e2f5243423506b176cff9849a79805b0853085bce4fcb7a/analysis/; classtype:trojan-activity; sid:42391; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Moarider variant outbound connection"; flow:to_server,established; content:"/aa.txt"; fast_pattern:only; http_uri; content:"/glp?"; http_uri; content:"rw="; http_uri; content:"rh="; http_uri; content:"ww="; http_uri; content:"wh="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f9a5b18e4da82b462e2f5243423506b176cff9849a79805b0853085bce4fcb7a/analysis/; classtype:trojan-activity; sid:42390; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 799 (msg:"MALWARE-CNC Win.Trojan.Mikcer variant outbound connection"; flow:to_server,established; content:"|0D 0A|Host|3A| ddos."; fast_pattern:only; content:!"Referer|3A|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/b72f47440e43b5c468c04e4d54a95a66c541b33df7a8d745689eb01ae0754583/analysis/; classtype:trojan-activity; sid:42386; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [53,$HTTP_PORTS] (msg:"MALWARE-CNC Win.Trojan.Moonwind outbound connection"; flow:to_server; content:"EMSG"; depth:4; nocase; content:" $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.ChChes set cookie tag inbound connection"; flow:to_client,established; content:"Set-Cookie|3A| tag="; fast_pattern:only; pcre:"/Set-Cookie\x3A\x20tag\x3D[a-f0-9]{16}\r\n/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2c71eb5c781daa43047fa6e3d85d51a061aa1dfa41feb338e0d4139a6dfd6910/analysis/; classtype:trojan-activity; sid:42425; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Cerber variant inbound connection attempt"; flow:to_client,established; content:"Content-Type|3A 20|application/vnd.ms-excel"; fast_pattern:only; http_header; file_data; content:"MZ|90 00|"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,isc.sans.edu/forums/diary/Blank+Slate+malspam+still+pushing+Cerber+ransomware/22215/; classtype:trojan-activity; sid:42421; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Frethog variant inbound connection attempt"; flow:to_client,established; file_data; content:"|5B|ParentProcess|5D|"; fast_pattern:only; content:"|5B|VIPBlack|5D|"; content:"|5B|SafeUrl|5D|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e09a8c28c426b894fcff5c1102570fa6a5cfdbce5d9202f6322262fe8143ab6b/analysis/; classtype:trojan-activity; sid:42453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Frethog variant outbound connection"; flow:to_server,established; urilen:10; content:"lock2.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/e09a8c28c426b894fcff5c1102570fa6a5cfdbce5d9202f6322262fe8143ab6b/analysis/; classtype:trojan-activity; sid:42452; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Batlopma variant outbound connection"; flow:to_server,established; content:"User-Agent: InetURL:/1.0|0D 0A|"; fast_pattern:only; http_header; content:"/notify.php"; nocase; http_uri; content:"Cache-Control: no-cache|0D 0A 0D 0A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/63dc515aa44a48a31191b8f905b40ce8883bc864d4784a0bf84edf102ddffaf3/analysis/; classtype:trojan-activity; sid:42447; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Axespec outbound request"; flow:to_server,established; content:"Content-Length: 94"; fast_pattern:only; http_header; content:!"User-Agent"; http_header; content:"s|00|v|00|c|00|h|00|o|00|s|00|t|00|.|00|e|00|x|00|e"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/28246917120592354D179C217E2B2DDA4756A6D9E9D62128F91FE2F5121F4509/analysis/; reference:url,virustotal.com/en/file/2DAB230CFD0F57D6C2CB2ECF1EBFD3C065D0C36F07F1EA60E56066844BB742F4/analysis/; classtype:trojan-activity; sid:42439; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Chopper web shell connection"; flow:to_server,established; content:"X-Forwarded-For"; http_header; content:"=Ev al "; http_client_body; content:"If+IsNumeric"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1100; reference:url,www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html; classtype:trojan-activity; sid:42837; rev:3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Chopper web shell connection"; flow:to_server,established; content:"=@eval(get_magic_quotes_gpc()?stripslashes($_POST["; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1100; reference:url,www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html; classtype:trojan-activity; sid:42836; rev:3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Chopper web shell connection"; flow:to_server,established; content:"X-Forwarded-For"; nocase; http_header; content:"=edoced_46esab"; fast_pattern:only; http_client_body; content:"z0="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1100; reference:url,www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html; classtype:trojan-activity; sid:42835; rev:3;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Chopper web shell connection"; flow:to_server,established; content:"X-Forwarded-For"; nocase; http_header; content:"z9=base64%5fdecode"; fast_pattern:only; http_client_body; content:"=%40eval"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1100; reference:url,www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html; classtype:trojan-activity; sid:42834; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Kasperagent outbound connection detected"; flow:to_server,established; content:"devd="; http_client_body; content:"&acc="; within:200; http_client_body; content:"&filenam="; within:50; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/a52d3e65fe5bbf57bab79b1c5092b66d9650247249b72f667a927f266d09efe6/analysis/; classtype:trojan-activity; sid:42833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Jaff ransomware outbound connection"; flow:to_server,established; urilen:7; content:"/77g643"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:42899; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/cheditor/cheditor.php"; fast_pattern:only; http_uri; content:"topic"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/71e55fd93bdba0cf2e348b83cea2cd3d44f7d29924abeab77e7599bcd8999dee/analysis/; classtype:trojan-activity; sid:42895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; urilen:>175; content:"/images/"; depth:20; fast_pattern; http_uri; content:"_2B"; http_uri; content:!"Accept|3A|"; http_header; content:!"Referer|3A|"; http_header; pcre:"/\x2Fimages\x2F[0-9a-zA-Z_\x2F]*?\x2E(avi|bmp|gif)/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d137ee63561a123edc51a1d23ce74a18ee094a872b0b9151606934ad12701c05/analysis/; classtype:trojan-activity; sid:42894; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Linux.Trojan.SpikeA outbound connection"; flow:to_server,established; content:"INFO"; depth:4; nocase; content:"|25 7C|"; within:7; distance:1; content:"Mbps"; within:10; distance:2; nocase; isdataat:!1,relative; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/7940252cc9dfd627c63663f0e9613235ec261b2f55c6a248b9d0b9c4677f2800/analysis/; classtype:trojan-activity; sid:42892; rev:2;)
alert tcp $HOME_NET any <> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC WashingTon ssl certificate negotiation attempt"; flow:to_server,established; content:"WashingTon"; fast_pattern:only; content:"WebMaster@Microsoft.com"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MadMax implant outbound connection"; flow:established,to_server; content:"/logon.aspx?Id="; fast_pattern:only; http_uri; content:"Cookie|3A 20|SessionData="; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42884; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MadMax implant outbound connection attempt"; flow:established,to_server; content:"/mm.jpg"; depth:7; fast_pattern; http_uri; content:"User-Agent|3A 20|Mozilla/5.0 (compatible"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42883; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC ZoxPNG initial outbound connection"; flow:established, to_server; content:"/search?q=Google&go=&qs=n&form="; fast_pattern:only; http_uri; content:"pq=google&sc=8-1&sp=-1&sk="; http_uri; content:"Cookie|3A 20|SESSIONID="; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42882; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Deputy Dog implant outbound connection"; flow:to_server,established; content:"/JP-ja/js?"; fast_pattern:only; http_uri; content:"SessionID:"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42881; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Deputy Dog implant outbound connection"; flow:established,to_server; content:"Connect.php?id="; fast_pattern:only; http_uri; content:"SessionID:"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:42880; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Niramdat variant initial outbound connection"; flow:established,to_server; content:"/tmp/gw.php"; fast_pattern:only; http_uri; content:"e=1&c="; depth:6; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/dbd135d59328d9c31fe1151668180c2b90ba4653e3739045db800f8850e150c6/analysis/; classtype:trojan-activity; sid:42929; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Js.Keylogger.Scanbox outbound connection"; flow:to_server,established; content:"/file/i/d.php?"; fast_pattern:only; http_uri; content:"=="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/cec9564a7d6308a06b629618c800255f9b92c7055c7a6f854d93ddcf379a849f/analysis/; classtype:trojan-activity; sid:42926; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Js.Keylogger.Scanbox outbound connection"; flow:to_server,established; content:"/file/i/recv.php"; fast_pattern:only; http_uri; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1056; reference:url,virustotal.com/en/file/cec9564a7d6308a06b629618c800255f9b92c7055c7a6f854d93ddcf379a849f/analysis/; classtype:trojan-activity; sid:42925; rev:3;)
# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Linux.Trojan.Backdoor inbound connection attempt"; flow:to_server,established; dsize:6; content:"|B5 A4 6F CE 21 66|"; fast_pattern:only; metadata:impact_flag red; reference:url,www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2014/october/analysis-of-the-linux-backdoor-used-in-freenode-irc-network-compromise/; classtype:trojan-activity; sid:43754; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.BlackEnergy outbound connection"; flow:to_server,established; content:"/stat.php"; fast_pattern:only; content:"id="; nocase; content:"&build_id="; within:50; nocase; pcre:"/id=x[0-9a-z]*?_[0-9a-z]*?&build_id=[0-9]{4}/i"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/bc062acda428f55782710f9c4f2df88c26dfbc004b94b479459f8572b1219444/analysis/; classtype:trojan-activity; sid:43597; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Android.Trojan.DroidKungFu outbound connection"; flow:to_server,established; content:"/ad/nadp.php"; fast_pattern:only; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/93bc7cae3dc7ecafb01a9d136a7d24e280673f7dde1b30f545e1fe2646e8a66c/analysis/; classtype:trojan-activity; sid:43578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win32.Trojan.NeutrinoPOS connection attempt"; flow:established,to_server; content:"POST"; http_method; content:"/newfiz29/logout.php"; http_uri; content:"auth=bc00595440e801f8a5d2a2ad13b9791b"; http_cookie; content:"|5F 77 76 3D 5A 57 35 30 5A 58 49 3D|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/433dade02cd1f41baaa5fff548c1ddce997735f90d8edeab7a7b03b028dc1836/analysis/; classtype:trojan-activity; sid:43575; rev:1;)
# alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Deltasource variant outbound connection detected"; flow:to_server; content:"|61 63 3E 48 0C 63 42 51 36 35 4A 29 40 03 00 6F 23 44 39 34 4A 39 52 73 2E 77 5C 77 40 78 2F 24 4C 7F 64 06 24 2B 01 09 31 22 61 44 40 62|"; fast_pattern:only; metadata:impact_flag red; reference:url,virustotal.com/en/file/2de77eb026e19a592590c3fde6599884d739a8f160ab4d2d78d14e993deda2aa/analysis/; classtype:trojan-activity; sid:43527; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Deltasource variant outbound connection detected"; flow:to_server,established; content:"|61 63 3E 48 0C 63 42 51 36 35 4A 29 40 03 00 6F 23 44 39 34 4A 39 52 73 2E 77 5C 77 40 78 2F 24 4C 7F 64 06 24 2B 01 09 31 22 61 44 40 62|"; fast_pattern:only; metadata:impact_flag red; reference:url,virustotal.com/en/file/2de77eb026e19a592590c3fde6599884d739a8f160ab4d2d78d14e993deda2aa/analysis/; classtype:trojan-activity; sid:43526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Donvibs variant outbound connection"; flow:to_server,established; content:"compatible|3B| MSIE 6.5|3B| Windows NT 5.5"; fast_pattern:only; http_header; urilen:5<>10; content:"Accept: */*|0D 0A|"; http_header; content:!"Referer|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/0A6D9E6BBBDAA4536DA8B1D83CEC607ED5EC4CBD4E95F8B9BCFA2A1FF24A929D/analysis/; classtype:trojan-activity; sid:43524; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Donvibs variant outbound connection"; flow:to_server,established; content:"WinHttp.WinHttpRequest.5"; fast_pattern:only; http_header; urilen:6<>10; content:"GET"; http_method; content:"Accept: */*|0D 0A|User-Agent:"; http_header; content:!"Referer|3A|"; http_header; content:!"Via|3A|"; http_header; content:!"Content-Type|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/0A6D9E6BBBDAA4536DA8B1D83CEC607ED5EC4CBD4E95F8B9BCFA2A1FF24A929D/analysis/; classtype:trojan-activity; sid:43523; rev:4;)
# alert tcp $EXTERNAL_NET 31 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.AgentInfo variant outbound connection"; flow:to_client,established; content:"AgentInfo 002 Beta 8."; fast_pattern:only; metadata:service http; classtype:trojan-activity; sid:43478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Agent ransomware downloader outbound connection detected"; flow:to_server,established; urilen:<19; content:"/read.php?f="; fast_pattern:only; http_uri; pcre:"/f=(\d{1,3}|\d\.(jpg|dat|exe))$/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4b6536616daaede6291ac779951e3bcc1819c75c0bc77704e0219ab0245aca19/analysis/; classtype:trojan-activity; sid:43477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Agent ransomware downloader outbound connection detected"; flow:to_server,established; urilen:<19; content:"/admin.php?f="; fast_pattern:only; http_uri; pcre:"/f=(\d{1,3}|\d\.(jpg|dat|exe))$/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f2841ad7f1b870222ea46b00e1cef07f828af189c15ce270d8a2ec58c86ce8e7/analysis/; classtype:trojan-activity; sid:43476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Agent ransomware downloader outbound connection detected"; flow:to_server,established; urilen:11; content:"/search.php"; fast_pattern:only; http_uri; content:"Host|3A|"; depth:5; http_header; content:"|0D 0A|Connection|3A|"; within:75; http_header; content:!"User-Agent|3A|"; http_header; content:!"Accept|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d731129990031b694ec04177927dc37bb19814b216b86f0005ecdd9049a7e5b5/analysis/; classtype:trojan-activity; sid:43475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fireball variant outbound connection"; flow:to_server,established; content:"/v4/service"; fast_pattern:only; http_uri; content:"action=visit"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc/analysis/; classtype:trojan-activity; sid:43468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fireball variant outbound connection"; flow:to_server,established; content:"reqs=visit|2E|"; fast_pattern:only; http_uri; content:"/provide?clients="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158/analysis/; classtype:trojan-activity; sid:43467; rev:1;)
alert tcp $HOME_NET 445 -> any any (msg:"MALWARE-CNC Win.Trojan.Doublepulsar variant successful ping response"; flow:to_client,established; flowbits:isset,smb.session_setup_subcommand; content:"|FF|SMB2|02 00 00 C0|"; depth:9; offset:4; isdataat:13,relative; content:!"|00 00 00 00 00 00 00 00|"; within:8; distance:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service netbios-ssn; reference:url,countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/; reference:url,www.virustotal.com/file/15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13/analysis/; classtype:trojan-activity; sid:43459; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Eorezo variant outbound connection"; flow:to_server,established; content:"/cgi-bin/advert/get"; fast_pattern:only; http_uri; content:"did="; http_uri; content:"X-OS-Ver:"; http_header; content:"X-Guuid:"; http_header; pcre:"/^User-Agent: [a-z]+_[a-z]+_\d{3,9}-/Hm"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/00A87AEF3CC1F82F4D2209A4042FC9BCD8ED433B139185C52550FEF9857F6F25/analysis/; classtype:trojan-activity; sid:43457; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Erebus variant outbound connection"; flow:to_server,established; file_data; urilen:1; content:"h="; depth:2; http_client_body; content:"&v="; within:3; distance:8; http_client_body; content:"&k="; within:3; distance:3; fast_pattern; http_client_body; content:"Expect|3A| 100-continue|0D 0A 0D 0A|"; http_header; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips alert, policy security-ips alert, service http; reference:url,virustotal.com/en/file/0b7996bca486575be15e68dba7cbd802b1e5f90436ba23f802da66292c8a055f/analysis/; classtype:trojan-activity; sid:43351; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Andr.Adware.Judy malicious java file download attempt"; flow:established,to_client; file_data; content:"|7B 22 64 22 3A 7B 22 62 22 3A 22|"; content:"|22 2C 22 61 22 3A 30 7D|"; within:10; distance:12; content:"|22|download/upgrade/upgp/|22|"; content:"http"; content:".tar.gz"; within:70; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d2f9b0a1a057d32cfd794f021093dd11e438b6d1e31a96ee38637e1ab2cdeadb/analysis/; classtype:trojan-activity; sid:43293; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Andr.Adware.Judy malicious dex file download attempt"; flow:established,to_client; file_data; content:"cs.network.configs.Config"; fast_pattern:only; content:"|22|url"; content:".dex"; within:75; content:"|22|md5|22|"; within:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a2ddf8e497e6ef6c8c023d483eb8d21e9886bd4448986de5b8d817eb7d08ff4c/analysis/; classtype:trojan-activity; sid:43292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Micropsia outbound connection"; flow:to_server,established; content:"/api/white_walkers/new"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.talosintelligence.com/2017/06/palestine-delphi.html; reference:url,virustotal.com/en/file/005dce6a8cec1d41513239517f1fae32bf2dbaba6bf6b4b8149c0510a889bf2e/analysis; classtype:trojan-activity; sid:43224; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Micropsia outbound connection"; flow:to_server,established; content:"/api/"; http_uri; content:"----"; depth:4; fast_pattern; http_client_body; content:"|0D 0A 0D 0A|Windows "; within:1000; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.talosintelligence.com/2017/06/palestine-delphi.html; reference:url,virustotal.com/en/file/0180e2b601ae643e7adf1784c313dd2d10d114bd2b5692eb6e9c031a6e448ed1/analysis/; classtype:trojan-activity; sid:43223; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Micropsia outbound connection"; flow:to_server,established; content:"Accept-Encoding: identity|0D 0A|"; fast_pattern:only; http_header; content:"User-Agent"; nocase; http_header; content:"+http://www.google.com/bot.html"; within:100; nocase; http_header; content:"----"; depth:4; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.talosintelligence.com/2017/06/palestine-delphi.html; reference:url,virustotal.com/en/file/0180e2b601ae643e7adf1784c313dd2d10d114bd2b5692eb6e9c031a6e448ed1/analysis/; classtype:trojan-activity; sid:43222; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.HiddenCobra variant outbound connection"; flow:to_server,established; content:"|1B 17 E9 E9 E9 E9|"; depth:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.us-cert.gov/ncas/alerts/TA17-164A; classtype:trojan-activity; sid:43194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.HiddenCobra variant outbound connection"; flow:to_server,established; content:"|18 17 E9 E9 E9 E9|"; fast_pattern:only; isdataat:!7; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community; reference:url,www.us-cert.gov/ncas/alerts/TA17-164A; classtype:trojan-activity; sid:43193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Konus variant outbound connection detected"; flow:to_server,established; content:"/happytimes/connect.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/C5586CE98622BAF123A10E99498C64F341B6454244121157185946F96AABE163/analysis/; classtype:trojan-activity; sid:43190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Matsnu variant outbound conection"; flow:to_server,established; content:"/p.ashx"; fast_pattern:only; http_uri; content:"e="; nocase; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/02dd736b4a08c2c3b36f62b74cd7d0d19255c0120c818f61669fcdcd140afbfc/analysis; classtype:trojan-activity; sid:43184; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Matsnu variant outbound conection"; flow:to_server,established; content:"/xdaovcny/index.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/02dd736b4a08c2c3b36f62b74cd7d0d19255c0120c818f61669fcdcd140afbfc/analysis; classtype:trojan-activity; sid:43183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fareit variant outbound connection"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (Windows NT 10.0|3B| WOW64)"; http_header; content:"Connection: Keep-Alive|0D 0A 0D 0A|"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9843a7be6b313c2fb4093ca25639b6d92cc1e0bdacfcc6277ea61e635e220e1c/analysis/; classtype:trojan-activity; sid:43129; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kabob outbound connection"; flow:to_server,established; content:"@|E9 03 00 00 00 00 00 00 00 00 64|"; fast_pattern:only; http_client_body; pcre:"/\/\d{8}\/\w{4}\/[A-F0-9]{4}\/[A-F0-9]{4}\/[A-Z0-9\-_~]{12}\.[aj]sp/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:43063; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gasonen variant outbound connection"; flow:to_server,established; content:"User-Agent|3A| AutoIt|0D 0A|"; fast_pattern:only; http_header; content:!"Referer|3A|"; http_header; content:"Cache-Control: no-cache"; http_header; pcre:"/(textile|banner|logo)\x2E(png|jpg|gif)$/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/31F00FDE356066B650AA9D4F234AD83B0EC03FE1ABFCD3038A32E7A0CD259DF2/analysis/; classtype:trojan-activity; sid:43049; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Spesseo variant outbound connection"; flow:established, to_server; content:"User-Agent: NSIS_Inetc (Mozilla)"; fast_pattern:only; http_header; content:"y6bdVFVIsvuYsgEClQfz8Peh"; depth:40; http_uri; content:!"Referrer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/intelligence/search/?query=9D81C402C4790C77500C270A5DAD7B59775BE001FAD4FB79B401AFFFE85EDFF6; classtype:trojan-activity; sid:42997; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Spesseo variant outbound connection"; flow:established, to_server; content:"User-Agent: NSIS_Inetc (Mozilla)"; fast_pattern:only; http_header; content:"/time.php"; depth:9; http_uri; urilen:9; content:!"Referrer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/intelligence/search/?query=9D81C402C4790C77500C270A5DAD7B59775BE001FAD4FB79B401AFFFE85EDFF6; classtype:trojan-activity; sid:42996; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Adylkuzz variant initial outbound connection"; flow:established,to_server; content:"User-Agent|3A| LuaSocket"; fast_pattern:only; http_header; content:"/report"; nocase; http_uri; content:"hasWanIP="; nocase; http_uri; content:"cpufreq="; nocase; http_uri; content:"mem="; nocase; http_uri; content:"m_procnum="; nocase; http_uri; content:"m_exists="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233/analysis/; classtype:trojan-activity; sid:42945; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.XAgent outbound connection"; flow:to_server,established; content:"(unknown version)"; http_header; content:"Darwin/"; within:30; http_header; content:"Accept|3A 20|*/*|0D 0A|"; http_header; pcre:"/\/(search|find|results|open|search|close|watch)\/\x3f[a-zA-Z0-9]{2,8}\x3d/Ui"; content:!"Referer"; http_header; metadata:impact_flag red, ruleset community, service http; reference:url,contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html; reference:url,download.bitdefender.com/resources/files/News/CaseStudies/study/143/Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web.pdf; classtype:trojan-activity; sid:43825; rev:2;)
