alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; http_uri; urilen:20; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_02_12, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2020_11_10, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)

Added 2021-10-04 19:24:41 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; http_uri; urilen:20; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:3; metadata:created_at 2014_02_12, updated_at 2020_11_10;)

Added 2020-11-10 19:09:46 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; urilen:20; http_uri; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:2; metadata:created_at 2014_02_12, updated_at 2020_04_27;)

Added 2020-04-27 19:10:28 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; urilen:20; http_uri; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:2; metadata:created_at 2014_02_12, updated_at 2014_02_12;)

Added 2018-09-13 19:48:25 UTC

Added 2018-09-13 17:58:26 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; urilen:20; http_uri; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:2; metadata:created_at 2014_02_12, updated_at 2014_02_12;)

Added 2017-08-07 21:12:10 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Linkup Ransomware check-in"; flow:established,to_server; content:"POST"; http_method; content:"/uplink.php?logo.jpg"; urilen:20; http_uri; content:"token="; http_client_body; reference:url,blog.emsisoft.com/2014/02/03/malware-analysis-ransomware-linkup-blocks-dns-and-mines-bitcoins/; classtype:trojan-activity; sid:2018122; rev:1;)

Added 2014-02-12 19:23:22 UTC