alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Gozi/Orderjack Reporting User Activity"; flow:established,to_server; uricontent:".cgi?"; nocase; uricontent:"user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"crc="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.secureworks.com/research/threats/gozi; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2002854; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Orderjack; sid:2002854; rev:4;)

Added 2009-02-13 19:30:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Gozi/Orderjack Reporting User Activity"; flow:established,to_server; uricontent:".cgi?"; nocase; uricontent:"user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"crc="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.secureworks.com/research/threats/gozi; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2002854; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Orderjack; sid:2002854; rev:4;)

Added 2009-02-13 19:30:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Gozi/Orderjack Reporting User Activity"; flow:established,to_server; uricontent:".cgi?"; nocase; uricontent:"user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"crc="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.secureworks.com/research/threats/gozi; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; sid:2002854; rev:3;)

Added 2008-06-05 05:15:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Gozi/Orderjack Reporting User Activity"; flow:established,to_server; uricontent:".cgi?"; nocase; uricontent:"user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"crc="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.secureworks.com/research/threats/gozi; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; sid:2002854; rev:3;)

Added 2008-06-05 05:15:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Orderjack Reporting User Activity"; flow:established,to_server; uricontent:"options.cgi?user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; sid:2002854; rev:2;)

Added 2008-01-31 10:12:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Orderjack Reporting User Activity"; flow:established,to_server; uricontent:"options.cgi?user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; sid:2002854; rev:2;)

Added 2008-01-31 10:12:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE TROJAN Orderjack Reporting User Activity"; flow:established,to_server; uricontent:"options.cgi?user_id="; nocase; uricontent:"&version_id="; nocase; uricontent:"&passphrase="; nocase; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1724/tr_dldr.orderjack.a.html; classtype:trojan-activity; sid:2002854; rev:1;)