# alert tcp $HOME_NET 34324 -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Biggluck variant inbound response"; flow:to_client,established; content:"Welcome!|0A 0D|# "; fast_pattern:only; dsize:12; metadata:impact_flag red; classtype:trojan-activity; sid:43899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 7080 (msg:"MALWARE-CNC Win.Malware.Emotet variant outbound connection"; flow:to_server,established; content:"/3MEGFV938DS21M9697282868BNSH73JD"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/file/8d8b45aa8724458ea7711f13ee237bbd3e4c77669ebd91109b94620ecc52bc72/analysis/; classtype:trojan-activity; sid:43890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fareit variant outbound connection"; flow:to_server,established; content:"/gate.php"; fast_pattern:only; http_uri; content:"WebKitFormBoundary"; http_header; content:"name=|22|getconfig|22|"; content:"Referer|3A 20|"; http_header; content:"Connection|3A 20|close|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/#/file/01092ea6b5eb749254cf61a58c7c8fe5f6700197643271202fe420ac7cc68d1f/detection; classtype:trojan-activity; sid:43972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kradod connection attempt"; flow:to_server,established; content:"User-Agent:|20|vb|20|wininet"; fast_pattern:only; http_header; content:"/app/linfo.asp"; http_uri; content:"?mid="; http_uri; content:"&ver="; http_uri; content:"&ud="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/es/file/109fce30219662725b42f1576071ae188e6d518414f25689ecbfbb1074573ee4/analysis/; classtype:trojan-activity; sid:43969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Globeimposter outbound connection"; flow:to_server,established; content:"/counter.php?"; depth:13; http_uri; content:"nu="; http_uri; content:"fb="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b/analysis/; classtype:trojan-activity; sid:43950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.GamKer variant outbound connection"; flow:to_server; urilen:22; content:".php"; fast_pattern:only; http_uri; content:"/"; depth:1; offset:9; http_uri; pcre:"/\x2f[a-f0-9]{8}\x2f[a-f0-9]{8}\.php$/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/97288f770d1317d6cc4c624156b3baf101a8ac7d6fd3da92393db703baaf149b/detection; classtype:trojan-activity; sid:43930; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Poogetad Variant connection attempt"; flow:to_server,established; content:"User-Agent:|20 20 20|MyApp/0.1"; fast_pattern:only; content:"CONNECT"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4063d08b84fdbb0d95cb78f22ebd39bf45207e868a9ca1b4c208df9aff8c0bed/analysis/; reference:url,virustotal.com/en/file/a3ff0ea9b4cb8ebbd9a64cc10af5a2ef243b30a9180a4a02163c87769a36a574/analysis/; reference:url,virustotal.com/en/file/e47b4b10d4bc3efc9d6b88cc071323eb27413995b4d4854bae342f7881ab7e21/analysis/; classtype:trojan-activity; sid:43929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Hippo variant outbound connection"; flow:to_server,established; content:"|11 76 90 09 00 09 00 00 00|"; depth:9; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:44011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rortiem outbound connection"; flow:to_server,established; content:"If|2D|None|2D|Match|3A 20 22|"; fast_pattern:only; http_header; content:"/gettime.html?"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6c9d748484021b2b7ee9722695432f73d0f5f2b5d7c19ffcc2bccaafe5d040b5/analysis/; reference:url,virustotal.com/en/file/913b31a9e399a64a9f72eb3d2c301b6d159274af549c60702271ef636de375c2/analysis/; classtype:trojan-activity; sid:43985; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Femas variant outbound connection"; flow:to_server,established; content:"did="; http_client_body; content:"/pockemon/squirtle/functions.php"; fast_pattern:only; http_uri; content:"Dalvik/"; http_header; content:"Android"; within:25; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:43982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Femas variant outbound connection"; flow:to_server,established; content:"did="; http_client_body; content:"/update/upfolder/updatefun.php"; fast_pattern:only; http_uri; content:"Dalvik/"; http_header; content:"Android"; within:25; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:43981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky dropper variant outbound request detected"; flow:to_server,established; content:"/JbhbUsfs"; fast_pattern:only; http_uri; content:"User-Agent|3A| Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:54.0) Gecko/20100101 Firefox/54.0"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/512738942e579a83f330e6ed8387158993f46126f4e3737e9db58a70fcafeea9/detection; classtype:trojan-activity; sid:44028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky dropper variant outbound request detected"; flow:to_server,established; content:"/y872ff2f"; fast_pattern:only; http_uri; content:"User-Agent|3A| Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| rv:54.0) Gecko/20100101 Firefox/54.0"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/512738942e579a83f330e6ed8387158993f46126f4e3737e9db58a70fcafeea9/detection; classtype:trojan-activity; sid:44027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 2008 (msg:"MALWARE-CNC Win.Trojan.Hupigon Connection attempt"; flow:to_server,established; content:"LIST|0B|10000"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f19a35f4e9030c6971a2145dacd3f37ddbdf05e586800ef600e1d5936ff70e0f/analysis/; classtype:trojan-activity; sid:44042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cerber variant outbound connection"; flow:to_server,established; content:"17gd1msp5FnMcEMF1MitTNSsYs7w7AQyCt"; http_uri; content:"_=15"; within:4; distance:1; http_uri; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/56f41afc8f025597659f11f59b191e66bd6c6525313cf3c0356c40490722b7c5/detection; classtype:trojan-activity; sid:44177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zurgop variant outbound beaconing connection"; flow:to_server,established; content:"|BC 6C|"; depth:2; http_client_body; content:"Content-Type: application/x-www-form-urlencoded|0D 0A|"; http_header; content:"Content-Length|3A| 63|0D 0A|"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/#/file/0885905c9997f003dfac42232a2f4b38b7f6a8773bdd6cdbc6386b28d1357109/; classtype:trojan-activity; sid:44171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.SyncCrypt variant initial outbound connection"; flow:to_server,established; urilen:19; content:"/mxRqXF/arrival.jpg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/3049a568c1c1cd4d225f8f333bf05e4560c8f9de5f167201253fedf35142fe3e/detection; classtype:trojan-activity; sid:44222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.SyncCrypt variant initial outbound connection"; flow:to_server,established; urilen:19; content:"/images/arrival.jpg"; fast_pattern:only; http_uri; content:"User-Agent|3A| curl/7.51.0"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/3049a568c1c1cd4d225f8f333bf05e4560c8f9de5f167201253fedf35142fe3e/detection; classtype:trojan-activity; sid:44221; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.SyncCrypt variant initial outbound connection"; flow:to_server,established; urilen:10; content:"/X8IOl.jpg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/3049a568c1c1cd4d225f8f333bf05e4560c8f9de5f167201253fedf35142fe3e/detection; classtype:trojan-activity; sid:44220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tarayt outbound connection"; flow:to_server,established; content:"/etir"; fast_pattern:only; http_uri; content:"/etir HTTP"; content:!"Referer"; http_header; content:"DNT: 1"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/E276142DD9AF0F064FF75AF17CA05A64E7944EC87B36F54B683B4E430744C242/analysis/; classtype:trojan-activity; sid:44212; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tarayt outbound connection"; flow:to_server,established; content:"/pixel/s2s.php?"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/E276142DD9AF0F064FF75AF17CA05A64E7944EC87B36F54B683B4E430744C242/analysis/; classtype:trojan-activity; sid:44211; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Bullrat variant outbound connection"; flow:to_server,established; content:"V|00|e|00|r|00|s|00|i|00|o|00|n|00 20 00|1|00 2E 00|0"; fast_pattern:only; content:"w|00|w|00|w|00|u|00 2E 00|e|00|t|00|n|00|e|00|w|00|s|00 2E 00|c|00|o|00|m"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/d6849b89e87b550c9e28db10e56fb11da0631d3add2adfdb32ade71f94374cfd/analysis/; classtype:trojan-activity; sid:44210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 8001 (msg:"MALWARE-CNC Win.Trojan.Cyfshent variant outbound connection"; flow:to_server,established; content:"01095040804|00 00 00 00 00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/50c0d041c61baac8924af7981cbe34aee909321fa6db7218a842544caa070f2a/analysis/; classtype:trojan-activity; sid:44190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.FlatChestWare varint outbound connection"; flow:to_server,established; content:"/listen/listen.php?line1="; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:"Connection|3A| Keep-Alive"; http_header; pcre:"/ran\s+on\s+\d{1,2}\x2f\d{1,2}\x2f\d{4}/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:44279; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CrystalAttack outbound file download attempt"; flow:to_server,established; content:"/filesok/443.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,bartblaze.blogspot.com/2017/08/crystal-finance-millennium-used-to.html; classtype:trojan-activity; sid:44278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Chthonic outbound file download attempt"; flow:to_server,established; content:"/versionmaster/nova/load.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,bartblaze.blogspot.com/2017/08/crystal-finance-millennium-used-to.html; classtype:trojan-activity; sid:44277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Chthonic outbound file download attempt"; flow:to_server,established; content:"/ico/load.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,bartblaze.blogspot.com/2017/08/crystal-finance-millennium-used-to.html; classtype:trojan-activity; sid:44276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ellell variant outbound connection"; flow:established,to_server; content:"/llll.html"; fast_pattern:only; http_uri; content:"search="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/A468A3B6E574626B26F459D42AF0D90D39E98D28787D19AAEAD94AB438800043/analysis/; classtype:trojan-activity; sid:44316; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Totbrick variant inbound connection attempt"; flow:to_client, established; file_data; content:"ok|0A|"; depth:3; pcre:"/ok\n\d+\n(\d+\x7C){5}/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/FD6F8C929DB5F1CE1721CB3CE6F9F9AB6DAD021226BD37DD65F7F2D66215EE1E/analysis/; classtype:trojan-activity; sid:44314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Totbrick variant outbound connection"; flow:to_server, established; content:"Mozilla/4.0 (compatible|3B| Synapse)"; fast_pattern:only; http_header; content:!"Referer"; http_header; content:!"|0D 0A|Accept|2D|Language|3A|"; http_header; content:"/admin.php"; http_uri; content:"1="; http_uri; content:"v="; http_uri; content:"q="; http_uri; content:"b="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/FD6F8C929DB5F1CE1721CB3CE6F9F9AB6DAD021226BD37DD65F7F2D66215EE1E/analysis/; classtype:trojan-activity; sid:44313; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Razy variant outbound connection"; flow:to_server,established; content:"DefaultForm."; http_uri; content:"pfr="; within:150; fast_pattern; http_uri; content:"User-Agent: Go-http-client"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77/analysis/; classtype:trojan-activity; sid:44307; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Paradise ransomware inbound executable"; flow:to_server,established; file_data; content:"F|00|i|00|l|00|e|00|s|00|.|00|t|00|x|00|t|00|"; content:"F|00|a|00|i|00|l|00|e|00|d|00|.|00|t|00|x|00|t|00|"; content:"/|00|#|00|D|00|E|00|C|00|R|00|Y|00|P|00|T|00| |00|M|00|Y|00| |00|F|00|I|00|L|00|E|00|S|00|#|00|.|00|t|00|x|00|t|00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80/analysis/; classtype:trojan-activity; sid:44367; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Paradise ransomware inbound executable"; flow:to_client,established; file_data; content:"F|00|i|00|l|00|e|00|s|00|.|00|t|00|x|00|t|00|"; content:"F|00|a|00|i|00|l|00|e|00|d|00|.|00|t|00|x|00|t|00|"; content:"/|00|#|00|D|00|E|00|C|00|R|00|Y|00|P|00|T|00| |00|M|00|Y|00| |00|F|00|I|00|L|00|E|00|S|00|#|00|.|00|t|00|x|00|t|00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80/analysis/; classtype:trojan-activity; sid:44366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Paradise ransomware outbound post"; flow:to_server,established; content:"/api/Encrypted.php"; fast_pattern:only; http_uri; content:"computer_name="; http_client_body; content:"decryption_info="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80/analysis/; classtype:trojan-activity; sid:44365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/ser825/"; depth:8; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44415; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/not46/"; depth:7; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44414; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/kas2/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44413; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/ser829/"; depth:8; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44412; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/kas3/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44411; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/ser831/"; depth:8; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44410; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/kas8/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44409; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/kas7/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44408; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/ser904/"; depth:8; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44407; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/worm/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44406; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/tt0002/"; depth:8; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44405; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"GET /mac1/"; fast_pattern:only; content:"/mac1/"; content:"_"; within:15; content:"."; within:10; content:"/"; within:33; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44404; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Trickbot malicious communication attempt"; flow:established,to_server; content:"/kas5/"; depth:6; http_uri; content:"_"; within:15; http_uri; content:"."; within:10; http_uri; content:"/"; within:33; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44403; rev:2;)
alert tcp $EXTERNAL_NET [443,447,449] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; distance:13; content:"|00 DC 5E AE E6 3E EC 78 EC|"; content:"Alaska"; content:"John_Alaska@gmail.com"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/en/file/70041c335a374d84f64c6c31d59ff09bd8473fd049cfcb46fe085d1eb92ac0b8/analysis/1502073944/; classtype:trojan-activity; sid:44402; rev:1;)
alert tcp $EXTERNAL_NET [443,447,449] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; distance:13; content:"|00 92 93 45 3A 42 8B 15 4C|"; fast_pattern:only; content:"London"; content:"example.com"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,malware-traffic-analysis.net/2017/08/12/index.html; classtype:trojan-activity; sid:44401; rev:1;)
alert tcp $EXTERNAL_NET [443,447,449] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; distance:13; content:"f2tee4"; content:"rvgvtfdf"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/#/file/604bd405cf8edd910b25c52b63ab7e4b6c2242bc6eaf6eca4cccb718e1d291e2; classtype:trojan-activity; sid:44400; rev:1;)
alert tcp $EXTERNAL_NET [443,447,449] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; distance:13; content:"3t2t3rgeg"; content:"fg2eq34df"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/#/file/604bd405cf8edd910b25c52b63ab7e4b6c2242bc6eaf6eca4cccb718e1d291e2; classtype:trojan-activity; sid:44399; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.KediRAT outbound connection"; flow:to_server; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|lions-rugby-tour|02|co|02|uk"; within:200; distance:32; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,www.virustotal.com/file/5dd32f23fde8798b2b34ce259983238f494a3e01613333128bdebc9aebc77f44/analysis/; classtype:trojan-activity; sid:44396; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Konus variant outbound connection detected"; flow:to_server,established; content:"/lampi/connect.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/C5586CE98622BAF123A10E99498C64F341B6454244121157185946F96AABE163/analysis/; classtype:trojan-activity; sid:44393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Konus variant outbound connection detected"; flow:to_server,established; content:"/noix/connect.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/C5586CE98622BAF123A10E99498C64F341B6454244121157185946F96AABE163/analysis/; classtype:trojan-activity; sid:44392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Konus variant outbound connection detected"; flow:to_server,established; content:"/kronos/connect.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/C5586CE98622BAF123A10E99498C64F341B6454244121157185946F96AABE163/analysis/; classtype:trojan-activity; sid:44391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Buterat variant outbount connection detected"; flow:to_server,established; content:"/redirect/CFGUpdate"; fast_pattern:only; http_uri; content:"number="; nocase; http_uri; content:"checksum="; nocase; http_uri; content:"cid="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/B4173046C5443AB642479A36BF08B99B4935CBFA852C47105C845EB76E8E64DF/analysis/; classtype:trojan-activity; sid:44450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Popureb variant outbound connection detected"; flow:to_server,established; content:"/do.php"; nocase; http_uri; content:"userid="; nocase; http_uri; content:"time="; nocase; http_uri; content:"msg="; nocase; http_uri; content:"pauid="; fast_pattern:only; http_uri; content:"checkId="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/07345029FAD7F00878B5EBF36BCB6F2C252F4F93DE417BB7E8314A0971198865/analysis/; classtype:trojan-activity; sid:44443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Poison variant outbound connection detected"; flow:to_server,established; content:"/upo5den/control.html"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/72AE7AE357F036834A9265E547B27C8598392E493FBDFDD89A34712063D41BCD/analysis/; classtype:trojan-activity; sid:44439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.Poison variant outbound connection detected"; flow:to_server,established; content:"/pivyconfig/pi.html"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/72AE7AE357F036834A9265E547B27C8598392E493FBDFDD89A34712063D41BCD/analysis/; classtype:trojan-activity; sid:44438; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site attempt"; flow:to_server,established; content:"/wp-includes"; fast_pattern:only; http_uri; pcre:"/(exe|dll|scr|rar|ps1|bat)$/Ui"; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,blog.avast.com/2013/05/03/regents-of-louisiana-spreading-sirefef-malware; classtype:trojan-activity; sid:44470; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site attempt"; flow:to_server,established; content:"/wp-admin"; fast_pattern:only; http_uri; pcre:"/(exe|dll|scr|rar|ps1|bat)$/Ui"; metadata:impact_flag red, policy security-ips drop, ruleset community, service http; reference:url,blog.avast.com/2013/05/03/regents-of-louisiana-spreading-sirefef-malware; classtype:trojan-activity; sid:44469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; pcre:"/^session(id)?=[a-z0-9\x2b\x2f]{27}=$/Cmi"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:44564; rev:4;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"CF-RAY: "; http_header; content:"=|0D 0A|"; within:3; distance:27; http_header; pcre:"/CF-RAY: [a-z0-9]{27}=\x0d\x0a/iH"; metadata:impact_flag red, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:44563; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"/login/process.php HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:44562; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC PowerShell Empire variant outbound connection"; flow:to_server,established; content:"/admin/get.php HTTP/1.1|0D 0A|Cookie: SESSION"; fast_pattern:only; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| WOW64|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:44561; rev:3;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Word.Trojan.Emotet obfuscated powershell"; flow:to_server,established; file_data; flowbits:isset,file.doc|file.xls; content:"powershell"; fast_pattern:only; pcre:"/powershell\s*?-e\s*?[A-Za-z0-9+\/=]{20}/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,attack.mitre.org/techniques/T1086; reference:url,virustotal.com/en/file/02ec7ded664c7638625dd3681e0332254cda9a288bc6e3a9a70d09f0309fa5b2/analysis/; reference:url,virustotal.com/en/file/e9cf17cb12e738e489164e93c1f3015cb245d12839bedb1a073046f519aad2be/analysis/; classtype:trojan-activity; sid:44560; rev:2;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Word.Trojan.Emotet obfuscated powershell"; flow:to_client,established; file_data; flowbits:isset,file.doc|file.xls; content:"powershell"; fast_pattern:only; pcre:"/powershell\s*?-e\s*?[A-Za-z0-9+\/=]{20}/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1086; reference:url,virustotal.com/en/file/02ec7ded664c7638625dd3681e0332254cda9a288bc6e3a9a70d09f0309fa5b2/analysis/; reference:url,virustotal.com/en/file/e9cf17cb12e738e489164e93c1f3015cb245d12839bedb1a073046f519aad2be/analysis/; classtype:trojan-activity; sid:44559; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 6280 (msg:"MALWARE-CNC Andr.Trojan.Congur variant outbound connection detected"; flow:to_server,established; content:"/collect"; fast_pattern:only; content:"ts="; nocase; content:"ver="; nocase; content:"diff="; nocase; content:"hash="; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/cd050a2868646f231c544c566ba3cc34538e63a5125a2c7ad1f4bbd41d5e8cdd/analysis/; classtype:trojan-activity; sid:44554; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.DNSMessenger outbound connection"; flow:to_server; content:"|01 00 00 01 00 00 00 00 00 00 0A|"; depth:11; offset:2; content:"|05|stage"; within:6; distance:10; nocase; content:"|00 10 00 01|"; within:45; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,blog.talosintelligence.com/2017/10/dnsmessenger-sec-campaign.html; classtype:trojan-activity; sid:44595; rev:2;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.PandaZeus self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; within:2; distance:13; content:"My Company Name LTD."; content:"domain.com"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/#/file/00fa65c8fced0abfab3f544801014a349f7d960819d8d79c47abe090bd75ccfc; classtype:trojan-activity; sid:44592; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.PandaZeus malicious certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; within:2; distance:13; content:"Let's Encrypt"; content:"gloverkentok.us"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/#/file/220a2b2d7353a697496abcabf1b4c1990b8c9b7143e6dada17782ddd9ee2c232; classtype:trojan-activity; sid:44591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Fareit variant outbound connection"; flow:to_server,established; content:"/gate.php"; http_uri; content:"Accept: |2A 2F 2A|"; nocase; http_header; content:"Content-Encoding:"; http_header; content:"binary"; within:10; nocase; http_header; content:"User-Agent:"; http_header; content:".NET CLR 3.0.04506.648"; within:120; fast_pattern; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9843a7be6b313c2fb4093ca25639b6d92cc1e0bdacfcc6277ea61e635e220e1c/analysis/1425053730/; classtype:trojan-activity; sid:44570; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Fareit variant outbound connection"; flow:to_server,established; content:"Accept: |2A 2F 2A|"; nocase; content:"Content-Encoding:"; content:"binary"; within:10; nocase; content:"User-Agent:"; content:"Windows 98"; within:50; fast_pattern; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/9843a7be6b313c2fb4093ca25639b6d92cc1e0bdacfcc6277ea61e635e220e1c/analysis/1425053730/; classtype:trojan-activity; sid:44569; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 7878 (msg:"MALWARE-CNC Android Red Alert Trojan outbound connection"; flow:to_server,established; content:"POST /sy HTTP/1.1|0D 0A|"; depth:19; content:"|0D 0A 0D 0A|eyJ"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9446a9a13848906ca3040e399fd84bfebf21c40825f7d52a63c7ccccec4659b7/analysis/; classtype:trojan-activity; sid:44622; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 7878 (msg:"MALWARE-CNC Android Red Alert Trojan outbound connection"; flow:to_server,established; content:"POST /ssl HTTP/1.1|0D 0A|"; depth:20; content:"|0D 0A 0D 0A|eyJ"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e47f075b9d0b2eb840b8bbd49017ffb743f9973c274ec04b4db209af73300d6/analysis/; classtype:trojan-activity; sid:44621; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 7878 (msg:"MALWARE-CNC Android Red Alert Trojan outbound connection"; flow:to_server,established; content:"POST /stbi HTTP/1.1|0D 0A|"; depth:21; content:"|0D 0A 0D 0A|eyJ"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e47f075b9d0b2eb840b8bbd49017ffb743f9973c274ec04b4db209af73300d6/analysis/; classtype:trojan-activity; sid:44620; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 7878 (msg:"MALWARE-CNC Android Red Alert Trojan outbound connection"; flow:to_server,established; content:"POST /sban HTTP/1.1|0D 0A|"; depth:21; content:"|0D 0A 0D 0A|eyJ"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3e47f075b9d0b2eb840b8bbd49017ffb743f9973c274ec04b4db209af73300d6/analysis/; classtype:trojan-activity; sid:44619; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/images/galery/post/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/8ca67f6ca5953a385504b23b859d40f76887e8778c3c69e9e978432874cddc26/detection; classtype:trojan-activity; sid:44618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/7309/"; depth:6; fast_pattern; http_uri; content:".zip"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/8ca67f6ca5953a385504b23b859d40f76887e8778c3c69e9e978432874cddc26/detection; classtype:trojan-activity; sid:44617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection"; flow:to_server,established; content:"/wp-admin/user/"; fast_pattern:only; http_uri; content:".zip"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/8ca67f6ca5953a385504b23b859d40f76887e8778c3c69e9e978432874cddc26/detection; classtype:trojan-activity; sid:44616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky dropper variant outbound request detected"; flow:to_server,established; content:"/JGHldb03m"; fast_pattern:only; http_uri; content:"UA-CPU: AMD64"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/83a7891731aacbe25bb5f5e2ba0c8dabed379be8c6fbc25db78c0d771a20a432/detection; classtype:trojan-activity; sid:44611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky dropper variant outbound request detected"; flow:to_server,established; content:"/IUGiwe8"; fast_pattern:only; http_uri; content:"UA-CPU: AMD64"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/1b80b24b7195960a74cc10dbbc9685ae229443a80d11c7fe7a9c8fdd4e59840d/detection; classtype:trojan-activity; sid:44610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Quimonk variant outbound connection detected"; flow:to_server,established; content:"/api/getlist"; nocase; http_uri; content:"js={"; depth:4; nocase; http_client_body; content:"|22|mac|22 3A|"; nocase; http_client_body; content:"|22|rgn|22 3A|"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/775c7bd9e820c4dfd0fabdfeade2de901414bd46d2691ea5020a818f6a42eb83/analysis/; classtype:trojan-activity; sid:44639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Wraut variant outbound connection"; flow:to_server,established; content:"/z/lib/"; fast_pattern:only; http_uri; content:".dll.c"; nocase; http_uri; content:"Cache-Control:"; nocase; http_header; content:"no-cache|0D 0A|"; within:15; nocase; http_header; content:!"Referer:"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/653b79aa9e92a7a2b8faa7b36c1541c045e12d583c6f1f71bd5c4190255e6d15/analysis/1425053730/; classtype:trojan-activity; sid:44659; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC IoT Reaper botnet CNC"; flow:to_server,established; content:"/api/api.php"; http_uri; content:"macaddress="; http_client_body; content:"&device=OpenWRT"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5e3334615651b1201f0ae41aa222deae6a10e0933d9b2bbabe7ce8b2e3752271/detection; classtype:trojan-activity; sid:44656; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC IoT Reaper botnet dropper"; flow:to_server,established; urilen:3; content:"/sa"; fast_pattern:only; http_uri; content:"Host"; http_header; content:!"User-Agent"; http_header; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/e2ed207461032f4bf96cfd36e54cd883186592860056bd96df94e73f5b7db035/detection; classtype:trojan-activity; sid:44655; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC IoT Reaper botnet CNC"; flow:to_server,established; content:"/api/api.php"; http_uri; content:"&device=TP-Link775&type=armv5le&version="; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/de242aefb9c8a8f10a7a3313265032172a6ecff69b01dc9ca88fd7779090285a/detection; classtype:trojan-activity; sid:44654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC IoT Reaper botnet"; flow:to_server,established; content:"/hedwig.cgi"; fast_pattern:only; http_uri; content:"../../../"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/b463ca6c3ec7fa19cd318afdd2fa2365fa9e947771c21c4bd6a3bc2120ba7f28/detection; classtype:trojan-activity; sid:44653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Zusy variant outbound connection"; flow:to_server,established; content:"/QualityCheck/ni6.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/5dea4247e021eeeb1347ff269a357dee77e8ac1837383b0ef37fb123339639a1/analysis/; classtype:trojan-activity; sid:44652; rev:1;)
# alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC SquirrelMail directory traversal attempt"; flow:to_server,established; content:"/src/redirect.php?plugins[]="; fast_pattern:only; http_uri; pcre:"/\x2fsrc\x2fredirect.php\x3fplugins\x5b\x5d=((?!^--).)*?\x2e\x2e[\x2f\x5c]/Usim"; metadata:service http; reference:cve,2006-2842; reference:url,attack.mitre.org/techniques/T1176; reference:url,www.securityfocus.com/bid/18231/info; classtype:web-application-attack; sid:44697; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gen variant outbound connection"; flow:established,to_server; content:"/aspnet_client/system_web/4_0_30319/update/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,us-cert.gov/ncas/alerts/TA17-293A; classtype:trojan-activity; sid:44689; rev:2;)
alert tcp $EXTERNAL_NET 8888 -> $HOME_NET any (msg:"MALWARE-CNC Linux.Trojan.IoTReaper_Botnet telnet connection attempt"; flow:established,to_client; content:"server get connect with "; depth:24; content:"."; within:4; content:"."; within:4; content:"."; within:4; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service telnet; classtype:trojan-activity; sid:44681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nemucod outbound connection"; flow:to_server,established; content:"/f78aqnQy/connect.php"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:44677; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Retadup variant outbound connection"; flow:established,to_client; content:"|3A 3A|6232743866487838"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/c69811d8574fcc59e37fe2cbf0a31be4956ab81c3279bfb1351ff6da3417b4a7/detection; classtype:trojan-activity; sid:44791; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nymaim variant outbound connection"; flow:to_server,established; content:"/vixduw/index.php"; fast_pattern:only; http_uri; content:"Host: carfax.com"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/6b905735d180947cabfeb54885dffc9e171b5001d103f395b59966de000ec4f8/; classtype:trojan-activity; sid:44789; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nymaim variant outbound connection"; flow:to_server,established; content:"/omcqeugwa/index.php"; fast_pattern:only; http_uri; content:"Host: carfax.com"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/6b905735d180947cabfeb54885dffc9e171b5001d103f395b59966de000ec4f8/; classtype:trojan-activity; sid:44788; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Godzilla outbound connection"; flow:to_server,established; content:"/gz/stat.php"; fast_pattern:only; http_uri; content:"g="; http_uri; content:"k="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/edeea5219eb15f510480f3d7103ef48e6f8443cf470a55a0f98727ee9202f8b0/; classtype:trojan-activity; sid:44787; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky outbound callout"; flow:to_server,established; content:"/8y6ghhfg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4074ff22a842725dd1f5ee40248e3d8acd4e912f8cf82edfe763713e49581d5b/analysis/; reference:url,virustotal.com/en/file/4df150f7e3f8ca7cbbccf6df90dd47cab0ab89b8a3dda1e91102a36364604ee6/analysis/; reference:url,virustotal.com/en/file/6c4b647c7c408bd78a8454d8a137139fc5f0456d6d606146030fe6f0e61c7942/analysis/; reference:url,virustotal.com/en/file/ec28311fd20e719ad532bd829bfa65440e012c7db5d0fb0fefb80ea7e06e9a6b/analysis/; reference:url,virustotal.com/en/file/ff0655d51206a6393b9e8d2a6db0c5cd68d5eaf16d21a2e88b7202e99185b405/analysis/; classtype:trojan-activity; sid:44782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky outbound callout"; flow:to_server,established; content:"/iugftrs2"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/057b9e96272f96685485a720ce962e093fd7d57360b312c114cc44096ec87695/analysis/; reference:url,virustotal.com/en/file/6853fae2acd6ed56c961d69301c907c01d3d2da6a7989b8b4a6eeb900067f748/analysis/; reference:url,virustotal.com/en/file/7744255c6d2ec9d1269867bb6804c663e4b0608056e9f5a9cbdfdc70d9b2d40a/analysis/; reference:url,virustotal.com/en/file/a51797f0078315e11a23b02c910a2161fc59e2dc85e5ab5c659075a2c9d8bf1d/analysis/; reference:url,virustotal.com/en/file/c4a5bb496388a17c963d856dcf0d194ce3c6f96d68199c6b3144ad3fa13ed5ce/analysis/; classtype:trojan-activity; sid:44781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Locky outbound callout"; flow:to_server,established; content:"/jhbfvg7"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/4074ff22a842725dd1f5ee40248e3d8acd4e912f8cf82edfe763713e49581d5b/analysis/; reference:url,virustotal.com/en/file/4df150f7e3f8ca7cbbccf6df90dd47cab0ab89b8a3dda1e91102a36364604ee6/analysis/; reference:url,virustotal.com/en/file/6c4b647c7c408bd78a8454d8a137139fc5f0456d6d606146030fe6f0e61c7942/analysis/; reference:url,virustotal.com/en/file/ec28311fd20e719ad532bd829bfa65440e012c7db5d0fb0fefb80ea7e06e9a6b/analysis/; reference:url,virustotal.com/en/file/ff0655d51206a6393b9e8d2a6db0c5cd68d5eaf16d21a2e88b7202e99185b405/analysis/; classtype:trojan-activity; sid:44780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?t0="; fast_pattern:only; http_uri; content:"t1="; http_uri; content:"t2="; http_uri; content:"t3="; http_uri; content:"t6="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.secureworks.com/research/bronze-butler-targets-japanese-businesses; classtype:trojan-activity; sid:44779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?h="; fast_pattern:only; http_uri; content:"o="; http_uri; content:"w="; http_uri; content:"a="; http_uri; content:"y="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.secureworks.com/research/bronze-butler-targets-japanese-businesses; classtype:trojan-activity; sid:44778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?ps0="; fast_pattern:only; http_uri; content:"ps1="; http_uri; content:"ps2="; http_uri; content:"ps3="; http_uri; content:"ps6="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.secureworks.com/research/bronze-butler-targets-japanese-businesses; classtype:trojan-activity; sid:44777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?item0="; fast_pattern:only; http_uri; content:"item1="; http_uri; content:"item2="; http_uri; content:"item3="; http_uri; content:"item6="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.secureworks.com/research/bronze-butler-targets-japanese-businesses; classtype:trojan-activity; sid:44776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?idcard0="; fast_pattern:only; http_uri; content:"idcard1="; http_uri; content:"idcard2="; http_uri; content:"idcard3="; http_uri; content:"idcard6="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.secureworks.com/research/bronze-butler-targets-japanese-businesses; classtype:trojan-activity; sid:44775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.xxmm variant initial outbound connection detected"; flow:to_server,established; content:"php?id0="; fast_pattern:only; http_uri; content:"id1="; http_uri; content:"id2="; http_uri; content:"id3="; http_uri; content:"id6="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/18e896a7547aacb33aa3941ab1b61659ed099c0f6fbb924068f81b4289b05f12/analysis/; classtype:trojan-activity; sid:44774; rev:2;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Silence monitoring module download"; flow:to_client,established; file_data; content:"pipe|5C|{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27/analysis/; classtype:attempted-admin; sid:44771; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Silence cnc module download"; flow:to_client,established; file_data; content:"h|00|t|00|r|00|j|00|y|00|y|00|t|00|r|00|n"; fast_pattern:only; content:"h|00|t|00|c|00|n|00|f|00|h|00|n"; content:"y|00|t|00|n|00|p|00|f|00|l|00|f|00|y|00|b|00|q"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/9fcc8c9b4eecc2cd8df621c924bbff40a0178ddbd6a6b5ced73ada2ee81854bb/analysis/; classtype:attempted-admin; sid:44770; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Silence inbound download"; flow:to_client,established; file_data; content:"|C6 45 E8 52 C6 45 E9 74 C6 45 EA 70 C6 45 EB 45 C6 45 EC 6E C6 45 ED 63 C6 45 EE 6F C6 45 EF 64 C6 45 F0 65 C6 45 F1 50 C6 45 F2 6F C6 45 F3 69 C6 45 F4 6E C6 45 F5 74 C6 45 F6 65 C6 45 F7 72 C6 45 F8 00|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2/analysis/; classtype:attempted-admin; sid:44769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Silence outbound request"; flow:to_server,established; content:"/get.php?name="; fast_pattern:only; http_uri; content:!"User-Agent"; http_header; content:!"Cookie"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2/analysis/; classtype:attempted-admin; sid:44768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.KopiLuwak variant outbound request detected"; flow:to_server,established; content:"%D0%8BTl%DC"; depth:11; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/turla-apt-actor-refreshes-kopiluwak-javascript-backdoor-use-g20-themed-attack; classtype:trojan-activity; sid:44763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.KopiLuwak variant outbound request detected"; flow:to_server,established; content:"User-Agent|3A|"; http_header; content:"Mozilla/5.0 (Windows NT 6.1|3B| Win64|3B| x64)|3B| "; distance:0; fast_pattern; http_header; pcre:"/Win64\x3B\sx64\x29\x3B\s[0-9]{16}\w{16}\x0D\x0A/iH"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/blog/research/77429/kopiluwak-a-new-javascript-payload-from-turla/; classtype:trojan-activity; sid:44762; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Reyptson ransomware download"; flow:to_server,established; file_data; flowbits:isset,file.exe; content:"Reyptson"; fast_pattern:only; content:"rthaergaerhaerg"; content:"tsrtjsrtghsrth"; content:"srtysrtusrtyg"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/e6d549543863cd3eb7d92436739a66da4b2cc1a9d40267c4bb2b2fa50bf42f41/analysis/; classtype:trojan-activity; sid:44761; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Reyptson ransomware download"; flow:to_client,established; file_data; flowbits:isset,file.exe; content:"Reyptson"; fast_pattern:only; content:"rthaergaerhaerg"; content:"tsrtjsrtghsrth"; content:"srtysrtusrtyg"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/e6d549543863cd3eb7d92436739a66da4b2cc1a9d40267c4bb2b2fa50bf42f41/analysis/; classtype:trojan-activity; sid:44760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Stimilina variant outbound connection detected"; flow:to_server,established; content:"VWGRTT"; depth:6; fast_pattern; http_client_body; content:"/gate.php"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/B58493C36B6ABA5B03D2D266ABA3B07A7E91090C77E5EC2464B02E93D21A4DB9/analysis/; classtype:trojan-activity; sid:44753; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0D|xmponmzmxkxkh|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44807; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0E|techniciantext|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44806; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0C|operatingbox|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44805; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|07|paniesx|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44804; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|08|dnsgogle|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44803; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0F|nylalobghyhirgh|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44802; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0B|tczafklirkl|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44801; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0B|ribotqtonut|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44800; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|06|notped|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44799; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0D|jkvmdmjyfcvkf|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44798; rev:2;)
alert udp $HOME_NET any -> any 53 (msg:"MALWARE-CNC Win.Trojan.Shadowpad DNS TXT encrypted outbound connection"; flow:to_server; dsize:>80; byte_test:1,!&,0xF8,2; content:"|0F|bafyvoruzgjitwr|03|com|00 00 10|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service dns; reference:url,virustotal.com/en/file/f86fa8fc2f2428ed145e782894ef3be32b9ea8d60b68b805d8fbd1c5e7af427c/analysis/; classtype:trojan-activity; sid:44797; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Malicious VBA Dropper outbound connection detected"; flow:to_server,established; content:"/news/t.php?"; http_uri; content:"thread="; within:20; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; classtype:trojan-activity; sid:44876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Php.Dropper.Mayhem variant outbound connection"; flow:established,to_server; content:"R|2C|20130826|2C|"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/b3cc1aa3259cd934f56937e6371f270c23edf96d2c0801728b0379dd07a0a035/detection; classtype:trojan-activity; sid:44975; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound connection"; flow:to_server,established; content:"/domain/apple-pie.in"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/54a349e84d2a27b46c549f553c975d727d376e9f8428eb9bae6c01a980e7d904/analysis/; classtype:trojan-activity; sid:44973; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound connection"; flow:to_server,established; content:"/domain/arthur.niria.biz"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/54a349e84d2a27b46c549f553c975d727d376e9f8428eb9bae6c01a980e7d904/analysis/; classtype:trojan-activity; sid:44972; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.FallChill variant outbound connection"; flow:to_server,established; dsize:13; content:"|17 03 01 00 08|"; depth:5; content:"|04 88 4D 76|"; within:4; distance:4; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6/analysis/; classtype:trojan-activity; sid:44946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.FallChill variant outbound connection"; flow:to_server,established; dsize:13; content:"|17 03 01 00 08|"; depth:5; content:"|B2 63 70 7B|"; within:4; distance:4; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6/analysis/; classtype:trojan-activity; sid:44945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.FallChill variant outbound connection"; flow:to_server,established; dsize:13; content:"|17 03 01 00 08|"; depth:5; content:"|B0 63 70 7B|"; within:4; distance:4; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6/analysis/; classtype:trojan-activity; sid:44944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.FallChill variant outbound connection"; flow:to_server,established; dsize:13; content:"|17 03 01 00 08|"; depth:5; content:"|06 88 4D 76|"; within:4; distance:4; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6/analysis/; classtype:trojan-activity; sid:44943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"MALWARE-CNC Osx.Trojan.Fruitfly variant outbound connection detected"; flow:to_server,established; content:"|01 77 04 00 00|"; depth:5; content:"|00 00 00|"; within:3; distance:1; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/#/file/ce07d208a2d89b4e0134f5282d9df580960d5c81412965a6d1a0786b27e7f044/detection; classtype:trojan-activity; sid:44911; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.CoinMiner inbound connection detected"; flow:to_client,established; file_data; content:"9[6we7w|2F|,+w&8buu"; content:"Sr&w09."; distance:0; content:".7,rz|22|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cb2a7647f12d858ed1739ddd1c4f257a0c4a5d0bdc3b303b4f1f663e56c8c90e/detection; classtype:trojan-activity; sid:44899; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CoinMiner outbound connection"; flow:to_server,established; urilen:10; content:"/text.html"; http_uri; content:"User-Agent|3A| NSIS_Inetc |28|Mozilla|29|"; http_header; content:!"Cookie"; nocase; http_header; content:!"Content-Length"; nocase; http_header; content:!"Content-Type"; nocase; http_header; content:!"Referer"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cb2a7647f12d858ed1739ddd1c4f257a0c4a5d0bdc3b303b4f1f663e56c8c90e/detection; classtype:trojan-activity; sid:44898; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CoinMiner outbound connection"; flow:to_server,established; urilen:10; content:"/test.html"; http_uri; content:"User-Agent|3A| NSIS_Inetc |28|Mozilla|29|"; http_header; content:!"Cookie"; nocase; http_header; content:!"Content-Length"; nocase; http_header; content:!"Content-Type"; nocase; http_header; content:!"Referer"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cb2a7647f12d858ed1739ddd1c4f257a0c4a5d0bdc3b303b4f1f663e56c8c90e/detection; classtype:trojan-activity; sid:44897; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CoinMiner outbound connection"; flow:to_server,established; urilen:10; content:"/stat.html"; http_uri; content:"User-Agent|3A| NSIS_Inetc |28|Mozilla|29|"; http_header; content:!"Cookie"; nocase; http_header; content:!"Content-Length"; nocase; http_header; content:!"Content-Type"; nocase; http_header; content:!"Referer"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cb2a7647f12d858ed1739ddd1c4f257a0c4a5d0bdc3b303b4f1f663e56c8c90e/detection; classtype:trojan-activity; sid:44896; rev:3;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.CoinMiner inbound connection detected"; flow:to_client,established; file_data; content:"|0D 0A| $EXTERNAL_NET [6660:6669,7000] (msg:"MALWARE-CNC Legend irc bot cnc attempt"; flow:to_server,established; content:"PRIVMSG |23|"; content:":!legend"; within:220; metadata:policy balanced-ips alert, policy security-ips drop, service irc; classtype:trojan-activity; sid:44998; rev:1;)
alert tcp $EXTERNAL_NET [6660:6669,7000] -> $HOME_NET any (msg:"MALWARE-CNC Legend irc bot cnc attempt"; flow:to_client,established; content:"PRIVMSG |23|"; content:":!legend"; within:220; metadata:policy balanced-ips alert, policy security-ips drop, service irc; classtype:trojan-activity; sid:44997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"; flow:to_server,established; content:"/W3SVC"; fast_pattern:only; http_uri; content:"cadata="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.ncsc.gov.uk/alerts/turla-group-malware; classtype:trojan-activity; sid:45065; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"; flow:to_server,established; content:"/W3SVC"; fast_pattern:only; http_uri; content:"cadata="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.ncsc.gov.uk/alerts/turla-group-malware; classtype:trojan-activity; sid:45064; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"; flow:to_server,established; content:"/ews/exchange/"; fast_pattern:only; http_uri; content:"cadata="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.ncsc.gov.uk/alerts/turla-group-malware; classtype:trojan-activity; sid:45063; rev:2;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"; flow:to_server,established; content:"/ews/exchange/"; fast_pattern:only; http_uri; content:"cadata="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.ncsc.gov.uk/alerts/turla-group-malware; classtype:trojan-activity; sid:45062; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.IcedId outbound connection"; flow:to_server,established; content:"/forum/viewtopic.php?a="; fast_pattern:only; http_uri; content:"Connection: Close"; nocase; http_header; content:!"Accept-Language:"; http_header; content:!"Referer:"; http_header; content:!"User-Agent:"; http_header; content:"&b="; depth:25; offset:24; http_uri; content:"&d="; within:3; distance:18; http_uri; content:"&e="; within:11; distance:1; http_uri; pcre:"/\x2fforum\x2fviewtopic.php\x3fa=[0-9]{1,2}&b=[0-9A-F]{18}&d=[0-9]{1,8}&e=/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/a6531184ea84bb5388d7c76557ff618d59f951c393a797950b2eb3e1d6307013/detection; classtype:trojan-activity; sid:45050; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 3380 (msg:"MALWARE-CNC Win.Malware.Recam variant outbound connection"; flow:to_server,established; content:"|41 00 00 00 83|"; depth:5; dsize:68<>69; metadata:impact_flag red, policy security-ips drop; reference:url,virustotal.com/en/file/99371d8da86e964cc52bd719fd85f1f0015e4c60a9705747bb9b8ac52fd29b4a/analysis/; classtype:trojan-activity; sid:45104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Syscon variant outbound connection"; flow:established,to_server; content:"-yT/XXNKKKK"; depth:11; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data; reference:url,virustotal.com/en/file/f4987d127320cb5bfb8f49fc26435e01312bdd35a4e5e60db13546046584bd4e/analysis/; classtype:trojan-activity; sid:45100; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Syscon variant inbound connection"; flow:established,to_client; content:"|29|.txt|0D 0A|-rw-r--r--"; fast_pattern:only; pcre:"/\(\d{2}-\d{2}\s\d{2}-\d{2}-\d{2}\)\.txt/i"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data; reference:url,virustotal.com/en/file/f4987d127320cb5bfb8f49fc26435e01312bdd35a4e5e60db13546046584bd4e/analysis/; classtype:trojan-activity; sid:45099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.SnatchLoader variant outbound connection"; flow:to_server,established; content:"/css/order.php"; http_uri; urilen:14; content:"OI6XFe"; depth:6; fast_pattern; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7d75a7a63b7a28399c89f3ff5def5af61409350ab5018c31d1518febd44b532b/analysis/; classtype:trojan-activity; sid:45098; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Downloader.SnatchLoader variant inbound connection"; flow:to_client,established; file_data; content:"Gb6la57gh7"; depth:10; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7d75a7a63b7a28399c89f3ff5def5af61409350ab5018c31d1518febd44b532b/analysis/; classtype:trojan-activity; sid:45097; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Ransomware.Gibon variant inbound connection"; flow:established,to_client; content:"message:LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/30b5c4609eadafc1b4f97b906a4928a47231b525d6d5c9028c873c4421bf6f98/analysis/; classtype:trojan-activity; sid:45096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Gibon variant outbound connection"; flow:established,to_server; content:"User-Agent: GIBON|0D 0A|"; fast_pattern:only; http_header; content:!"Host: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/30b5c4609eadafc1b4f97b906a4928a47231b525d6d5c9028c873c4421bf6f98/analysis/; classtype:trojan-activity; sid:45095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.StoneDrill get commands outbound connection"; flow:to_server,established; content:"/insert/index?"; fast_pattern:only; http_uri; content:"id="; http_uri; content:"hst="; http_uri; content:"ttype="; http_uri; content:"state="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf; classtype:trojan-activity; sid:45092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.StoneDrill login outbound connection"; flow:to_server,established; content:"username=MD5Sum"; fast_pattern:only; http_client_body; content:"password=MD5Sum"; http_client_body; content:"button=Login"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf; classtype:trojan-activity; sid:45091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Backdoor.StoneDrill server selection outbound connection"; flow:to_server,established; content:"public/Check_Exist.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf; classtype:trojan-activity; sid:45090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Catch-All malicious Chrome extension dropper outbound connection"; flow:to_server,established; urilen:15; content:"/md"; depth:3; http_uri; pcre:"/\/md[0-9]{8}\.