Re: Multiple signatures 025

[Matthew Mickel <mmickel () sourcefire com>]

Hi, Yaser-

Thanks for your submissions.  We will test these and get back to you when we’re finished.  Any PCAPs and Yara/ClamAV 
that you can share with us are greatly appreciated.  Thanks again.  Best,

Matt Mickel

> On Mar 18, 2019, at 2:18 PM, Y M via Snort-sigs <snort-sigs () lists snort org> wrote:
>
> # --------------------
> # Title: Win.Trojan.Tefosteal
> # Reference: Windows Defender Security Intelligence
> #   https://twitter.com/WDSecurity/status/1105990737961742336 
> <https://twitter.com/WDSecurity/status/1105990737961742336>
> # Tests: pcaps
> # Yara:
> #   - MALWARE_Win_Trojan_Remcos
> # ClamAV:
> #   - MALWARE_Win.Trojan.Remcos
> # Hashes:
> #   - 6e6a81c711f60ccc868a9a731c4cee5c4c3cdf336f0e006647ae9cb9de144ae2 (upx-packed)
> #   - 73a4afdf76d5fd896932a15c4a5616a168f69e44bfdea151d2521c567a08fcbf
> #   - a2f5817d17ced1e6a61b2f836a8ae9e1919cd7a9a26030e061aef98e00af0596
> #   - f967c96185e534a195f30876ee74526013842f7bcdaa16f3d799e428e9a7da0a (upx-unpacked)
> # Notes:
> #   - Both rules below can be merged into one while
> #     removing the second http_client_body content
> #     match.
> #   - Existing Yara rule INDICATOR_Binary_References_Many_Browsers
> #     is valid for these.
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; 
> flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| 
> name=|22|files|22 3B|"; http_client_body; content:"Browsers/"; http_client_body; metadata:ruleset community, service 
> http; classtype:trojan-activity; sid:8000561; rev:1;)
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Tefosteal outbound connection"; 
> flow:to_server,established; urilen:18; content:"/google_status.php"; fast_pattern:only; http_uri; content:"|3B| 
> name=|22|files|22 3B|"; http_client_body; content:"InfoPC/"; http_client_body; metadata:ruleset community, service 
> http; classtype:trojan-activity; sid:8000562; rev:1;)

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!