Versions (2)
Version DetailsCurrent
Rev: 4 • Oct 16, 2015, 12:00 PMET MALWARE Nemucod Downloading Payload 2
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nemucod Downloading Payload 2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/document.php?rnd="; depth:18; fast_pattern; content:"&id="; distance:0; pcre:"/^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$/i"; http.header_names; content:!"Referer|0d 0a|"; reference:url,trendmicro.com/vinfo/us/threat-encyclopedia/malware/js_nemucod.hqk; classtype:trojan-activity; sid:2021956; rev:4; metadata:created_at 2015_10_16, signature_severity Major, updated_at 2020_06_04;)
Oct 16, 2015, 12:00 PM
Jun 4, 2020, 12:00 PM
Oct 16, 2015, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules