#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET TROJAN DHL Spam Inbound"; flow:established,to_server; content:"name=|22|DHL"; nocase; content:".zip|22|"; within:68; nocase; pcre:"/name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-11-10 16:17:53 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET TROJAN DHL Spam Inbound"; flow:established,to_server; content:"name=|22|DHL"; nocase; content:".zip|22|"; within:68; nocase; pcre:"/name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 21:03:15 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET TROJAN DHL Spam Inbound"; flow:established,to_server; content:"name=|22|DHL"; nocase; content:".zip|22|"; within:68; nocase; pcre:"/name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:13;)

Added 2014-09-12 16:28:26 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"name=|22|DHL"; nocase; content:".zip|22|"; within:68; nocase; pcre:"/name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:12;)

Added 2012-05-24 17:51:46 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|DHL_"; nocase; content:".zip|22|"; nocase; pcre:"/filename=\x22DHL_(tracking|document|(|print_|package_)label)(|_nr|_id.nr)(|[0-9]{4,5}|_[0-9a-z]{4,5})\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:11;)

Added 2011-10-12 19:29:03 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|DHL_"; nocase; content:".zip|22|"; nocase; pcre:"/filename=\x22DHL_(tracking|document|(|print_|package_)label)(|_nr|_id.nr)(|[0-9]{4,5}|_[0-9a-z]{4,5})\.zip\x22/i"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; sid:2010148; rev:11;)

Added 2011-09-14 22:42:19 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|DHL_"; nocase; content:".zip|22|"; nocase; pcre:"/filename=\x22DHL_(tracking|document|(|print_|package_)label)(|_nr|_id.nr)(|[0-9]{4,5}|_[0-9a-z]{4,5})\.zip\x22/i"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:11;)

Added 2011-03-12 13:00:45 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|DHL_"; nocase; content:".zip|22|"; nocase; pcre:"/filename=\x22DHL_(document|(|print_|package_)label)(|_nr|_id.nr)(|[0-9]{4,5}|_[0-9a-z]{4,5})\.zip\x22/i"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:10;)

Added 2011-03-04 15:37:35 UTC


##alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|DHL_"; nocase; pcre:"/filename=\x22DHL_(label_id|ID.document)\.Nr[0-9]{4,5}\.zip\x22/i"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:9;)

Added 2011-02-04 17:29:36 UTC

variants seen

tracking.zip DHL_document.zip DHL_tracking.zip DHL_document_Nr17124.zip DHL_label_id.Nr21964.zip DHL_label_id.Nr48305.zip DHL_label_id.Nr3139.zip DHL_label_id.Nr15544.zip DHL_label_id.Nr7085.zip DHL_Label_97c78.zip DHL_package_label_4faa6.zip DHL_print_label_0ab2d.zip

-- JasonWeir - 04 Mar 2011


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*\"DHL_(Label_|document_|package_label_|print_label_).{5,7}\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:5;)

Added 2010-02-04 11:01:07 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*\"DHL_(Label_|document_|package_label_|print_label_).{5,7}\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:5;)

Added 2010-02-04 11:01:07 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:4;)

Added 2009-11-03 22:05:08 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:4;)

Added 2009-11-03 22:05:08 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:4;)

Added 2009-11-03 22:00:42 UTC


alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:4;)

Added 2009-11-03 22:00:42 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:3;)

Added 2009-11-02 20:30:41 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:3;)

Added 2009-11-02 20:30:41 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:3;)

Added 2009-11-02 20:26:37 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010148; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_DHL; sid:2010148; rev:3;)

Added 2009-11-02 20:26:37 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; sid:2010148; rev:2;)

Added 2009-10-22 14:54:39 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_).....\.zip/m"; classtype:trojan-activity; sid:2010148; rev:2;)

Added 2009-10-22 14:54:39 UTC


alert tcp $EXTERNAL_NET 1024: -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment\;"; nocase; content:"filename"; within:100; content:"DHL_"; within:50; pcre:"/filename\s*=\s*"DHL_(package_label_|print_label_)....\.zip/m"; classtype:trojan-activity; sid:2010148; rev:1;)

Added 2009-10-22 14:22:37 UTC


Topic revision: r5 - 2011-03-11 - JasonWeir
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats