2014616 < Main < EmergingThreats

Main Web>2014616 (2022-05-03, TWikiGuest) (raw view)
 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:established,to_server; content:"/ufr.php"; http_uri; fast_pattern; content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:md5,3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:7; metadata:created_at 2011_11_16, former_category MALWARE, updated_at 2022_05_03;)

</h2>

Added 2022-05-03 18:06:35 UTC


 %COMMENT{type="threadmode" default="Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps." button="Add to Documentation" }%
 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:md5,3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:6; metadata:created_at 2011_11_16, former_category MALWARE, updated_at 2020_11_19;)

</h2>

Added 2021-09-13 18:07:04 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:6; metadata:created_at 2011_11_16, former_category MALWARE, updated_at 2020_11_19;)

</h2>

Added 2020-11-19 18:26:18 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:6; metadata:created_at 2011_11_16, former_category MALWARE, updated_at 2020_08_19;)

</h2>

Added 2020-08-19 18:14:21 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:6; metadata:created_at 2011_11_16, former_category MALWARE, updated_at 2019_10_07;)

</h2>

Added 2020-08-05 19:08:08 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern:only;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; metadata: former_category MALWARE; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:5; metadata:created_at 2011_11_16, updated_at 2019_10_07;)

</h2>

Added 2019-10-07 19:58:24 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern:only;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; metadata: former_category MALWARE; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:5; metadata:created_at 2011_11_16, updated_at 2011_11_16;)

</h2>

Added 2019-09-26 19:57:08 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern:only;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:5; metadata:created_at 2011_11_16, updated_at 2011_11_16;)

</h2>

Added 2018-09-13 19:44:32 UTC


 
 <hr>
 


 <h2>
 


</h2>

Added 2018-09-13 17:56:21 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; fast_pattern:only;  content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:5; metadata:created_at 2011_11_16, updated_at 2011_11_16;)

</h2>

Added 2017-08-07 21:08:03 UTC


 
 <hr>
 


 <h2>
 

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; fast_pattern:only; http_uri; content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:4;)

</h2>

Added 2013-01-28 20:10:07 UTC


 
 <hr>
 


 <h2>
 

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32/Usteal.B Checkin"; flow:to_server,established; content:"/ufr.php"; http_uri; content:"name="; http_client_body; content:"filename="; http_client_body; content:"UFR|21|"; http_client_body; reference:url,www.threatexpert.com/report.aspx?md5=3155b146bee46723acc5637617e3703a; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FUsteal.B&ThreatID=-2147320862; classtype:trojan-activity; sid:2014616; rev:3;)

</h2>

Added 2012-04-18 11:50:45 UTC


 
 <hr>
Topic revision: r1 - 2022-05-03 - TWikiGuest
Main
User Reference
ATasteOfTWiki
TextFormattingRules
Signature Reference
WebRss Feed
EmergingFAQ