alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Recovery KEYS for your account Trojan Email Trojan Inbound (2)"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; content:"new_activation_keys.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:2008774; rev:1;)

Added 2008-11-13 10:06:24 UTC