alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid: 2001337; rev:7;)

Added 2009-02-16 21:30:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2001337; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/WORM_KORGO; sid: 2001337; rev:7;)

Added 2009-02-16 21:30:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:6;)

Added 2008-01-31 10:12:24 UTC

alert tcp $HOME_NET any -> any 445 (msg:"ET WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:6;)

Added 2008-01-31 10:12:24 UTC

alert tcp $HOME_NET any -> any 445 (msg: "BLEEDING-EDGE WORM Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; classtype: trojan-activity; sid: 2001337; rev:5; )