Versions (3)
Version DetailsCurrent
Rev: 5 • Mar 26, 2015, 12:00 PMET MALWARE Win32.Chroject.B Receiving ClickFraud Commands from CnC 2
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32.Chroject.B Receiving ClickFraud Commands from CnC 2"; flow:from_server,established; file_data; content:"<html><title>"; within:13; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$/R"; content:"</title></html>"; fast_pattern; flowbits:isset,ET.Chroject; reference:md5,586ad13656f4595723b481d77b6bfb09; classtype:command-and-control; sid:2020749; rev:5; metadata:created_at 2015_03_26, signature_severity Major, updated_at 2019_10_08;)Mar 26, 2015, 12:00 PM
Oct 8, 2019, 12:00 PM
Mar 26, 2015, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules