Versions (4)
Version DetailsCurrent
Rev: 2 • Oct 8, 2015, 12:00 PMET MALWARE MSIL/Banker.M Downloading Binary from SQL
alert tcp $EXTERNAL_NET 1433 -> $HOME_NET any (msg:"ET MALWARE MSIL/Banker.M Downloading Binary from SQL"; flow:established,to_client; content:"|03 00|d|00|b|00|o|00 09 00|n|00|o|00|v|00|o|00|s|00|l|00|o|00|a|00|d|00 03|i|00|m|00|g"; fast_pattern; content:"This program cannot be run"; distance:0; reference:md5,54618b126c69b2f0a3309b7c0ac5ae26; reference:url,blogs.mcafee.com/mcafee-labs/brazilian-banking-malware-hides-in-sql-database/; classtype:trojan-activity; sid:2021931; rev:2; metadata:created_at 2015_10_08, malware_family MSIL_Banker_M, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_17;)
Oct 8, 2015, 12:00 PM
Mar 17, 2022, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 22, 2025, 10:34 PM
rules/emerging-malware.rules