OT: Israeli industrial espionage Trojan horse snort sigs

Sat Jun 4 02:04:12 UTC 2005

I spent a bit of time thinking about this, and decided this is not off
topic due to high interest and worry from list subscribers. Although I
am looking wearily at Randy Bush, so I decided to mark it as OT: and max
not send such things next time, although this is a rather rare case
(publicly anyway).

Matt Jonkman over at Bleeding-Snort wrote and released snort signatures,
in cooperation with Joe Stewart at lurhq and myself at IL-CERT.
I am sure many organizations would be interested in those.

Let's hope non of you ever get to see these triggered.

http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/VIRUS/TROJAN_Hotword?rev=1.1&view=auto

alert tcp $EXTERNAL_NET any -> $HOME_NET 2any(msg:"BLEEDING-EDGE VIRUS
Hotword Trojan in Transit"; content:"|63 6f 6d 66 69 64 65 6e 74 69 61
6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72 6f 6d 20 44
69 67 69 44 6f 63 00 43 4d 20 25 73 20|"; flow:established,from_server;
classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001959; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
VIRUS Hotword Trojan inbound via http"; content:"|63 6f 6d 66 69 64 65
6e 74 69 61 6c 20 64 6f 63 75 6d 65 6e 74 20 28 57 6f 72 64 29 20 66 72
6f 6d 20 44 69 67 69 44 6f 63 00 43 4d 20 25 73 20|";
flow:established,from_server; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001960; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible File Upload CHJO"; content:"STOR __";
content:"-CHJO.DRV"; within:100; nocase; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001961; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible File Upload CFXP"; content:"STOR __";
content:"-CFXP.DRV"; within:100; nocase; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001962; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Request pspv.exe"; content:"SIZE pspv.exe";
classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001963; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Request .tea"; content:"LIST ";
content:".tea"; nnocase; within:50; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001964; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Status Upload ___"; content:"|53 54 4f 52 20
5f 5f 5f 0d 0a|"; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001965; rev:1;)
alert tcp any any -> $EXTERNAL_NET 21 (msg:"BLEEDING-EDGE VIRUS Hotword
Trojan -- Possible FTP File Status Check ___"; content:"|53 49 5a 45 20
5f 5f 5f 0d 0a|"; classtype:trojan-activity;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.hotword.html;
reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.rona.html;
sid:2001966; rev:1;)

	Gadi Evron.