Versions (5)
Version DetailsCurrent
Rev: 6 • Jan 22, 2014, 12:00 PMET MALWARE Win32/Kryptik.BSYO Checkin 2
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Kryptik.BSYO Checkin 2"; flow:to_server,established; http.uri; content:"/cmd?version="; fast_pattern; content:"&aid="; content:"&id="; content:"&os="; pcre:"/&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=/"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:command-and-control; sid:2018198; rev:6; metadata:created_at 2014_01_22, malware_family Win32_Kryptik_BSYO, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_22;)
Jan 22, 2014, 12:00 PM
Sep 22, 2020, 12:00 PM
Jan 22, 2014, 12:00 PM
Oct 20, 2025, 3:34 PM
rules/emerging-malware.rules