Sign in - Adobe"; nocase; distance:0; fast_pattern:2,20; content:"password-revealer"; nocase; distance:0; metadata: former_category CURRENT_EVENTS; reference:md5,ba42e59213f10f5c1bd70ce4813f25d1; classtype:trojan-activity; sid:2023047; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, deployment Perimeter, tag Phishing, signature_severity Major, created_at 2016_08_11, performance_impact Low, updated_at 2017_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2405 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS RIG encrypted payload M1 Aug 01 2017"; flow:established,to_client; file_data; content:"|73 29 88 ff e0 d1 0e 74|"; within:8; metadata: former_category CURRENT_EVENTS; reference:md5,263a2cf88f340b2a755db749be1371ea; classtype:trojan-activity; sid:2024507; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag RigEK, signature_severity Major, created_at 2017_08_01, malware_family RIG, updated_at 2017_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2432 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Nemucod JS Downloader Aug 01 2017"; flow:established,to_server; pcre:"/\/[A-Za-z0-9]{5,9}\?+[A-Za-z0-9]{6,12}=[A-Za-z0-9]{6,12}$/U"; content:"Accept|3a 20 2a 2f 2a 0d 0a|Accept-Language|3a|"; http_header; depth:29; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.0)"; http_user_agent; fast_pattern:30,20; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; metadata: former_category CURRENT_EVENTS; reference:md5,cb558b04216e0e7a9c936945ebee6611; classtype:trojan-activity; sid:2024508; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_08_01, malware_family Nemucod, updated_at 2017_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2433 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Maldoc Downloader Aug 18 2017"; flow:established,to_server; content:"/s.php?id="; http_uri; depth:10; content:!"User-Agent|3a|"; http_header; content:!"Accept|3a|"; http_header; content:!"Cookie|3a|"; pcre:"/^\/s\.php\?id=[a-z0-9]{2,6}$/U"; metadata: former_category CURRENT_EVENTS; reference:md5,5285f1adfc0013fa86218a7d76c0016d; classtype:trojan-activity; sid:2024600; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2017_08_21, malware_family Maldoc, performance_impact Low, updated_at 2017_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2488 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted payload Oct 19 (1)"; flow:established,to_client; file_data; content:"|1a 3d d0 28 82 1a 6f 08|"; depth:8; fast_pattern; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024907; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2622 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted check-in response Oct 19 (1)"; flow:established,to_client; file_data; content:"|0c 3c|"; depth:2; content:"|04 a3|"; distance:1; within:2; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024909; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2623 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicious Macro DL BIN May 2016 (No UA)"; flow:established,to_server; content:"GET"; http_method; content:"/system/"; depth:8; http_uri; nocase; fast_pattern; pcre:"/^(?:cache|logs)\/[^\x2f]+\.(?:exe|dll|doc|bin)$/URi"; http_header_names; content:!"Referer"; reference:md5,c6747ca29d5c28f4349a5a8343d6b025; classtype:trojan-activity; sid:2022834; rev:5; metadata:created_at 2016_05_24, updated_at 2016_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2673 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Potential Dridex.Maldoc Minimal Executable Request"; flow:established,to_server; urilen:<40; content:"GET"; http_method; content:".exe"; http_uri; fast_pattern; content:!"Mozilla/"; http_user_agent; content:!"MstarUpdate"; http_header; content:!".bitdefender.com"; http_host; content:!".homestead.com"; http_host; pcre:"/\/[a-z0-9]+\/[a-z0-9]+\.exe$/Ui"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a 0d 0a|"; depth:22; isdataat:!1,relative; metadata: former_category CURRENT_EVENTS; reference:md5,28208e19a528bfa95e5662e2d6f2e911; reference:url,blogs.cisco.com/security/dridex-attacks-target-corporate-accounting; classtype:trojan-activity; sid:2020826; rev:7; metadata:created_at 2015_04_01, updated_at 2017_03_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2675 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted check-in Oct 19 M1"; flow:established,to_server; content:"|2c 45 32 4d f1 38 55|"; depth:7; http_client_body; fast_pattern; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024908; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2701 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Napolar / Shifu SSL Cert Oct 9 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|19|secure.barrentomedear.com"; distance:1; within:26; metadata: former_category CURRENT_EVENTS; reference:md5,958804a1191cb281a3a967de17763cf4; classtype:trojan-activity; sid:2019376; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_09, updated_at 2018_03_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2863 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET !9987 -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set"; content:!"7PYqwfzt"; depth:8; byte_test:1,!&,64,2; byte_test:1,&,32,2; byte_test:1,&,16,2; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014701; rev:12; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3135 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set"; content:!"7PYqwfzt"; depth:8; byte_test:1,&,64,2; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014702; rev:9; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3136 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set"; content:!"7PYqwfzt"; depth:8; byte_test:1,&,64,3; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014703; rev:9; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3137 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS HOIC with booster outbound"; flow:to_server,established; content:"GET"; http_method; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; content:"If-Modified-Since|3a 20 20|"; http_raw_header; content:"Keep-Alive|3a 20 20|"; http_raw_header; content:"Connection|3a 20 20|"; http_raw_header; content:"User-Agent|3a 20 20|"; http_raw_header; threshold: type both, count 1, seconds 60, track by_src; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018977; rev:3; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3162 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS HOIC with booster inbound"; flow:to_server,established; content:"GET"; http_method; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; content:"If-Modified-Since|3a 20 20|"; http_raw_header; content:"Keep-Alive|3a 20 20|"; http_raw_header; content:"Connection|3a 20 20|"; http_raw_header; content:"User-Agent|3a 20 20|"; http_raw_header; threshold: type both, count 1, seconds 60, track by_dst; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018978; rev:2; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3163 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> any [5555,7547] (msg:"ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE "; flow:to_server,established; content:"urn|3a|dslforum-org|3a|service|3a|Time|3a|1#SetNTPServers"; nocase; http_header; fast_pattern:only; reference:url,devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/; reference:md5,a19d5b596992407796a33c5e15489934; classtype:trojan-activity; sid:2023548; rev:3; metadata:affected_product Eir_D1000_Modem, attack_target Networking_Equipment, deployment Perimeter, signature_severity Major, created_at 2016_11_28, updated_at 2016_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3490 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> any [5555,7547] (msg:"ET EXPLOIT Eir D1000 Modem CWMP Exploit Retrieving Wifi Key"; flow:to_server,established; content:"urn|3a|dslforum-org|3a|service|3a|Time|3a|1#SetNTPServers"; nocase; http_header; fast_pattern:only; content:"|3c 75 3a 47 65 74 53 65 63 75 72 69 74 79 4b 65 79 73|"; http_client_body; reference:url,devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/; reference:md5,a19d5b596992407796a33c5e15489934; classtype:trojan-activity; sid:2023549; rev:3; metadata:affected_product Eir_D1000_Modem, attack_target Networking_Equipment, deployment Perimeter, signature_severity Major, created_at 2016_11_28, performance_impact Low, updated_at 2016_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3491 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PlaySushi User-Agent"; flow:established,to_server; content:"User-Agent|3A 20|psi "; http_header; reference:md5,039815a7cb0b7ee52b753a9b79006f97; classtype:trojan-activity; sid:2014261; rev:2; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3876 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.Win32.Sushi.au Checkin"; flow:to_server,established; content:"/inst.php?"; http_uri; content:"User-Agent|3a| psi"; http_header; reference:md5,3aad2075e00d5169299a0a8889afa30b; reference:url,www.securelist.com/en/descriptions/24412036/not-a-virus%3aAdWare.Win32.Sushi.au; classtype:trojan-activity; sid:2014262; rev:4; metadata:created_at 2012_01_21, updated_at 2012_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3877 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/GameVance Adware Checkin"; flow:established,to_server; content:"/inst.asp?d="; http_uri; content:"&cl="; http_uri; content:"&l="; http_uri; content:"&e="; http_uri; content:"&v="; http_uri; content:"&uid="; http_uri; content:"&time="; http_uri; content:"&win="; http_uri; content:"&ac="; http_uri; content:"&ti="; http_uri; content:"&xv="; http_uri; reference:md5,2609c78efbc325d1834e49553a9a9f89; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3aWin32/GameVance; classtype:trojan-activity; sid:2014339; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3878 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/LoudMo.Adware Checkin"; flow:established,to_server; content:"/?aff="; http_uri; content:"Host|3A 20|www.gamebound.com"; http_header; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FLoudmo; reference:md5,fc06c613e83f0d3271beba4fdcda987f; classtype:trojan-activity; sid:2014400; rev:3; metadata:created_at 2012_03_19, updated_at 2012_03_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3949 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Dialer.Adultchat Checkin"; flow:established,to_server; content:"/getclientid.wnk?srv="; http_uri; content:"&ver="; http_uri; content:"&pin="; http_uri; content:"&OSInfo2="; http_uri; content:"&cinfo="; http_uri; content:"retryattempt="; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FDluca.AN&ThreatID=-2147365813; reference:md5,fd2c949dc20b651a53326a3d571641ec; classtype:trojan-activity; sid:2014667; rev:2; metadata:created_at 2012_05_02, updated_at 2012_05_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3951 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Bublik.B/Birele/Variant.Kazy.66443 Checkin"; flow:established,to_server; urilen:12; content:"POST"; http_method; content:"/rdc/rnd.php"; http_uri; reference:md5,48352e3a034a95845864c0f6aad07d39; classtype:trojan-activity; sid:2014767; rev:5; metadata:created_at 2012_05_18, updated_at 2012_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3953 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/OnlineGames Checkin"; flow:established,to_server; content:"/game"; http_uri; content:"/diary/item/"; http_uri; content:"User-Agent|3A| getURLDown|0D 0A|"; http_header; reference:md5,60763078b8860fd59a1d8bea2bf8900b; classtype:trojan-activity; sid:2015017; rev:4; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3956 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User-Agent (Huai_Huai)"; flow:to_server,established; content:"User-Agent|3a| Huai_Huai|0d 0a|"; http_header; reference:md5,ee600bdcc45989750dee846b5049f935; reference:md5,91b9aa25563ae524d3ca4582630eb8eb; reference:md5,1051f7176fe0a50414649d369e752e98; classtype:trojan-activity; sid:2006361; rev:9; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2010_07_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3958 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Win32/SProtector.A Client Checkin"; flow:established,to_server; content:"?data="; http_uri; content:"&version="; http_uri; distance:0; content:"win32"; http_user_agent; depth:5; fast_pattern; reference:md5,38f61d046e575971ed83c4f71accd132; classtype:trojan-activity; sid:2016780; rev:4; metadata:created_at 2013_04_22, updated_at 2013_04_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3981 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware pricepeep Adware.Shopper.297"; flow: established,to_server; content:"GET"; nocase; http_method; content:"/logger/software/hit/"; nocase; http_uri; content:"/?v."; nocase; http_uri; reference:url,virustotal.com/en/file/1ea487b1507305f17a2cd2ab0dbcfac523419dbc27cde38e27cb5c4a8d3c9caf/analysis/; reference:url,lists.clean-mx.com/pipermail/viruswatch/20121222/037085.html; reference:md5,0564e603f9ed646553933cb0d271f906; classtype:trojan-activity; sid:2016917; rev:2; metadata:created_at 2013_05_22, updated_at 2013_05_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3989 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Ezula Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/download/UVid.asp?"; fast_pattern:only; http_uri; reference:md5,dede600f1e78fd20e4515bea1f2bdf61; classtype:trojan-activity; sid:2016938; rev:3; metadata:created_at 2013_05_28, updated_at 2013_05_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3990 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Tibs Checkin"; flow:established,to_server; content:"/adv/"; nocase; http_uri; content:".php?a1="; nocase; http_uri; content:"&a2=Type of Processor|3a|"; nocase; http_uri; content:"&a3=Windows version is "; nocase; http_uri; content:"&a4=Build|3a|"; nocase; http_uri; reference:md5,65448c8678f03253ef380c375d6670ce; classtype:trojan-activity; sid:2002955; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3991 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Linkular.Adware Icons.dat Second Stage Download"; flow:established,to_server; content:"/downloads/icons.dat"; http_uri; fast_pattern:only; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; reference:md5,7cc162a2ba136baaa38a9ccf46d97a06; classtype:trojan-activity; sid:2017881; rev:3; metadata:created_at 2013_12_17, updated_at 2013_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4002 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE GMUnpackerInstaller.A Checkin"; flow:to_server,established; content:"/new/rar.xml"; fast_pattern:only; nocase; http_uri; content:!"User-Agent|3a| "; nocase; http_header; reference:md5,43e89125ad40b18d22e01f997da8929a; classtype:trojan-activity; sid:2017892; rev:2; metadata:created_at 