Versions (4)
Version DetailsCurrent
Rev: 3 • Mar 5, 2016, 12:00 PMET MALWARE Dridex Base64 Executable
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex Base64 Executable"; flow:from_server,established; http.stat_code; content:"200"; http.cookie; content:"|47 4f 44 5a 49 4c 4c 41|"; file.data; content:"<div style=|22|display|3a|none|22 20|id=|22|"; depth:30; fast_pattern; pcre:"/^(?P<id>[a-z])\x22\sname=\x22(?P=id)\x22>TVqQAA/Rsi"; classtype:trojan-activity; sid:2022595; rev:3; metadata:created_at 2016_03_05, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_06_24;)
Mar 5, 2016, 12:00 PM
Jun 24, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 2, 2025, 10:34 PM
rules/emerging-malware.rules