[a-z]{3}/iU"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/90750c7b57a3de333f4ed5d805522e3f909f2e16e7fd5d1e68b965d4c57be0a6/analysis/; classtype:trojan-activity; sid:45114; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 6892 (msg:"MALWARE-CNC Win.Trojan.FileCryptor variant outbound connection"; flow:to_server; content:"501000"; depth:6; offset:17; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/648f4e50848a55deb1c51fa8d82674bc7dbf3c630c6b6956c015258157736389/analysis/; classtype:trojan-activity; sid:45194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nautilus outbound call"; flow:to_server,established; content:"/OWA-AUTODISCOVER-EWS"; fast_pattern:only; http_uri; content:"Referer|3A|"; http_header; content:"bing.com"; within:30; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,ncsc.gov.uk/alerts/turla-group-malware; classtype:trojan-activity; sid:45221; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.VEye2 remote access tool download"; flow:to_server,established; file_data; content:"|3B B0 31 46 FA 72 24 20 DB 3B D0 1B 7E 75 BB 11 30 2C 9E C3 1E 3A 85 50 42 6A 62 9B EC EB CD F9|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/65878c810cb339da226ad47528073307396697ad4265c7d19716677c9ed10505/analysis/; classtype:trojan-activity; sid:45209; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.VEye2 remote access tool download"; flow:to_client,established; file_data; content:"|3B B0 31 46 FA 72 24 20 DB 3B D0 1B 7E 75 BB 11 30 2C 9E C3 1E 3A 85 50 42 6A 62 9B EC EB CD F9|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/65878c810cb339da226ad47528073307396697ad4265c7d19716677c9ed10505/analysis/; classtype:trojan-activity; sid:45208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Spider variant download attempt detected"; flow:to_server,established; content:"/javascript-enc-"; fast_pattern:only; http_uri; pcre:"/javascript-enc-\d{1,2}-\d{1,2}-\d{1,2}\.js/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/; classtype:trojan-activity; sid:45252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Spider variant download attempt detected"; flow:to_server,established; content:"/javascript-dec-"; fast_pattern:only; http_uri; pcre:"/javascript-dec-\d{1,2}-\d{1,2}-\d{1,2}\.js/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/; classtype:trojan-activity; sid:45251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.Freenki variant outbound connection"; flow:to_server,established; urilen:29; content:"/btob_asiana/udel_confirm.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df/analysis/; classtype:trojan-activity; sid:45239; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.CactusTorch download attempt detected"; flow:to_client,established; file_data; content:"base64ToStream"; fast_pattern:only; content:"ActiveXObject"; content:"DynamicInvoke"; content:"ToArray"; within:50; content:"CreateInstance"; within:50; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/0bbc1b5ba8075996a57fde4d9455688fb38e6bf90eb47321e98030aa17b6e8a5/detection; classtype:attempted-admin; sid:45232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DDEDownloader variant outbound connection detected"; flow:to_server,established; content:"/cr/dd/a.js"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/0bbc1b5ba8075996a57fde4d9455688fb38e6bf90eb47321e98030aa17b6e8a5/detection; classtype:trojan-activity; sid:45231; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 1502 (msg:"MALWARE-CNC Win.Backdoor.Triton Triton ICS malware upload attempt"; flow:to_server; content:"|06 00 48 FF FF 60 38 02 00 00 44 D0 FF 21 94 2C 00 E1 93 78 0B 3F 7C 08 00 7F 90 08 00 9F 80 13|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware; classtype:trojan-activity; sid:45260; rev:3;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC PowerShell Empire HTTP listener response"; flow:to_client,established; content:"Content-Length: 233|0D 0A|"; fast_pattern:only; http_header; content:"Expires: 0|0D 0A|"; nocase; http_header; content:"Cache-Control: no-cache, no-store, must-revalidate|0D 0A|"; nocase; http_header; content:"Pragma: no-cache|0D 0A|"; nocase; http_header; content:"Not Found"; nocase; http_stat_msg; content:!"Set-Cookie: "; nocase; http_header; content:!"|0D 0A|X-"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1086; reference:url,powershellempire.com; classtype:trojan-activity; sid:45352; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/wp-admin/images/1.tif"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/demo/xxx.bin"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/daten/1/hgsydei.tif"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/moduli/zolo.wg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/liveaccess/a1.rar"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/js/rts.bin"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/custom/dhfjur74.vt"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/media/vsart.bin"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/wp-admin/user/"; fast_pattern:only; http_uri; content:".tif"; http_uri; pcre:"/\x2fwp-admin\x2fuser\x2f\d{3}\x2etif/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/psd/"; fast_pattern; http_uri; content:".zip"; distance:0; http_uri; pcre:"/\x2fpsd\x2f[A-Z]{5,7}\x2ezip/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/bildergalerie/ast/"; fast_pattern; http_uri; content:".rar"; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/demo/wwww.bin"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/abbazia/"; fast_pattern; http_uri; content:".bin"; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45333; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/tmp/"; fast_pattern; http_uri; content:".vt"; distance:0; http_uri; pcre:"/\x2ftmp\x2f[a-z]{4,6}\x2evt/"; metadata:impact_flag red, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/_iserv/dlfiles/DT49456.rar"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/8932c9fb29bfbd56cd08519f517f8b088dce4bb97dfbb681b66f01775c38c9f6/analysis/; classtype:trojan-activity; sid:45331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Trojan.OceanLotus outbound connection attempt"; flow:to_server,established; content:"/sigstore.db?"; fast_pattern:only; content:"k="; http_uri; content:"?q="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update; classtype:trojan-activity; sid:45400; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Backdoor.Triton Triton ICS malware transfer attempt"; flow:to_server,established; flowbits:isset,file.pyc|file.zip; file_data; content:"ts_"; fast_pattern:only; content:"Ts"; content:"pyc"; within:20; nocase; pcre:"/Ts_?[^\s]{2,6}\.pyc/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware; classtype:trojan-activity; sid:45478; rev:2;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Backdoor.Triton Triton ICS malware transfer attempt"; flow:to_client,established; flowbits:isset,file.pyc|file.zip; file_data; content:"ts_"; fast_pattern:only; content:"Ts"; content:"pyc"; within:20; nocase; pcre:"/Ts_?[^\s]{2,6}\.pyc/"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware; classtype:trojan-activity; sid:45477; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; urilen:7; content:"/httpd1"; fast_pattern:only; http_uri; content:"Wget/"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ef7ee620ce09cd8edca81dc7866fbe87405c4a8ac88f985ac350269d8d081073/analysis/; classtype:trojan-activity; sid:45473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; urilen:9; content:"/minerd32"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ef7ee620ce09cd8edca81dc7866fbe87405c4a8ac88f985ac350269d8d081073/analysis/; classtype:trojan-activity; sid:45472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; urilen:11; content:"/watchcat32"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ef7ee620ce09cd8edca81dc7866fbe87405c4a8ac88f985ac350269d8d081073/analysis/; classtype:trojan-activity; sid:45471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; content:"/kelly6666/sm.txt"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1065; reference:url,www.virustotal.com/en/file/90024e7ce704b9a186964cf05bce65fa4b620fff5461036532cafd94db4ae050/analysis/; classtype:trojan-activity; sid:45470; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; content:"/kelly6666/lo.txt"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1065; reference:url,www.virustotal.com/en/file/90024e7ce704b9a186964cf05bce65fa4b620fff5461036532cafd94db4ae050/analysis/; classtype:trojan-activity; sid:45469; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC SambaCry ransomware download attempt"; flow:to_server,established; urilen:9; content:"/sambacry"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/7ce136262994ca82b1123cde62caf69e42281eb258d641205ba59b55f5558684/analysis/; classtype:trojan-activity; sid:45468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Pdf.Phishing.Agent variant outbound connection detected"; flow:to_server,established; content:"/cache/dropbox1/dropbox/"; fast_pattern:only; http_uri; content:"//cache/dropbox1/dropbox/"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1102; reference:url,virustotal.com/en/file/940fe3a9514f64b6c80ee25541271be206421c4d80d08061d1fa3a9ff96298a8/analysis/; classtype:trojan-activity; sid:45483; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rokrat file upload attempt"; flow:to_server,established; content:"/uploadfile"; http_uri; content:"filename=|22|pho_"; fast_pattern:only; http_client_body; pcre:"/filename\x3D\x22pho\x5F[A-F0-9]+?\x5f\d+?\x2Ejpg\x22/Pi"; content:"Content-Type: voice/mp3"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/171e26822421f7ed2e34cc092eaeba8a504b5d576c7fd54aa6975c2e2db0f824/detection; classtype:trojan-activity; sid:45510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/wp-includes/pomo/"; nocase; http_uri; content:".pif"; within:20; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/fb58d736c09fe1f05a36c2fe2c0ce3cfe03ece885ba8272000355e35600aef17/analysis/; classtype:trojan-activity; sid:45567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/xmlrpc/"; nocase; http_uri; content:".tif"; within:10; nocase; http_uri; pcre:"/\/xmlrpc\/\d{3,5}\x2etif/Ui"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/fb58d736c09fe1f05a36c2fe2c0ce3cfe03ece885ba8272000355e35600aef17/analysis/; classtype:trojan-activity; sid:45566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Vpnfilter variant outbound connection attempt"; flow:to_server,established; content:"User-Agent: Mozilla/5.0|0D 0A|Host: "; fast_pattern:only; http_header; content:"Accept: */*|0D 0A|Content-Type: application/x-www-form-urlencoded|0D 0A 0D 0A|"; http_header; content:!"Cookie:"; http_header; content:!"Referer:"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.talosintelligence.com/2018/05/VPNFilter.html; classtype:trojan-activity; sid:45564; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.Vpnfilter variant outbound connection attempt"; flow:to_server,established; content:"User-Agent: Mozilla/6.1 (compatible|3B| MSIE 9.0|3B| Windows NT 5.3|3B| Trident/5.0)|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.talosintelligence.com/2018/05/VPNFilter.html; classtype:trojan-activity; sid:45563; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.LockPoS outbound connection attempt"; flow:to_server,established; content:"/_x/_x.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/063f14091c811feb0b99de21d52dc55ca2ccb0c387b515e7407ea09a4337ceef/analysis/; classtype:trojan-activity; sid:45562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.LockPoS outbound connection attempt"; flow:to_server,established; content:"User-Agent: Lock|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/063f14091c811feb0b99de21d52dc55ca2ccb0c387b515e7407ea09a4337ceef/analysis/; reference:url,www.virustotal.com/en/file/1436577b2b111fe299a1321e00543d0e8d49d827abde651faea7403e4bb38644/analysis/; classtype:trojan-activity; sid:45561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.LockPoS outbound connection attempt"; flow:to_server,established; content:"/_x/update.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/1436577b2b111fe299a1321e00543d0e8d49d827abde651faea7403e4bb38644/analysis/; classtype:trojan-activity; sid:45560; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Velso ransomware download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|5C|get_my_files.txt"; fast_pattern:only; content:"Velso"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/4c8cf7ce3836edceb540edeccae97ef182331f6ed93e678d2e33105d01e809bf/analysis/; classtype:trojan-activity; sid:45552; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Velso ransomware download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|5C|get_my_files.txt"; fast_pattern:only; content:"Velso"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/4c8cf7ce3836edceb540edeccae97ef182331f6ed93e678d2e33105d01e809bf/analysis/; classtype:trojan-activity; sid:45551; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.xxmm second stage configuration download attempt"; flow:to_client,established; file_data; flowbits:isset,file.jpeg; content:"|FF D9|x|00|x|00|m|00|m|00|"; fast_pattern:only; content:"m|00|m|00|x|00|x|00|"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/18e896a7547aacb33aa3941ab1b61659ed099c0f6fbb924068f81b4289b05f12/analysis/; classtype:trojan-activity; sid:45574; rev:10;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rokrat variant outbound connection detected"; flow:to_server,established; content:".php?id="; http_uri; content:"fp_vs="; fast_pattern:only; http_uri; content:"os_vs="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/3004196da6055c6f062c94a9aae8dc357fa19b953b071049083e69e840083cf9/detection; classtype:trojan-activity; sid:45607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [$HTTP_PORTS,1025:] (msg:"MALWARE-CNC Win.Trojan.Agent outbound connection"; flow:to_server,established; content:"user-agent: libsfml-network/2.x"; fast_pattern:only; http_header; content:"from: user@sfml-dev.org"; nocase; http_header; content:"content-length: 64"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/af7a4f04435f9b6ba3d8905e4e67cfa19ec5c3c32e9d35937ec0546cce2dd1ff/analysis/; classtype:trojan-activity; sid:45658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vermin outbound connection attempt"; flow:to_server,established; urilen:3; content:"FgMBAFoBAABWAwFacgyY47N9f2hbus+/VSalBB0qkdube/LuEYBfQoqL7QAAGAAvADUABQAKwBPAFMAJwAoAMgA4ABMABAEAABX/AQABAAAKAAYABAAXABgACwACAQA="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/5ee12dd028f5f8c2c0eb76f28c2ce273423998b36f3fc20c9e291f39825601f9/detection; classtype:trojan-activity; sid:45651; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Doc.Dropper.Lazarus initial download"; flow:to_server,established; flowbits:isset,file.doc; file_data; content:"kgw:18 $HOME_NET any (msg:"MALWARE-CNC Doc.Dropper.Lazarus initial download"; flow:to_client,established; flowbits:isset,file.doc; file_data; content:"kgw:18 $EXTERNAL_NET 1025: (msg:"MALWARE-CNC Vbs.Trojan.Agent outbound system information disclosure"; flow:to_server,established; content:"POST /is-return "; depth:16; fast_pattern; content:"User-Agent"; content:"|2D 7C 2D|"; within:10; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45646; rev:3;)
alert tcp $EXTERNAL_NET 1025: -> $HOME_NET any (msg:"MALWARE-CNC Vbs.Trojan.Agent inbound payload download"; flow:to_client,established; content:"s2|2D 7C 2D|"; fast_pattern:only; content:"Content-Length"; content:"s3|2D 7C 2D|"; within:200; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45645; rev:3;)
alert tcp $EXTERNAL_NET 1025: -> $HOME_NET any (msg:"MALWARE-CNC Vbs.Trojan.Agent inbound payload download"; flow:to_client,established; content:"s1|2D 7C 2D|"; fast_pattern:only; content:"Content-Length"; content:"s1|2D 7C 2D|"; within:200; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45644; rev:3;)
alert tcp $EXTERNAL_NET 1025: -> $HOME_NET any (msg:"MALWARE-CNC Vbs.Trojan.Agent inbound payload download"; flow:to_client,established; content:"s0|2D 7C 2D|"; fast_pattern:only; content:"Content-Length"; content:"s0|2D 7C 2D|"; within:200; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45643; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1025: (msg:"MALWARE-CNC Vbs.Trojan.Agent outbound connection"; flow:to_server,established; content:"Content-Length: 0"; fast_pattern:only; content:"User-Agent"; content:"|2D 7C 2D|"; within:10; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45642; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt"; flow:to_server,established; content:"/wp-includes/ID3/opds.tif"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/264C92F7B91DD41A234BE261CAD448285365D26F4B128665C001D33AA44ACF07/analysis/; classtype:trojan-activity; sid:45675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.GandCrab outbound connection"; flow:to_server,established; content:"/curl.php?token="; fast_pattern:only; http_uri; content:"data="; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/69f55139df165bea1fcada0b0174d01240bc40bc21aac4b42992f2e0a0c2ea1d/detection; classtype:trojan-activity; sid:45694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [8043,8080,8843] (msg:"MALWARE-CNC Win.Trojan.CannibalRAT outbound upload attempt"; flow:to_server,established; content:"POST|20|/api/upload|20|"; depth:17; content:"User-Agent|3A 20|python-requests"; content:"name=|22|botid|22|"; fast_pattern:only; content:"name=|22|src|22|"; nocase; content:"name=|22|uploaded|22|"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b/analysis/; classtype:trojan-activity; sid:45773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [8043,8080,8843] (msg:"MALWARE-CNC Win.Trojan.CannibalRAT outbound reporting attempt"; flow:to_server,established; content:"POST|20|/api/report|20|"; depth:17; content:"User-Agent|3A 20|python-requests"; content:"botid="; fast_pattern:only; content:"output="; nocase; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/83d49f14ebb6641f1b813614a40e7df2d200096b8aae198e6298125f47b55b59/analysis/; classtype:trojan-activity; sid:45772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [8043,8080,8843] (msg:"MALWARE-CNC Win.Trojan.CannibalRAT initial outbound connection"; flow:to_server,established; content:"POST|20|/api/"; depth:10; content:"/hello"; depth:300; content:"User-Agent|3A 20|python-requests"; fast_pattern:only; content:"|22|username|22 3A|"; content:"|22|hostname|22 3A|"; content:"|22|platform|22 3A|"; content:"|22|memory|22 3A|"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/98bcb29912a8802d1a863d129d35876f7b2922146d2f05c17cd51ba907e617ba/analysis/; classtype:trojan-activity; sid:45771; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Saturn initial download"; flow:to_server,established; file_data; content:"|3C 90 A7 C3 20 1D FA FA 06 69 2A A7 CD FC FB FB FB 39 A2 3A 42 FC AB 3C 90 A7 C1 20 0D FE FE 3F|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/b3040fe60ac44083ef54e0c5414135dcec3d8282f7e1662e03d24cc18e258a9c/analysis/; classtype:trojan-activity; sid:45755; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Saturn initial download"; flow:to_client,established; file_data; content:"|3C 90 A7 C3 20 1D FA FA 06 69 2A A7 CD FC FB FB FB 39 A2 3A 42 FC AB 3C 90 A7 C1 20 0D FE FE 3F|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/b3040fe60ac44083ef54e0c5414135dcec3d8282f7e1662e03d24cc18e258a9c/analysis/; classtype:trojan-activity; sid:45754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Smominru outbound call"; flow:to_server,established; content:"/cudart32_65.dll"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Referrer|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/f1c36aebdcd92a04fd689d31944e5388e7e9b9421063ec4c98804ac7a04e6b0d; classtype:trojan-activity; sid:45827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Smominru outbound call"; flow:to_server,established; content:"/md5.txt"; depth:8; nocase; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Referrer|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/f1c36aebdcd92a04fd689d31944e5388e7e9b9421063ec4c98804ac7a04e6b0d; classtype:trojan-activity; sid:45826; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC User-Agent known malicious user-agent string - Win.Ransomware.Thanatos"; flow:to_server,established; content:"User-Agent|3A| Mozilla/5.0 (Windows NT 6.1) Thanatos/1.1"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/fe1eafb8e31a84c14ad5638d5fd15ab18505efe4f1becaa36eb0c1d75cd1d5a9; classtype:trojan-activity; sid:45816; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Dridex initial file download"; flow:to_server,established; file_data; content:"MZ"; depth:2; content:".coda"; depth:1000; content:".crt"; depth:1000; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/d2e29766acf5dab8b6b6a2c498a56e070a59329978e13faeedb9fc985884fe93/analysis/; classtype:trojan-activity; sid:45932; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex initial file download"; flow:to_client,established; file_data; content:"MZ"; depth:2; content:".coda"; depth:1000; content:".crt"; depth:1000; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/d2e29766acf5dab8b6b6a2c498a56e070a59329978e13faeedb9fc985884fe93/analysis/; classtype:trojan-activity; sid:45931; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Dridex initial file download"; flow:to_server,established; file_data; content:"MZ"; depth:2; content:".codu"; depth:1000; content:".crt"; depth:1000; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/en/file/d2e29766acf5dab8b6b6a2c498a56e070a59329978e13faeedb9fc985884fe93/analysis/; classtype:trojan-activity; sid:45930; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dridex initial file download"; flow:to_client,established; file_data; content:"MZ"; depth:2; content:".codu"; depth:1000; content:".crt"; depth:1000; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/en/file/d2e29766acf5dab8b6b6a2c498a56e070a59329978e13faeedb9fc985884fe93/analysis/; classtype:trojan-activity; sid:45929; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC CobaltStrike outbound beacon command result"; flow:to_server; content:"/submit.php?id="; fast_pattern:only; http_uri; content:"Content-Type: application/octet-stream"; nocase; http_header; content:"|0D 0A 0D 0A|"; byte_jump:4,0,relative; isdataat:!1,relative; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,colbaltstrike.com; classtype:trojan-activity; sid:45910; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC CobaltStrike trial version inbound beacon response"; flow:to_client; content:"X-Malware: X5O!P%@AP[4|5C|PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,colbaltstrike.com; classtype:trojan-activity; sid:45909; rev:1;)
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"MALWARE-CNC Cobalt Strike DNS beacon inbound TXT record"; flow:to_client; content:"|03|aaa|05|stage"; fast_pattern; content:"|00 00 10 00 01 00 00 00 01 01 00 FF|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service dns; reference:url,colbaltstrike.com; classtype:trojan-activity; sid:45908; rev:1;)
alert udp any any -> $HOME_NET 53 (msg:"MALWARE-CNC Cobalt Strike DNS beacon outbound TXT record"; flow:to_server; content:"|03|aaa|05|stage"; nocase; content:"|00 00 10 00 01|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service dns; reference:url,colbaltstrike.com; classtype:trojan-activity; sid:45907; rev:1;)
alert udp any any -> $HOME_NET 53 (msg:"MALWARE-CNC CobaltStrike DNS Beacon outbound A record"; flow:to_server; content:"|03|aaa|05|stage"; nocase; content:"|00 00 01 00 01|"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service dns; reference:url,colbaltstrike.com; classtype:trojan-activity; sid:45906; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.UDPOS outbound data exfiltration"; flow:to_server; isdataat:150; content:"|0F|"; content:"|04|note"; within:5; distance:15; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service dns; reference:url,attack.mitre.org/techniques/T1020; reference:url,blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns; reference:url,www.virustotal.com/#/file/62688903adfc719c5514f25a17563547aac4801959852f5d49faa93967ce86cf/detection; classtype:trojan-activity; sid:45968; rev:2;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.UDPOS outbound data exfiltration"; flow:to_server; isdataat:150; content:"|0F|"; content:"|03|trp"; within:4; distance:15; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service dns; reference:url,attack.mitre.org/techniques/T1020; reference:url,blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns; reference:url,www.virustotal.com/#/file/62688903adfc719c5514f25a17563547aac4801959852f5d49faa93967ce86cf/detection; classtype:trojan-activity; sid:45967; rev:2;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.UDPOS outbound heartbeat"; flow:to_server; isdataat:150; content:"|0F|"; content:"|04|ping"; within:5; distance:15; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service dns; reference:url,blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns; reference:url,www.virustotal.com/#/file/62688903adfc719c5514f25a17563547aac4801959852f5d49faa93967ce86cf/detection; classtype:trojan-activity; sid:45966; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.UDPOS outbound system information disclousre"; flow:to_server; isdataat:150; content:"|0F|"; content:"|03|bin"; within:4; distance:15; fast_pattern; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service dns; reference:url,blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns; reference:url,www.virustotal.com/#/file/62688903adfc719c5514f25a17563547aac4801959852f5d49faa93967ce86cf/detection; classtype:trojan-activity; sid:45964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.UDPOS outbound command and control IP address check"; flow:to_server,established; content:"/index.php?udpool="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns; reference:url,www.virustotal.com/#/file/62688903adfc719c5514f25a17563547aac4801959852f5d49faa93967ce86cf/detection; classtype:trojan-activity; sid:45963; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Revenge RAT inbound heartbeat check"; flow:to_client,established; content:"PNC|2A 2D 5D|NK|5B 2D 2A|"; depth:11; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/518f7803ad1b8e630f50719d7cb3638ea5d67fa4d4387a55f44ddca4ef55a3ee/analysis/; reference:url,www.virustotal.com/en/file/79bdbf9ec639d5ccf3992e9c9fe9eeba21d191dc168194a80b50f3aa8068892a/analysis/; reference:url,www.virustotal.com/en/file/edb115dd5ca7c7f9dd069746daa0a4ee6298bf94de62510d3f8bebfa5f5a8bcd/analysis/; classtype:trojan-activity; sid:45962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Revenge RAT initial outbound connection"; flow:to_server,established; content:"Information"; depth:11; content:"false|2A 2D 5D|NK|5B 2D 2A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/518f7803ad1b8e630f50719d7cb3638ea5d67fa4d4387a55f44ddca4ef55a3ee/analysis/; reference:url,www.virustotal.com/en/file/79bdbf9ec639d5ccf3992e9c9fe9eeba21d191dc168194a80b50f3aa8068892a/analysis/; reference:url,www.virustotal.com/en/file/edb115dd5ca7c7f9dd069746daa0a4ee6298bf94de62510d3f8bebfa5f5a8bcd/analysis/; classtype:trojan-activity; sid:45961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Silverstar outbound connection"; flow:to_server,established; content:"response=fallback"; fast_pattern:only; http_uri; content:"/api.php?"; depth:9; http_uri; content:"gpu="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/3f751799a501532f43ca5f12fe80aa0bad78f9f5d57e76bf49b401bb99f355df/detection; classtype:trojan-activity; sid:45960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Unix.Trojan.PyCryptoMiner outbound connection"; flow:to_server,established; content:"/api"; depth:4; http_uri; content:"action=get&name=jboss"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/file/d47d2aa3c640e1563ba294a140ab3ccd22f987d5c5794c223ca8557b68c25e0d/analysis/1519876147/; classtype:trojan-activity; sid:45956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection attempt"; flow:to_server,established; content:"/resp?"; depth:6; http_uri; pcre:"/\/resp\?[A-F0-9]+?(AAZ|ABZ)/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/231115a614c99e8ddade4cf4c88472bd3801c5c289595fc068e51b77c2c8563f/analysis/; classtype:trojan-activity; sid:45948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection attempt"; flow:to_server,established; content:"/chk?"; depth:6; http_uri; pcre:"/\/chk\?[A-F0-9]+?$/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/231115a614c99e8ddade4cf4c88472bd3801c5c289595fc068e51b77c2c8563f/analysis/; classtype:trojan-activity; sid:45947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection attempt"; flow:to_server,established; content:"/what?"; depth:6; http_uri; pcre:"/\/what\?[A-F0-9]+?$/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/231115a614c99e8ddade4cf4c88472bd3801c5c289595fc068e51b77c2c8563f/analysis/; classtype:trojan-activity; sid:45946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DarkSky variant outbound connection"; flow:to_server,established; urilen:>160; content:"/activation.php?key="; nocase; http_uri; content:"User-Agent: 2zAz"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/042614cc004f7a5236355cf66531f3b8becabb10a6d6bde9ddae772e2be54fdd/analysis/; classtype:trojan-activity; sid:45945; rev:1;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC known malicious SSL certificate - Odinaff C&C"; flow:to_client,established; ssl_state:server_hello; content:"|31 0B 30 09 06 03 55 04 06 13 02|--"; content:"|31 12 30 10 06 03 55 04 08 0C 09|SomeState"; content:"|31 11 30 0F 06 03 55 04 07 0C 08|SomeCity"; content:"|31 19 30 17 06 03 55 04 0A 0C 10|SomeOrganization"; content:"|31 1F 30 1D 06 03 55 04 0B 0C 16|SomeOrganizationalUnit"; content:"|31 0F 30 0D 06 03 55 04 03 0C 06|thabet"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/2503bdaeaa264bfc67b3a3603ee48ddb7b964d6466fac0377885c6649209c098/analysis/1477342434/; classtype:trojan-activity; sid:45944; rev:1;)
# alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC known malicious SSL certificate - Odinaff C&C"; flow:to_client,established; ssl_state:server_hello; content:"|31 0B 30 09 06 03 55 04 06 13 02|XX"; content:"|31 15 30 13 06 03 55 04 07 0C 0C|Default City"; content:"|31 1C 30 1A 06 03 55 04 0A 0C 13|Default Company Ltd"; fast_pattern:only; metadata:impact_flag red, policy security-ips drop, service ssl; reference:url,www.virustotal.com/en/file/2503bdaeaa264bfc67b3a3603ee48ddb7b964d6466fac0377885c6649209c098/analysis/1477342434/; classtype:trojan-activity; sid:45943; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC MultiOS.Trojan.OSCelestial variant inbound connection"; flow:to_client,established; content:"|74 00 29|net.oscp.client.keylogger.KeystrokeLogger"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/9b4843ff0181af15a6c8478ca00aafd4296592a2985a480575810f4f64442742/analysis/; classtype:trojan-activity; sid:45980; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC MultiOS.Trojan.OSCelestial variant outbound connection"; flow:to_server,established; content:"|72 00 17|com.net.LoginDataPacket"; fast_pattern:only; content:"|74 00 13|Lcom/net/LoginData"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/9b4843ff0181af15a6c8478ca00aafd4296592a2985a480575810f4f64442742/analysis/; classtype:trojan-activity; sid:45979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Suspected Unix.Malware.GoScanSSH outbound beacon attempt"; flow:established,to_server; content:"Host: "; http_header; content:".onion."; within:7; distance:16; http_header; urilen:>400; pcre:"/^\x2F[a-zA-Z0-9_\x2D]{400}/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/a390df91a70c6d745ec1ee660008964a476e0bb9f1e4e15314ab7117221f3832/detection; classtype:trojan-activity; sid:45974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [2050,7020,7628] (msg:"MALWARE-CNC Win.Trojan.Chafer malicious communication attempt"; flow:established,to_server; content:"/update.php|3F|"; content:"req|3D|"; content:"m|3D|b"; content:!"User-Agent"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/91b58105c4470a5d51b8037b8715524ab021b7fb9f05e9879d4d22ef705e78f0/analysis; classtype:trojan-activity; sid:45973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [2050,7020,7628] (msg:"MALWARE-CNC Win.Trojan.Chafer malicious communication attempt"; flow:established,to_server; content:"/update.php|3F|"; content:"req|3D|"; content:"m|3D|d"; content:!"User-Agent"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/36909773f0537abd863348c9cf44a1d5d6c5e77badf7df075378e0e51c52f7de/analysis; classtype:trojan-activity; sid:45972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Mobef variant outbound connection attempt"; flow:to_server,established; content:"/fukkha.php"; fast_pattern; http_uri; content:"a=286490"; within:50; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/aa2c9c02def2815aa24f5616051aa37e4ce002e62f507b3ce15aac191a36e162/analysis/; classtype:attempted-user; sid:46047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.yty file exfiltration outbound request"; flow:to_server,established; content:"Expect: 100-continue"; fast_pattern:only; http_header; content:"id="; depth:3; http_client_body; content:"&pc="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/; classtype:trojan-activity; sid:46070; rev:4;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.yty module request"; flow:to_server,established; content:"Expect: 100-continue"; fast_pattern:only; http_header; content:"cnumber="; http_uri; content:"orname="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/; classtype:trojan-activity; sid:46069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.yty module download request"; flow:to_server,established; content:"/football/download/"; depth:19; http_uri; content:!"User-Agent|3A|"; nocase; http_header; content:!"Accept|3A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/; classtype:trojan-activity; sid:46068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.yty plugin downloader initial outbound connection"; flow:to_server,established; content:"Expect: 100-continue"; fast_pattern:only; http_header; content:"pc="; http_client_body; content:"pc_data="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1176; reference:url,www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/; classtype:trojan-activity; sid:46067; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.yty second stage downloader initial outbound connection"; flow:to_server,established; content:"/football/goal"; fast_pattern:only; http_uri; content:"ball="; http_client_body; content:"score="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/; classtype:trojan-activity; sid:46066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Sigma outbound connection"; flow:to_server,established; urilen:10; content:"/email.bin"; fast_pattern:only; http_uri; content:"User-Agent: Microsoft BITS/"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1197; reference:url,virustotal.com/en/file/55f497f3728c57d284bd710bb517d6d2c56f0a6cc2248cfaf649294655abc1bc/analysis/; classtype:trojan-activity; sid:46065; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC User-Agent known malicious user-agent string Uploador - Win.Trojan.CrossRAT"; flow:to_server,established; content:"User-Agent|3A| Uploador|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/da81aec00b563123d2fbd14fb6a76619c90f81e83c5bd8aa0676922cae96b9ad/detection; classtype:trojan-activity; sid:46052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Bandook/Anbacas outbound connection attempt"; flow:to_server,established; content:"QDAwMD"; depth:6; fast_pattern; content:"&&&"; within:200; isdataat:!0,relative; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf; reference:url,www.virustotal.com/#/file/bf600e7b27bdd9e396e5c396aba7f079c244bfb92ee45c721c2294aa36586206/detection; classtype:trojan-activity; sid:46051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.CrossRAT outbound connection attempt"; flow:to_server,established; content:"[^8]&&&"; fast_pattern:only; content:"[^8]&&&"; isdataat:!0,relative; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/#/file/da81aec00b563123d2fbd14fb6a76619c90f81e83c5bd8aa0676922cae96b9ad/detection; classtype:trojan-activity; sid:46050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fosniw variant connection attempt"; flow:to_server,established; content:"app.asp?prj="; http_uri; content:"logdata=MacTryCnt:0&code="; within:100; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/b0f4f14e9c5e800f0534620ed685f8e21e46829cdb6065006c21b12b806519e4/detection; classtype:trojan-activity; sid:46049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Gen variant outbound communication"; flow:established,to_server; content:"/A56WY"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,us-cert.gov/ncas/alerts/TA17-293A; classtype:trojan-activity; sid:46048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Modimer Trojanized MediaGet outbound connection"; flow:to_server,established; content:"video_associations="; fast_pattern:only; http_client_body; content:"/start.php"; http_uri; urilen:10; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,cloudblogs.microsoft.com/microsoftsecure/2018/03/13/poisoned-peer-to-peer-app-kicked-off-dofoil-coin-miner-outbreak/; classtype:trojan-activity; sid:46099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Bandarchor variant outbound connection"; flow:to_server,established; urilen:14; content:"/123/index.php"; fast_pattern:only; http_uri; content:"="; depth:1; offset:1; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/4c0855466cc65cfc273f8cd953c9bf328656732879a0ce387cbdf9c78b9827a1/detection; classtype:trojan-activity; sid:46141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Bandarchor variant outbound connection"; flow:to_server,established; urilen:14; content:"/555/index.php"; fast_pattern:only; http_uri; content:"="; depth:1; offset:1; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/4c0855466cc65cfc273f8cd953c9bf328656732879a0ce387cbdf9c78b9827a1/detection; classtype:trojan-activity; sid:46140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Bandarchor variant outbound connection"; flow:to_server,established; urilen:14; content:"/777/index.php"; fast_pattern:only; http_uri; content:"="; depth:1; offset:1; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/4c0855466cc65cfc273f8cd953c9bf328656732879a0ce387cbdf9c78b9827a1/detection; classtype:trojan-activity; sid:46139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Bandarchor variant outbound connection"; flow:to_server,established; urilen:14; content:"/345/index.php"; fast_pattern:only; http_uri; content:"="; depth:1; offset:1; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/4c0855466cc65cfc273f8cd953c9bf328656732879a0ce387cbdf9c78b9827a1/detection; classtype:trojan-activity; sid:46138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Cidox variant outbound connection attempt"; flow:to_server,established; content:"POST /b/req/"; depth:12; content:" HTTP/1.1|0D 0A|Accept: */*|0D 0A|Content-Type: application/octet-stream|0D 0A|Connection: Close|0D 0A|User-Agent: Mozilla/"; within:103; distance:24; content:")|0D 0A|Host: "; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; classtype:trojan-activity; sid:46137; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banbra variant outbound connection"; flow:to_server,established; content:"User-Agent: Mozilla/3.0 (compatible|3B| Indy Library)"; http_header; content:"remetente="; depth:10; fast_pattern; http_client_body; content:"&destinatario"; distance:0; http_client_body; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:46136; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"MALWARE-CNC Win.Trojan.Krodown variant connection attempt"; flow:to_server,established; file_data; content:"http://"; depth:7; content:":8888/5.txt"; within:40; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d5d5831105b5f4e048091e5a46c6d02820c768de340970b4614bc1dae74f86ee/analysis/; classtype:trojan-activity; sid:46135; rev:1;)
alert tcp $EXTERNAL_NET 8888 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Krodown variant connection attempt"; flow:to_client,established; file_data; content:"echo"; content:">>%systemroot%|5C|system32|5C|drivers|5C|etc|5C|hosts.ics"; within:100; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/d5d5831105b5f4e048091e5a46c6d02820c768de340970b4614bc1dae74f86ee/analysis/; classtype:trojan-activity; sid:46134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.HW32 variant outbound connection"; flow:to_server,established; content:"Cpa=+EXEC+"; depth:10; http_client_body; content:"%27%2C%27"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/0b2e8a9413d3b34d532d553922bd402830c1784302fc8ecaeeee17e826798d46/analysis/; classtype:trojan-activity; sid:46129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Coldroot RAT outbound connection"; flow:to_server,established; content:"|22|PCName|22|:"; fast_pattern:only; content:"|22|Ver|22|:"; nocase; content:"|22|Serial|22|:"; nocase; content:"|22|OS|22|:"; nocase; content:"|22|ID|22|:"; nocase; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/c20980d3971923a0795662420063528a43dd533d07565eb4639ee8c0ccb77fdf/detection; classtype:trojan-activity; sid:46156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix file upload attempt"; flow:to_server,established; content:"/images/"; http_uri; content:".bmp"; http_uri; content:"filename=|22|D73B.bin"; fast_pattern:only; http_client_body; content:"MSCF"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/detection; classtype:trojan-activity; sid:46253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix outbound connection attempt"; flow:established,to_server; content:"/OU/nc.dat"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis; classtype:trojan-activity; sid:46252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix outbound connection attempt"; flow:established,to_server; content:"/OU/freddie.php|3F|"; content:"l|3D|"; content:"brandg"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis; classtype:trojan-activity; sid:46251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix outbound connection attempt"; flow:established,to_server; content:"/FBB/brandg.class"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis; classtype:trojan-activity; sid:46250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rovnix outbound connection attempt"; flow:established,to_server; content:"/OU/stem.php|3F|"; content:"utma|3D|"; content:"brandg"; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis; classtype:trojan-activity; sid:46249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rarog user-agent outbound communication attempt"; flow:to_server,established; file_data; content:"User-Agent"; nocase; http_header; content:"Rarog"; within:200; fast_pattern; nocase; http_header; pcre:"/User-Agent\s*:[^\r\n]*Rarog/iH"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:46240; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rarog outbound communication attempt"; flow:to_server,established; file_data; content:"POST"; nocase; http_method; content:"/4.0/method/"; depth:12; nocase; http_uri; pcre:"/\/4\.0\/method\/(check|cores|installSuccess|modules|threads|blacklist)/iU"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:46239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Rarog outbound communication attempt"; flow:to_server,established; file_data; content:"POST"; nocase; http_method; content:"/2.0/method/"; depth:12; nocase; http_uri; pcre:"/\/2\.0\/method\/(checkConnection|config|delay|error|get|info|setOnline|update)/iU"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:46238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Dofoil file download attempt"; flow:established,to_server; content:"/15022018/"; fast_pattern:only; http_uri; content:"Host|3A|"; http_header; content:".bit"; distance:1; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d191ee5b20ec95fe65d6708cbb01a6ce72374b309c9bfb7462206a0c7e039f4d/analysis; classtype:trojan-activity; sid:46236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Dofoil outbound connection attempt"; flow:established,to_server; content:"/smidSdkjkk/gate.php"; fast_pattern:only; http_uri; content:"client_id|3D|"; http_uri; content:"connected|3D|"; http_uri; content:"server_port|3D|"; http_uri; content:"debug|3D|"; http_uri; content:"sm_id|3D|"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d191ee5b20ec95fe65d6708cbb01a6ce72374b309c9bfb7462206a0c7e039f4d/analysis; classtype:trojan-activity; sid:46235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Blackshades variant outbound communication"; flow:to_server,established; content:"/system/classes/alive.php"; fast_pattern:only; http_uri; content:"?key="; nocase; http_uri; content:"&pcuser="; nocase; http_uri; content:"&pcname="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/86f83fe8dfe6a0bce639e12876d983bb9dbe94d4b1db5062144a93780c1916d9/analysis/; classtype:trojan-activity; sid:46210; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Downloader.Wannamine malicious Powershell download attempt"; flow:established,to_server; file_data; content:"|24 66 61 3D 27 5A 6E 56 75 59 33 52 70 62 32 34 67 53 57 35 32 62 32 74 6C 4C 56 64 4E 53 55 56|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/en/file/3f287e29bcb10b200439626d97dd49521816c8dc847797f5acc7ebfe25b4efc4/analysis/; classtype:trojan-activity; sid:46203; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Downloader.Wannaminer malicious Powershell download attempt"; flow:established,to_client; file_data; content:"|24 66 61 3D 27 5A 6E 56 75 59 33 52 70 62 32 34 67 53 57 35 32 62 32 74 6C 4C 56 64 4E 53 55 56|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/3f287e29bcb10b200439626d97dd49521816c8dc847797f5acc7ebfe25b4efc4/analysis/; classtype:trojan-activity; sid:46202; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Bandios inbound delivery attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"1Q2a3k79"; fast_pattern:only; content:"MD5Final"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/ee3302fc5fca16f74a9fed36f14db4139ca3d9f8a4528e67797862dd91b7f5be/community; classtype:trojan-activity; sid:46286; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Bandios inbound delivery attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"1Q2a3k79"; fast_pattern:only; content:"MD5Final"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/ee3302fc5fca16f74a9fed36f14db4139ca3d9f8a4528e67797862dd91b7f5be/community ; classtype:trojan-activity; sid:46285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Bandios user agent outbound communication attempt"; flow:to_server,established; content:"User-Agent|3A| DoPost"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2; classtype:trojan-activity; sid:46284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sanny malware variant FTP login"; flow:to_server,established; content:"USER cnix_21072852|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp; reference:url,www.virustotal.com/#/file/b0f30741a2449f4d8d5ffe4b029a6d3959775818bf2e85bab7fea29bd5acafa4/detection; classtype:trojan-activity; sid:46272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sanny malware variant FTP login"; flow:to_server,established; content:"PASS vlasimir2017|0D 0A|"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp; reference:url,www.virustotal.com/#/file/b0f30741a2449f4d8d5ffe4b029a6d3959775818bf2e85bab7fea29bd5acafa4/detection; classtype:trojan-activity; sid:46271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Sanny URI request for known malicious URI"; flow:to_server,established; content:"/3.txt"; fast_pattern:only; http_uri; urilen:6; content:"User-Agent: Microsoft-CryptoAPI/6.1"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/b0f30741a2449f4d8d5ffe4b029a6d3959775818bf2e85bab7fea29bd5acafa4/detection; classtype:trojan-activity; sid:46270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Sanny URI request for known malicious URI"; flow:to_server,established; content:"/1.txt"; fast_pattern:only; http_uri; urilen:6; content:"User-Agent: Microsoft-CryptoAPI/6.1"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/b0f30741a2449f4d8d5ffe4b029a6d3959775818bf2e85bab7fea29bd5acafa4/detection; classtype:trojan-activity; sid:46269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Sanny URI request for known malicious URI"; flow:to_server,established; content:"/2.txt"; fast_pattern:only; http_uri; urilen:6; content:"User-Agent: Microsoft-CryptoAPI/6.1"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/b0f30741a2449f4d8d5ffe4b029a6d3959775818bf2e85bab7fea29bd5acafa4/detection; classtype:trojan-activity; sid:46268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Matrix outbound connection"; flow:to_server,established; content:"add.php?apikey="; http_uri; content:"&compuser="; http_uri; content:"&sid="; http_uri; content:"&phase="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,"www.virustotal.com/#/file/996ea85f12a17e8267dcc32eae9ad20cff44115182e707153006162711fbe3c9/detection"; classtype:trojan-activity; sid:46339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FILE_DATA_PORTS (msg:"MALWARE-CNC Win.Trojan.Dropper variant outbound connection"; flow:established,to_server; content:"IHkoeWRrcnkpIikqNy95ZCB5LSl5ZCB5"; depth:40; fast_pattern; http_client_body; content:!"Referer|3A|"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/fd08f6bc823cbfa495f0568ba4284e02f1cad57e56bd04ef0a0b948ea9dddee4/details; classtype:trojan-activity; sid:46378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/p/wokaixin158998/detail"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d/detection; classtype:trojan-activity; sid:46364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/p/haoxingfu12389/detail"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d/detection; classtype:trojan-activity; sid:46363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/p/haoxingfu88/detail"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/c65318aa58c9091b938948b62c4b5d6e47237697d8d2f96863f99ef177b6818d/detection; classtype:trojan-activity; sid:46362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/abfdbnas3"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/aa183fda57fde0137ab931f3729215956e6f9ee158d90ed82151948f70db841b/detection; classtype:trojan-activity; sid:46361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/cdvsvfa2"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/aa183fda57fde0137ab931f3729215956e6f9ee158d90ed82151948f70db841b/detection; classtype:trojan-activity; sid:46360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/asbfdee1"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/aa183fda57fde0137ab931f3729215956e6f9ee158d90ed82151948f70db841b/detection; classtype:trojan-activity; sid:46359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/user/329505325"; fast_pattern:only; http_uri; content:"Host: my.tv.sohu.com"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/aa183fda57fde0137ab931f3729215956e6f9ee158d90ed82151948f70db841b/detection; classtype:trojan-activity; sid:46358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/user/329505231"; fast_pattern:only; http_uri; content:"Host: my.tv.sohu.com"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/detection; classtype:trojan-activity; sid:46357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.Wroba outbound connection"; flow:to_server,established; content:"/user/329505338"; fast_pattern:only; http_uri; content:"Host: my.tv.sohu.com"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/detection; classtype:trojan-activity; sid:46356; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Vbs.Downloader.Agent inbound delivery attempt"; flow:to_server,established; flowbits:isset,file.ole; file_data; content:"Shell"; nocase; content:"vbHide"; within:100; fast_pattern; content:"Chr"; nocase; content:"Asc"; within:100; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/#/file/7975cbaa5657d89b45126bf739fd84acd5bbe724f372a20360bd4fc038b67541; classtype:trojan-activity; sid:46439; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Vbs.Downloader.Agent inbound connection"; flow:to_client,established; flowbits:isset,file.ole; file_data; content:"Shell"; nocase; content:"vbHide"; within:100; fast_pattern; content:"Chr"; nocase; content:"Asc"; within:100; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/7975cbaa5657d89b45126bf739fd84acd5bbe724f372a20360bd4fc038b67541; classtype:trojan-activity; sid:46438; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Vbs.Downloader.Agent inbound connection"; flow:to_server,established; flowbits:isset,file.ole; file_data; content:"3832D640-CF90-11CF-8E43-00A0C911005A"; fast_pattern:only; content:"Workbook_Open"; nocase; content:"Document_Open"; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/#/file/7975cbaa5657d89b45126bf739fd84acd5bbe724f372a20360bd4fc038b67541; classtype:trojan-activity; sid:46437; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Vbs.Downloader.Agent inbound connection"; flow:to_client,established; flowbits:isset,file.ole; file_data; content:"3832D640-CF90-11CF-8E43-00A0C911005A"; fast_pattern:only; content:"Workbook_Open"; nocase; content:"Document_Open"; nocase; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/7975cbaa5657d89b45126bf739fd84acd5bbe724f372a20360bd4fc038b67541; classtype:trojan-activity; sid:46436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Vbs.Downloader.Kryptik known malicious user-agent string "; flow:to_server,established; content:"User-Agent|3A| USR-KL"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/7975cbaa5657d89b45126bf739fd84acd5bbe724f372a20360bd4fc038b67541; classtype:trojan-activity; sid:46435; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Adware.Doyo client outbound connection"; flow:established,to_server; content:"|01 00 00 00 01 01 00 00 01 00 00 00 00 00 04 00 03 00 00 00 00 00 00 00 00 00 00 00|"; depth:28; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/0692bfe17754036b12b862cd5618051d8b2def85aca2a910188a12baa1ed0060; classtype:trojan-activity; sid:46434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Adware.Doyo initial connection"; flow:established, to_server; content:"data=85702b2fccafcb2f"; depth:21; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/0692bfe17754036b12b862cd5618051d8b2def85aca2a910188a12baa1ed0060; classtype:trojan-activity; sid:46433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Kraens initial outbound request"; flow:to_server,established; content:"/up_d.php"; fast_pattern:only; http_uri; content:"{|22|i|22|:"; depth:5; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/426d7bb2f4b362c6ff6b982565aa2bdb47e70320da0f60ba6c9bf04049e08829; classtype:trojan-activity; sid:46423; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.Kraens delivery attempt"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"{|22|i|22|:|22|%s|22|,|22|l|22|:["; fast_pattern:only; content:"RES_OK"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/#/file/426d7bb2f4b362c6ff6b982565aa2bdb47e70320da0f60ba6c9bf04049e08829; classtype:trojan-activity; sid:46422; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Kraens delivery attempt"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"{|22|i|22|:|22|%s|22|,|22|l|22|:["; fast_pattern:only; content:"RES_OK"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/426d7bb2f4b362c6ff6b982565aa2bdb47e70320da0f60ba6c9bf04049e08829; classtype:trojan-activity; sid:46421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Spyware.Autoit outbound connection"; flow:to_server,established; content:"win32=FFD8FFE000104A464946"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/8ac4e164b463c313af059760ce1f830c19b0d5a280ec80554e8f77939143e24e; classtype:trojan-activity; sid:46416; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Bitvote miner kernel driver payload download attempt"; flow:to_client,established; flowbits:isset,file.gif; file_data; content:"lKTD"; fast_pattern; content:"MZ"; within:50; content:"This program cannot be run in DOS mode"; within:200; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/019426698cb1cc733024c38d0d09ff5dcac1ad9cf81d26c092a278f72f131e59/analysis/; classtype:trojan-activity; sid:46407; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Bitvote miner kernel driver outbound request attempt"; flow:to_server,established; content:"/dr.php"; fast_pattern:only; http_uri; content:"mid="; nocase; http_client_body; content:"agentid="; nocase; http_client_body; content:"idx="; nocase; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/019426698cb1cc733024c38d0d09ff5dcac1ad9cf81d26c092a278f72f131e59/analysis/; classtype:trojan-activity; sid:46406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent outbound request"; flow:to_server,established; content:".php?