Re: Gamut Spambot sig

[James Lay <jlay () slave-tothe-box net>]

On 2014-03-04 12:03, James Lay wrote:
> A low hanger for a Tuesday:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
> (msg:"MALWARE-CNC
> Gamut Spambot Configuration Download"; flow:from_client, established;
> file_data; content:"|26|file=SenderClient.conf"; fast_pattern:only;
> http_uri;
>
> reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html;
> classtype:trojan-activity; sid:10000129; rev:1;)
>
> James
>
>
> ------------------------------------------------------------------------------
> Subversion Kills Productivity. Get off Subversion & Make the Move to
> Perforce.
> With Perforce, you get hassle-free workflows. Merge that actually 
> works.
> Faster operations. Version large binaries.  Built-in WAN optimization 
> and the
> freedom to use Git, Perforce or both. Make the move to Perforce.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!

Thanks to @Rmkml for the quick fix:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC 
Gamut Spambot Configuration Download"; flow:from_client, established; 
content:"|26|file=SenderClient.conf"; fast_pattern:only; http_uri; 
reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html; 
classtype:trojan-activity; sid:10000129; rev:2;)

James

------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works. 
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!