Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Inbound JasperLoader Using Array Push Obfuscation"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|20|=|20|new|20|Array|28 29 3b|"; depth:50; content:".push|28 22|"; distance:0; pcre:"/^(?:\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(?:\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)(?:[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)(?:[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)/Ri"; content:".push|28 22 22 29 0d 0a|"; fast_pattern; content:"eval|28|"; distance:0; classtype:trojan-activity; sid:2027102; rev:5; metadata:attack_target Client_Endpoint, created_at 2019_03_19, deployment Perimeter, malware_family JasperLoader, performance_impact Low, confidence Medium, signature_severity Major, tag Downloader, tag JavaScript, updated_at 2020_08_28;)