&1001="; fast_pattern:only; http_uri; content:"1="; http_client_body; content:"2="; http_client_body; pcre:"/(^|&)\d{1,2}=[^&]*?\d{4}/Pm"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/123275cc76ef377986715c98abb0fec50cbd53f01dc3976080009dc7cdafbe86/analysis/; classtype:trojan-activity; sid:46502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent outbound request"; flow:to_server,established; content:".php?&1001="; fast_pattern:only; http_uri; content:"99="; http_uri; content:"f1="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/123275cc76ef377986715c98abb0fec50cbd53f01dc3976080009dc7cdafbe86/analysis/; classtype:trojan-activity; sid:46501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ammy download attempt"; flow:to_server,established; content:"/q2/index.php?"; fast_pattern:only; http_uri; content:"id="; http_uri; content:"&c="; http_uri; content:"&mk="; http_uri; content:"&il="; http_uri; content:"&vr="; http_uri; content:"&bt="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:46488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Ammy heartbeat"; flow:to_server,established; content:"id="; depth:3; offset:5; content:"&os="; within:4; distance:8; content:"&priv="; distance:0; content:"&cred="; distance:0; content:"&pcname="; distance:0; content:"&build_time="; distance:0; fast_pattern; content:"&card="; distance:0; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:46487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Installation Keylogger Osx.Trojan.Mokes data exfiltration"; flow:established,to_server,only_stream; content:"GET /v1 HTTP/1.1"; depth:16; fast_pattern; content:"Connection: "; http_header; content:"User-Agent: "; http_header; content:"Accept-Encoding: "; http_header; content:"Accept-Language: "; http_header; content:"Host: "; http_header; detection_filter:track by_src,count 3,seconds 6; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,attack.mitre.org/techniques/T1020; reference:url,attack.mitre.org/techniques/T1056; reference:url,www.virustotal.com/en/file/664e0a048f61a76145b55d1f1a5714606953d69edccec5228017eb546049dc8c/analysis/; classtype:trojan-activity; sid:46482; rev:6;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.SquirtDanger inbound delivery attempt"; flow:to_server,established; file_data; content:"%TEMP%|5C|MonoCecil"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/ff067b9450decd99ba6fccb3eaa15ed669e9bb40d4b24e131e51e9e3570073b0; classtype:trojan-activity; sid:46479; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.SquirtDanger inbound delivery attempt"; flow:to_server,established; file_data; content:"%TEMP%|5C|Microsoft_SQL_SDKs"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/ff067b9450decd99ba6fccb3eaa15ed669e9bb40d4b24e131e51e9e3570073b0; classtype:trojan-activity; sid:46478; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.SquirtDanger inbound delivery attempt"; flow:to_client,established; file_data; content:"%TEMP%|5C|Microsoft_SQL_SDKs"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/ff067b9450decd99ba6fccb3eaa15ed669e9bb40d4b24e131e51e9e3570073b0; classtype:trojan-activity; sid:46477; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.SquirtDanger inbound delivery attempt"; flow:to_client,established; file_data; content:"%TEMP%|5C|MonoCecil"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/1f42c85b43acdaaf98f6f522bd5394c5351ca7cf27187e3c08d32f18fa00fc32; classtype:trojan-activity; sid:46476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.SquirtDanger get module list outbound request"; flow:to_server,established; content:"IConnector|0D|GetModuleList"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,www.virustotal.com/en/file/90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2; classtype:trojan-activity; sid:46475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/tm/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/pz/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/mn/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/kk/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/gr/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/5ad70ea6d1477d48170793ccf5adb482eb0bad21e9d1a4ba95937049bd24532d/detection; classtype:trojan-activity; sid:46587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/tm.zip"; http_uri; pcre:"/\/\d{8}\/tm\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/pz.zip"; http_uri; pcre:"/\/\d{8}\/pz\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/mn.zip"; http_uri; pcre:"/\/\d{8}\/mn\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/kk.zip"; http_uri; pcre:"/\/\d{8}\/kk\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/gr.zip"; http_uri; pcre:"/\/\d{8}\/gr\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ap.zip"; http_uri; pcre:"/\/\d{8}\/ap\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/al.zip"; http_uri; pcre:"/\/\d{8}\/al\.zip/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious system information disclosure"; flow:to_server,established; file_data; content:"vv="; content:"vw="; content:"mods="; content:"uname="; content:"cname="; content:"os="; content:"is="; content:"iss="; content:"iav="; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/aca39ba30759eaf9fbfc911aadfb9a61ef1bf70bcd35bebcd8161a48660a3228/detection; classtype:trojan-activity; sid:46579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious system information disclosure"; flow:to_server,established; content:"/av/"; http_uri; content:"/page2.php"; distance:2; http_uri; content:"AT="; http_client_body; content:"MD="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/223d79984a171b854b72026f6ca0c7a24bbc229db91ab6e26639af4a2de0da1e/detection; classtype:trojan-activity; sid:46578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/ap/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/ilha/al/"; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/mbvbs/"; http_uri; content:".zip"; distance:2; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a279131ec03d0c6a148f6db6e5263a588724531325cd52d2bd0917311c8268d6/detection; classtype:trojan-activity; sid:46575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload malicious file download"; flow:to_server,established; content:"/xver/"; http_uri; content:".zip"; distance:2; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/ba5062343ac64a138251b3f54861c85773b357cff0d007538099981b8eadd425/detection; classtype:trojan-activity; sid:46574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Gandcrab variant outbound connection"; flow:to_server,established; content:".bit|0D 0A|"; http_header; content:"User-Agent|3A| Mozilla/5.0 (Windows NT 6.1|3B| WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/ad48c3770736588b17b4af2599704b5c86ff8ae6dadd30df59ea2b1ccc221f9c/analysis/; classtype:trojan-activity; sid:46636; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Rubella Macro Builder generated payload"; flow:to_client,established; file_data; content:"Dim"; content:"reat"; content:"|22|ell"; within:75; fast_pattern; pcre:"/V(BA|.BA|B.A).{0,50}C(.reate|r.eate|re.ate|rea.te|reat.e|reate).{0,75}\x22ell/s"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/71ce7315d302a7d3ec6fac6534f262de213be59a19f84182c94b182cbe277f14/detection; classtype:trojan-activity; sid:46631; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Rubella Macro Builder generated payload"; flow:to_client,established; file_data; content:"Dim"; content:"reat"; content:"ell|22|"; within:75; fast_pattern; pcre:"/V(BA|.BA|B.A).{0,50}C(.reate|r.eate|re.ate|rea.te|reat.e|reate).{0,75}ell\x22/s"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/71ce7315d302a7d3ec6fac6534f262de213be59a19f84182c94b182cbe277f14/detection; classtype:trojan-activity; sid:46630; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Rubella Macro Builder generated payload"; flow:to_server,established; file_data; content:"Dim"; content:"reat"; content:"ell|22|"; within:75; fast_pattern; pcre:"/V(BA|.BA|B.A).{0,50}C(.reate|r.eate|re.ate|rea.te|reat.e|reate).{0,75}ell\x22/s"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/71ce7315d302a7d3ec6fac6534f262de213be59a19f84182c94b182cbe277f14/detection; classtype:trojan-activity; sid:46629; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Rubella Macro Builder generated payload"; flow:to_server,established; file_data; content:"Dim"; content:"reat"; content:"|22|ell"; within:75; fast_pattern; pcre:"/V(BA|.BA|B.A).{0,50}C(.reate|r.eate|re.ate|rea.te|reat.e|reate).{0,75}\x22ell/s"; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/71ce7315d302a7d3ec6fac6534f262de213be59a19f84182c94b182cbe277f14/detection; classtype:trojan-activity; sid:46628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Unruy outbound callout"; flow:to_server,established; content:".php?q="; fast_pattern:only; http_uri; content:"Accept-Language: en-us"; http_header; content:"Accept-Encoding: gzip, deflate"; http_header; content:"Connection: Keep-Alive"; http_header; content:"Referer: http://www.google.com"; http_header; pcre:"/.php\?q=\d{1,4}\.\d{2,4}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.[0-9a-f]{64}\.1.\d{4,6}/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:46612; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banload second stage download request"; flow:established,to_server; isdataat:!100; content:!"Referer|3A|"; http_header; content:!"Accept"; http_header; content:!"User-Agent|3A 20|http"; http_header; content:".zip HTTP/1.1|0D 0A|Host|3A 20|"; fast_pattern:only; pcre:"/GET \/\w*.zip HTTP\/1.1\r\nHost\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\n/i"; metadata:impact_flag red, ruleset community, service http; classtype:trojan-activity; sid:46611; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.BlackIce variant outbound connection"; flow:to_server,established; content:"/blackice/"; nocase; http_uri; content:"User-Agent: blackice/1"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2acafc3bd1b5355971f48b456cf697e67e55624cc5095ae7ebac05a48a80ba0e/detection; classtype:trojan-activity; sid:46609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Blackshades variant outbound communication"; flow:to_server,established; content:"/system/classes/fg.php?key="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/86f83fe8dfe6a0bce639e12876d983bb9dbe94d4b1db5062144a93780c1916d9/analysis/; classtype:trojan-activity; sid:46608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Osx.Downloader.Crossrider outbound download request"; flow:to_server,established; content:"/sdl/mmStub.tar.gz?ts="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5b57f555f1d0500026235635ef8d761306bb4a8a8d25762677734eed269298bf/detection; classtype:trojan-activity; sid:46700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Brontok user-agent outbound connection"; flow:to_server,established; content:"User-Agent|3A| Administrator"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9b504da9e77ec067b0577b557443f76e84717cb00455ce39138eeaf344f3d2e3/analysis/; classtype:trojan-activity; sid:46642; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Qarallax outbound connection"; flow:established,to_server; content:"|00 05|child|01 00 16|"; depth:11; content:"|22|magic|22|"; within:100; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/658f67dbf509fc017ace6db7ed38b3591fe72b9ba950a59054869cd718b4da2b/analysis; classtype:trojan-activity; sid:46748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Qarallax outbound connection"; flow:established,to_server; content:"|00 07|nemesis"; depth:10; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/658f67dbf509fc017ace6db7ed38b3591fe72b9ba950a59054869cd718b4da2b/analysis; classtype:trojan-activity; sid:46747; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dropper malicious executable download attempt"; flow:to_client,established; content:"Content-Type:"; nocase; http_header; content:"application/java-vm"; within:50; fast_pattern; http_header; file_data; content:"MZ"; depth:2; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/#/file/76afa767b0374bde95d9a93074aceaec88228ba234caa13dd01313076baf02ee/detection; classtype:trojan-activity; sid:46744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $FILE_DATA_PORTS (msg:"MALWARE-CNC Win.Trojan.Dropper initial outbound connection attempt"; flow:to_server,established; content:".php?utma"; fast_pattern:only; http_uri; content:!"Referer:"; nocase; http_header; pcre:"/(stem|slick)\.php\?utma/iU"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/#/file/76afa767b0374bde95d9a93074aceaec88228ba234caa13dd01313076baf02ee/detection; classtype:trojan-activity; sid:46743; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Dropper malicious script download attempt"; flow:to_client,established; file_data; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Dharma ransomware dropper outbound connection"; flow:to_server,established; content:"/infolan.php"; fast_pattern:only; http_uri; content:"|7B 22|LanCnt|22 3A|"; depth:10; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/d913558f256224e6352b12cb6137ad8a789670b6c4d3a3a665ba8a0b961b2828/analysis/; classtype:trojan-activity; sid:46796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Dharma ransomware dropper initial outbound connection"; flow:to_server,established; content:"User-Agent|3A| infobot|0D 0A|"; fast_pattern:only; http_header; content:"|22|userpass|22|"; http_client_body; content:"|22|bits|22|"; http_client_body; content:"|22|disk|22|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a39af09bf65d8942d0c943151cdde8c04b302c5c0b115ab80759e226b50e743b/analysis/; classtype:trojan-activity; sid:46795; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC Outbound malicious vbscript attempt"; flow:to_server,established; file_data; content:"/ilha/"; fast_pattern; nocase; http_uri; content:"logs.php"; within:9; distance:2; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; classtype:attempted-user; sid:46792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"; flow:to_server,established; content:"/spyMobile/upload.php"; fast_pattern:only; http_uri; content:"iemi="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a/analysis; classtype:trojan-activity; sid:46790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"; flow:to_server,established; content:"/get/index.php"; http_uri; content:"id=Z29nbw=="; fast_pattern:only; http_uri; content:"user="; http_uri; content:"pass="; http_uri; content:"data="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a/analysis; classtype:trojan-activity; sid:46789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"; flow:to_server,established; content:"/telg/index.php?set=show"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a/analysis; classtype:trojan-activity; sid:46788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"; flow:to_server,established; content:"/telg/sv/sv.php"; fast_pattern:only; http_uri; content:"id"; http_client_body; content:"data"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/76fa36d35e0e16b0ea416726b0da2a66dfe7d7b35504cf6c475eac4cfa95fe3a/analysis; classtype:trojan-activity; sid:46787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Zebrocy initial outbound request"; flow:to_server,established; content:"?fort="; fast_pattern:only; http_uri; content:"pol="; depth:4; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/5fab4d08348b4ef080ba91bdb0d769d31797f5092bff3b24b3c23d091fccc8a7; classtype:trojan-activity; sid:46786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.Zebrocy known malicious user-agent string"; flow:to_server,established; content:"User-Agent|3A| Mozilla v5.1"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/5fab4d08348b4ef080ba91bdb0d769d31797f5092bff3b24b3c23d091fccc8a7; classtype:trojan-activity; sid:46785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [443,8443] (msg:"MALWARE-CNC Unix.Trojan.Vpnfilter variant SSL connection attempt"; flow:to_server,established; content:"|09 4D 69 63 72 6F 73 6F 66 74 31 10 30 0E 06 03 55 04 0B 13 07 53 75 70 70 6F 72 74 31 0B 30 09 06 03 55 04 03 13 02 63 61|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.talosintelligence.com/2018/05/VPNFilter.html; classtype:trojan-activity; sid:46783; rev:5;)
alert tcp $EXTERNAL_NET [443,8443] -> $HOME_NET any (msg:"MALWARE-CNC Unix.Trojan.Vpnfilter variant SSL connection attempt"; flow:to_client,established; content:"|09 4D 69 63 72 6F 73 6F 66 74 31 10 30 0E 06 03 55 04 0B 13 07 53 75 70 70 6F 72 74 31 0B 30 09 06 03 55 04 03 13 02 63 61|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,blog.talosintelligence.com/2018/05/VPNFilter.html; classtype:trojan-activity; sid:46782; rev:5;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Vega variant outbound connection detected"; flow:to_server,established; content:"/foaf.php"; fast_pattern:only; http_uri; urilen:9; content:"c="; nocase; http_client_body; isdataat:1000,relative; content:!"&"; within:1000; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign; classtype:trojan-activity; sid:46838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Vega variant outbound connection detected"; flow:to_server,established; content:"/lipomargara/lossyc.yarn"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign; classtype:trojan-activity; sid:46837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.Vega variant outbound connection detected"; flow:to_server,established; content:"/cachedmajsoea/index.php?e=lossyc"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign; classtype:trojan-activity; sid:46836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Dunihi outbound connection"; flow:to_server,established; content:"|00 00 A2 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 81 8D 00 30 81 89 02 81 81 00|"; depth:32; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/en/file/be442a5f8be3bf720236f71a613a534b8aa82b16b0daf8ff84a59bcb92e19e7d/analysis/; classtype:trojan-activity; sid:46827; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.N40 variant outbound connection"; flow:to_server,established; content:"/ponto.php"; fast_pattern:only; http_uri; content:"GENERAL="; depth:8; http_client_body; content:"&VERSAO="; within:75; http_client_body; content:"&NAVEGADOR="; within:75; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/bd5c8d44b1ec1a4ba712aa7e853f89d934bd459a2e502d4fce83b4be9cc90ca3/analysis/; classtype:trojan-activity; sid:46821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.QuantLoader variant outbound connection attempt"; flow:to_server,established; content:"/main/index.php"; fast_pattern:only; http_uri; content:"id="; http_uri; content:"c="; http_uri; content:"mk="; http_uri; content:"il="; http_uri; content:"vr="; http_uri; content:"bt="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/502497f5d165b64a2e287d77a06b34abcdedff227089217a874f49f58b536e92/analysis/; reference:url,virustotal.com/en/file/b87e0dd9b0e032c6d2d5f0bf46f00243a2a866bf1d3d22f8b72737b4aa1148eb/analysis/; classtype:trojan-activity; sid:46820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Satan outbound connection"; flow:to_server,established; content:"/data/token.php"; fast_pattern:only; http_uri; content:"status="; nocase; http_uri; content:"code="; nocase; http_uri; content:"Winnet Client"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/b686cba1894f8ab5cec0ce5db195022def00204f6cd143a325608ec93e8b74ee/analysis/; classtype:trojan-activity; sid:46818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC GPON botnet outbound communication"; flow:to_server,established; content:"/r -O -"; fast_pattern:only; http_uri; content:"/r+-O+-"; http_raw_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:cve,2018-10561; reference:url,vpnmentor.com/blog/critical-vulnerability-gpon-router/; classtype:trojan-activity; sid:46842; rev:2;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.RedLeaves variant outbound connection"; flow:to_server,established; content:".NET CLR 3.0.30729|3B| .NET4.0C|3B| .NET4.0E)|0D 0A|Content-Length"; fast_pattern:only; http_header; urilen:<20; content:"/index.php"; http_uri; content:"POST"; http_method; content:"Connection: Keep-Alive|0D 0A|Accept: */*|0D 0A|"; http_header; content:!"Content-Type"; http_header; content:!"Referer"; http_header; content:!"Accept-"; http_header; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b/analysis/; classtype:trojan-activity; sid:46839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 20480 (msg:"MALWARE-CNC Win.Trojan.CowerSnail initial outbound connection attempt"; flow:to_server,established; content:"+CHANNEL|0B|"; fast_pattern:only; content:"line-client"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service irc; reference:url,www.virustotal.com/#/file/3fb8a4d2ed4f662a4cb4270bb5f488b79c8758aa6fc5c8b119c78fba38d6b7d1/detection; classtype:trojan-activity; sid:46873; rev:1;)
