ET MALWARE Win32.Chroject.B Receiving ClickFraud Commands from CnC 2
Sourceet/open
CreatedMarch 26, 2015
UpdatedOctober 8, 2019
Classificationcommand-and-control
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32.Chroject.B Receiving ClickFraud Commands from CnC 2"; flow:from_server,established; file_data; content:"<html><title>"; within:13; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$/R"; content:"</title></html>"; fast_pattern; flowbits:isset,ET.Chroject; reference:md5,586ad13656f4595723b481d77b6bfb09; classtype:command-and-control; sid:2020749; rev:5; metadata:created_at 2015_03_26, signature_severity Major, updated_at 2019_10_08;)
References
| md5 | 586ad13656f4595723b481d77b6bfb09 |
Metadata
created at2015_03_26
signature severityMajor
updated at2019_10_08
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!