2013_12_19, updated_at 2013_12_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4003 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/InstallRex.Adware Initial CnC Beacon"; flow:established,to_server; content:"/?step_id="; http_uri; content:"&publisher_id="; http_uri; content:"&page_id="; http_uri; content:"&country_code="; http_uri; content:"&browser_id="; http_uri; content:"&download_id="; http_uri; content:"&hardware_id="; http_uri; reference:md5,9abbb5ea3f55b5182687db69af6cba66; classtype:trojan-activity; sid:2017911; rev:2; metadata:created_at 2014_12_30, updated_at 2014_12_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4004 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/InstallRex.Adware Report CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/?report_version="; http_uri; content:"data="; http_client_body; depth:5; reference:md5,9abbb5ea3f55b5182687db69af6cba66; classtype:trojan-activity; sid:2017912; rev:2; metadata:created_at 2014_12_30, updated_at 2014_12_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4005 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware Initial Checkin"; flow:established,to_server; content:"/updater/"; http_uri; content:"UpdaterResponse"; http_user_agent; depth:15; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018024; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4006 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware POST Checkin"; flow:established,to_server; content:"POST"; content:"UpdaterResponse"; http_user_agent; fast_pattern; depth:15; pcre:"/^\x2F[A-F0-9]{25,40}$/U"; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018025; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4007 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent EXE2"; flow: established,to_server; content:"EXE2"; nocase; depth:4; http_user_agent; reference:md5,112c6db4fb8a9aa18d0cc105662af5a4; classtype:trojan-activity; sid:2018049; rev:3; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4008 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Magania"; flow: established,to_server; flowbits:set,EXE2; flowbits:noalert; content:"GET"; http_method; content:".txt"; http_uri; content:"EXE2"; depth:4; fast_pattern; nocase; http_user_agent; content:!"Accept|3a| "; nocase; http_header; content:!"Referer|3a| "; nocase; http_header; content:!"Connection|3a| "; nocase; http_header; reference:md5,112c6db4fb8a9aa18d0cc105662af5a4; classtype:trojan-activity; sid:2018050; rev:4; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4009 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent Mozi11a"; flow: established,to_server; content:"Mozi11a"; depth:7; http_user_agent; reference:md5,3cf3d4d5de51a8c37e11595159179571; classtype:trojan-activity; sid:2018051; rev:4; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4010 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User-Agent (gettingAnswer)"; flow: established,to_server; content:"gettingAnswer"; depth:13; nocase; http_user_agent; reference:md5,c305a0af3fe84525a993130b7854e3e0; classtype:trojan-activity; sid:2018084; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2014_02_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4012 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BetterInstaller"; flow:to_server,established; content:"GET"; http_method; content:"?v="; http_uri; content:"&uid="; http_uri; content:"&muid="; http_uri; pcre:"/[a-f0-9]{32}\?v=/Ui"; reference:md5,efa0bed2695446eab679083a9f0f89c6; classtype:trojan-activity; sid:2018195; rev:3; metadata:created_at 2014_01_15, updated_at 2014_01_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4014 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.AdWare.iBryte.C Install "; flow:established,to_server; content:"/offers.json?version="; http_uri; content:"&pid=installer&ts="; http_uri; reference:md5,2fae46d1a71a893834a01ed3106b8036; classtype:trojan-activity; sid:2018197; rev:2; metadata:created_at 2014_02_28, updated_at 2014_02_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4015 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Xpire.info Spyware Install Reporting"; flow: to_server,established; content:"/report.php?user_id="; fast_pattern; http_uri; content:"&status="; http_uri; content:"&country_id="; http_uri; content:"Windows Internet"; depth:16; http_user_agent; reference:url,doc.emergingthreats.net/bin/view/Main/2001472; reference:md5,17c204bb156dd7f6a3ebd1547129f347; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FZdesnado.AD&ThreatID=-2147454482; classtype:trojan-activity; sid:2001472; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4017 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Toolbar.CrossRider.A Checkin"; flow:to_server,established; content:".gif?action="; http_uri; content:"&browser="; http_uri; content:"&ver="; http_uri; content:"&bic="; fast_pattern:only; http_uri; content:"&app="; http_uri; content:"&appver="; http_uri; content:"&verifier="; http_uri; reference:md5,55668102739536c1b00bce9e02d8b587; classtype:trojan-activity; sid:2018301; rev:3; metadata:created_at 2012_10_05, updated_at 2012_10_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4018 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.MSIL.Solimba.b GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/dmr/access/"; http_uri; content:"DownloadMR"; nocase; depth:10; http_user_agent; reference:url,virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:trojan-activity; sid:2016905; rev:4; metadata:created_at 2013_05_21, updated_at 2013_05_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4019 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.MSIL.Solimba.b POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/dmr/exception"; http_uri; content:"DownloadMR"; depth:10; nocase; http_user_agent; reference:url,virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:trojan-activity; sid:2016906; rev:4; metadata:created_at 2013_05_21, updated_at 2013_05_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4020 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent Smart-RTP"; flow: established,to_server; content:"Smart-RTP"; depth:9; nocase; http_user_agent; reference:url,www.threatexpert.com/report.aspx?md5=a80f33c94c44556caa2ef46cd5eb863c; reference:url,www.drwebhk.com/en/virus_techinfo/Trojan.DownLoader8.25530.html; reference:md5,2b63ed542eb0e1a4547a2b6e91391dc0; classtype:trojan-activity; sid:2016915; rev:5; metadata:created_at 2013_05_22, updated_at 2013_05_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4021 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.Win32.Yotoon.hs Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/product-am.php?id="; http_uri; fast_pattern:only; content:"&v="; http_uri; content:"&offer["; distance:0; http_uri; content:"NSISDL/1.2 (Mozilla)"; depth:20; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,20c7226185ed7999e330a46d3501dccb; classtype:trojan-activity; sid:2018307; rev:4; metadata:created_at 2014_03_19, updated_at 2014_03_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4022 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SoundCloud Downloader Install Beacon"; flow:established,to_server; urilen:10; content:"POST"; http_method; content:"/index.php"; http_uri; content:"&OSversion="; http_client_body; content:"&Slv="; http_client_body; content:"&Sysid="; http_client_body; content:"&Sysid1="; http_client_body; content:"&admin="; http_client_body; content:"&browser="; http_client_body; content:"&exe="; http_client_body; content:"&ffver="; http_client_body; content:"&lang_DfltUser="; http_client_body; content:"&ver="; http_client_body; content:"&ts="; http_client_body; reference:url,blog.malwarebytes.org/online-security/2014/03/soundcloud-downloader-always-read-the-eulas/; reference:md5,2e20e446943ecd01d3a668083d81d1fc; classtype:trojan-activity; sid:2018324; rev:2; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4023 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Amonetize.Downloader Executable Download Request"; flow:established,to_server; content:"GET"; http_method; content:"/bundle/"; http_uri; content:"/?p="; http_uri; content:"zz_afi"; depth:6; http_user_agent; reference:md5,23246f740cffc0bd9eb5be2e7703568a; classtype:trojan-activity; sid:2018333; rev:4; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4024 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Linkular.Adware Successful Install Beacon"; flow:established,to_server; content:"/api/success/?s="; http_uri; fast_pattern:only; content:"&c="; http_uri; content:"&cv="; http_uri; content:"&context="; http_uri; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; reference:md5,7cc162a2ba136baaa38a9ccf46d97a06; classtype:trojan-activity; sid:2017880; rev:6; metadata:created_at 2013_12_17, updated_at 2013_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4028 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.PUQD Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/debug/Version/"; fast_pattern:only; http_uri; content:"/trace/"; http_uri; pcre:"/^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(?:mostrarFailed(?:EndLoading|ReadyState)|Get(?:XmlDataRequisites|BinaryData)|(?:DownloadRequisites|down_)Finish|Re(?:cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$/U"; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; content:!"Accept|3a|"; http_header; reference:md5,e44962d7dec79c09a767a1d3e8ce02d8; reference:url,www.virustotal.com/en/file/1a1ff0fc6af6f7922bae906728e1919957998157f3a0cf1f1a0d3292f0eecd85/analysis/; classtype:trojan-activity; sid:2017945; rev:3; metadata:created_at 2014_01_08, updated_at 2014_01_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4032 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/RocketfuelNextUp.Adware CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/evt/?nexcb="; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:"a="; http_client_body; depth:2; content:"&b="; http_client_body; distance:0; pcre:"/^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$/U"; reference:md5,408e8969cd0abd153eab6696f8add363; classtype:trojan-activity; sid:2018565; rev:3; metadata:created_at 2014_06_16, updated_at 2014_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4033 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.MultiInstaller checkin 2"; flow:established, to_server; content:"GET"; http_method; content:"/entrance?s1="; depth:13; http_uri; pcre:"/^\/entrance\?s1=[a-f0-9]{100,}$/Ui"; content:!"Referer|3a|"; http_header; reference:md5,c610d46d97c1b80f027f56d227a003f7; classtype:trojan-activity; sid:2018590; rev:2; metadata:created_at 2014_06_20, updated_at 2014_06_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4035 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OptimizerPro Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/op?sid="; http_uri; content:"&dt="; http_uri; distance:0; content:"&gid="; http_uri; distance:0; reference:md5,d04a7f30c83290b86cac8d762dcc2df5; reference:md5,eba3a996f5b014b2d410f4bf32b8530b; classtype:trojan-activity; sid:2018742; rev:3; metadata:created_at 2013_12_11, updated_at 2013_12_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4036 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SearchSuite Install CnC Beacon"; flow:established,to_server; content:"POST"; http_method; urilen:23; content:"/install_statistics.php"; fast_pattern; http_uri; depth:23; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE|3B| Win32)"; http_header; content:"XML="; http_client_body; depth:4; content:!"Referer|3a|"; http_header; reference:md5,7203a56c3888e819c602e758fce823fa; reference:md5,77e33e8a53e2a0dbc06c921de9b71142; classtype:trojan-activity; sid:2018753; rev:2; metadata:created_at 2014_07_23, updated_at 2014_07_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4038 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MultiPlug.A checkin"; flow:to_server,established; content:"get/?ver="; http_uri; content:"&aid="; http_uri; distance:0; content:"&hid="; http_uri; distance:0; content:"&rid="; http_uri; distance:0; content:"&data="; http_uri; distance:0; content:"&report="; http_uri; distance:0; content:!"Referer|3a 20|"; http_header; pcre:"/^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=/U"; reference:md5,f9556acf36168414ad7d5650eeee7972; reference:md5,69e28b658520528a1473f51e62698c87; classtype:trojan-activity; sid:2018867; rev:2; metadata:created_at 2014_08_01, updated_at 2014_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4039 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/iBryte.Adware Affiliate Campaign Executable Download"; flow:established,to_server; content:"GET"; http_method; content:".exe?mode="; fast_pattern:only; http_uri; content:"&subid="; http_uri; content:"&filedescription="; http_uri; content:!"Referer|3a 20|"; http_header; reference:md5,65e5b8e84772f55d761a85bf53c14169; reference:md5,cfda690ebe7bccc5c3063487f6e54086; classtype:trojan-activity; sid:2018367; rev:7; metadata:created_at 2014_04_07, updated_at 2014_04_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4040 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.InstallCore.B Checkin"; flow:established,to_server; urilen:13<>18; content:"POST"; http_method; content:"/?pcrc="; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/^\/\?pcrc=[0-9]{7,10}$/U"; content:"0A0Czut"; depth:7; http_client_body; reference:md5,d933bef7e1118b181add31eb5edc5c73; classtype:trojan-activity; sid:2019511; rev:5; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4045 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DealPly Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/pxl/"; http_uri; fast_pattern:only; content:"e=-1"; http_uri; content:"&c="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,c6ebffb418813ed68ac5ed9f51f83946; classtype:trojan-activity; sid:2019622; rev:2; metadata:created_at 2014_10_31, updated_at 2014_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4046 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SoftonicDownloader.Adware User Agent"; flow:established,to_server; content:"Softonic Downloader/"; http_user_agent; reference:md5,1047b186bb2822dbb5907cd743069261; classtype:trojan-activity; sid:2014355; rev:3; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4047 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32.SoftPulse Checkin"; flow: established, to_server; content:"POST"; http_method; content:"NSIS_Inetc (Mozilla|29|"; depth:20; http_user_agent; content:"|7b 22|event_type|22 3a 22|SPidentifier|22 2c 20 22|environment|22 3a 22|"; depth:45; http_client_body; content:"|22|machine_ID|22 3a 