[Emerging-Sigs] ET TROJAN Win32.VBNA.b Checkin Signature

Micah Kays micah.d.kays at gmail.com
Sun Oct 9 23:58:37 EDT 2011


alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"ET TROJAN
Win32.VBNA.b Checkin"; content:"GET"; http_method;
uricontent:"ip_query_country.php?key="; uricontent:"&timezone=";
classtype:trojan-activity;
reference:url,http://www.threatexpert.com/report.aspx?md5=0d6cd3944f0dc79275727393c66ab744
sid:001; rev:1;)


More information about the Emerging-sigs mailing list