Rule History

SID: 2014566 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 4 • Apr 16, 2012, 12:00 PM

Message:

ET MALWARE W32/UltimateDefender.FakeAV Checkin

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/UltimateDefender.FakeAV Checkin"; flow:established,to_server; http.uri; content:"/show_module.php?IsAutoGeneratedPage="; content:"&asked_billing_id="; content:"&original_asked_billing_id="; content:"&brokerid="; content:"&country="; content:"&customid="; content:"&product="; content:"&custom_param="; content:"&extparam="; content:"&nums="; reference:md5,cec40236236466a1acb33aca3220eebe; classtype:command-and-control; sid:2014566; rev:4; metadata:created_at 2012_04_16, signature_severity Major, updated_at 2020_08_04;)

Created:

Apr 16, 2012, 12:00 PM

Updated:

Aug 4, 2020, 12:00 PM

DB Created:

Apr 16, 2012, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-malware.rules