[Emerging-Sigs] Win32.Trojan.SuspectCRC Checkin Signature

Micah Kays micah.d.kays at gmail.com
Tue Oct 4 09:50:26 EDT 2011


alert tcp $HOME_NET any -> any $HTTP_PORTS
(msg:"Win32.Trojan.SuspectCRC Checkin"; uricontent:"value.php?";
uricontent:"md="; uricontent:"&pc="; classtype:trojan-activity;
reference:url,http://www.threatexpert.com/report.aspx?md5=54c9d51661a05151e5143f4e80cbed86;
sid:1; rev:1;)


More information about the Emerging-sigs mailing list