alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET MALWARE Evil JS Ransomware";
flow:from_server,established;
file_data;
content:"|5c|u006d|5c|u0065|5c|u0073|5c|u0073|5c|u0061|5c|u0067|5c|u0065";
content:"<html><body|20|bgcolor=|22|#F78181|22|>"; nocase; within:100;
content:"Hello.|20|Your|20|UID|3a|"; within:100;
content:"|65 76 69 6c 20 72 61 6e 73 6f 6d 77 61 72 65|"; fast_pattern; within:100;
content:"|75 6e 69 71 75 65 20 73 74 72 6f 6e 67 65 73 74 20 41 45 53 20 6b 65 79|"; distance:0;
content:"|73 65 6e 64 20 6d 65 20 79 6f 75 72 20 55 49 44 20 74 6f|"; distance:0;
content:"|4c 69 73 74 20 6f 66 20 65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73|"; distance:0;
reference:md5,b9d81c51c10abd64107edc5e73a26aea;
reference:url,www.cert.pl/en/news/single/evil-a-poor-mans-ransomware-in-javascript/;
classtype:trojan-activity;
sid:2023747; rev:2;
metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_18, deployment Perimeter, malware_family Ransomware, confidence High, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;
)