alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WSF/JS Downloader Jan 30 2017 M1"; flow:to_server,established; urilen:>65; content:"/counter/?"; fast_pattern; http_uri; depth:10; content:"a="; http_uri; content:"i="; http_uri; content:"MSIE 7.0"; http_user_agent; pcre:"/[&?]i=[A-Za-z0-9_-]{50,}(?:&|$)/U"; pcre:"/[&?]a=(?:[a-zA-Z0-9_-]{25,}|(?:0\.)?\d+)(?:&|$)/U"; http_header_names; content:!"Referer|0d 0a|"; content:!"Cookie|0d 0a|"; reference:md5,852cbd70766feb96923a79b210e94646; classtype:trojan-activity; sid:2023816; rev:3; metadata:created_at 2017_01_31, updated_at 2020_11_04;)

Added 2020-11-04 18:49:47 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WSF/JS Downloader Jan 30 2017 M1"; flow:to_server,established; urilen:>65; content:"/counter/?"; fast_pattern; http_uri; depth:10; content:"a="; http_uri; content:"i="; http_uri; content:"MSIE 7.0"; http_user_agent; pcre:"/[&?]i=[A-Za-z0-9_-]{50,}(?:&|$)/U"; pcre:"/[&?]a=(?:[a-zA-Z0-9_-]{25,}|(?:0\.)?\d+)(?:&|$)/U"; http_header_names; content:!"Referer|0d 0a|"; content:!"Cookie|0d 0a|"; reference:md5,852cbd70766feb96923a79b210e94646; classtype:trojan-activity; sid:2023816; rev:3; metadata:created_at 2017_01_31, updated_at 2020_03_04;)

Added 2020-03-04 19:16:54 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WSF/JS Downloader Jan 30 2017 M1"; flow:to_server,established; urilen:>65; content:"/counter/?"; fast_pattern; http_uri; depth:10; content:"a="; http_uri; content:"i="; http_uri; content:"MSIE 7.0"; http_user_agent; pcre:"/[&?]i=[A-Za-z0-9_-]{50,}(?:&|$)/U"; pcre:"/[&?]a=(?:[a-zA-Z0-9_-]{25,}|(?:0\.)?\d+)(?:&|$)/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; reference:md5,852cbd70766feb96923a79b210e94646; classtype:trojan-activity; sid:2023816; rev:2; metadata:created_at 2017_01_31, updated_at 2017_01_31;)

Added 2018-09-13 19:53:25 UTC

Added 2018-09-13 18:01:23 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WSF/JS Downloader Jan 30 2017 M1"; flow:to_server,established; urilen:>65; content:"/counter/?"; fast_pattern; http_uri; depth:10; content:"a="; http_uri; content:"i="; http_uri; content:"MSIE 7.0"; http_user_agent; pcre:"/[&?]i=[A-Za-z0-9_-]{50,}(?:&|$)/U"; pcre:"/[&?]a=(?:[a-zA-Z0-9_-]{25,}|(?:0\.)?\d+)(?:&|$)/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; reference:md5,852cbd70766feb96923a79b210e94646; classtype:trojan-activity; sid:2023816; rev:2; metadata:created_at 2017_01_31, updated_at 2017_01_31;)

Added 2017-08-07 21:19:03 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WSF/JS Downloader Jan 30 2017 M1"; flow:to_server,established; urilen:>65; content:"/counter/?"; fast_pattern; http_uri; depth:10; content:"a="; http_uri; content:"i="; http_uri; content:"MSIE 7.0"; http_user_agent; pcre:"/[&?]i=[A-Za-z0-9_-]{50,}(?:&|$)/U"; pcre:"/[&?]a=(?:[a-zA-Z0-9_-]{25,}|(?:0\.)?\d+)(?:&|$)/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; reference:md5,852cbd70766feb96923a79b210e94646; classtype:trojan-activity; sid:2023816; rev:2;)

Added 2017-01-31 16:51:02 UTC