alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a 20|0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:6; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2020_10_14;)

Added 2020-10-14 20:54:43 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a 20|0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:6; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2019_10_11;)

Added 2020-08-05 19:08:51 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a 20|0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; metadata: former_category MALWARE; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:6; metadata:created_at 2013_02_20, updated_at 2019_10_11;)

Added 2019-10-11 19:56:37 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; metadata: former_category MALWARE; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:5; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2019-09-19 19:25:54 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:5; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2018-09-13 19:46:24 UTC

Added 2018-09-13 17:57:20 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:5; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2017-08-07 21:10:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:4;)

Added 2013-02-20 05:32:07 UTC