22|"; distance:0; http_client_body; reference:md5,9aa08a2700074c7a8a81e49dc8396e00; reference:md5,50f1fc1085f18a25c09c08566fc1a457; classtype:trojan-activity; sid:2018557; rev:6; metadata:created_at 2014_06_11, updated_at 2014_06_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4048 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DomaIQ Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"&OSversion="; http_client_body; content:"&Sysid="; http_client_body; content:"&Sysid1="; http_client_body; content:"&X64="; http_client_body; content:"&exe="; http_client_body; content:"&ffver="; http_client_body; content:"&lang_DfltSys="; http_client_body; content:"&lang_DfltUser="; http_client_body; reference:md5,9befc43d2019c5614e7372a16e3a5ce5; classtype:trojan-activity; sid:2019944; rev:3; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4051 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP W32/DownloadGuide.D"; flow:established,to_server; content:"POST"; http_method; content:"/config-from-production"; http_uri; content:"{|22|os|22 3A 22|"; http_client_body; depth:7; content:"|22|lang|22 3A 22|"; http_client_body; distance:0; content:"|22|uid|22 3A 22|"; http_client_body; distance:0; content:"|22|prod|22 3A 22|"; http_client_body; distance:0; reference:md5,294752c7c4fcf4252a9e99bb4df7ff5c; classtype:trojan-activity; sid:2019974; rev:2; metadata:created_at 2014_12_18, updated_at 2014_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4052 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MALWARE W32/WinWrapper.Adware User-Agent"; flow:established,to_server; content:!"Referer|3a|"; http_header; content:"WinWrapper"; depth:10; http_user_agent; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020629; rev:4; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4058 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Application AirInstaller"; flow:to_server,established; urilen:>31; content:"GET"; http_method; content:"/launch/?c="; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"&m="; http_uri; content:"&l="; http_uri; content:"&b="; http_uri; content:"&sid="; http_uri; content:"&os="; http_uri; reference:md5,3eaaf0de35579e5af89ae3dd81d0c592; reference:md5,ac030896aad1b6b0eeb00952dee24c3f; classtype:trojan-activity; sid:2018095; rev:5; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4059 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Application AirInstaller CnC Beacon"; flow:to_server,established; content:"GET"; http_method; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"/log/?"; http_uri; fast_pattern; content:"="; distance:1; within:1; http_uri; content:"&d="; distance:0; http_uri; content:"&o="; http_uri; content:"&r="; http_uri; content:"&s="; http_uri; content:"&t="; http_uri; pcre:"/^\/(?:[^\x2f]+\/)*log\/\?[bc]=/U"; reference:md5,e89ec5e8f89ee6ae4a6b65157c886614; classtype:trojan-activity; sid:2020701; rev:2; metadata:created_at 2015_03_16, updated_at 2015_03_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4060 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/AdWare.Sendori User-Agent"; flow:established,to_server; content:"Sendori-Client"; http_user_agent; depth:14; reference:url,isc.sans.edu/forums/diary/Suspect+Sendori+software/16466; reference:md5,aee8ddf3b36d60d33c571ee798b6bad6; classtype:trojan-activity; sid:2020881; rev:3; metadata:created_at 2015_04_08, updated_at 2015_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4061 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Softpulse PUP Install Failed Beacon"; flow:established,to_server; content:"GET"; http_method; content:"?sentry_version="; http_uri; content:"&sentry_client="; distance:0; http_uri; content:"&sentry_key=84ce05510b844b75acc37de959560a65&sentry_secret=1c9aa912021b4626a5b7a7e589cba678&sentry_data="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,bb9f26d52327979fb9b4d467408eba25; classtype:trojan-activity; sid:2021027; rev:2; metadata:created_at 2015_04_28, updated_at 2015_04_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4062 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Toolbar.Conduit.AG Checkin"; flow:to_server,established; urilen:1; content:"POST"; http_method; content:"User-Agent|3a 20|NSIS_Inetc (Mozilla|29 0d 0a|"; http_header; content:"postInstallReport"; http_client_body; fast_pattern; content:"machineId|22 3a 22|"; http_client_body; reference:md5,8fc00c6696268ae42411a5ebf9d2576f; classtype:trojan-activity; sid:2021094; rev:3; metadata:created_at 2015_05_13, updated_at 2015_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4063 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP.GigaClicks Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/ver/"; http_uri; content:"/sid/"; http_uri; content:"instlog="; http_client_body; fast_pattern; content:!"User-Agent|3a|"; http_header; reference:md5,942fd71fb26b874502f3ba8546e6c164; classtype:trojan-activity; sid:2021099; rev:2; metadata:created_at 2015_05_15, updated_at 2015_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4064 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/Conduit.SearchProtect.O CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/?uid="; http_uri; content:"&affid="; distance:0; http_uri; content:"&inst_date="; distance:0; http_uri; fast_pattern; content:"&prod="; distance:0; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,525917c79e22fa9bc54da36b94437a46; classtype:trojan-activity; sid:2021173; rev:2; metadata:created_at 2015_05_29, updated_at 2015_05_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4065 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.FakeAV.SystemDefender Checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:".php?"; nocase; http_uri; content:"action=stat&wmid="; nocase; http_uri; content:"&event="; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&i1"; nocase; http_uri; content:"&i2"; nocase; http_uri; reference:url,doc.emergingthreats.net/2008732; reference:md5,4d1df7240837832853c8b87606f3dfc2; classtype:trojan-activity; sid:2008732; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4068 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP TheSZ AutoUpdate CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/update.php?p="; http_uri; fast_pattern:only; content:"&v="; http_uri; content:"&id="; distance:0; http_uri; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"User-Agent|3a 20|AutoUpdate|0d 0a|"; http_header; reference:md5,76e54deb6f81edd6b47c854c847d590d; classtype:trojan-activity; sid:2021401; rev:2; metadata:created_at 2015_07_10, updated_at 2015_07_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4069 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DealPly Adware CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/?pcrc="; http_uri; depth:7; fast_pattern; content:"&v="; http_uri; pcre:"/^\/\?pcrc=\d+&v=[\d.]+$/U"; content:!"Referer|3a 20|"; http_header; reference:md5,a34236628ea04e10430e20ac2b9d7ad2; classtype:trojan-activity; sid:2021618; rev:4; metadata:created_at 2015_08_12, updated_at 2015_08_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4072 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUA Boxore User-Agent"; flow:to_server,established; content:"BoxoreClent"; depth:11; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,5cb2e8a9b6935f228623c69f1b17669d; classtype:trojan-activity; sid:2021700; rev:3; metadata:created_at 2015_08_21, updated_at 2015_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4075 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DealPly Adware CnC Beacon 4"; flow:established,to_server; content:"POST"; http_method; content:"/?v="; http_uri; depth:4; fast_pattern; content:"&pcrc="; http_uri; content:!"Referer|3a 20|"; http_header; content:!"Accept-"; http_header; pcre:"/^\/\?v=[\d.]+&pcrc=\d+$/U"; reference:md5,038da581f99c88a4ee6700de440a54ca; classtype:trojan-activity; sid:2022354; rev:2; metadata:created_at 2016_01_13, updated_at 2016_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4078 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/SmartTab PUP Install Activity 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/v"; http_uri; depth:2; content:".asp"; http_uri; content:"User-Agent|3a 20|Mozilla/3.0 (compatible|3b| Indy Library|29 0d 0a|"; http_header; fast_pattern:32,20; pcre:"/\/v\d\/[^.]+\.asp$/Ui"; reference:md5,84fcdf1cd6dc3ee71686835f9489752c; classtype:trojan-activity; sid:2022694; rev:2; metadata:created_at 2016_04_01, updated_at 2016_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4079 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Checkin"; flow:established,to_server; content:"GET"; http_method; content:".sh?do="; http_uri; content:"&d="; http_uri; content:"&inj="; http_uri; content:"&cl="; http_uri; content:"&cs="; http_uri; content:"&id="; http_uri; content:"&se="; http_uri; content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|"; http_header; fast_pattern:5,20; content:!"Referer|3a|"; http_header; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022716; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4080 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Activity 1"; flow:established,to_server; content:"GET"; http_method; content:"?mid="; http_uri; fast_pattern; content:"User-Agent|3a 20|curl/"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$/Ui"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022717; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4081 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Activity 2"; flow:established,to_server; content:"POST"; http_method; content:!"."; http_uri; content:"User-Agent|3a 20|curl/"; http_header; content:"vs_mid="; http_client_body; depth:7; fast_pattern; content:"&br_mid="; http_client_body; content:"&event_type="; http_client_body; content:"diss URL"; http_client_body; nocase; content:!"Referer|3a|"; http_header; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022718; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4082 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit Web Injects"; flow:established,to_server; content:"GET"; http_method; content:"/mu?id="; http_uri; fast_pattern; content:"&d="; http_uri; content:"&cl="; http_uri; pcre:"/\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$/Ui"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022719; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4083 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 4"; flow:established,to_server; content:"POST"; http_method; content:"/u/"; depth:3; http_uri; fast_pattern; content:"Connection|3a| Close|0d 0a|"; nocase; http_header; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|"; content:!"Accept"; http_header; content:!"Referer|3a|"; nocase; http_header; content:"a="; depth:2; http_client_body; content:"&c="; http_client_body; distance:0; content:"&r="; http_client_body; distance:0; pcre:"/^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$/P"; reference:md5,3ea75d62966f8c52de16d7849eeb3691; classtype:trojan-activity; sid:2022723; rev:2; metadata:created_at 2016_04_11, updated_at 2016_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4085 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/MediaGet.Adware Installer Download"; flow:established,to_client; content:"Set-Cookie|3A 20 |MediagetDownloaderInfo=installer"; http_raw_header; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; fast_pattern; distance:-64; within:4; flowbits:isnotset,ET.Adobe.Site.Download; reference:url,home.mcafee.com/VirusInfo/VirusProfile.aspx?key=860182; reference:md5,39c1769c39f61dd2ec009de8374352c6; classtype:trojan-activity; sid:2014353; rev:6; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4086 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Successful QuizScope Installation"; flow:established,to_server; content:"GET"; http_method; content:"/qscope/ithankyou"; depth:17; fast_pattern; http_uri; reference:md5,4dae2a394b792c36936a88cfc296f9b9; classtype:trojan-activity; sid:2022812; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4087 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SearchProtect PUA User-Agent Observed"; flow:established,to_server; content:"SearchProtect|3b|"; depth:14; http_user_agent; reference:md5,34e2350c2ed6a9a9e9d444102ae4dd87; classtype:trojan-activity; sid:2022813; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4088 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Conduit Trovi Adware/PUA"; flow:established,to_server; content:"GET"; http_method; content:"/?gd="; http_uri; depth:5; fast_pattern; content:"&ctid="; http_uri; distance:0; content:"&octid="; http_uri; distance:0; content:"&SSPV="; http_uri; distance:0; reference:md5,069ce8c2a553f9bc5a9599d7541943ce; classtype:trojan-activity; sid:2022814; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4089 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)"; flow:to_server,established; content:"POST"; http_method; nocase; content:"WidgiToolbar-"; depth:13; http_user_agent; reference:md5,1785f9784cb4e7400ed6f2c8f0e421c2; classtype:trojan-activity; sid:2022826; rev:2; metadata:created_at 2016_05_18, updated_at 2016_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4095 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP/DriverRestore Sending System Information to Affiliate"; flow:established,to_server; content:".jsp?leadTrackerId="; http_uri; content:"|22|ComputerName|22|"; http_uri; distance:0; content:"|22|UserName|22|"; http_uri; distance:0; content:"|22|IsAdmin|22|"; http_uri; distance:0; content:"User-Agent|3a 20|DriverRestore/"; http_header; fast_pattern:6,20; content:!"Referer|3a 20|"; http_header; reference:md5,4f7f497668e3e716a6f4a53af0924a25; classtype:trojan-activity; sid:2022827; rev:2; metadata:created_at 2016_05_18, updated_at 2016_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4096 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TopTools PUP Install Activity"; flow:established,to_server; content:"POST"; http_method; content:"_install.cgi"; http_uri; content:"User-Agent|3a 20|BIDUI18N|0d 0a|"; http_header; content:"name=|22|ufile01|22 3b 20|filename=|22|boundary|22|"; http_client_body; fast_pattern; content:"Content-Type|3a 20|application/octet-stream"; http_client_body; distance:0; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; reference:md5,3e464cff8690c7a2f57542688a278c62; classtype:trojan-activity; sid:2022829; rev:2; metadata:created_at 2016_05_19, updated_at 2016_05_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4097 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/CloudScout Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/QualityCheck/"; http_uri; fast_pattern; content:".php"; distance:0; http_uri; content:!"Referer|3a|"; http_header; content:"dp="; http_client_body; depth:3; content:"&sdp="; http_client_body; distance:0; content:"&a="; http_client_body; distance:0; pcre:"/\.php$/U"; reference:md5,c732b52b245444e3f568d372ce399911; classtype:trojan-activity; sid:2019780; rev:8; metadata:created_at 2014_11_24, updated_at 2016_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4098 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MultiPlug.J Checkin"; flow:established,to_server; urilen:>103; content:"/?q="; http_uri; fast_pattern; depth:4; content:!"Referer|3a 20|"; http_header; content:"GET"; http_method; content:"+"; http_raw_uri; pcre:"/^\/(?:[A-Za-z]+\d?