#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;)

Added 2020-11-20 19:36:41 UTC

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;)

Added 2020-08-05 19:09:13 UTC

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; metadata: former_category MALWARE; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2019-09-19 19:25:56 UTC

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2018-09-13 19:47:28 UTC

Added 2018-09-13 17:57:55 UTC

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:2; metadata:created_at 2013_08_05, updated_at 2013_08_05;)

Added 2017-08-07 21:11:09 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN SpamBot? CnC? Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:"<repo"; distance:0; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:trojan-activity; sid:2017275; rev:1;)

Added 2013-08-05 19:51:58 UTC