# 10/11/2008 Activation Key Malware - Trojan horse

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Recovery KEYS for your account - Trojan"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; content:"The_Keys.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:9035; rev:2;)

#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Recovery KEYS for your account - Trojan"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; pcre:"The_Keys.zip/i"; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:2035; rev:1;)