alert tcp $EXTERNAL_NET 20480 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.CowerSnail command and control response detected"; flow:to_client,established; content:"pk"; depth:2; content:"R|00|e|00|q|00|u|00|e|00|s|00|t|00|"; fast_pattern:only; content:"|00|a|00|r|00|g|00|"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service irc; reference:url,www.virustotal.com/#/file/3fb8a4d2ed4f662a4cb4270bb5f488b79c8758aa6fc5c8b119c78fba38d6b7d1/detection; classtype:trojan-activity; sid:46872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Dropper.NavRat payload download"; flow:to_server,established; content:"/skin_board/s_build_cafeblog/exp_include/img.png"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/e5f191531bc1c674ea74f8885449f4d934d5f1aa7fd3aaa283fe70f9402b9574/analysis/; classtype:trojan-activity; sid:46871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nocturnal outbound connection"; flow:to_server,established; content:"/server/gate.php"; fast_pattern:only; http_uri; content:"name=|22|hwid|22|"; http_client_body; content:"name=|22|platform|22|"; http_client_body; content:"name=|22|pcount|22|"; http_client_body; content:"name=|22|cccount|22|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/ae7e5a7b34dc216e9da384fcf9868ab2c1a1d731f583f893b2d2d4009da15a4e/analysis/; classtype:trojan-activity; sid:46895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Vbs.Worm.SysinfY2X outbound beacon"; flow:established,to_server; content:"bot/lancer/index.php?cmd="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/fe9c78249937d57aaed2792238caeea298e715d9cf261add1fbfbaeeab084d40/detection; classtype:trojan-activity; sid:46894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"MALWARE-CNC Win.Trojan.Joanap variant outbound connection"; flow:to_server,established; content:"TO: Joana "; fast_pattern:only; content:"SUBJECT: |5B|T|5D|"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/#/file/077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885/detection; reference:url,www.virustotal.com/#/file/4c5b8c3e0369eb738686c8a111dfe460e26eb3700837c941ea2e9afd3255981e/detection; classtype:trojan-activity; sid:46885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DarkSeoul variant payload download"; flow:to_server,established; content:"/e107/e107_files/js/e107_001.cab"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6c627a4be54b6377af9f73ab0923aeebcccbb57ec94e995a2171deb69d61af9d/analysis/; classtype:trojan-activity; sid:46959; rev:2;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Js.Downloader.Cryptojacking miner download attempt"; flow:to_client,established; file_data; content:"[|22 5C|x69|5C|x64|22|]=|27||5C|x6d|5C|x5f|5C|x67|5C|x5f|5C|x61|27|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/#/file/b672224d6d3776da343ae0e15c32815082aa514805b5efe47fb2c678c861d534/detection; classtype:trojan-activity; sid:46946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Dropper outbound connection"; flow:to_server,established; content:"User-Agent: HTTPREAD|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/782cc4188618cf0c4815f85ea7873a004464095f5ed459b8d1579fa27ce5810e/analysis/; classtype:trojan-activity; sid:46936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fareit variant outbound connection"; flow:to_server,established; content:"/panel/logout.php"; depth:17; http_uri; content:!"Accept"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/en/file/6de535e8d4b82e5554a138ec1d6c6b530943ff08d5e04308d695f473e74f9600/analysis/; classtype:trojan-activity; sid:46922; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Autophyte RAT variant outbound connection"; flow:to_server,established; content:"Content-Disposition: form-data|3B| name=|22|board_id|22|"; fast_pattern:only; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|user_id|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|file1|22|"; http_client_body; content:!"Referer"; http_header; metadata:ruleset community, service http; reference:url,www.virustotal.com/#/file/c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8/detection; reference:url,www.virustotal.com/#/file/e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292/detection; classtype:trojan-activity; sid:46970; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Autophyte dropper variant outbound connection"; flow:to_server,established; urilen:10; content:"/mainls.cs"; fast_pattern:only; http_uri; content:"Content-Type: application/octet-stream"; nocase; http_header; content:!"User-Agent"; nocase; http_header; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47/detection; classtype:trojan-activity; sid:46969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Danabot outbound connection"; flow:to_server,established; content:"/index.php?m=T&"; fast_pattern:only; http_uri; content:"&a="; http_uri; content:"&b="; http_uri; content:"&d="; http_uri; content:"&e="; http_uri; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f60c6c45ff27d1733d8ab03393ab88e3a2d7c75c7d9fce3169417e8c9fd3df12/analysis; classtype:trojan-activity; sid:46968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Danabot outbound connection"; flow:to_server,established; content:"/index.php?m=F&"; fast_pattern:only; http_uri; content:"&a="; http_uri; content:"&b="; http_uri; content:"&d="; http_uri; content:"&e="; http_uri; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f60c6c45ff27d1733d8ab03393ab88e3a2d7c75c7d9fce3169417e8c9fd3df12/analysis; classtype:trojan-activity; sid:46967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Danabot outbound connection"; flow:to_server,established; content:"/index.php?m=S&"; fast_pattern:only; http_uri; content:"&a="; http_uri; content:"&b="; http_uri; content:"&d="; http_uri; content:"&e="; http_uri; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/f60c6c45ff27d1733d8ab03393ab88e3a2d7c75c7d9fce3169417e8c9fd3df12/analysis; classtype:trojan-activity; sid:46966; rev:1;)
alert tcp $EXTERNAL_NET [443,447,449] -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Backswap self-signed certificate exchange"; flow:to_client,established; content:"|16 03|"; content:"|30 82|"; distance:13; content:"SomeOrganizationalUnit"; fast_pattern:only; content:"root@DS848885.clientshostname.com"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/#/file/5349a0c06823fa285faa31381b5566b2a3d8990f6a5b6775288471caa35f8516; classtype:trojan-activity; sid:46965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Ammyy RAT outbound connection"; flow:to_server,established; content:"&priv="; content:"&cred="; fast_pattern:only; content:"&pcname="; content:"&avname="; content:"&build_time="; content:"&card="; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/bab69fb29c167451608f0840ede9dfb4c3c52fa0da5f38089ac7f2afbd94d867/detection; classtype:trojan-activity; sid:46964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Adware.Taplika toolbar download attempt"; flow:to_server,established; content:"php?context="; fast_pattern:only; http_uri; content:"&status="; http_uri; content:"&sesid="; http_uri; content:"&iid="; http_uri; content:"&cd="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/6a9b041b65d699da4ecb66b2c0a7321e82a81b4aae03f0d7b7382f8d598bc471/analysis/; classtype:trojan-activity; sid:46963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Yoban RAT outbound connection"; flow:to_server,established; content:"7n6HZllH="; fast_pattern:only; content:"/ch49/"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/80384531435a6281a53f8d2b6f10a9aa80c199fac9f7684d7be4c53922b5e773/detection; classtype:trojan-activity; sid:46985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Yoban RAT outbound connection"; flow:to_server,established; content:"/newbuild/t.php?stats="; fast_pattern:only; http_uri; content:"&thread="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/80384531435a6281a53f8d2b6f10a9aa80c199fac9f7684d7be4c53922b5e773/detection; classtype:trojan-activity; sid:46984; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Orcus RAT inbound SSL certificate"; flow:to_client,established; content:"|16 03|"; depth:2; content:"|02|"; within:1; distance:3; content:"|0C|Orcus Server"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ssl; reference:url,virustotal.com/en/file/8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a/analysis/; classtype:trojan-activity; sid:46981; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET [$HTTP_PORTS,1337,5156] (msg:"MALWARE-CNC Win.Trojan.SocketPlayer outbound connection"; flow:to_server,established; content:"/uploads/excutbls/h/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/de38e74b2cd493d0f014fc6ca5d2834cea213778c2e056a7c84e9547fe275889/analysis/; classtype:trojan-activity; sid:47006; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET [$HTTP_PORTS,3000,5156,7218] (msg:"MALWARE-CNC Win.Trojan.SocketPlayer outbound connection"; flow:to_server,established; content:"POST /cl/uplod/"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/de38e74b2cd493d0f014fc6ca5d2834cea213778c2e056a7c84e9547fe275889/analysis/; classtype:trojan-activity; sid:47005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [1433,5003] (msg:"MALWARE-CNC Win.Trojan.MnuBot variant outbound SQL connection"; flow:to_server,established; content:"S|00|E|00|T|00 20 00|F|00|M|00|T|00|O|00|N|00|L|00|Y|00 20 00|O|00|N|00 20 00|s|00|e|00|l|00|e|00|c|00|t|00 20 00|*|00 20 00|f|00|r|00|o|00|m|00 20 00|x|00|g|00|o|00|r|00|d|00|o"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,www.virustotal.com/#/file/7e8ee86a1170ca5bbac64b5cab8817a4e65e76a78d36e242fba3755338174781/; classtype:trojan-activity; sid:46998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Malware.Innaput variant outbound connection"; flow:established,to_server,no_stream; isdataat:!60; isdataat:59; content:"|00 00 00 00|"; depth:4; pcre:"/^\x00\x00\x00\x00[0-9a-f]{24}\x00/"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,www.virustotal.com/#/file/1570e5d88d14111fb0293fdb9764f34ff19550a1f97c9dee684607924f5a3bb4/detection; classtype:trojan-activity; sid:47030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent variant outbound connection detected"; flow:to_server,established; content:"/search.php"; fast_pattern:only; http_uri; content:"var="; nocase; http_uri; content:"name="; nocase; http_uri; content:"n="; nocase; http_uri; content:"o="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:47027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent variant outbound connection detected"; flow:to_server,established; content:"/config.php"; fast_pattern:only; http_uri; content:"inst="; nocase; http_uri; content:"name="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:47026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Syndicasec variant outbound connection"; flow:to_server,established; content:"P0wned by Q"; fast_pattern:only; http_client_body; content:"IP:"; nocase; http_client_body; content:"/interface/xmlrpc"; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets; classtype:trojan-activity; sid:47025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Spyware.Invisimole CnC outbound connection"; flow:to_server,established; content:"/www/"; depth:5; fast_pattern; http_uri; content:"/00"; distance:0; http_uri; content:!"Accept|3A|"; http_header; pcre:"/\/www\/(%[A-F0-9]{2}){5,}\/00/I"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/be554e706f6b8ab8f4bbea209b669e9dca98bf647faa55c46756f322dadab32f/analysis/; classtype:trojan-activity; sid:47016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ICLoader outbound connection"; flow:to_server,established; content:"|0A|User-Agent|3A 20|Christmas Mystery"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c3267535c9f16940b939f74298ec902db6ebe187461c015bc48b6bf13a9aa808/analysis/1529443552/; classtype:trojan-activity; sid:47051; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TYPEFRAME malware download attempt"; flow:to_client,established; flowbits:isnotset,file.msi; flowbits:isnotset,file.packed; file_data; content:"|C7 04 24 DA E1 61 FF C7 44 24 04 0C 27 95 87 C7 44 24 08 17 57 A4 D6 C7 44 24 0C EA E3 82 2B|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210/analysis/; classtype:trojan-activity; sid:47090; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TYPEFRAME malware download attempt"; flow:to_client,established; flowbits:isnotset,file.msi; flowbits:isnotset,file.packed; file_data; content:"|C7 45 30 85 C0 7C 17 C7 45 34 8B 4D F4 8B C7 45 38 76 20 33 C0 C7 45 3C 3B C8 77 0B|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8/analysis/; classtype:trojan-activity; sid:47089; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TYPEFRAME malware download attempt"; flow:to_client,established; flowbits:isnotset,file.msi; flowbits:isnotset,file.packed; file_data; content:"|C6 44 24 0C DA C6 44 24 0D E1 C6 44 24 0E 61 C6 44 24 0F FF C6 44 24 10 0C C6 44 24 11 27 C6 44|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/3c809a10106990ba93ec0ed3b63ec8558414c6680f6187066b1aacd4d8c58210/analysis/; classtype:trojan-activity; sid:47088; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TYPEFRAME malware download attempt"; flow:to_client,established; flowbits:isnotset,file.msi; flowbits:isnotset,file.packed; file_data; content:"|C6 44 24 14 75 C6 44 24 15 0E C6 44 24 1A C1 C6 44 24 1C 84 C6 44 24 1D D2 C6 44 24 1E 75 C6 44|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/d1d490866d4a4d29306f0d9300bffc1450c41bb8fd62371d29672bf9f747bf92/analysis/; classtype:trojan-activity; sid:47087; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.TYPEFRAME malware download attempt"; flow:to_client,established; flowbits:isnotset,file.msi; flowbits:isnotset,file.packed; file_data; content:"|85 C6 44 24 16 7C C6 44 24 17 17 C6 44 24 19 4D C6 44 24 1A F4 C6 44 24 1C 76 C6 44 24 1D 20 C6|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/en/file/8c3e0204f52200325ed36db9b12aba1c5e46984d415514538a5bf10783cacdf8/analysis/; classtype:trojan-activity; sid:47086; rev:1;)
alert tcp any any -> any any (msg:"MALWARE-CNC Unix.Trojan.Vpnfilter variant connection attempt"; flow:stateless; flags:S+; content:"|0C 15 22 2B|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,blog.talosintelligence.com/2018/05/VPNFilter.html; classtype:trojan-activity; sid:47084; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Powershell PRB backdoor initial outbound communication attempt"; flow:to_server,established; content:"Content-Length|3A| 199|0D 0A|"; fast_pattern:only; http_header; content:"=="; depth:2; offset:194; http_client_body; pcre:"/^[A-Za-z0-9+\/]{194}==\d{2}/P"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b/analysis/; classtype:trojan-activity; sid:47076; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Smokeloader outbound response"; flow:established,to_client; content:"Content-Length: 7|0D 0A|"; fast_pattern:only; http_header; content:"404"; http_stat_code; file_data; content:"|03 00 00 00|"; depth:4; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/b65806521aa662bff2c655c8a7a3b6c8e598d709e35f3390df880a70c3fded40/detection; classtype:trojan-activity; sid:47073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"; flow:to_server,established; content:"/update_new.php?"; fast_pattern:only; http_uri; content:"code="; nocase; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/c9adabc7516e38ce611cbde5856fbe6b06e8afee4422d754aa810aec59ecd8d8/detection; classtype:trojan-activity; sid:47069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"; flow:to_server,established; content:"/register.php?"; fast_pattern:only; http_uri; content:"p="; nocase; http_uri; content:"&code="; nocase; http_uri; content:!"User-Agent"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/c9adabc7516e38ce611cbde5856fbe6b06e8afee4422d754aa810aec59ecd8d8/detection; classtype:trojan-activity; sid:47068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"; flow:to_server,established; content:"/show_new.php?"; fast_pattern:only; http_uri; content:"code="; nocase; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/c9adabc7516e38ce611cbde5856fbe6b06e8afee4422d754aa810aec59ecd8d8/detection; classtype:trojan-activity; sid:47067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Downloader.XAgent variant outbound connection"; flow:to_server,established; content:"&itwm="; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b814fdbb7cfe6e5192fe1126835b903354d75bfb15a6c262ccc2caf13a8ce4b6; classtype:trojan-activity; sid:48140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"/cfg?cb="; fast_pattern:only; http_uri; content:"&guid="; http_uri; content:"&uid="; distance:0; http_uri; content:"&ua="; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"UID: P002|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"User-Agent: ITRANSLATOR|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"/ufiles/"; fast_pattern:only; http_uri; content:".dll"; http_uri; content:"UID: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"/gl.php?uid="; fast_pattern:only; http_uri; content:"&v="; http_uri; content:"&x="; within:20; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"; flow:to_server,established; content:"/dl.itranslator.info/"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/b73d436d7741f50d29764367cbecc4ee67412230ff0d66b7d1d0e4d26983824d/analysis; classtype:trojan-activity; sid:48115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MirageFox variant outbound connection"; flow:to_server,established; content:"/search?gid="; fast_pattern:only; http_uri; content:"Accept:*/*"; http_header; content:"POST"; http_method; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/97813e76564aa829a359c2d12c9c6b824c532de0fc15f43765cf6b106a32b9a5/analysis; classtype:trojan-activity; sid:48093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MirageFox variant outbound connection"; flow:to_server,established; content:"/image_download.php?uid="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/016948ec7743b09e41b6968b42dfade5480774df3baf915e4c8753f5f90d1734/analysis; classtype:trojan-activity; sid:48092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/6SrlScT/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/MUHagMS/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/1RurEqF/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/xIeDFfp/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/6pGAbF/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/ms27r/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/o2x7Bx/"; fast_pattern:only; http_uri; content:!"User-Agent: "; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/B12749AD0E060AE0B715A83EBD1BFEA23E0B9F4968DAC80CC604FC229C55052F/analysis; classtype:trojan-activity; sid:48085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"/pidoras6"; fast_pattern:only; http_uri; content:"User-Agent: Opera/9.80 (Windows NT 6.0) Presto/2.12.388"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/A25F83694449EB297D91D5059954FA1EBE98BABDFAC2E98B76FD1F695AE44964/analysis; classtype:trojan-activity; sid:48084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Occamy variant outbound connection"; flow:to_server,established; content:"03488030fb57e825ca7f652571f12f15dbb069220773190978b85793c9ecfead"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/A25F83694449EB297D91D5059954FA1EBE98BABDFAC2E98B76FD1F695AE44964/analysis; classtype:trojan-activity; sid:48083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Agent download attempt"; flow:to_server,established; content:"/nuwpqicunde.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/053ca5737cbd3df1936c9e945e90fa244fb4b8705da0659bbcfd6aa5bfa50cd9; classtype:trojan-activity; sid:48082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound connection"; flow:to_server,established; content:"/download/Stp5.exe?aid="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/536148b202ddf00bf76f28bea53399ac16764de8628c71209ea22f5aa31a9681; classtype:trojan-activity; sid:48081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound connection"; flow:to_server,established; content:"/s2s_install.exe"; fast_pattern:only; http_uri; content:"tracking="; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/536148b202ddf00bf76f28bea53399ac16764de8628c71209ea22f5aa31a9681; classtype:trojan-activity; sid:48080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Ramnit variant outbound connection"; flow:to_server,established; content:"/update20180524/bundles.xml"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/536148b202ddf00bf76f28bea53399ac16764de8628c71209ea22f5aa31a9681; classtype:trojan-activity; sid:48079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.AcridRain outbound connection"; flow:to_server,established; content:"/Libs.zip"; fast_pattern:only; http_uri; urilen:9; content:!"User-Agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/3d28392d2dc1292a95b6d8f394c982844a9da0cdd84101039cf6ca3cf9874c1c/analysis/; classtype:trojan-activity; sid:48036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.AcridRain outbound connection"; flow:to_server,established; content:"browser/Vivaldi.txtPK"; fast_pattern:only; http_client_body; content:"/Upload/"; http_uri; urilen:8; content:!"User-Agent|3A 20|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/3d28392d2dc1292a95b6d8f394c982844a9da0cdd84101039cf6ca3cf9874c1c/analysis/; classtype:trojan-activity; sid:48035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Turla outbound connection"; flow:to_server,established; urilen:200<>250; content:"/scripts/m/query.php?id="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/2a61b4d0a7c5d7dc13f4f1dd5e0e3117036a86638dbafaec6ae96da507fb7624/analysis/; classtype:trojan-activity; sid:48028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC BabaYaga outbound connection"; flow:to_server,established; content:"/sserpdrow/ipconfig"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.wordfence.com/blog/2018/06/babayaga-wordpress-malware/; classtype:trojan-activity; sid:48027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC BabaYaga outbound connection"; flow:to_server,established; content:"/pw/versionORG"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.wordfence.com/blog/2018/06/babayaga-wordpress-malware/; classtype:trojan-activity; sid:48026; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-CNC BabaYaga inbound connection"; flow:to_server,established; content:"wpsroot"; fast_pattern:only; nocase; http_uri; content:"User-Agent: "; nocase; http_header; content:"en.support.wordpress.com"; within:75; nocase; http_header; content:!"Host: en.support.wordpress.com"; nocase; http_header; pcre:"/User-Agent\x3a[^\x0d\x0a]*en\x2esupport\x2ewordpress\x2ecom/Hi"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.wordfence.com/blog/2018/06/babayaga-wordpress-malware/; classtype:trojan-activity; sid:48025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.PyLocky outbound connection attempt"; flow:to_server,established; content:"/wp-system.php"; fast_pattern:only; http_uri; content:"PCNAME="; nocase; http_client_body; content:"IV="; nocase; http_client_body; content:"GC="; nocase; http_client_body; content:"PASSWORD="; nocase; http_client_body; content:"CPU="; nocase; http_client_body; content:"LANG="; nocase; http_client_body; content:"INSERT="; nocase; http_client_body; content:"UID="; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/c9c91b11059bd9ac3a0ad169deb513cef38b3d07213a5f916c3698bb4f407ffa/analysis/; classtype:trojan-activity; sid:48024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Viro variant outbound connection"; flow:to_server,established; content:"/noauth/register"; fast_pattern:only; http_uri; content:"crypto_id="; depth:10; http_client_body; content:"&product_id="; within:50; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/911b25a4d99e65ff920ba0e2ef387653b45789ef4693ef36d95f14c9777a568b/analysis/; classtype:trojan-activity; sid:48022; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.MSDownloader variant download"; flow:to_server,established; file_data; content:"Content-Type|3A 20|multipart/form-data|3B| boundary=MS_D0wnl0ad3r"; fast_pattern:44,13; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service smtp; reference:url,www.virustotal.com/#/file/c3c5d7961381c202c98badc7ff0739b4f381c10b4e76d153ad2a978118a4b505/detection; classtype:trojan-activity; sid:47936; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.MSDownloader variant download"; flow:to_client,established; file_data; content:"Content-Type|3A 20|multipart/form-data|3B| boundary=MS_D0wnl0ad3r"; fast_pattern:44,13; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service ftp-data, service http, service imap, service pop3; reference:url,www.virustotal.com/#/file/c3c5d7961381c202c98badc7ff0739b4f381c10b4e76d153ad2a978118a4b505/detection; classtype:trojan-activity; sid:47935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.MSDownloader variant outbound connection"; flow:to_server,established; content:"MS_D0wnl0ad3r"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/c3c5d7961381c202c98badc7ff0739b4f381c10b4e76d153ad2a978118a4b505/detection; classtype:trojan-activity; sid:47934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/file/Documents/document_78219"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5859a21be4ca9243f6adf70779e6986f518c3748d26c427a385efcd3529d8792; classtype:trojan-activity; sid:47906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/transactions/id02082018.jpg"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5859a21be4ca9243f6adf70779e6986f518c3748d26c427a385efcd3529d8792; classtype:trojan-activity; sid:47905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/Document00591674.doc"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5859a21be4ca9243f6adf70779e6986f518c3748d26c427a385efcd3529d8792; classtype:trojan-activity; sid:47904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/documents/2018/fraud/fraud_16082018.doc"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/0367554ce285a3622eb5ca1991cfcb98b620d0609c07cf681d9546e2bf1761c4; classtype:attempted-user; sid:47903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/invoice/id/305674567"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/9c0ddfcfb8d1e64332fa7420f690e65a6c4ecbeef6395f4c7645da51098962cc; classtype:trojan-activity; sid:47902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.CobInt outbound connection"; flow:to_server,established; content:"/xaczkajeieypiarll"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/5859a21be4ca9243f6adf70779e6986f518c3748d26c427a385efcd3529d8792; classtype:trojan-activity; sid:47901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection"; flow:to_server,established; content:"GET /pser?"; fast_pattern:only; pcre:"/\x2fpser\x3f[A-F0-9]{3,84}(BBZ|BBY)/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9; classtype:attempted-user; sid:47900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection"; flow:to_server,established; content:"GET /khc?"; fast_pattern:only; pcre:"/\x2fkhc\x3f[A-F0-9]{3,84}$/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9; classtype:attempted-user; sid:47899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OilRig variant outbound connection"; flow:to_server,established; content:"GET /tahw?"; fast_pattern:only; pcre:"/\x2ftahw\x3f[A-F0-9]{3,84}$/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9; classtype:attempted-user; sid:47898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.AnubisCrypt variant outbound post detected"; flow:to_server, established; content:"/private/checkPanel.php"; fast_pattern:only; http_uri; content:"User-Agent:"; http_header; content:"Android"; within:100; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/d27034b9f58aa71f08f3c57d893fe07cdd395c9b4e494fbcca2a1d1ca3dce88e/detection; classtype:trojan-activity; sid:47877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.AnubisCrypt variant outbound post detected"; flow:to_server, established; content:"/private/"; fast_pattern; http_uri; content:".php"; distance:0; http_uri; content:"p="; http_client_body; content:"User-Agent:"; http_header; content:"Android"; within:100; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/#/file/d27034b9f58aa71f08f3c57d893fe07cdd395c9b4e494fbcca2a1d1ca3dce88e/detection; classtype:trojan-activity; sid:47876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 5416 (msg:"MALWARE-CNC Andr.Trojan.Xamaria variant outbound connection"; flow:to_server,established; content:"GET /?q="; depth:8; content:":ICAi"; fast_pattern:only; pcre:"/\/\?q=[0-9]{15}\-[0-9]{1,2}:ICAi/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/a342a16082ea53d101f556b50532651cd3e3fdc7d9e0be3aa136680ad9c6a69f/analysis/; classtype:trojan-activity; sid:47860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Java.Trojan.Adwind