ET MALWARE LuckyCat/TROJ_WIMMIE Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE LuckyCat/TROJ_WIMMIE Checkin";
    flow:established,to_server;
    http.method;
    content:"POST"; nocase;
    http.uri;
    content:".php?m=";
    content:"&n="; within:4;
    content:"_"; distance:0;
    content:"@"; distance:0;
    pcre:"/\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$/";
    reference:url,blog.trendmicro.com/luckycat-redux-inside-an-apt-campaign/;
    reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf;
    classtype:command-and-control;
    sid:2014462; rev:4;
    metadata:created_at 2012_04_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;
)