Versions (4)
Version DetailsCurrent
Rev: 2 • Nov 23, 2015, 12:00 PMET MALWARE MegalodonHTTP CnC Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MegalodonHTTP CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?hwid="; fast_pattern; content:"&ip="; content:"&os="; content:"&name="; content:"&ram="; content:"&cpu="; content:"&gpu="; content:"&av="; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Accept"; content:!"Referer|0d 0a|"; reference:md5,966301e88d8a43abe1215413bfd48b09; reference:url,damballa.com/megalodonhttp-botnet-discovered-the-shark-paradox/; classtype:command-and-control; sid:2022126; rev:2; metadata:created_at 2015_11_23, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_06_09;)
Nov 23, 2015, 12:00 PM
Jun 9, 2020, 12:00 PM
Nov 23, 2015, 12:00 PM
Dec 5, 2025, 11:34 PM
rules/emerging-malware.rules