#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_06_26, deployment Perimeter, former_category ADWARE_PUP, performance_impact Moderate, signature_severity Major, updated_at 2017_09_01;)

Added 2022-05-19 19:06:43 UTC

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_06_26, deployment Perimeter, former_category ADWARE_PUP, performance_impact Moderate, signature_severity Major, updated_at 2017_09_01;)

Added 2020-08-05 19:13:39 UTC

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; metadata: former_category ADWARE_PUP; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_26, performance_impact Moderate, updated_at 2017_09_01;)

Added 2019-09-19 19:26:48 UTC

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; metadata: former_category MALWARE; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_26, performance_impact Moderate, updated_at 2017_09_01;)

Added 2018-09-13 19:53:52 UTC

Added 2018-09-13 18:01:38 UTC

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; metadata: former_category MALWARE; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_26, performance_impact Moderate, updated_at 2017_09_01;)

Added 2017-09-01 16:17:59 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; metadata: former_category TROJAN; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_26, performance_impact Moderate, updated_at 2017_07_19;)

Added 2017-08-07 21:19:48 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:3;)

Added 2017-07-19 17:15:22 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN InstallCore? Variant CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:2;)

Added 2017-07-19 09:12:57 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Powershell/Unknown CnC? Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:trojan-activity; sid:2024428; rev:2;)

Added 2017-06-26 16:42:58 UTC