Snort mailing list archives
New Skpe worm sig
From: James Lay <jlay () slave-tothe-box net>
Date: Thu, 23 May 2013 15:07:13 -0600
Slow Thursday: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Trojan.Win32.Gapz C2 traffic"; flow:to_server,established; content:"|2f|images|2f|gx.php"; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,http://bartblaze.blogspot.com/2013/05/another-skype-worm.html; classtype:trojan-activity; sid:10000071; rev:1;) Could add the UA that's in the strings of the malware executable from the pastbin link I guess to tighten it up. James ------------------------------------------------------------------------------ Try New Relic Now & We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, & servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- New Skpe worm sig James Lay (May 23)