Versions (3)
Version DetailsCurrent
Rev: 6 • May 29, 2014, 12:00 PMET MALWARE Trojan-Dropper.Win32.Agent.ksja
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Dropper.Win32.Agent.ksja"; flow:established,to_server; http.uri; content:".php?m="; fast_pattern; pcre:"/\.php\?m=[A-F0-9]{12}/"; http.user_agent; bsize:35; content:"Mozilla|2f|4|2e|0|20 28|Compatible|3b 20|MSIE|20|6|2e|0|3b 29|"; http.header_names; content:!"Connection|0d 0a|"; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|"; startswith; content:"|0d 0a|Accept|0d 0a|"; reference:md5,3b440e052da726942763d11cf9e3f72c; classtype:trojan-activity; sid:2018507; rev:6; metadata:created_at 2014_05_29, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_11;)
May 29, 2014, 12:00 PM
Mar 11, 2024, 12:00 PM
May 29, 2014, 12:00 PM
Dec 22, 2025, 10:34 PM
rules/emerging-malware.rules