#alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2001337; classtype:trojan-activity; sid:2001337; rev:7;)

Added 2011-10-12 19:10:18 UTC

#alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; classtype: trojan-activity; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2001337; sid:2001337; rev:7;)

Added 2011-09-14 20:53:41 UTC

#alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; classtype: trojan-activity; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid:2001337; rev:7;)

Added 2011-02-04 17:21:25 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid:2001337; rev:7;)

Added 2010-06-28 22:46:58 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid:2001337; rev:7;)

Added 2010-06-28 22:46:58 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid: 2001337; rev:7;)

Added 2009-02-16 21:30:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid: 2001337; rev:7;)

Added 2009-02-16 21:30:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:6;)

Added 2008-01-31 10:12:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:6;)

Added 2008-01-31 10:12:24 UTC

alert tcp $HOME_NET any -> any 445 (msg: "BLEEDING-EDGE WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:5; )