Re: Unknown Botnet sig

[James Lay <jlay () slave-tothe-box net>]

On 2013-07-11 16:29, rmkml wrote:
> Hi James,
>
> Thx for sharing rule,
>
> maybe add before first content : /?
> and ending first content : &k=
>
> like this: content:"/?f=sm_main.mp3&k="; ...
>
> Regards
> @Rmkml
>
>
> On Thu, 11 Jul 2013, James Lay wrote:
>
> > Would be nice to put a name to this if anyone has any other info on 
> > it:
> >
> > alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
> > (msg:"MALWARE-CNC
> > Win.Trojan.Kuluoz variant outbound connection";
> > flow:to_server,established; content:"f=sm_main.mp3"; 
> > fast_pattern:only;
> > http_uri; pcre:"/[a-f0-9]{10}/\x3ff=sm_main.mp3\x26k=[0-9]{15}/U";
> > metadata:policy balanced-ips drop, policy security-ips drop, service
> > http;
> >
> > reference:url,http://research.zscaler.com/2013/07/tracking-botnet-infection.html;
> > classtype:trojan-activity; sid:10000087; rev:1;)
> >
> > James
> k

Ah good call RM...thank you...new one below:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC 
Win.Trojan.Kuluoz variant outbound connection"; 
flow:to_server,established; content:"/?f=sm_main.mp3&k="; 
fast_pattern:only; http_uri; 
pcre:"/[a-f0-9]{10}/\x3ff=sm_main.mp3\x26k=[0-9]{15}/U"; metadata:policy 
balanced-ips drop, policy security-ips drop, service http; 
reference:url,http://research.zscaler.com/2013/07/tracking-botnet-infection.html; 
classtype:trojan-activity; sid:10000087; rev:2;)

James

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!