\/)?\?q=(?=[a-z0-9+/]*[A-Z])(?=[A-Z0-9+/]*[a-z])(?=[A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}/U"; content:!"map24.com|0d 0a|"; http_header; content:!"aptrk.com|0d 0a|"; http_header; content:!"Accept-"; http_header; pcre:"/^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r\n\r?$/H"; reference:md5,6b95ddc5238cc0576db7b206af13339e; classtype:trojan-activity; sid:2023707; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_01_09, malware_family PUA, performance_impact Low, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4102 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware Update Checkin"; flow:established,to_server; content:"/Check.ashx?"; depth:12; http_uri; content:"&e="; http_uri; content:"&n="; http_uri; content:"&mv="; http_uri; content:!"Referer|3a 20|"; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018026; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4105 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ProxyGearPro Proxy Tool PUA"; flow:to_server,established; content:"GET"; http_method; content:"Proxy|20|Gear|20|Pro/"; http_user_agent; fast_pattern; content:!"Referer|3a 20|"; http_header; metadata: former_category MALWARE; reference:md5,b8889db7b4ef74c9302c12781a92a23a; classtype:policy-violation; sid:2024484; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_07_20, performance_impact Moderate, updated_at 2017_07_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4123 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/LoadMoney Adware Activity"; flow:to_server,established; content:"POST"; http_method; content:".htm?v="; http_uri; fast_pattern; content:"&eh="; distance:0; http_uri; content:"&ts="; distance:0; http_uri; content:"&u2="; distance:0; http_uri; content:"Cookie|3a 20|a=h+"; content:!"Referer|3a 20|"; http_header; flowbits:set,ETPTadmoney; metadata: former_category MALWARE; reference:md5,681501695c12112aaf2129ab614481bd; reference:md5,1282b899c41b06dac0adb17e0e603d30; classtype:trojan-activity; sid:2024693; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_12, malware_family Neshta, performance_impact Low, updated_at 2017_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4124 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32.SoftPulse Retrieving data"; flow:established,to_server; content:"GET"; http_method; content:"/maxpower-static/templates/"; depth:27; http_uri; http_header_names; content:!"Referer"; reference:md5,4aa02ca6a3f04cf445924a6d657d10e5; classtype:trojan-activity; sid:2019143; rev:5; metadata:created_at 2014_07_22, updated_at 2014_07_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4146 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/DownloadGuide.A"; flow:established,to_server; content:"POST"; http_method; content:"/1/dg/3"; http_uri; fast_pattern; content:"Content-Type|3a 20|application/json"; http_header; content:"{|22|BuildId|22 3a|"; http_client_body; content:"|22|Campaign|22|"; http_client_body; content:"|22|TrackBackUrl|22|"; http_client_body; http_header_names; content:!"Referer"; reference:md5,37b91123a58a48975770241445392aeb; classtype:trojan-activity; sid:2018513; rev:4; metadata:created_at 2014_06_02, updated_at 2014_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4147 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/SoftPulse.H Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:9; content:"/__dmp__/"; http_uri; fast_pattern; content:"data={"; depth:6; http_client_body; http_header_names; content:!"Accept"; content:!"Connection"; content:!"Referer"; reference:md5,6424fb3317b4be3d00e4d489122c9a48; classtype:trojan-activity; sid:2019228; rev:4; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4149 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/BrowseFox.H Checkin 2"; flow:established,to_server; content:"POST"; http_method; urilen:3; content:"/rs"; http_uri; content:"alpha="; http_client_body; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/PR"; http_header_names; content:!"User-Agent"; content:!"Accept"; content:!"Referer"; reference:md5,437a5cb57567c2691ce61a700682eab7; classtype:trojan-activity; sid:2018899; rev:4; metadata:created_at 2014_07_29, updated_at 2014_07_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4151 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PullUpdate.Adware CnC Beacon"; flow:established,to_server; urilen:7; content:"POST"; http_method; content:"?v="; http_uri; fast_pattern; pcre:"/^\/[a-z]{2}\x3Fv\x3D[0-9]$/U"; http_header_names; content:!"Referer"; content:!"Accept"; content:!"User-Agent"; reference:md5,129563c2ab034af094422db408d7d74f; classtype:trojan-activity; sid:2018368; rev:5; metadata:created_at 2014_04_07, updated_at 2014_04_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4152 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/iBryte.Adware Installer Download"; flow:established,to_server; content:"GET"; http_method; content:".exe?mode="; http_uri; content:"&sf="; http_uri; content:"&browser="; http_uri; content:"&useragent="; http_uri; http_header_names; content:!"Referer"; reference:md5,4c80e5f72a2ab8324b981e37b3b0e5d1; classtype:trojan-activity; sid:2020197; rev:5; metadata:created_at 2015_01_16, updated_at 2015_01_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4153 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE AdWare.Win32.BetterSurf.b SSL Cert"; flow:established,from_server; content:"CN=*.tr553.com"; threshold: type limit, track by_src, count 2, seconds 60; reference:md5,54c9288cbbf29062d6d873cba844645a; classtype:trojan-activity; sid:2020712; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_03_19, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4154 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/ELEX Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/v"; depth:2; http_uri; content:"?update"; http_uri; fast_pattern; distance:0; pcre:"/^[0-9]?=[a-z]+/URi"; http_header_names; content:!"User-Agent"; content:!"Accept"; content:!"Referer"; reference:md5, 2fed7fe9d055ebb63897bc2c8996676d; reference:md5,e2fd0d2c44e96cab5017bb8a68ca92a6; classtype:trojan-activity; sid:2019779; rev:6; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4157 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/DownloadAssistant.A Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/launch/"; http_uri; isdataat:!1,relative; http_header_names; content:"X-Crypto-Version"; fast_pattern; content:!"User-Agent"; content:!"Referer"; reference:md5,62a4d32dcb1c495c5583488638452ff9; classtype:trojan-activity; sid:2021283; rev:4; metadata:created_at 2015_06_16, updated_at 2015_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4159 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/WinWrapper.Adware Initial Install Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/api.cgi?act="; http_uri; fast_pattern; content:"&appid="; http_uri; content:"&ts="; http_uri; content:"&dlip="; http_uri; content:"&dlid="; http_uri; content:"&proto="; http_uri; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; http_header_names; content:!"Referer"; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020627; rev:5; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4162 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/OutBrowse.G Variant Checkin"; flow:to_server,established; content:"/dmresources/instructions"; fast_pattern; http_uri; content:".dat"; http_uri; content:"NSISDL/1.2 (Mozilla)"; depth:20; http_user_agent; http_protocol; content:"HTTP/1.0"; isdataat:!1,relative; http_header_names; content:!"Referer"; reference:md5,d75055c45e2c5293c3e0fbffb299ea6d; reference:url,www.virustotal.com/en/file/95e0eaaee080f2c167464ed6da7e4b7a27937ac64fd3e1792a1aa84c1aed488e analysis/; classtype:trojan-activity; sid:2017992; rev:8; metadata:created_at 2014_01_20, updated_at 2014_01_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4163 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/InstallCore Initial Install Activity 1"; flow:established,to_server; content:"POST"; http_method; content:"/?v="; depth:4; http_uri; content:"&subver="; fast_pattern; distance:0; http_uri; content:"&pcrc="; distance:0; http_uri; pcre:"/^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$/U"; http_header_names; content:!"Accept-"; content:!"Referer"; reference:md5,0a6a0baf77b80706cab665754ecadac9; classtype:trojan-activity; sid:2022807; rev:2; metadata:created_at 2016_05_16, updated_at 2016_05_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4165 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Hadsruda!bit Adware/PUA Installation Activity"; flow:to_server,established; content:"GET"; http_method; content:"?alpha="; http_uri; content:"NSIS_Inetc"; http_user_agent; depth:10; fast_pattern; pcre:"/\?alpha=(?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})/U"; reference:md5,6b58b3eb9bbb0f7297a2e36e615506d3; classtype:trojan-activity; sid:2022850; rev:3; metadata:created_at 2016_06_02, updated_at 2016_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4172 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.MultiInstaller"; flow:established, to_server; content:"GET"; http_method; content:"?s1="; http_uri; fast_pattern; pcre:"/^\/(?:info|entrance|start|debug)\?s1=[a-f0-9]{100,}$/U"; http_header_names; content:!"Referer"; reference:md5, 26973eeddb4781225b7c23d2d9cce996; reference:md5,a74b1602a50b9c7d3262e3f80a6a2e68; classtype:trojan-activity; sid:2018512; rev:6; metadata:created_at 2014_06_02, updated_at 2014_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4176 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PicColor Adware CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"?d="; http_uri; content:"&format=json"; http_uri; isdataat:!1,relative; fast_pattern; http_header_names; content:!"Accept-"; content:!"Referer"; reference:md5,6b173406ffccaa6d0287b795f8de2073; classtype:trojan-activity; sid:2020948; rev:3; metadata:created_at 2015_04_20, updated_at 2015_04_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4177 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DownloadAssistant.A PUP CnC"; flow:established,to_server; content:"POST"; http_method; content:"/v2/"; http_uri; depth:4; fast_pattern; pcre:"/^\/v2\/(?:(?:(?:intro_impr|s)ession|l(?:aunch|og)|exit)/$|c(?:(?:dn_(?:success|check)|ancel)/$|lick/))/U"; http_header_names; content:"X-Crypto-Version"; content:!"User-Agent"; reference:md5,a54f78d0fe6d1a1a09c22a71646c24b3; classtype:trojan-activity; sid:2021282; rev:3; metadata:created_at 2015_06_16, updated_at 2015_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4179 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MALWARE W32/WinWrapper.Adware POST CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/api.cgi?act="; http_uri; fast_pattern; content:"&appid="; http_uri; content:"&proto="; http_uri; content:"WinWrapper"; depth:10; http_user_agent; content:"{|22|appId|22 3a 22|"; http_client_body; content:"|22|uuId|22 3a 22|"; http_client_body; http_header_names; content:!"Referer"; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020628; rev:4; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4180 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Gamevance.AV Checkin"; flow:established,to_server; content:"/aj/"; http_uri; fast_pattern; content:".php?p="; http_uri; http_header_names; content:!"Referer"; reference:url,virustotal.com/en/file/21e04ef285d9df2876bab83dd91a8bd78ecdf0d47a8e4693e2ec1924f642bfc8/analysis/; reference:md5,0134997dff945fbfe62f343bcba782bc; classtype:trojan-activity; sid:2017136; rev:5; metadata:created_at 2013_07_11, updated_at 2013_07_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4181 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 5"; flow:established,to_server; content:"POST"; http_method; content:"/q/"; depth:3; http_uri; fast_pattern; content:"q="; depth:2; http_client_body; pcre:"/^[a-zA-Z0-9_-]+$/PR"; http_connection; content:"close"; nocase; isdataat:!1,relative; http_content_type; content:"application/x-www-form-urlencoded"; depth:33; isdataat:!1,relative; http_header_names; content:!"Accept"; content:!"Referer"; metadata: former_category MALWARE; reference:md5,f0e02ba660cfcb122b89bc780a6555ac; classtype:trojan-activity; sid:2025094; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Internet, tag Adware, signature_severity Major, created_at 2017_12_01, malware_family Adposhel, performance_impact Moderate, updated_at 2017_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4183 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/LoadMoney Adware Activity M2"; flow:to_server,established; content:"GET"; http_method; content:"/software_install?sid="; http_uri; fast_pattern; content:"&sub_id="; distance:0; http_uri; content:"&hash="; distance:0; http_uri; content:"&mid="; distance:0; http_uri; content:"&fname="; distance:0; http_uri; content:!"Referer|3a 20|"; http_header; flowbits:set,ETPTadmoney; metadata: former_category MALWARE; reference:md5,844e53381099d572c3864c7a42ddbbf1; classtype:trojan-activity; sid:2025303; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_02_02, malware_family Loadmoney, performance_impact Moderate, updated_at 2018_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4188 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue.WinPCDefender Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?machine_id={"; http_uri; depth:14; fast_pattern; content:"}"; http_uri; distance:0; isdataat:!1,relative; content:!"Referer"; http_header; content:"anti"; http_host; depth:4; metadata: former_category MALWARE; reference:md5,aa8def27909596f8477a5374f735eec9; reference:url,www.bleepingcomputer.com/virus-removal/remove-antivirus-pro-2017; classtype:trojan-activity; sid:2025358; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_02_14, performance_impact Moderate, updated_at 2018_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4189 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PPI User-Agent (InstallCapital)"; flow:to_server,established; content:"User-Agent|3a 20|InstallCapital"; http_header; metadata: former_category TROJAN; reference:md5,a6a9e8b0432ad557245ac8ad2926ed7c; classtype:trojan-activity; sid:2022246; rev:3; metadata:created_at 