ET MALWARE W32/Liftoh.Downloader Get Final Payload Request
Sourceet/open
CreatedDecember 17, 2013
UpdatedApril 27, 2020
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Liftoh.Downloader Get Final Payload Request"; flow:established,to_server; http.uri; content:"/get/"; content:"/final"; http.cookie; content:"ip="; depth:3; pcre:"/^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}/R"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/spam-campaign-delivers-liftoh-downloader/; classtype:trojan-activity; sid:2017870; rev:4; metadata:created_at 2013_12_17, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_27;)
References
Metadata
created at2013_12_17
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2020_04_27
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!