alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|Content-Length|3a 20|128|0d 0a|"; http_header; fast_pattern; http_start; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Cache-Control|0d 0a 0d 0a|"; depth:53; isdataat:!1,relative; classtype:trojan-activity; sid:2016759; rev:3; metadata:created_at 2013_04_16, former_category MALWARE, updated_at 2020_11_05;)

Added 2020-11-05 18:35:54 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|Content-Length|3a 20|128|0d 0a|"; http_header; fast_pattern; http_start; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Cache-Control|0d 0a 0d 0a|"; depth:53; isdataat:!1,relative; classtype:trojan-activity; sid:2016759; rev:3; metadata:created_at 2013_04_16, former_category MALWARE, updated_at 2020_03_09;)

Added 2020-08-05 19:09:02 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|Content-Length|3a 20|128|0d 0a|"; http_header; fast_pattern; http_start; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Cache-Control|0d 0a 0d 0a|"; depth:53; isdataat:!1,relative; metadata: former_category MALWARE; classtype:trojan-activity; sid:2016759; rev:3; metadata:created_at 2013_04_16, updated_at 2020_03_09;)

Added 2020-03-09 21:02:07 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|"; http_header; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; content:!"Referer|3a 20|"; http_header; metadata: former_category MALWARE; classtype:trojan-activity; sid:2016759; rev:2; metadata:created_at 2013_04_16, updated_at 2019_09_26;)

Added 2019-09-26 19:57:22 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|"; http_header; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2016759; rev:1; metadata:created_at 2013_04_16, updated_at 2013_04_16;)

Added 2018-09-13 19:46:48 UTC


Added 2018-09-13 17:57:34 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|"; http_header; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2016759; rev:1; metadata:created_at 2013_04_16, updated_at 2013_04_16;)

Added 2017-08-07 21:10:33 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Redyms.A Checkin"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; offset:6; depth:7; content:".net|0d 0a|"; http_header; pcre:"/^POST \/(?P[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(?P=filep)[a-z]+?\.net\r\n/s"; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2016759; rev:1;)

Added 2013-04-16 20:09:51 UTC


Topic revision: r1 - 2020-11-05 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats