#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;)

Added 2020-11-20 19:36:41 UTC


alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;)

Added 2020-08-05 19:09:13 UTC


alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; metadata: former_category MALWARE; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2019-09-19 19:25:56 UTC


alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2018-09-13 19:47:28 UTC


Added 2018-09-13 17:57:55 UTC


alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2017-08-07 21:11:09 UTC


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:1;)

Added 2013-08-05 19:51:58 UTC


Topic revision: r1 - 2020-11-21 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats