[Snort-sigs] Unknown Botnet sig

James Lay jlay at ...3266...
Thu Jul 11 18:14:00 EDT 2013


Would be nice to put a name to this if anyone has any other info on it:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC 
Win.Trojan.Kuluoz variant outbound connection"; 
flow:to_server,established; content:"f=sm_main.mp3"; fast_pattern:only; 
http_uri; pcre:"/[a-f0-9]{10}/\x3ff=sm_main.mp3\x26k=[0-9]{15}/U"; 
metadata:policy balanced-ips drop, policy security-ips drop, service 
http; 
reference:url,http://research.zscaler.com/2013/07/tracking-botnet-infection.html; 
classtype:trojan-activity; sid:10000087; rev:1;)

James




More information about the Snort-sigs mailing list