[easternerd]

Snort signatures for rxbot / rbot.gl

For those interested here are a couple of Snort signatures for the aforementioned rxbot / rbto.gl variant.

alert tcp $HOME_NET any -> any any (msg:"RXBOT / RBOT Exploit Report";
content:"|5D 3A 20|Exploiting|20|IP|3A 20|"; nocase; classtype:
trojan-activity; reference:url,www.nitroguard.com/rxbot.html;
reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_
RBOT.GL; sid:1003620; rev: 1;)


alert tcp any any -> $HOME_NET any (msg:"RXBOT / RBOT Vulnerability Scan";
content:"|2E|advscan|20|"; nocase; classtype: trojan-activity;
reference:url,www.nitroguard.com/rxbot.html;
reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_
RBOT.GL;reference:url,www.muzzleflash.org/readarticle.php?article_id=5#scanning;
sid:1003621; rev: 1