Versions (4)
Version DetailsCurrent
Rev: 6 • May 1, 2012, 12:00 PMET MALWARE Win32/Ponmocup.A Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Ponmocup.A Checkin"; flow:established,to_server; urilen:10; http.method; content:"GET"; http.uri; content:"/space.php"; fast_pattern; http.accept; bsize:3; content:"*/*"; http.cookie; content:"uid="; startswith; content:"|3b 20|VISITOR="; distance:0; http.header_names; content:"|0d 0a|Accept|0d 0a|Cookie|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|"; distance:-2; content:"|0d 0a|Host|0d 0a|"; distance:-2; reference:md5,97a1acc085849c0b9af19adcf44607a7; classtype:command-and-control; sid:2014660; rev:6; metadata:created_at 2012_05_01, malware_family Win32_Ponmocup_A, signature_severity Major, updated_at 2024_03_12;)
May 1, 2012, 12:00 PM
Mar 12, 2024, 12:00 PM
May 1, 2012, 12:00 PM
Sep 16, 2024, 11:00 PM
rules/emerging-malware.rules