ET DELETED ProFTPD Backdoor outbound Request Sent

SID: 2011993Rev: 20 viewsHistory

Sourceet/open

CreatedDecember 2, 2010

UpdatedJuly 26, 2019

Classificationtrojan-activity

alert tcp $HOME_NET any -> 212.26.42.47 9090 (msg:"ET DELETED ProFTPD Backdoor outbound Request Sent"; flow:established,to_server; content:"GET /AB"; reference:url,slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed; reference:url,xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/; reference:url,sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org; classtype:trojan-activity; sid:2011993; rev:2; metadata:created_at 2010_12_02, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)

References

url	slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed
url	xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/
url	sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org

Metadata

created at2010_12_02

signature severityUnknown

tagDescription_Generated_By_Proofpoint_Nexus

updated at2019_07_26

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!