Rule History

SID: 2018300 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 5 • Mar 20, 2014, 12:00 PM

Message:

ET MALWARE Win32/Stoberox.B

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Stoberox.B"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; http.connection; bsize:5; content:"Close"; http.accept_enc; bsize:4; content:"none"; fast_pattern; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Host|0d 0a|"; startswith; http.request_body; pcre:"/^[a-zA-Z0-9\+\/]+={0,2}$/"; reference:md5,6ca1690720b3726bc76ef0e7310c9ee7; classtype:trojan-activity; sid:2018300; rev:5; metadata:created_at 2014_03_20, malware_family Win32_Stoberox_B, signature_severity Major, updated_at 2024_03_05;)

Created:

Mar 20, 2014, 12:00 PM

Updated:

Mar 5, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-malware.rules