2015_12_11, updated_at 2018_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4190 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MALWARE Observed Win32/Foniad Domain (suggedin .info in DNS Lookup)"; dns_query; content:"suggedin.info"; nocase; isdataat:!1,relative; metadata: former_category MALWARE; reference:md5,dc2c0b6a8824f5ababf18913ad6d0793; classtype:trojan-activity; sid:2025531; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_04_17, malware_family Foniad, performance_impact Moderate, updated_at 2018_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4200 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WiseCleaner Installed (PUA)"; flow:established,to_server; content:"POST"; http_method; content:".php?p=install_statistics"; nocase; http_uri; content:"wisecleaner.net"; http_host; fast_pattern; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.0|3b 20|Maxthon)"; http_user_agent; metadata: former_category MALWARE; reference:url,wisecleaner.com; reference:md5,cd6e96207ea60b3e6e46c393fdcc9e0c; classtype:trojan-activity; sid:2025589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2018_06_12, updated_at 2018_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4202 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Antibody Software Installed (PUA)"; flow:established,to_server; content:"GET"; http_method; content:"version.php?ver="; nocase; http_uri; content:"&newinstall="; nocase; http_uri; distance:0; content:"antibody-software.com"; http_host; fast_pattern; content:"Embarcadero URI Client/1.0"; http_user_agent; metadata: former_category MALWARE; reference:url,antibody-software.com; reference:md5,8e22d630b992f9cb4d7f6b0aceebb37f; classtype:trojan-activity; sid:2025590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2018_06_12, updated_at 2018_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4203 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/Adload.AT Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/impression.do"; http_uri; fast_pattern; content:"source="; http_uri; content:"&event="; http_uri; content:"&implementation_id="; http_uri; content:"user_id="; http_uri; content:"&useragent="; http_uri; content:"&sgn="; http_uri; content:"&subid2="; http_uri; content:"&ts="; http_uri; http_header_names; content:!"Referer"; content:!"Accept"; metadata: former_category MALWARE; reference:md5,d15069e44ec849ab26bcefffe6867f10; reference:md5,4ececc2f027a096c2100ec1125d0d151; classtype:trojan-activity; sid:2022893; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Adware, signature_severity Major, created_at 2016_06_13, malware_family MSIL_Adload, updated_at 2018_06_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4204 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [eSentire] Win32/Adware.Adposhel.lgvk CnC Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/inst?data="; http_uri; nocase; content:"Installer event sender/"; http_user_agent; depth:23; fast_pattern; isdataat:!3,relative; http_header_names; content:!"Accept"; content:!"Referer"; metadata: former_category MALWARE; reference:md5,e7c2c1b796dad6210165110b7e8cda7d; classtype:trojan-activity; sid:2025645; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_07_10, malware_family Adposhel, performance_impact Low, updated_at 2018_07_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4205 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Ksapp.A Checkin"; flow:to_server,established; content:"/kspp/do?imei="; fast_pattern:only; http_uri; content:"&wid="; http_uri; content:"&type="; http_uri; content:"&step="; http_uri; reference:md5,e6d9776113b29680aec73ac2d1445946; reference:md5,13e6ce4aac7e60b10bfde091c09b9d88; reference:url,anubis.iseclab.org/?action=result&task_id=16b7814b794cd728435e122ca2c2fcdd3; reference:url,www.fortiguard.com/latest/mobile/4158213; reference:url,symantec.com/connect/blogs/mdk-largest-mobile-botnet-china; classtype:trojan-activity; sid:2016318; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2012_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4239 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android TrojanFakeLookout.A"; flow:established,to_server; urilen:13; content:"/controls.php"; http_uri; content:"Dalvik/"; http_user_agent; reference:url,blog.trustgo.com/fakelookout/; reference:md5,65baecf1fe1ec7b074a5255dc5014beb; classtype:trojan-activity; sid:2016343; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_02_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Fakelash.A!tr.spy Checkin"; flow:to_server,established; content:"/data.php?action="; nocase; http_uri; content:"&online="; distance:0; http_uri; content:"&m="; distance:0; http_uri; content:"&ver="; distance:0; http_uri; content:"User-Agent|3a| Dalvik/"; http_header; reference:md5,7dec1c9174d0f688667f6c34c0fa66c2; reference:url,blog.fortiguard.com/android-malware-distributed-by-malicious-sms-in-france/; classtype:trojan-activity; sid:2016344; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_02_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4241 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/FakeTimer.A Reporting to CnC"; flow:to_server,established; content:"/send.php?a_id="; http_uri; content:"&telno="; fast_pattern:only; http_uri; content:"&m_addr="; http_uri; content:"Android"; http_user_agent; reference:url,about-threats.trendmicro.com/Malware.aspx?language=uk&name=ANDROIDOS_FAKETIMER.A; reference:url,anubis.iseclab.org/?action=result&task_id=1ba82b938005acea4ddefc8eff1f4db06; reference:md5,cf9ba4996531d40402efe268c7efda91; reference:md5,537f190d3d469ad1f178024940affcb5; classtype:trojan-activity; sid:2014161; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2012_01_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SMSSend Fake flappy bird APK"; flow:to_server,established; content:"GET"; http_method; content:"/bookmark/getServiceCode?price="; http_uri; fast_pattern:only; content:"Dalvik"; depth:6; http_user_agent; content:!"Referer|3a 20|"; http_header; reference:url,securehoney.net/blog/how-to-dissect-android-flappy-bird-malware.html; reference:md5,6c357ac34d061c97e6237ce9bd1fe003; classtype:trojan-activity; sid:2018306; rev:3; metadata:created_at 2014_03_24, updated_at 2014_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4259 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement"; flow:established,to_client; file_data; content:"|7b 22|success|22 3A|1,|22|message|22 3A 22|Product successfully updated.|22|}"; within:55; reference:url,www.fireeye.com/blog/technical/targeted-attack/2013/11/dissecting-android-korbanker.html; reference:md5,a68bbfe91fab666daaf2c070db00022f; reference:md5,a68bbfe91fab666daaf2c070db00022f; classtype:trojan-activity; sid:2017788; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_11_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4260 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AndroidOS/Lotoor.Q"; flow:established, to_server; content: "device_id="; http_uri; pcre:"/^\d{10,20}&imsi=\d{10,15}&device_name=/URi"; content:"&app_id="; http_uri; pcre:"/^[a-f0-9]{30,35}&app_package_name=/URi"; content: "screen_density="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,92608e6ff795862f83d891ad8337b387; classtype:trojan-activity; sid:2018520; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_06_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4261 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Adware.Wapsx.A"; flow:established, to_server; content:"/fengmian/"; fast_pattern:only; content:"meinv6.4.0 qiu shou gou, zhi mai 503 wan ren min bi"; http_user_agent; depth:51; content:!"Referer|3a|"; http_header; reference:md5,37e36531e6dbc3ad0954fd9bb4588fad; classtype:trojan-activity; sid:2018533; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_06_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4262 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Andr/com.sdwiurse"; flow:established,to_server; content:"POST"; http_method; content:"/youxi_up.php"; fast_pattern:only; http_uri; content:"--*****|0d 0a|Content-Disposition|3a| form-data|3b| name=|22|npki|22|"; depth:52; http_client_body; reference:url,fireeye.com/blog/technical/2014/06/what-are-you-doing-dsencrypt-malware.html; reference:md5,04d24eb45d3278400b5fee5c1b06226c; classtype:trojan-activity; sid:2018584; rev:3; metadata:created_at 2014_06_19, updated_at 2014_06_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4264 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET 9999 (msg:"ET MOBILE_MALWARE Android Spyware Dowgin Checkin"; flow:established,to_server; urilen:13; content:"POST"; http_method; content:"/webviewAdReq"; nocase; depth:13; http_uri; reference:md5,45bf9f6e19649d3e1642854ecd82623c; classtype:trojan-activity; sid:2018663; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_10, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4265 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android ScarePakage checkin"; flow:established,to_server; content:"POST"; http_method; content:"/flash/api.php?id="; http_uri; fast_pattern:only; pcre:"/^\/flash\/api\.php\?id=\d/U"; content:"method="; depth:7; http_client_body; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:url,blog.lookout.com/blog/2014/07/16/scarepakage/; reference:url,contagiominidump.blogspot.com/2014/07/android-scarepackage-ransomware.html; reference:md5,645a60e6f4393e4b7e2ae16758dd3a11; classtype:trojan-activity; sid:2018769; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4266 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android ScarePakage checkin 2"; flow:established,to_server; content:"POST"; http_method; urilen:14; content:"/api33/api.php"; http_uri; fast_pattern:only; content:"method="; depth:7; http_client_body; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:url,blog.lookout.com/blog/2014/07/16/scarepakage/; reference:url,contagiominidump.blogspot.com/2014/07/android-scarepackage-ransomware.html; reference:md5,645a60e6f4393e4b7e2ae16758dd3a11; classtype:trojan-activity; sid:2018774; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4267 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AndroidOS.Simplocker Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:5; content:"/1/?1"; http_uri; fast_pattern:only; content:"{|22|n|22 3a 22|"; depth:6; http_client_body; content:"|22 2c 22|d|22 3a 22|"; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:url,welivesecurity.com/2014/07/22/androidsimplocker/; reference:md5,b98cac8f1ce9284f9882ba007878caf1; classtype:trojan-activity; sid:2018781; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_25, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4268 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Worm.AndroidOS.Selfmite.a Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:12; content:"/message.php"; http_uri; fast_pattern:only; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,54b715f6608d4457a9d22cfdd8bddbe6; reference:url,adaptivemobile.com/blog/selfmite-worm; reference:url,computerworld.com/s/article/9249430/Self_propagating_SMS_worm_Selfmite_targets_Android_devices; classtype:trojan-activity; sid:2018792; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_28, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4269 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MOBILE_MALWARE Android/Trogle.A Possible Exfiltration of SMS via SMTP"; flow:established,to_server; content:"MAIL FROM|3a|<a137736513@qq.com>"; nocase; reference:md5,ef819779fc4bee6117c124fb752abf57; classtype:trojan-activity; sid:2018887; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4270 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Spy.Kasandra.A Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/path/DeviceManager.php"; nocase; depth:23; http_uri; content:"func="; depth:5; http_client_body; content:"&deviceid="; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,6df6553b115d9ed837161a9e67146ecf; classtype:trojan-activity; sid:2018888; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4271 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Locker.B Checkin 1"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"method=counter&app_key="; depth:23; http_client_body; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,28726f772f6b4b63fb40696a28afafc9; reference:url,malware.dontneedcoffee.com/2014/08/scarepackageknstant.html; classtype:trojan-activity; sid:2018945; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4272 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Locker.B Checkin 2"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"method=devicestatus"; http_client_body; fast_pattern:only; content:"&app_key="; offset:19; http_client_body; content:"&imei="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,28726f772f6b4b63fb40696a28afafc9; reference:url,malware.dontneedcoffee.com/2014/08/scarepackageknstant.html; classtype:trojan-activity; sid:2018946; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4273 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Youmi.Adware Install Report CnC Beacon"; flow:established,to_server; content:"POST"; http_method; urilen:15; content:"/report/install"; http_uri; fast_pattern:only; content:"data="; http_client_body; depth:5; content:"os="; http_client_body; distance:0; content:"mac="; http_client_body; distance:0; content:"sign="; http_client_body; distance:0; reference:md5,6096ace9002792e625a0cdb6aec3f379; classtype:trojan-activity; sid:2019125; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_09_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4274 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/AppBuyer Checkin 1"; flow:established,to_server; content:"/updatesrv.aspx?f=1"; http_uri; fast_pattern:only; reference:md5,1c32f9f05234cac7dd7a83e3925a3105; reference:url,researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/; classtype:trojan-activity; sid:2019174; rev:2; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4275 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/AppBuyer Checkin 2"; flow:established,to_server; content:"/updatesrv.aspx?f=2&uuid="; http_uri; fast_pattern:only; reference:md5,1c32f9f05234cac7dd7a83e3925a3105; reference:url,researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/; classtype:trojan-activity; sid:2019175; rev:2; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4276 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser Checkin"; flow:to_server,established; content:"GET"; http_method; nocase; content:"/TargetConnect.aspx"; http_uri; content:"&tIMEI="; http_uri; content:"&tIMSI="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019331; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4277 