alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern; http_uri; content:"&sitename="; http_uri; reference:md5,44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:7; metadata:created_at 2011_07_06, former_category MALWARE, updated_at 2020_09_29;)

Added 2021-09-13 18:07:05 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:7; metadata:created_at 2011_07_06, former_category MALWARE, updated_at 2020_09_29;)

Added 2020-09-29 18:42:02 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:7; metadata:created_at 2011_07_06, former_category MALWARE, updated_at 2019_10_07;)

Added 2020-08-05 19:09:06 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern; http_uri; content:"&sitename="; http_uri; metadata: former_category MALWARE; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:7; metadata:created_at 2011_07_06, updated_at 2019_10_07;)

Added 2019-10-08 19:34:09 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; metadata: former_category MALWARE; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:6; metadata:created_at 2011_07_06, updated_at 2011_07_06;)

Added 2019-09-26 19:57:24 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:6; metadata:created_at 2011_07_06, updated_at 2011_07_06;)

Added 2018-09-13 19:47:03 UTC


Added 2018-09-13 17:57:41 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:6; metadata:created_at 2011_07_06, updated_at 2011_07_06;)

Added 2017-08-07 21:10:46 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ISRStealer Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:6;)

Added 2015-01-19 18:12:38 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/PolyCrypt.A Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; reference:url,cert.pl/news/8706/langswitch_lang/en; classtype:trojan-activity; sid:2016941; rev:5;)

Added 2014-06-26 18:58:02 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN W32/PolyCrypt.A Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; classtype:trojan-activity; sid:2016941; rev:5;)

Added 2013-05-30 18:26:24 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN W32/PolyCrypt.A Checkin"; flow:to_server,established; content:"?action="; http_uri; content:"&username="; http_uri; content:"&password="; http_uri; content:"&app="; http_uri; content:"&pcname="; fast_pattern:only; http_uri; content:"&sitename="; http_uri; reference:url,www.threatexpert.com/report.aspx?md5=44be7c6d4109ae5fb0ceb2824facf2dd; classtype:trojan-activity; sid:2016941; rev:5;)

Added 2013-05-29 18:22:01 UTC


Topic revision: r1 - 2021-09-13 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats