Versions (3)
Version DetailsCurrent
Rev: 3 • Aug 26, 2015, 12:00 PMET MALWARE Win32.Banker.bqba Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Banker.bqba Checkin"; flow:to_server,established; http.uri; content:".php"; nocase; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MyApp)"; fast_pattern; bsize:31; http.request_body; content:"windows="; depth:8; content:"&av="; reference:md5,838d43239ba2c28bd968f8a7da64d340; classtype:command-and-control; sid:2023693; rev:3; metadata:created_at 2015_08_26, signature_severity Major, updated_at 2020_06_01;)
Aug 26, 2015, 12:00 PM
Jun 1, 2020, 12:00 PM
Aug 26, 2015, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules