Rule History

SID: 2021954 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • Oct 15, 2015, 12:00 PM

Message:

ET MALWARE JS/Nemucod.M.gen downloading EXE payload

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JS/Nemucod.M.gen downloading EXE payload"; flow:from_server,established; flowbits:isset,ET.nemucod.exerequest; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; fast_pattern; distance:-64; within:4; reference:url,www.certego.net/en/news/italian-spam-campaigns-using-js-nemucod-downloader/; reference:md5,0bc86ab7ead67e264531ccb16c3c529a; classtype:trojan-activity; sid:2021954; rev:2; metadata:created_at 2015_10_15, malware_family JS_Nemucod_M_gen, signature_severity Major, updated_at 2019_07_26;)

Created:

Oct 15, 2015, 12:00 PM

Updated:

Jul 26, 2019, 12:00 PM

DB Created:

Oct 15, 2015, 12:00 PM

DB Updated:

Sep 13, 2024, 9:01 PM

Filename:

rules/emerging-malware.rules