[***] Results from Oinkmaster started Wed Sep 29 20:00:02 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (3):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Ezula"; reference:url,www.ezula.com;
reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html;
uricontent:"/MindSet5/install/ezinstall.exe"; nocase;
classtype:trojan-activity; sid:2001334; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Malware Ezula Installer Download";
reference:url,www.ezula.com;
reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html; content:"|65 5a
75 6c 61 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 00 49|";
classtype:trojan-activity; sid:2001335; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Internet Optimizer Spyware Agent Upload";
uricontent:"/conf/xml/"; nocase; classtype:trojan-activity; sid:2001336; rev:1;)
-> Added to bleeding-p2p.rules (1):
alert tcp $HOME_NET any -> any any (msg:"BLEEDING-EDGE P2P CHAT Skype
VoIP Initialization";flow:to_server,established;
content:"|8046010301002d0000001000000500000400000a0000090000640000620000080000030000060100800700c0030080060040020080040080|";
depth:112; classtype:policy-violation; sid:2001333; rev:1;)
[---] Disabled rules: [---]
-> Disabled in bleeding-virus.rules (1):
#alert tcp any any -> any any (msg:"BLEEDING-EDGE GDI Exploit - Worm 1
Successful Execution"; content:"USER bawz"; nocase;
reference:url,www.easynews.com/virus.txt; classtype:trojan-activity;
sid:2001332; rev:2;)
[---] Removed rules: [---]
-> Removed from bleeding-malware.rules (3):
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Malware TopText ILookup Installer Download";
reference:url,www.ezula.com;
reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html; content:"|65 5a
75 6c 61 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 00 49|";
classtype:trojan-activity; sid:2000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware TopText ILookup Access";
reference:url,www.ezula.com;
reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html;
uricontent:"/MindSet5/install/ezinstall.exe"; nocase;
classtype:trojan-activity; sid:2000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Unknown Spyware Agent Upload";
uricontent:"/conf/xml/"; nocase; classtype:trojan-activity; sid:2001324; rev:1;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-p2p.rules (1):
#Submitted by Jason Haar
-> Added to bleeding-sid-msg.map (4):
2001333 || BLEEDING-EDGE P2P CHAT Skype VoIP Initialization
2001334 || BLEEDING-EDGE Malware Ezula ||
url,www.spyany.com/program/article_spw_rm_eZuLa.html || url,www.ezula.com
2001335 || BLEEDING-EDGE Malware Ezula Installer Download ||
url,www.spyany.com/program/article_spw_rm_eZuLa.html || url,www.ezula.com
2001336 || BLEEDING-EDGE Malware Internet Optimizer Spyware Agent Upload
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (4):
2000578 || BLEEDING-EDGE Malware TopText ILookup Access ||
url,www.spyany.com/program/article_spw_rm_eZuLa.html || url,www.ezula.com
2000579 || BLEEDING-EDGE Malware TopText ILookup Installer Download ||
url,www.spyany.com/program/article_spw_rm_eZuLa.html || url,www.ezula.com
2001324 || BLEEDING-EDGE Malware Unknown Spyware Agent Upload
2001332 || BLEEDING-EDGE GDI Exploit - Worm 1 Successful Execution ||
url,www.easynews.com/virus.txt
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
