ET MALWARE nte Binary Download Attempt (multiple malware variants served)

SID: 2011576Rev: 50 views
History
Sourceet/open
CreatedSeptember 27, 2010
UpdatedFebruary 8, 2024
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE nte Binary Download Attempt (multiple malware variants served)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/nte/"; fast_pattern; pcre:"/(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$/i"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; http.user_agent; content:"Java"; startswith; reference:url,www.malwaredomainlist.com; reference:url,www.malwareurl.com/search.php?domain=&s=trest1&match=0&rp=200&urls=on&redirs=on&ip=on&reverse=on&as=on; classtype:trojan-activity; sid:2011576; rev:5; metadata:created_at 2010_09_27, signature_severity Major, updated_at 2024_02_08;)

References

urlwww.malwaredomainlist.com
urlwww.malwareurl.com/search.php?domain=&s=trest1&match=0&rp=200&urls=on&redirs=on&ip=on&reverse=on&as=on

Metadata

created at2010_09_27
signature severityMajor
updated at2024_02_08

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!