Versions (4)
Version DetailsCurrent
Rev: 4 • Apr 4, 2012, 12:00 PMET MALWARE LuckyCat/TROJ_WIMMIE Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LuckyCat/TROJ_WIMMIE Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:".php?m="; content:"&n="; within:4; content:"_"; distance:0; content:"@"; distance:0; pcre:"/\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$/"; reference:url,blog.trendmicro.com/luckycat-redux-inside-an-apt-campaign/; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf; classtype:command-and-control; sid:2014462; rev:4; metadata:created_at 2012_04_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)
Apr 4, 2012, 12:00 PM
Apr 21, 2020, 12:00 PM
Apr 4, 2012, 12:00 PM
Oct 22, 2025, 9:34 PM
rules/emerging-malware.rules