Versions (3)
Version DetailsCurrent
Rev: 6 • Jul 30, 2010, 12:00 PMET MALWARE Trash Family - HTTP POST
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Trash Family - HTTP POST"; flow:established,to_server; http.method; content:"POST"; depth:4; http.request_body; content:"Type="; nocase; content:"&Dvip="; fast_pattern; nocase; content:"&Mask="; nocase; content:"&Guid="; nocase; content:"&Addr="; nocase; content:"&Protect="; nocase; content:"Url"; nocase; content:"&OSVer="; nocase; http.header_names; content:!"|0d 0a|User-Agent|0d 0a|"; reference:url,www.spywareguide.com/product_show.php?id=1935; reference:url,www.sunbeltsecurity.com/threatdisplay.aspx?name=Trojan.Trash.Gen&tid=178782&cs=03253E96A71C3EE824071E5BE3A32CCD; classtype:trojan-activity; sid:2009449; rev:6; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_22;)
Jul 30, 2010, 12:00 PM
Feb 22, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Nov 10, 2025, 10:34 PM
rules/emerging-malware.rules