alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST"; nocase; http_method; content:!"Referer|3a| "; http_header; nocase; content:"User-Agent|3a| Microsoft Internet Explorer|0d 0a|"; http_header; nocase; content:"loads2.php?r="; nocase; http_uri; fast_pattern; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; classtype:trojan-activity; sid:2010594; rev:5;)

Added 2011-10-12 19:30:08 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST"; nocase; http_method; content:!"Referer|3a| "; http_header; nocase; content:"User-Agent|3a| Microsoft Internet Explorer|0d 0a|"; http_header; nocase; content:"loads2.php?r="; nocase; http_uri; fast_pattern; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; sid:2010594; rev:5;)

Added 2011-09-14 22:43:19 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST"; nocase; http_method; content:!"Referer|3a| "; http_header; nocase; content:"User-Agent|3a| Microsoft Internet Explorer|0d 0a|"; http_header; nocase; content:"loads2.php?r="; nocase; http_uri; fast_pattern; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010594; rev:5;)

Added 2011-02-04 17:30:11 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST "; nocase; depth:5; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; uricontent:"loads2.php?r="; nocase; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010594; rev:2;)

Added 2009-12-29 10:00:51 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST "; nocase; depth:5; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; uricontent:"loads2.php?r="; nocase; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010594; rev:2;)

Added 2009-12-29 10:00:51 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST "; nocase; depth:5; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; uricontent:"loads2.php?r="; nocase; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010594; rev:2;)

Added 2009-12-29 09:58:48 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST "; nocase; depth:5; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; uricontent:"loads2.php?r="; nocase; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; reference:url,doc.emergingthreats.net/2010594; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Fake_AV; sid:2010594; rev:2;)

Added 2009-12-29 09:58:48 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Potential FakeAV? HTTP POST Check-IN (?r=)"; flow:established,to_server; content:"POST "; nocase; depth:5; content:!"|0d 0a|Referer\: "; nocase; content:"|0d 0a|User-Agent\: Microsoft Internet Explorer|0d 0a|"; nocase; uricontent:"loads2.php?r="; nocase; pcre:"/loads2\.php\?r=[0-9]{2}\.[0-9]+/Ui"; classtype:trojan-activity; reference:url,www.threatexpert.com/report.aspx?md5=94e13e13c6da5e32bde00bc527475bd2; reference:url,www.malwaredomainlist.com/forums/index.php?topic=3190.420; sid:2010594; rev:1;)

Added 2009-12-28 14:15:44 UTC