variant outbound connection"; flow:to_server,established; content:"|00 00 00 04 77 2A 00 28|"; depth:8; isdataat:39,relative; pcre:"/\x77\x2a\x00\x28[a-f0-9]{40}/i"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/file/0a2f74a7787ae904e5a22a3c2b3acf0316c10b95fae08cced7ca5e2fcc7d9bf8/analysis; classtype:trojan-activity; sid:47843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownloadGuide variant outbound traffic"; flow:to_server,established; content:"/public-source/downloadguide/chip-eu/"; http_uri; content:".zip"; distance:0; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/d4275116c2084c9d4e698c25c2774ab714e498c5737a0a0f6b929cc3f6a2fe47/; classtype:trojan-activity; sid:47837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownloadGuide variant outbound traffic"; flow:to_server,established; content:"/config-from-production"; fast_pattern; http_uri; content:"{|22|os|22 3A 22|"; depth:7; http_client_body; content:"|22|lang|22 3A 22|"; distance:0; http_client_body; content:"|22|uid|22 3A 22|"; distance:0; http_client_body; content:"|22|prod|22 3A 22|"; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/d4275116c2084c9d4e698c25c2774ab714e498c5737a0a0f6b929cc3f6a2fe47/; classtype:trojan-activity; sid:47836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.DownloadGuide variant outbound traffic"; flow:to_server,established; content:"/1/dg/3"; fast_pattern; http_uri; content:"{|22|BuildId|22|:"; http_client_body; content:"|22|Campaign|22|"; http_client_body; content:"|22|TrackBackUrl|22|"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/d4275116c2084c9d4e698c25c2774ab714e498c5737a0a0f6b929cc3f6a2fe47/; classtype:trojan-activity; sid:47835; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.njrat njRAT trojan variant download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"|0F 84 B9 76 06 00 8D 84 24 10 2B 00 00 50 8D 84 24 0C 29 00 00 50 8D 84 24 F8 04 00 00 50 8D 84|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/f3f91f89b9a9387843c251e7fce65bb90d8463df6c3751a29a43ff8d71c9f66e/detection; classtype:trojan-activity; sid:47826; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.njrat njRAT trojan variant download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"|0F 84 B9 76 06 00 8D 84 24 10 2B 00 00 50 8D 84 24 0C 29 00 00 50 8D 84 24 F8 04 00 00 50 8D 84|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/f3f91f89b9a9387843c251e7fce65bb90d8463df6c3751a29a43ff8d71c9f66e/detection; classtype:trojan-activity; sid:47825; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.njrat njRAT trojan variant download"; flow:to_server,established; flowbits:isset,file.exe; file_data; content:"matemdeea"; fast_pattern:only; content:"Copyright |C2 A9| 2018"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,www.virustotal.com/#/file/1399b9bf2a5625725037e7e0a560e0b6c0c891662bd4c353801bd74067570cb5/detection; reference:url,www.virustotal.com/#/file/68648f0a3501a59d3bdbbf9d178be48758c92d5441f635f6bc30c47a932abea8/detection; reference:url,www.virustotal.com/#/file/e10697181dd1634c4883137252df8051a211d0a6cd7ab30fbb1ef7a4cdef1e0d/detection; classtype:trojan-activity; sid:47824; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.njrat njRAT trojan variant download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"matemdeea"; fast_pattern:only; content:"Copyright |C2 A9| 2018"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/1399b9bf2a5625725037e7e0a560e0b6c0c891662bd4c353801bd74067570cb5/detection; reference:url,www.virustotal.com/#/file/68648f0a3501a59d3bdbbf9d178be48758c92d5441f635f6bc30c47a932abea8/detection; reference:url,www.virustotal.com/#/file/e10697181dd1634c4883137252df8051a211d0a6cd7ab30fbb1ef7a4cdef1e0d/detection; classtype:trojan-activity; sid:47823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 1700 (msg:"MALWARE-CNC Win.Trojan.njrat njRAT trojan outbound attempt"; flow:to_server; content:"1234No1234N/A1234"; fast_pattern:only; content:"==1234"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,zscaler.com/blogs/research/njrat-pushes-lime-ransomware-and-crypto-wallet-grabbers; classtype:trojan-activity; sid:47822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win32.Backdoor.Turla variant outbound connection"; flow:to_server, established; content:"default.asp"; nocase; http_uri; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 6.0)"; fast_pattern; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/0d1fe4ab3b074b5ef47aca88c5d1b8262a1293d51111d59c4e563980a873c5a6/detection; classtype:trojan-activity; sid:47773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.GandCrab outbound connection"; flow:to_server,established; content:"wfKD6iudumBkmpL8IRr"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/8163602357b51402b8e34b385b0228ac4a603e19c6c8006e1c7a7a8099450742/; classtype:trojan-activity; sid:47766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Andr.Trojan.MysteryBot outbound connection"; flow:to_server,established; content:"/site/gate.php?i=eyAiYWN0aW9uIjog"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/334f1efd0b347d54a418d1724d51f8451b7d0bebbd05f648383d05c00726a7ae/analysis/; classtype:trojan-activity; sid:47723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Fallchill variant outbound connection"; flow:to_server,established; content:"boundary=jeus"; fast_pattern:only; http_header; content:"--jeus"; http_client_body; content:"filename="; http_client_body; content:".gif"; within:30; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04/detection; classtype:trojan-activity; sid:47708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Backdoor.Iniduoh variant outbound connection"; flow:to_server,established; content:"POST /Vre "; fast_pattern:only; content:"User-Agent: "; content:!"|0D 0A|"; within:75; content:"|5C|Microsoft Windows"; within:75; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/3898085d7f99b9cc1b5f915ce6c9eca14b17a7e6d8fdc6c6b77b6f89782c59b6/analysis; classtype:trojan-activity; sid:47701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC User-Agent known malicious user-agent string - Win.Downloader.Powload"; flow:to_server,established; content:"User-Agent|3A| come-tome|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/9f2e3a5a5617562a8b5a4e9521d197cc0cb2095651ead86ccaeb6f5f0c35c0f4/analysis/; classtype:trojan-activity; sid:47697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC User-Agent known malicious user-agent string - Win.Downloader.Powload"; flow:to_server,established; content:"User-Agent|3A| noobBoy|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/6ed8c5a1db8d80e9100268f20e75e507efbab2fe8ad83adb998af83dfe2a3137/analysis/; classtype:trojan-activity; sid:47696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC User-Agent known malicious user-agent string - Win.Downloader.Powload"; flow:to_server,established; content:"User-Agent|3A| newUser|0D 0A|"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/aac8f537eb495d94d5ff7bfe1d40b9fbad041d87986c1dacf9682b685e366f59/analysis/; classtype:trojan-activity; sid:47695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Ransomware.Shrug2 outbound connection"; flow:to_server,established; content:"/marthas_stuff/"; fast_pattern:only; http_uri; content:"partA="; depth:6; http_client_body; content:"partB="; within:100; http_client_body; content:"partC="; within:100; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/c89833833885bafdcfa1c6ee84d7dbcf2389b85d7282a6d5747da22138bd5c59; classtype:trojan-activity; sid:47692; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Torpplar variant outbound connection"; flow:to_server,established; content:"/ie/ie.asp"; fast_pattern:only; http_uri; content:"%0D%0A|BB FA C6 F7 C2 EB|%3A"; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/7d633c7889091c70a203fb5c6fbf814544538a20ef6fb6e2990134eb1e37fa06/detection; classtype:trojan-activity; sid:47678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Marap outbound beacon detected"; flow:to_server,established; content:"/dot.php"; fast_pattern:only; http_uri; content:"param="; depth:6; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/en/file/bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5/analysis/; classtype:trojan-activity; sid:47650; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.KeyPass variant inbound connection attempt"; flow:to_client,established; file_data; content:"|7B 22|line1|22 3A 22|"; depth:10; fast_pattern; content:"|22|line2|22 3A 22|"; within:30; distance:30; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community, service http; reference:url,virustotal.com/#/file/901d893f665c6f9741aa940e5f275952/detection; classtype:trojan-activity; sid:47627; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 6901 (msg:"MALWARE-CNC Win.Ransomware.Princess variant outbound connection attempt"; flow:to_server; content:"data="; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,virustotal.com/en/file/b4f05277bafc06af87fccb02a444e5a22b3760f98c05bf0f6cf5344da7faa543/analysis/; classtype:trojan-activity; sid:47621; rev:1;)
# alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Trickbot variant outbound connection"; flow:to_server,established; content:"/5/spk/ HTTP/1.1|0D 0A|"; fast_pattern:only; content:"/5/spk/"; http_uri; content:!"Accept: "; http_header; content:!"Referer: "; http_header; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop, service ssl; reference:url,virustotal.com/en/file/eec7784f51c9e7de1220e7cf57a6d372d5744e7e7c66ca2033286ec4241c5e92/analysis/; classtype:trojan-activity; sid:47618; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Emotet variant download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"QueryUsersOnEncryptedFile|00|"; fast_pattern:only; content:"msi.dll|00|"; content:"|A4 10 02 00|"; content:"|1C 10 02 00|"; within:6; distance:10; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/10810ac39fa23e7e64330b95724cd649040729705b9fbeba03064fb81ab6346a/detection; classtype:trojan-activity; sid:47617; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Emotet variant download"; flow:to_client,established; flowbits:isset,file.exe; file_data; content:"Who is!!!??|00|"; fast_pattern:only; content:"|00|x|00|A|00|C|00|"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/10810ac39fa23e7e64330b95724cd649040729705b9fbeba03064fb81ab6346a/detection; classtype:trojan-activity; sid:47616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.AzoRult variant outbound connection detected"; flow:to_server,established; content:"/~ygnwgnrp/gate.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/d89168411b7d7bfa9fb402978c553d88ff50bcbbbb10c06a15cbbe6b48ab852f/detection; classtype:trojan-activity; sid:47602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Betabot variant outbound connection detected"; flow:to_server,established; content:"/panel/order.php"; depth:16; nocase; http_uri; content:!"Accept|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/dbd77affbcef98e8814411a7fb713254f06c21fe5fe7697e75824c60a7ebcbcd/detection; classtype:trojan-activity; sid:47601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Waldek variant initial outbound connection detected"; flow:to_server,established; content:"/tv/getinfo.php"; fast_pattern:only; http_uri; content:"HTTP/1.0"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:47600; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Fake PDFEscape font pack cryptominer"; flow:to_server,established; flowbits:isset,file.msi; file_data; content:"PDFescapeDesktopInstaller.exe"; content:"|5C|system32|5C|xbox-service.exe"; fast_pattern:only; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:47594; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Fake PDFEscape font pack cryptominer"; flow:to_client,established; flowbits:isset,file.msi; file_data; content:"PDFescapeDesktopInstaller.exe"; content:"|5C|system32|5C|xbox-service.exe"; fast_pattern:only; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:47593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Zegost variant outbound connection"; flow:to_server,established; content:"|2A 00 00 00|"; depth:4; isdataat:37,relative; isdataat:!38,relative; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,www.virustotal.com/#/file/108bbc4ff7b7da4f0de1225094964d03b19fc38b93933f739c475f08ae17915e/detection; classtype:trojan-activity; sid:47567; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.PLEAD downloader outbound connection"; flow:to_server,established; content:"GET /index.php?id="; depth:18; content:"HTTP/1.1|0D 0A|"; within:10; distance:11; nocase; content:"Cookie:"; isdataat:50,relative; content:!"="; within:50; content:!"|3B|"; within:50; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html; classtype:trojan-activity; sid:47557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.PLEAD downloader outbound connection"; flow:to_server,established; content:"GET /logo.png HTTP/1.1|0D 0A|"; depth:24; content:"User-Agent: Mozilla/4.0 (compatible|3B| MSIE 8.0)|0D 0A|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, ruleset community; reference:url,blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html; classtype:trojan-activity; sid:47556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Keywsec variant outbound request for malicious dll exe and js detected"; flow:to_server,established; content:!"User-Agent|3A|"; http_header; content:!"Accept|3A|"; http_header; content:"/downloads/kwc/"; http_uri; pcre:"/\/downloads\/kwc\/\w+\.(dll|exe|js)$/iU"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/9c655017f4f0609868df5614a8361bb54d12ecfeafbaf8edf2f6c158f55bdbf5/detection; classtype:trojan-activity; sid:47548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Keywsec variant post-compromise outbound request detected"; flow:to_server,established; content:"/jobs/updated-versions/set/values/"; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Accept|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/9c655017f4f0609868df5614a8361bb54d12ecfeafbaf8edf2f6c158f55bdbf5/detection; classtype:trojan-activity; sid:47547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Keywsec variant outbound request detected"; flow:to_server,established; content:"/jobs/fetch-versions/?v="; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/9c655017f4f0609868df5614a8361bb54d12ecfeafbaf8edf2f6c158f55bdbf5/detection; classtype:trojan-activity; sid:47546; rev:1;)
# alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"MALWARE-CNC Win.Trojan.Grobios C2 inbound server command"; flow:to_client,established; file_data; content:"|0A|WAIT "; content:"|0A|CONNECT "; content:"|0A|CERT "; fast_pattern:only; pcre:"/CERT\s[a-zA-Z\+\/\x3d0-9]{1,200}/"; metadata:impact_flag red, policy max-detect-ips drop, policy security-ips drop; reference:url,www.virustotal.com/#/file/8b86662ab617d11079f16d95d4d584e8acb4a374b87edf341195ab9e043ed1d2/; classtype:trojan-activity; sid:47526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"MALWARE-CNC Win.Trojan.Grobios outbound connection"; flow:to_server,established; content:"/ajax?"; http_uri; content:!"Content-Length|3A|"; http_header; content:!"Content-Type|3A|"; http_header; content:!"Connection|3A|"; http_header; pcre:"/\/ajax\?[a-zA-Z]{20}/U"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop; reference:url,www.virustotal.com/#/file/8b86662ab617d11079f16d95d4d584e8acb4a374b87edf341195ab9e043ed1d2/; classtype:trojan-activity; sid:47525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win32.Backdoor.Ropindo variant outbound post detected"; flow:to_server, established; content:"statuses/update.xml?status="; http_uri; content:"|20|En|20 20 7C 20|IP1|3A 20|"; within:27; fast_pattern; http_uri; content:"|20 7C 20|IP2|3A 20|"; within:24; http_uri; content:"|20 7C 20|IP3|3A 20|"; within:24; http_uri; content:"|20 7C 20|IP4|3A 20|"; within:24; http_uri; content:"|20 7C 20|IP|20|Externa|3A 20|"; within:31; http_uri; content:"|20 7C 20|Version|3A 20|"; within:28; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,"https://www.virustotal.com/intelligence/search/?query=b56733286ca66bb63de91b260ed75a5250c14f68b1e65c696e3192a344953ee5"; classtype:trojan-activity; sid:47511; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC Py.Malware.EvilOSX 404 Error Page Payload/Command Delivery"; flow:established,to_client; content:"|0A|["; fast_pattern:only; content:"]-->[2"; content:"]-->["; distance:1; content:"]-->["; distance:11; content:"]-->["; distance:3; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service telnet; reference:url,virustotal.com/#/file/c983c7380b13216ec7f66d8214e58770a2541990f57a028af43c84da98f478e3/detection; classtype:trojan-activity; sid:48275; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Banking download attempt initiated"; flow:to_client; file_data; content:"pgs99.online"; content:"painelhost.uol.com.br"; fast_pattern:only; content:!"User-Agent:"; nocase; http_header; content:!"Referer:"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/91781126feeae4d1a783f3103dd5ed0f8fc4f2f8e6f51125d1bfc06683b01c39; classtype:trojan-activity; sid:48356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Banking download attempt initiated"; flow:to_server; content:"/maquinas/PC078BFBFF00000F61-OFF.txt"; fast_pattern:only; http_uri; content:!"User-Agent:"; nocase; http_header; content:!"Referer:"; nocase; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2a1af665f4692b8ce5330e7b0271cfd3514b468a92d60d032095aebebc9b34c5; classtype:trojan-activity; sid:48355; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Doc.GrayEnergy malicious document download attempt"; flow:to_server,established; file_data; content:"|BC 1D 47 5B 75 C6 FB A8 C7 8C C7 38 D3 7A 77 BC 75 D4 F1 1C AB A3 8E A3 8E 3A 3A 8E B7 FE 76 DF|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:url,virustotal.com/#/file/f50ee030224bf617ba71d88422c25d7e489571bc1aba9e65dc122a45122c9321/detection; classtype:trojan-activity; sid:48308; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Doc.GrayEnergy malicious document download attempt"; flow:to_client,established; file_data; content:"|BC 1D 47 5B 75 C6 FB A8 C7 8C C7 38 D3 7A 77 BC 75 D4 F1 1C AB A3 8E A3 8E 3A 3A 8E B7 FE 76 DF|"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:url,virustotal.com/#/file/f50ee030224bf617ba71d88422c25d7e489571bc1aba9e65dc122a45122c9321/detection; classtype:trojan-activity; sid:48307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Telebot variant outbound connection"; flow:to_server,established; content:"/Microsoft/Outlook/initialization"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb/analysis; classtype:trojan-activity; sid:48302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Telebot variant outbound connection"; flow:to_server,established; content:"/Microsoft/updates/kbupdate"; fast_pattern:only; http_uri; content:"id="; http_client_body; content:"&kb="; distance:0; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb/analysis; classtype:trojan-activity; sid:48301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Telebot variant outbound connection"; flow:to_server,established; content:"/Microsoft/Office/validation?m="; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb/analysis; classtype:trojan-activity; sid:48300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Telebot variant outbound connection"; flow:to_server,established; content:"/last.ver?rnd="; fast_pattern:only; http_uri; content:"Cookie: EDRPOU="; nocase; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740/analysis; classtype:trojan-activity; sid:48299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Emotet variant outbound connection attempt"; flow:to_server,established; content:"GET / HTTP/1.1|0D 0A|Cookie: "; depth:24; content:"="; within:6; pcre:"/Cookie: \d{1,5}=[a-zA-Z0-9\x2b\x2f]+=*\r\nUser-Agent:/"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,attack.mitre.org/techniques/T1041/; reference:url,www.virustotal.com/en/file/f78b1778da8108d3a9d3ca5d8194fb607d9fe84da4aabbfec0c27f5d261cd646/analysis/; classtype:trojan-activity; sid:48402; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.Zebrocy TLS server hello attempt"; flow:to_client,established; ssl_state:server_hello; content:"support@ikeashop.fi"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ssl; reference:url,www.virustotal.com/#/file/074a5836c5973bb53ab02c2bad66a4743b65c20fd6bf602cfaf09219f32d2426; classtype:trojan-activity; sid:48397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zebrocy outbound connection"; flow:to_server,established; content:"Mozilla v5.1 (Windows NT 6.1|3B| rv:6.0.1) Gecko/20100101 Firefox/6.0.1"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/86bb3b00bcd4878b081e4e4f126bba321b81a17e544d54377a0f590f95209e46; classtype:trojan-activity; sid:48396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zebrocy outbound connection"; flow:to_server,established; content:"/documents/Note_template.dotm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/c91843a69dcf3fdad0dac1b2f0139d1bb072787a1cfcf7b6e34a96bc3c081d65; classtype:trojan-activity; sid:48395; rev:1;)
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"MALWARE-CNC Win.Trojan.Bondupdater outbound cnc connection"; flow:to_server; content:"|0C|withyourface|03|com"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service dns; reference:url,www.virustotal.com/#/file/7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00; classtype:trojan-activity; sid:48422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OlympicDestroyer variant outbound connection"; flow:to_server,established; content:"/plise.exe"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/b85027de6871e2ed1a2154edb645fd016807989b44107fc2804eb6e9acce3b9d; classtype:trojan-activity; sid:48436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.OlympicDestroyer variant outbound connection"; flow:to_server,established; content:"/check/index"; depth:12; http_uri; content:!"User-Agent"; http_header; content:!"Referer"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/#/file/a6678a676d6a55833aa63233b3bae53fd7825c3c8afc4d015a2ca8296baee31a; classtype:trojan-activity; sid:48435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zebrocy outbound connection"; flow:to_server,established; content:"/catalog/products/books.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/d18d909ee3eb65dfd49925853553c87f7fd8a40e7cebb0f342e43e0c1fbab7d7; classtype:trojan-activity; sid:48432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zebrocy outbound connection"; flow:to_server,established; content:"/local/s3/filters.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/6AD3EB8B5622145A70BEC67B3D14868A1C13864864AFD651FE70689C95B1399A; classtype:trojan-activity; sid:48431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cannon outbound connection"; flow:to_server,established; content:"/live/owa/office.dotm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f; classtype:trojan-activity; sid:48430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Cannon outbound connection"; flow:to_server,established; content:"/version/in/documents.dotm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f; classtype:trojan-activity; sid:48429; rev:1;)
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"MALWARE-CNC Win.Trojan.12percent ransomware generator download"; flow:to_server,established; file_data; flowbits:isset,file.exe; content:"icacls |22|**|22| /grant administrators"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:48438; rev:1;)
alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Win.Trojan.12percent ransomware generator download"; flow:to_client,established; file_data; flowbits:isset,file.exe; content:"icacls |22|**|22| /grant administrators"; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:48437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.DNSpionage variant outbound connection"; flow:to_server,established; content:"/Client/Upload"; http_uri; content:"form-data|3B 20|name=|22|txts|22|"; fast_pattern:only; http_client_body; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec/analysis/; classtype:trojan-activity; sid:48445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Malware.DNSpionage variant outbound connection"; flow:to_server,established; urilen:19; content:"/Client/Login?id="; fast_pattern:only; http_uri; content:"User-Agent: Mozilla/5.0 (Windows NT 6.1|3B| Trident/7.0|3B| rv:11.0) like Gecko"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,virustotal.com/en/file/2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec/analysis/; classtype:trojan-activity; sid:48444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Exaramel outbound cnc connection"; flow:to_server,established; content:"/eset/18.04.12"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2f12fd3fb35f8690eea80dd48de98660c55df7f5c26b49d0cc82aaf3635b0c7a; classtype:trojan-activity; sid:48449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sofacy outbound connection"; flow:to_server,established; content:"/resource-store/stockroom-center-service/check.php"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/2da5a388b891e42df4ed62cffbc167db2021e2441e6075d651ecc1d0ffd32ec8; classtype:trojan-activity; sid:48447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Sofacy outbound connection"; flow:to_server,established; content:"/doc/temp/release.dotm"; fast_pattern:only; http_uri; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/40318f3593bca859673827b88d65c5d2f0d80a76948be936a60bda67dff27be9; classtype:trojan-activity; sid:48446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.tRat variant outbound cnc connection"; flow:to_server,established; content:"D9BD68ABF53C3914A248EC603E9CD96F"; fast_pattern:only; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cdb8a02189a8739dbe5283f8bc4679bf28933adbe56bff6d050bad348932352b; classtype:trojan-activity; sid:48467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.tRat variant outbound cnc connection"; flow:to_server,established; content:"CF9C77"; depth:6; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/#/file/cdb8a02189a8739dbe5283f8bc4679bf28933adbe56bff6d050bad348932352b; classtype:trojan-activity; sid:48466; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MALWARE-CNC Js.Worm.Bondat inbound connection attempt"; flow:to_client,established; file_data; content:"File not found.|0A| |