Versions (4)
Version DetailsCurrent
Rev: 5 • Jan 18, 2012, 12:00 PMET MALWARE W32/Jiwerks.A Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Jiwerks.A Checkin"; flow:established,to_server; content:"|0d 0a 0d 0a|a="; fast_pattern; http.method; content:"POST"; nocase; http.uri; content:"/update.aspx"; http.accept_lang; content:"zh-cn"; http.request_body; content:"a="; depth:2; content:"&v="; distance:0; reference:md5,0e47c711d9edee337575b6dbef850514; classtype:command-and-control; sid:2014133; rev:5; metadata:created_at 2012_01_18, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)
Jan 18, 2012, 12:00 PM
Apr 21, 2020, 12:00 PM
Jan 18, 2012, 12:00 PM
Dec 10, 2025, 11:34 PM
rules/emerging-malware.rules