#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN FTP File Upload - BlackPOS? Naming Scheme"; flow:established,to_server; content:"STOR "; depth:5; content:".txt"; pcre:"/data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt/"; reference:url,www.cyphort.com/blog/cyphort-tracks-down-new-variants-of-target-malware/; classtype:trojan-activity; sid:2018115; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)

Added 2020-11-20 19:36:44 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN FTP File Upload - BlackPOS? Naming Scheme"; flow:established,to_server; content:"STOR "; depth:5; content:".txt"; pcre:"/data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt/"; reference:url,www.cyphort.com/blog/cyphort-tracks-down-new-variants-of-target-malware/; classtype:trojan-activity; sid:2018115; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)

Added 2018-09-13 19:48:24 UTC

Added 2018-09-13 17:58:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN FTP File Upload - BlackPOS? Naming Scheme"; flow:established,to_server; content:"STOR "; depth:5; content:".txt"; pcre:"/data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt/"; reference:url,www.cyphort.com/blog/cyphort-tracks-down-new-variants-of-target-malware/; classtype:trojan-activity; sid:2018115; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)

Added 2017-08-07 21:12:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN FTP File Upload - BlackPOS? Naming Scheme"; flow:established,to_server; content:"STOR "; depth:5; content:".txt"; pcre:"/data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt/"; reference:url,www.cyphort.com/blog/cyphort-tracks-down-new-variants-of-target-malware/; classtype:trojan-activity; sid:2018115; rev:1;)

Added 2014-02-12 19:23:22 UTC