ET MALWARE SpamTool.Win32.Agent.gy/Grum/Tedroo Or Similar HTTP Checkin

SID: 2008189Rev: 60 views
History
Sourceet/open
CreatedJuly 30, 2010
UpdatedApril 21, 2020
Classificationcommand-and-control
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpamTool.Win32.Agent.gy/Grum/Tedroo Or Similar HTTP Checkin"; flow:established,to_server; http.uri; content:"?id="; nocase; content:"&tick="; nocase; content:"&ver="; nocase; content:"&smtp="; nocase; reference:url,www.secureworks.com/research/threats/botnets2009/; reference:url,securitylabs.websense.com/content/Blogs/2721.aspx; classtype:command-and-control; sid:2008189; rev:6; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_04_21;)

References

urlwww.secureworks.com/research/threats/botnets2009/
urlsecuritylabs.websense.com/content/Blogs/2721.aspx

Metadata

created at2010_07_30
signature severityMajor
updated at2020_04_21

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!