Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET [587,25] (msg:"ET MALWARE LDPinch Reporting infection via Email"; flow:established,to_server; content:"X-Mailer|3a| Blat v2.6.2 w/GSS encryption, a Win32 SMTP/NNTP mailer http|3a|//www.blat.net|0d 0a|"; content:"|0d 0a|Subject|3a| Contents of file|3a| WINDOWS/system32/"; distance:0; classtype:trojan-activity; sid:2009242; rev:3; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)