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser sending GPS info"; flow:to_server,established; content:"GET"; http_method; nocase; content:"/TargetUploadGps.aspx"; http_uri; content:"tmac="; http_uri; content:"&JZ="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019332; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4278 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser sending files"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/TargetUploadFile.aspx"; http_uri; content:"tmac="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019333; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4279 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser checking library version"; flow:to_server,established; content:"GET"; http_method; nocase; urilen:18; content:"/CheckLibrary.aspx"; http_uri; content:!"Referer|3a|"; http_header; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019334; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4280 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Stealthgenie Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/SGCommand.aspx?sgcommand="; fast_pattern:6,20; http_uri; content:"&uid="; http_uri; distance:0; content:"&sid="; http_uri; distance:0; content:"&value="; http_uri; distance:0; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"|20|Android|20|"; http_user_agent; reference:md5,06947ce839a904d6abcb272ff46e7de1; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2014-111416-1306-99&tabid=2; reference:url,engadget.com/2014/09/30/crackdown-on-spying-apps-leads-to-stealthgenie-ceos-arrest/; classtype:trojan-activity; sid:2019805; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_11_25, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4281 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Syria-Twitter Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/contacts"; http_uri; content:"Apache-HttpClient/"; depth:18; http_user_agent; content:"contact|25|26="; depth:11; fast_pattern; http_client_body; pcre:"/\/contacts$/U"; reference:md5,b91315805ef1df07bdbfa07d3a467424; reference:url,www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-behind-the-syria-conflict.pdf; classtype:trojan-activity; sid:2020343; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_02_02, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4286 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon"; flow:established,to_server; content:"/input_data_get_contact.asp?user="; http_uri; content:"&pwd="; http_uri; content:"&addr="; http_uri; reference:url,research.zscaler.com/2015/02/android-banking-trojan-and-sms-stealer.html; reference:md5,ff081c1400a948f2bcc4952fed2c818b; classtype:trojan-activity; sid:2020353; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_02_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4287 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.SMSSend.Y"; flow:established,to_server; content:"/api/log.html|3f|"; http_uri; fast_pattern; content:"c="; http_uri; content:"&o="; http_uri; content:"&n="; http_uri; content:"Apache-HttpClient"; depth:18; http_user_agent; reference:md5,ef79985c90675e7abfb6b9a6bc5a6c65; classtype:trojan-activity; sid:2020729; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_03_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4290 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba.m Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:!"User-Agent|3a 20|"; http_header; content:"content=eyJmaW5nZXJwcmludCI"; fast_pattern; depth:27; http_client_body; reference:md5,0aa69ad64e20bb6cbf72f346ce43ff23; reference:url,www.fireeye.com/blog/threat-research/2014/07/the-service-you-cant-refuse-a-secluded-hijackrat.html; classtype:trojan-activity; sid:2021185; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_06_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4292 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"User-Agent|3a| Mozilla/5.0 (Windows NT 5.2|29 20|"; http_header; content:"appid="; depth:6; http_client_body; content:"&model="; http_client_body; content:"&imei="; fast_pattern:only; http_client_body; content:"&connect="; http_client_body; content:"&dpi="; http_client_body; content:"&width="; http_client_body; content:"&cpu="; http_client_body; content:"&phoneno="; http_client_body; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021386; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4293 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Gunpoder Checkin"; flow:to_server,established; content:"/landing?c="; fast_pattern:only; http_uri; content:"&g="; http_uri; content:"&a="; http_uri; content:"&s1="; http_uri; content:"&s2="; http_uri; content:"&s3="; http_uri; content:"&s4="; http_uri; content:"&s5="; http_uri; content:"&s6="; http_uri; content:"&s7="; http_uri; content:"&s8="; http_uri; content:"&s9="; http_uri; content:"&s10="; http_uri; content:"&s11="; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; reference:url,researchcenter.paloaltonetworks.com/2015/07/new-android-malware-family-evades-antivirus-detection-by-using-popular-ad-libraries/; reference:md5,b0b2cd71b4d15bb5f07b8315d7b27822; classtype:trojan-activity; sid:2021392; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4294 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"uuid="; http_client_body; content:"language="; http_client_body; content:"appkey"; http_client_body; content:"model="; http_client_body; content:"operatorsname="; fast_pattern:only; http_client_body; content:"networkname="; http_client_body; content:"networktype="; http_client_body; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021387; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4295 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE DNS Android/Spy.Feabme.A Query"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|tinduongpho|03|com|00|"; fast_pattern; distance:0; nocase; reference:md5,3ae3cb09c8f54210cb4faf7aa76741ee; reference:url,blog.trustlook.com/2015/07/08/most-successful-malware-on-google-play/; classtype:trojan-activity; sid:2021412; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_14, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4296 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Koler.C Checkin"; flow:to_server,established; content:".php?v="; http_uri; content:"&brok="; fast_pattern:only; http_uri; content:"&u="; http_uri; content:"&id="; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/&id=\d{15}$/U"; reference:md5,6ae7b0d04e2fd64a50703910d0eff9cc; classtype:trojan-activity; sid:2019510; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4300 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c Checkin"; flow:to_server,established; urilen:1; content:"POST"; http_method; nocase; content:!"Referer|3a 20|"; http_header; content:"{|22|type|22 3a|"; depth:8; http_client_body; content:",|22|text|22 3a|"; http_client_body; content:",|22|code|22 3a|"; fast_pattern:only; http_client_body; content:",|22|from|22 3a|"; http_client_body; content:"|22|}"; http_client_body; reference:md5,c9d3237885072b796e5849f7b9ec1a64; reference:url,b0n1.blogspot.com.br/2015/11/android-malware-drops-banker-from-png.html?m=1; reference:url,fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html; classtype:trojan-activity; sid:2022137; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_11_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4308 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Android/Fakeinst.KD .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|pc35hiptpcwqezgs"; nocase; distance:0; fast_pattern; reference:url,www.csis.dk/da/csis/blog/4818/; reference:md5,111b71c120167b5b571ee5501ffef65e; classtype:trojan-activity; sid:2022517; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4311 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|yuwurw46taaep6ip"; nocase; distance:0; fast_pattern; reference:md5,58fed8b5b549be7ecbfbc6c63b84a728; classtype:trojan-activity; sid:2022562; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4312 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain 2"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|voooxrrw2wxnoyew"; nocase; distance:0; fast_pattern; reference:md5,8d260ab2bb36aeaf5b033b80b6bc1e6a; classtype:trojan-activity; sid:2022563; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4313 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw/SlemBunk/SLocker Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:!"Referer|3a 20|"; http_header; content:",|22|model|22 3a|"; http_client_body; content:",|22|apps|22 3a 5b 22|"; http_client_body; content:",|22|imei|22 3a|"; fast_pattern:only; http_client_body; pcre:"/^\{\x22(?:os|type)\x22\x3a/P"; reference:md5,c9d3237885072b796e5849f7b9ec1a64; reference:md5,a83ce290469654002bcc64062c39387c; reference:url,www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html; classtype:trojan-activity; sid:2022288; rev:5; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_12_21, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4314 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE DNS Trojan-Banker.AndroidOS.Marcher.i Query"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tmdxiawceahpbhmb|03|com"; nocase; distance:0; fast_pattern; reference:md5,3c52de547353d94e95cde7d4c219ccac; classtype:trojan-activity; sid:2022975; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_07_18, performance_impact Low, updated_at 2016_07_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4316 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher Sending Credit Card Info"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/cards_json.php"; http_uri; content:!"Referer|3a 20|"; http_header; content:"bot_id="; depth:7; fast_pattern; http_client_body; content:"&info="; http_client_body; content:"cardNum"; http_client_body; pcre:"/^bot_id=[a-f0-9]{32}&/P"; pcre:"/\.php$/U"; reference:md5,78c2444fe15a8e58c629076781d9442a; reference:url,blog.fortinet.com/2016/11/01/android-banking-malware-masquerades-as-flash-player-targeting-large-banks-and-popular-social-media-apps; classtype:trojan-activity; sid:2023483; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_03, performance_impact Low, updated_at 2016_11_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4318 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/RequestActionsToExecute"; fast_pattern; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|CommandLine|22 3a|"; depth:15; http_client_body; content:",|22|CurrentDirectory|22 3a|"; http_client_body; pcre:"/\/RequestActionsToExecute$/U"; reference:md5,3c1055f19971d580ef9ced172d8eba3b; reference:url,rednaga.io/2016/11/14/hackingteam_back_for_your_androids/; classtype:trojan-activity; sid:2023507; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4321 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/NotifyLog"; fast_pattern:only; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|ClientId|22 3a|"; depth:12; http_client_body; content:",|22|Date|22 3a|"; http_client_body; pcre:"/\/NotifyLog$/U"; reference:md5,3c1055f19971d580ef9ced172d8eba3b; reference:url,rednaga.io/2016/11/14/hackingteam_back_for_your_androids/; classtype:trojan-activity; sid:2023508; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4322 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU SSL CnC Cert"; flow:established,from_server; content:"|02|IT"; content:"|03|AAA"; distance:0; content:"|02|BB"; distance:0; content:"|03|EEE"; distance:0; content:"|0d|IT Department"; distance:0; content:"|0a|SASDS_Srv0"; fast_pattern; distance:0; reference:md5,cbd1c2db9ffc6b67cea46d271594c2ae; classtype:trojan-activity; sid:2023509; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4323 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin"; flow:to_server,established; content:"lm="; http_uri; content:"/watch/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023680; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4326 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 3"; flow:to_server,established; content:"lm="; http_uri; content:"/find/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023682; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4327 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 4"; flow:to_server,established; content:"lm="; http_uri; content:"/results/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023683; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4328 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 5"; flow:to_server,established; content:"lm="; http_uri; content:"/open/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023684; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4329 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 6"; flow:to_server,established; content:"lm="; http_uri; content:"/close/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023685; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4330 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher SSL CnC Cert"; flow:established,from_server; content:"|00 dd 45 ec 3f 08 74 58 6a|"; content:"|0a|Department"; distance:0; content:"|55 04 03|"; distance:0; content:"|0f|www.example.com"; distance:1; within:16; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023708; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4331 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|rockybalboa|02|at|00|"; nocase; distance:0; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023709; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4332 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|storegoogle|02|at|00|"; nocase; distance:0; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023710; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4333 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php"; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|Content-Language|3a 20|en-US|0d 0a|Connection|3a 20|Keep-Alive|0d 0a|"; depth:98; http_header; content:!"Referer|3a 20|"; http_header; content:"&method="; fast_pattern:only; http_client_body; pcre:"/^d(?:id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$/P"; pcre:"/\.php$/U"; reference:md5,d6ef9b0cdb49b56c53da3433e30f3fd6; reference:md5,4ddf3ff57db24513a16eacb99ad07675; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:2023933; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_02_16, performance_impact Low, updated_at 2017_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4334 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b Apps List Exfil"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/functions.php"; fast_pattern:only; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:"apslst="; depth:7; http_client_body; reference:md5,4ddf3ff57db24513a16eacb99ad07675; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:2023934; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_02_16, performance_impact