alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header; pcre:"/^\d+$/P"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; classtype:trojan-activity; sid:2017261; rev:6; metadata:created_at 2013_07_31, former_category MALWARE, updated_at 2020_11_05;)

Added 2020-11-05 18:35:55 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header; pcre:"/^\d+$/P"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; classtype:trojan-activity; sid:2017261; rev:6; metadata:created_at 2013_07_31, former_category MALWARE, updated_at 2020_03_09;)

Added 2020-08-05 19:09:12 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header; pcre:"/^\d+$/P"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; metadata: former_category MALWARE; classtype:trojan-activity; sid:2017261; rev:6; metadata:created_at 2013_07_31, updated_at 2020_03_09;)

Added 2020-03-09 21:02:08 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; pcre:"/^\d+$/P"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; metadata: former_category MALWARE; classtype:trojan-activity; sid:2017261; rev:5; metadata:created_at 2013_07_31, updated_at 2020_02_29;)

Added 2020-03-02 20:02:22 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; pcre:"/^\d+$/P"; metadata: former_category MALWARE; classtype:trojan-activity; sid:2017261; rev:4; metadata:created_at 2013_07_31, updated_at 2019_05_29;)

Added 2019-09-26 19:57:26 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:4; metadata:created_at 2013_07_31, updated_at 2019_05_29;)

Added 2019-05-29 19:52:18 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3; metadata:created_at 2013_07_31, updated_at 2013_07_31;)

Added 2018-09-13 19:47:27 UTC

Added 2018-09-13 17:57:55 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3; metadata:created_at 2013_07_31, updated_at 2013_07_31;)

Added 2017-08-07 21:11:08 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3;)

Added 2015-02-02 18:00:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN TrojanDownloader?.Win32/Dofoil.U Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:2;)

Added 2014-04-21 19:36:52 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN TrojanDownloader?.Win32/Dofoil.U Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:1;)

Added 2013-08-09 00:04:07 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:1;)

Added 2013-07-31 18:43:51 UTC