Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request"; flow:established,to_server; dsize:<30; content:"pimbsbd"; startswith; fast_pattern; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r\n/R"; reference:md5,b6e0ad4963d054b697f307c09e7eb35f; reference:url,app.any.run/tasks/509940a9-d20a-4599-89e0-40b2810f485d; classtype:trojan-activity; sid:2047723; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_08_24, deployment Perimeter, malware_family Mekotio, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_08_24, reviewed_at 2023_08_24; target:src_ip;)