[***] Results from Oinkmaster started Tue Aug 31 20:00:01 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding.rules (2):
alert tcp $HOME_NET 4321 -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE Akak
trojan protocol response from infected host"; content:"|6f 17 00 00|";
dsize:4;flow:established,to_client; reference:url,www.lurhq.com/akak.html;
classtype:trojan-activity; sid:2001237; rev:1;)
alert tcp any any -> any 4321 (msg:"BLEEDING-EDGE Akak trojan protocol
hello"; content:"|89 13 00 00|"; dsize:4; flow:established,to_server;
reference:url,www.lurhq.com/akak.html; classtype:trojan-activity; sid:2001236;
rev:1;)
[///] Modified active rules: [///]
-> Modified active in bleeding.rules (1):
old: alert ip any any -> any any (msg:"BLEEDING-EDGE Possible
Win32/Small.AR download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|";
classtype:trojan-activity; sid:2001233; rev:2;)
new: alert ip any any -> any any (msg:"BLEEDING-EDGE Possible CIA
download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|";
classtype:trojan-activity; sid:2001233; rev:2;)
[---] Disabled rules: [---]
-> Disabled in bleeding-malware.rules (1):
#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Gator Ad Retrieval"; content:"Host\:
webpdp.gator.com"; nocase; classtype:trojan-activity; sid:2001014; rev:1;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (3):
2001233 || BLEEDING-EDGE Possible CIA download/upload attempt
2001236 || BLEEDING-EDGE Akak trojan protocol hello ||
url,www.lurhq.com/akak.html
2001237 || BLEEDING-EDGE Akak trojan protocol response from infected
host || url,www.lurhq.com/akak.html
-> Added to bleeding.rules (1):
#Submitted by Chris Norton
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (2):
2001014 || BLEEDING-EDGE Malware Gator Ad Retrieval
2001233 || BLEEDING-EDGE Possible Win32/Small.AR download/upload attempt
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
