Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banito/Agent.pb Pass Stealer Email Report Outbound"; flow:established,to_server; content:"Subject|3a| Vip Passw0rds|0d 0a 0d 0a|Victim Name |3a| "; content:"|0d 0a|######## ICQ PASSWORDS ########"; within:70; classtype:trojan-activity; sid:2008551; rev:4; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_08_19;)