Versions (3)
Version DetailsCurrent
Rev: 6 • Jul 30, 2010, 12:00 PMET MALWARE Palevo/BFBot/Mariposa server join acknowledgement
alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Palevo/BFBot/Mariposa server join acknowledgement"; dsize:8; content:"|40|"; depth:1; flowbits:isset,ET.MariposaJoin; reference:url,defintel.com/docs/Mariposa_Analysis.pdf; reference:url,defintel.blogspot.com/2009/09/half-of-fortune-100-companies.html; reference:url,blogs.pcmag.com/securitywatch/2009/09/botnet_reported_loose_in_fortu.php; reference:url,www.symantec.com/business/security_response/writeup.jsp?docid=2009-093006-0442-99&tabid=2; reference:url,www.symantec.com/connect/blogs/mariposa-butterfly; classtype:trojan-activity; sid:2010101; rev:6; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Jul 30, 2010, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Nov 10, 2025, 10:34 PM
rules/emerging-malware.rules