Versions (2)
Version DetailsCurrent
Rev: 6 • Jan 3, 2012, 12:00 PMET MALWARE Trojan.Win32.A.FakeAV Reporting
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32.A.FakeAV Reporting"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/404.php?"; nocase; content:"type=stats"; nocase; content:"affid="; nocase; content:"subid="; nocase; reference:url,securelist.com/en/descriptions/24405309/Trojan.Win32.FakeAV.dlbc; reference:md5,ac0ba9e186aee9cf9889d71158485715; classtype:trojan-activity; sid:2014083; rev:6; metadata:created_at 2012_01_03, signature_severity Major, updated_at 2020_04_29;)
Jan 3, 2012, 12:00 PM
Apr 29, 2020, 12:00 PM
Jan 3, 2012, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules