Versions (4)
Version DetailsCurrent
Rev: 11 • Feb 29, 2012, 12:00 PMET MALWARE Cridex.B/Feodo Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex.B/Feodo Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/in"; offset:11; depth:3; pcre:"/\/\w{3}\/\w\d_\w\w\w\/in\/?$/i"; http.host; content:".ru"; endswith; fast_pattern; reference:md5,7ed139b53e24e4385c4c59cd2aa0e5f7; reference:url,labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html; reference:url,about-threats.trendmicro.com/Malware.aspx?language=us&name=WORM_CRIDEX.IC; classtype:command-and-control; sid:2014405; rev:11; metadata:created_at 2012_02_29, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_14;)
Feb 29, 2012, 12:00 PM
Feb 14, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 6, 2025, 4:34 PM
rules/emerging-malware.rules