alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, former_category MALWARE, updated_at 2020_11_19;)

Added 2020-11-19 18:26:23 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, former_category MALWARE, updated_at 2020_08_19;)

Added 2020-08-19 18:14:30 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, former_category MALWARE, updated_at 2018_01_28;)

Added 2020-08-05 19:14:23 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; metadata: former_category MALWARE; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, updated_at 2018_01_28;)

Added 2019-09-26 19:58:25 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; metadata: former_category TROJAN; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, updated_at 2018_01_28;)

Added 2018-09-13 19:54:31 UTC


Added 2018-09-13 18:02:02 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; threshold: type both, track by_src, count 2, seconds 60; metadata: former_category TROJAN; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:4; metadata:created_at 2018_01_26, updated_at 2018_01_28;)

Added 2018-01-30 17:00:13 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; metadata: former_category TROJAN; reference:url,darkwebs.ws/threads/41806/; reference:md5,e18c73ec38cbdd0bb0c66f360183e6d9; classtype:trojan-activity; sid:2025253; rev:3; metadata:created_at 2018_01_26, updated_at 2018_01_28;)

Added 2018-01-29 17:12:24 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN [PTsecurity] Kuriyama Loader Checkin"; flow: established, to_server; content:"?hwid="; http_uri; content:"&group="; http_uri; fast_pattern; content:"&os="; http_uri; content:"&cpu="; http_uri; content:"GET"; http_method; content:!"Referer|3a|"; http_header; classtype:trojan-activity; sid:2025253; rev:2; metadata:created_at 2018_01_26, updated_at 2018_01_26;)

Added 2018-01-26 16:33:34 UTC


Topic revision: r1 - 2020-11-19 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats