ET MALWARE TLD4 Purple Haze Variant Initial CnC Request for Ad Servers

7.0.35.0SID: 2014208Rev: 3Disabled0 views
Sourceet/open
Fileemerging-malware.rules
CreatedFebruary 7, 2012
UpdatedMarch 16, 2024
Classificationcommand-and-control
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TLD4 Purple Haze Variant Initial CnC Request for Ad Servers"; flow:established,to_server; http.uri; content:"trf?q="; fast_pattern; content:"&edv="; content:"&o="; content:"&kp="; content:"&tk="; content:"&fk="; content:"&ks="; reference:url,contagiodump.blogspot.com/2012/02/purple-haze-bootkit.html; classtype:command-and-control; sid:2014208; rev:3; metadata:created_at 2012_02_07, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_16;)

References

urlcontagiodump.blogspot.com/2012/02/purple-haze-bootkit.html

Metadata

created at2012_02_07
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_03_16

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!