Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic Stealer Config from Server"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"wallets|3b 2a 3b 2d|"; content:"|3b|Local|20|Extension|20|Settings"; distance:0; content:"azne|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0; fast_pattern; content:"pm|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0; content:"cc|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0; content:"rc|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0; reference:md5,0a7b32e75a01764ef5389a1d9e72ed63; classtype:trojan-activity; sid:2036883; rev:1; metadata:created_at 2022_06_06, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_06;)