Low, updated_at 2017_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4335 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Comll.Banker RAT CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/n/"; http_uri; content:!"Referer|3a 20|"; http_header; content:"content=eyJ"; http_client_body; depth:11; fast_pattern; content:!"Accept|3a|"; http_header; pcre:"/\/n\/\d{15}$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,a78e904a05d4a9e6a15b6f56b261eab9; classtype:trojan-activity; sid:2018630; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_03, updated_at 2017_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4342 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/sdk_api.php?id="; fast_pattern:only; http_uri; content:"&type="; http_uri; content:"Apache-HttpClient/"; depth:18; http_user_agent; content:!"Referer|3a 20|"; http_header; pcre:"/\.php\?id=[a-f0-9]{8}(?:-[a-f0-9]{4}){4}[a-f0-9]{8}&type=/U"; metadata: former_category MOBILE_MALWARE; reference:md5,bc76d516a66e4002461128f62896c6dd; classtype:trojan-activity; sid:2024201; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_04_11, malware_family Android_Ewind, updated_at 2017_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4347 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Response"; flow:from_server,established; file_data; content:"[{|22|id|22 3a 22|0|22|,|22|command|22 3a 22|OK|22|}"; depth:26; fast_pattern; metadata: former_category MOBILE_MALWARE; reference:md5,bc76d516a66e4002461128f62896c6dd; classtype:trojan-activity; sid:2024202; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_04_11, malware_family Android_Ewind, updated_at 2017_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4348 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.KorBanker Fake Banking App Install CnC Beacon"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/send_sim_no.php|20|HTTP/1."; fast_pattern; content:!"Referer|3a 20|"; http_header; content:"_no="; http_client_body; depth:16; metadata: former_category MOBILE_MALWARE; reference:url,www.fireeye.com/blog/technical/targeted-attack/2013/11/dissecting-android-korbanker.html; reference:md5,a68bbfe91fab666daaf2c070db00022f; reference:md5,a68bbfe91fab666daaf2c070db00022f; classtype:trojan-activity; sid:2017787; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_11_27, updated_at 2017_04_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4349 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Dropper.Abd Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/ad-"; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"RgQ7"; depth:4; fast_pattern; http_client_body; pcre:"/\/ad-(?:strat|devi)\/$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,66a1dda748d073f5e659b700339c3343; reference:url,www.zscaler.com/blogs/research/malicious-android-ads-leading-drive-downloads; classtype:trojan-activity; sid:2024411; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android_07012016, signature_severity Major, created_at 2017_06_19, updated_at 2017_06_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4350 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a CnC Beacon"; flow:to_server,established; content:"/inj/injek-1.php?id="; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/\?id=(?:[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,e9542a8bd9f0ab57e40bb8519ac443a2; classtype:trojan-activity; sid:2024426; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_06_26, malware_family Android_Marcher, updated_at 2017_06_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4351 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/get.php|20|HTTP/1."; fast_pattern:only; content:!"Referer|3a 20|"; http_header; content:"info"; http_client_body; pcre:"/(?:^|&|\x22|\{\x22)id(?:=|\x22\x3a\x22)(?:[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(?:&|\x22|$)/P"; metadata: former_category MOBILE_MALWARE; reference:md5,a85990f79268a18329f4040a2ec85591; reference:md5,f48cd0c0e5362142c0c15316fa2635dd; classtype:trojan-activity; sid:2023553; rev:7; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_04_17, malware_family Android_Hqwar, updated_at 2017_07_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4352 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE WireX Botnet DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|axclick|05|store|00|"; fast_pattern; distance:0; nocase; metadata: former_category MOBILE_MALWARE; reference:md5,6af299a2ac9b59f7d551b6e235e0d200; reference:url,blog.cloudflare.com/the-wirex-botnet/; classtype:trojan-activity; sid:2024615; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_08_28, malware_family Android_WireX, updated_at 2017_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4355 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.RedAlert CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/gt|20|HTTP/1."; fast_pattern:only; content:"|0d 0a|Connection|3a 20|keep-alive|0d 0a|Content-Type|3a 20|application/json|0d 0a|"; http_header; content:"|3b 20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; metadata: former_category MOBILE_MALWARE; reference:md5,b66010a9c91b17f4d26dc973a97419ac; reference:url,info.phishlabs.com/blog/redalert2-mobile-banking-trojan-actively-updating-its-techniques; classtype:trojan-activity; sid:2024765; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_09_25, malware_family Android_RedAlert, updated_at 2017_09_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4372 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android JadeRAT CnC Beacon"; flow:to_server,established; dsize:<500; content:"@!MyID|3a|"; depth:7; content:"IMEI|3a|"; distance:0; content:"Mobile|20|ID|3a|"; content:"SIM|3a|"; content:"IMSI|3a|"; content:"Android|20|version|3a|"; content:"Model|3a|"; content:"All|20|SD|20|Size|3a|"; fast_pattern:only; content:"Free|20|SD|20|Size|3a|"; content:"Network|20|type|3a|"; metadata: former_category MOBILE_MALWARE; reference:md5,9027f111377598362972745478e40311; reference:url,blog.lookout.com/mobile-threat-jaderat; classtype:trojan-activity; sid:2024895; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_10_23, malware_family Android_JadeRAT, updated_at 2017_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4373 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android JadeRAT CnC Beacon 2"; flow:to_server,established; dsize:22; content:"@!hi|3a|"; depth:5; fast_pattern; pcre:"/^\d{15}\r\n$/R"; metadata: former_category MOBILE_MALWARE; reference:md5,9027f111377598362972745478e40311; reference:url,blog.lookout.com/mobile-threat-jaderat; classtype:trojan-activity; sid:2024896; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_10_23, malware_family Android_JadeRAT, updated_at 2017_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4374 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 1"; dns_query; content:"loaderclientarea24.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025014; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4379 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 2"; dns_query; content:"loaderclientarea22.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025015; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4380 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 3"; dns_query; content:"loaderclientarea20.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025016; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4381 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 4"; dns_query; content:"loaderclientarea15.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025017; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4382 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Adware.Adwo.A"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?m="; http_uri; content:"&a="; http_uri; content:"&os="; http_uri; content:!"&ComPut="; http_uri; http_header_names; content:!"User-Agent"; reference:md5,bbb0aa6c9f84963dacec55345fe4c47e; classtype:trojan-activity; sid:2023475; rev:3; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_01, performance_impact Low, updated_at 2016_11_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4384 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android.Trojan.Marcher.U DNS Lookup"; dns_query; content:"sagdzusghcsh.top"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,ccefe18d7b9bc31a8673b9bf82104f48; classtype:trojan-activity; sid:2025273; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2018_01_30, malware_family Android_Marcher, updated_at 2018_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4385 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 2"; flow:to_server,established; content:"POST"; http_method; content:"lm="; http_uri; content:"/search/?"; fast_pattern:only; http_uri; content:!"&clid="; http_uri; content:!"&banerid="; http_uri; content:!"&win="; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; metadata: former_category MOBILE_MALWARE; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023681; rev:3; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2018_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4386 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Golden Rat Checkin"; flow:to_server,established; content:"<HmzaPacket>|3e 0a 20 20|<Command>"; depth:25; fast_pattern; content:"<MSG>"; within:40; content:"</MSG>|3e 0a 20 20|"; distance:0; content:"</HmzaPacket></HAMZA_DELIMITER_STOP>"; distance:0; metadata: former_category MOBILE_MALWARE; reference:url,csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf; reference:md5,6296586cf9a59b25d1b8ab3eeb0c2a33; classtype:trojan-activity; sid:2025895; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_07_25, malware_family Android_GoldenRat, updated_at 2018_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4397 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/data/collectdata-new.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|a|22 3a|"; depth:5; http_client_body; content:"|22|b|22 3a|[{|22|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,cc56d261cbf0ecddcdc70de85af138d1; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025987; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4448 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/newuser.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|imei|22 3a|"; depth:8; http_client_body; content:"|22|tag|22 3a|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,cc56d261cbf0ecddcdc70de85af138d1; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025988; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4449 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/data/fcollectdata.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|category|22 3a|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,b603017bbcee17a76f5b0ee478d2d935; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025989; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4450 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN PoisonIvy.Eu5 Keepalive from CnC"; flow:established,from_server; content:"|3a 62 26 fd 44 34 01 ed a1 ed 88 48 7e f4 6e ca 0d 81 aa 70 c7 da e0 1c fc f2 f1 d2 94 f6 d9 44 f6 c1 92 c4 4f d4 2d 53 a7 5f 59 fd f6 1e 9b 6f|"; depth:48; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:trojan-activity; sid:2014057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2011_12_30, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5208 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Eu5 Keepalive to CnC"; flow:established,to_server; content:"|13 cb df 56 6f f3 20 08 c2 f1 ab d3 6f 75 56 a9|"; offset:16; depth:16; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:trojan-activity; sid:2014056; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2011_12_30, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5209 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Nuclear Checkin"; flow:established,to_server; content:".htm"; http_uri; content:"Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Win32)"; http_header; content:"HOST|3A 20|"; http_header; reference:md5,bd4af162f583899eeb6ce574863b4db6; classtype:trojan-activity; sid:2014121; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Exploit_Kit, tag Nuclear, signature_severity Critical, created_at 2012_01_12, malware_family Nuclear, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5215 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Ehy Keepalive to CnC"; flow:established,to_server; content:"|19 07 1b 24 3b 7a 9d e7 77 1e 84 f6 0f 60 3e 27|"; offset:16; depth:16; dsize:48; reference:md5,d2311b7208d563ac59c9114f5d422441; classtype:trojan-activity; sid:2014145; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2012_01_23, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5217 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/DelfInject.A CnC Checkin 2"; flow:established,to_server; content:"/gate.php?username="; http_uri; content:"&country="; http_uri; content:"&OS="; http_uri; reference:md5,d8c2f31493692895c45d620723e9a8c3; classtype:trojan-activity; sid:2014164; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5218 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/Mentory CnC Server Providing Update Details"; flow:established,to_client; content:"[UPDATE]|0D 0A|VER ="; content:"URL ="; distance:0; content:"[PATTERN]|0D 0A|VER ="; distance:0; content:"URL ="; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:trojan-activity; sid:2014166; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5219 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/Mentory CnC Server Providing File Info Details"; flow:established,to_client; content:"[DBINFO]|0D 0A|Info ="; content:"Version ="; distance:0; content:"[TotalCount]|0D 0A|Count ="; distance:0; content:"[GaruYac"; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:trojan-activity; sid:2014167; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5220 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Query for Known Hostile *test.3322.org.cn Domain"; content:"|01 00 00 01 00 00 00 00 00|"; depth:9; offset:2; content:"test|04|3322|03|org|02|cn"; fast_pattern; nocase; distance:0; reference:url,www.sans.org/reading_room/whitepapers/malicious/detailed-analysis-advanced-persistent-threat-malware_33814; reference:md5,e4afcee06ddaf093982f80dafbf9c447; classtype:trojan-activity; sid:2014267; rev:1; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5231 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.RShot Checkin"; flow:established,to_server; content:"connected#"; depth:10; content:"#Windows "; content:"##"; distance:0; dsize:<120; reference:md5,c0aadd5594d340d8a4909d172017e5d0; classtype:trojan-activity; sid:2014268; rev:1; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5232 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.PEx.942728546 Checkin"; flow:established,to_server; content:".com.exe"; http_uri; fast_pattern; content:"User-Agent|3a| GetRight/"; http_header; reference:md5,25e9e3652e567e70fba00c53738bdf74; reference:url,threatcenter.crdf.fr/?More&ID=74977&D=CRDF.Backdoor.Win32.PEx.942728546; classtype:trojan-activity; sid:2014290; rev:2; metadata:created_at 2012_02_29, updated_at 2012_02_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5236 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Koobface Variant Checkin Attempt"; flow:established,to_server; content:"/ping.php"; http_uri; content:" WinHttp.WinHttpRequest.5|29 0d 0a|"; http_header; reference:md5,62aa9e798746e586fb1f03459a970104; classtype:trojan-activity; sid:2014303; rev:2; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5237 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Backdoor.BlackMonay Checkin"; flow:established,to_server; content:".Php?UserName="; nocase; http_uri; content:"&Bank="; nocase; http_uri; content:"&Money="; nocase; http_uri; content:"Accept-Language|3A 20|zh-cn"; http_header; reference:md5,4a203e37caa2e04671388341419bda69; classtype:trojan-activity; sid:2014306; rev:3; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5238 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/NSIS.TrojanDownloader Second Stage Download Instructions from Server"; flow:established,to_client; content:"|3B 20|Ini download file modue"; nocase; content:"DownUrl="; nocase; distance:0; content:"FileName="; nocase; distance:0; content:"SaveType="; nocase; distance:0; pcre:"/FileName\x3D[^\r\n]*\x2E(dll|exe)/i"; reference:md5,3ce5da32903b52394cff2517df51f599; classtype:trojan-activity; sid:2014312; rev:2; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Genome.aetqe Checkin"; flow:established,to_server; content:"/stats/counterz.php?id="; http_uri; content:"&stat="; http_uri; reference:md5,700b7a81d1460a652e5f9f06fc54dcd6; classtype:trojan-activity; sid:2014331; rev:1; metadata:created_at 2012_03_07, updated_at 2012_03_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5242 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET TROJAN SMTP Subject Line Contains C Path and EXE Possible Trojan Reporting Execution Path/Binary Name"; flow:established,to_server; content:"Subject|3A 20|"; content:"C|3A 5C|"; nocase; fast_pattern; within:100; content:".exe"; within:40; pcre:"/Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe/i"; reference:md5,24e937b9f3fd6a04dde46a2bc75d4b18; classtype:bad-unknown; sid:2014343; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Coced.PasswordStealer User-Agent 5.0"; flow:established,to_server; content:"User-Agent|3A 20|5.0|0D 0A|"; http_header; reference:md5,24e937b9f3fd6a04dde46a2bc75d4b18; classtype:trojan-activity; sid:2014344; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5244 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Smart Fortress FakeAV/Kryptik.ABNC Checkin"; flow:established,to_server; content:"/?&affid="; http_uri; fast_pattern; content:"Accept|3a| *//*|0d 0a|"; http_header; reference:md5,fa20c17e5f58e7419b4f0eed318fa95a; reference:url,support.kaspersky.com/viruses/rogue/description?qid=208286259; classtype:trojan-activity; sid:2014293; rev:3; metadata:created_at 2012_02_29, updated_at 2012_02_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5245 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Graybird Checkin"; flow:to_server,established; content:"/count.asp?mac="; http_uri; content:"&os="; http_uri; content:"&av="; http_uri; content:"User-Agent|3a| Post|0d 0a|"; http_header; reference:md5,0fd68129ecbf68ad1290a41429ee3e73; reference:md5,11353f5bdbccdd59d241644701e858e6; classtype:trojan-activity; sid:2014365; rev:3; metadata:created_at 2012_02_11, updated_at 2012_02_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5246 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Lici Initial Checkin"; flow:established,to_server; content:".php?email="; http_uri; content:"&lici="; http_uri; content:"&ver="; http_uri; content:"HTTP/1.0"; content:!"User-Agent|3A|"; http_header; reference:md5,2f4d35e797249e837159ff60b827c601; classtype:trojan-activity; sid:2014119; rev:3; metadata:created_at 2012_01_12, updated_at 2012_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5247 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32-Dynamer.dtc Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/total_visitas.php"; http_uri; content:".php HTTP/1.1|0d 0a|Host|3a| "; content:!"User-Agent|3a| "; http_header; reference:url,microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32/Dynamer!dtc; reference:md5,989ba48e0a9e39b4b6fc5c6bf400c41b; classtype:trojan-activity; sid:2014113; rev:4; metadata:created_at 2012_01_11, updated_at 2012_01_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5406 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Jiwerks.A Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/update.aspx"; http_uri; content:"Accept-Language|3A 20|zh-cn"; http_header; content:"a="; fast_pattern; http_client_body; depth:2; content:"&v="; http_client_body; distance:0; reference:md5,0e47c711d9edee337575b6dbef850514; classtype:trojan-activity; sid:2014133; rev:4; metadata:created_at 2012_01_18, updated_at 2012_01_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5407 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.RShot HTTP Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"|3B| name=|22|bot_id|22 0D 0A 0D 0A|"; fast_pattern; content:" name=|22|os_version|22 0D 0A 0D 0A|"; reference:md5,c0aadd5594d340d8a4909d172017e5d0; classtype:trojan-activity; sid:2014269; rev:5; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5413 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Protux.B POST checkin"; flow:from_client,established; content:"POST"; nocase; http_method; content:"Mozilla/4.8.20 (compatible|3B| MSIE 5.0.2|3B| Win32)|0D 0A|Host|3a| "; http_header; reference:md5,53105ecf3cf6040039e16abb382fb836; classtype:trojan-activity; sid:2014360; rev:4; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5414 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Datamaikon Checkin myAgent"; flow:to_server,established; content:"/index.dat?"; http_uri; content:" myAgent|0d 0a|Host|3a| "; http_header; pcre:"/\/index.dat\?\d{5,9}$/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FDatamaikon.gen!A&ThreatID=-2147312276; reference:md5,a51933ee0f2ade7df98feb7207a2ffaf; classtype:trojan-activity; sid:2014468; rev:3; metadata:created_at 2012_04_04, updated_at 2012_04_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5418 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Yakes.pwo Checkin"; flow:to_server,established; content:"/stat.php?w="; http_uri; content:"&i="; http_uri; content:"&a="; http_uri; content:"User-Agent|3A| Opera/6"; http_header; content:"|3B| LangID="; http_header; reference:md5,d40927e8c4b59a1c2af4f981ef295321; classtype:trojan-activity; sid:2014604; rev:3; metadata:created_at 2012_03_01, updated_at 2012_03_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5429 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Es11 Keepalive to CnC"; flow:established,to_server; content:"|89 e7 52 d4 68 64 a7 73 bd 7e 3f 5c f7 99 3a 2e|"; offset:16; depth:16; dsize:48; reference:md5,4a17e9bd99f496c518ddfaaef93384b0; classtype:trojan-activity; sid:2014630; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2012_04_20, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5434 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Session_Id length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_test:1,>,SSL.Client_Hello.length,34,relative; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014634; rev:1; metadata:created_at 2012_04_24, updated_at 2012_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5440 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Cipher_Suite length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_jump:1,34,relative; byte_test:2,>,SSL.Client_Hello.length,0,relative; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014635; rev:1; metadata:created_at 2012_04_24, updated_at 2012_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5441 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ConstructorWin32/Agent.V"; flow:to_server,established; content:"GET http|3A|//"; depth:11; content:"|0D 0A|Pragma|3A| no-catch|0D 0A|"; http_header; content:"|0D 0A|X-HOST|3A| "; http_header; content:"|0D 0A|Content-Length|3A| 0|0D 0A|"; http_header; reference:md5,3305ad96bcfd3a406dc9daa31e538902; classtype:trojan-activity; sid:2014643; rev:7; metadata:created_at 2012_04_26, updated_at 2012_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5443 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Mepaow.Backdoor Initial Checkin to Intermediary Pre-CnC"; flow:established,to_server; content:"/PostView.nhn?blogId="; fast_pattern; http_uri; content:"&logNo="; http_uri; content:"&parentCategoryNo="; http_uri; content:"&userTopListOpen="; http_uri; content:"&userTopListManageOpen="; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| Win32|3B| WinHttp.WinHttpRequest.5)|0d 0a|"; http_header; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=1072862; reference:md5,8af17164500aac1c0965b842aca3fed7; classtype:trojan-activity; sid:2014754; rev:6; metadata:created_at 2012_05_17, updated_at 2012_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5446 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpyBanker Infection Confirmation Email 2"; flow:established,to_server; content:"From|3A 20 22|Infected|22|"; reference:md5,f091e8ed0e8f4953ff10ce3bd06dbe54; classtype:trojan-activity; sid:2014762; rev:2; metadata:created_at 2012_05_17, updated_at 2012_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5447 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Comrerop Checkin to FTP server"; flow:established,to_server; content:"USER griptoloji|0d 0a|"; fast_pattern:5,12; reference:md5,6b16290b05afd1a9d638737924f2ab5c; classtype:trojan-activity; sid:2014757; rev:4; metadata:created_at 2012_05_15, updated_at 2012_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5449 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN VBS/Wimmie.A Set"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/count.php?m=c&n="; http_uri; content:"_"; distance:0; http_uri; content:"@"; distance:0; http_uri; content:"|0D 0A|Content-Length|3a| 0|0D 0A|"; http_header; reference:url,www.threatexpert.com/report.aspx?md5=6fd7493e56fdc3b0dd8ecd24aea20da1; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AVBS%2FWimmie.A; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf; reference:md5,61474931882dce7b1c67e1f22d26187e; classtype:trojan-activity; sid:2014803; rev:7; metadata:created_at 2011_11_04, updated_at 2011_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5454 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET !6661:6668 -> $HOME_NET any (msg:"ET TROJAN IRC Bot Download http Command"; flow:established,from_server; content:"JOIN |3a|#"; nocase; content:"dl|20|http|3a 2f 2f|"; distance:0; content:"|2e|exe"; distance:0; reference:md5,fa6ae89b101a0367cc98798c7333e3a4; classtype:trojan-activity; sid:2014439; rev:4; metadata:created_at 2012_03_28, updated_at 2012_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5459 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Nutiliers.A Downloader CnC Checkin - Request Encrypted Response"; flow:established,to_server; content:"/js/data/encryptedtest.dll"; http_uri; reference:md5,7b2bfb9d270a5f446f32502d2ed34d67; classtype:trojan-activity; sid:2014962; rev:2; metadata:created_at 2012_06_25, updated_at 2012_06_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5471 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Armageddon CnC Checkin"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3A| ArmageddoN"; nocase; http_header; content:"GetList="; http_client_body; depth:8; reference:md5,3f4c5649d66fc5befc0db47930edb9f6; classtype:trojan-activity; sid:2014963; rev:2; metadata:created_at 2012_06_25, updated_at 2012_06_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5472 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Rogue.Win32/Winwebsec Install 2"; flow:to_server,established; content:"/api/urls/?ts="; http_uri; content:"&affid="; http_uri; content:"GTB0.0|3b|"; http_header; reference:md5,181999985de5feae6f44f9578915417f; classtype:trojan-activity; sid:2014816; rev:5; metadata:created_at 2012_05_24, updated_at 2012_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5473 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC POST /common/versions.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/common/versions.php"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014979; rev:2; metadata:created_at 2012_06_28, updated_at 2012_06_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5475 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC GET /lost.dat"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/lost.dat"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014980; rev:3; metadata:created_at 2012_06_28, updated_at 2012_06_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5476 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC POST /common/timestamps.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/common/timestamps.php"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014999; rev:2; metadata:created_at 2012_07_02, updated_at 2012_07_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5477 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Numnet.Downloader CnC Checkin 1"; flow:established,to_server; content:"/counter/mac_proc.php?cid="; fast_pattern; http_uri; content:"&mid="; http_uri; content:"User-Agent|3A| internet|0D 0A|"; http_header; reference:md5,fbc732c7cd1bbd84956b1e76b53384da; classtype:trojan-activity; sid:2015020; rev:2; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5478 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Numnet.Downloader CnC Checkin 2"; flow:established,to_server; content:"/check_counter.php?pid="; http_uri; content:"&mid="; http_uri; content:"User-Agent|3A| internet|0D 0A|"; http_header; reference:md5,fbc732c7cd1bbd84956b1e76b53384da; classtype:trojan-activity; sid:2015021; rev:2; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5479 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Pift Checkin 1"; flow:established,to_server; content:"/plg3.z"; fast_pattern; http_uri; urilen:7; content:"User-Agent|3a| Mozilla/4.0|0d 0a|"; http_header; reference:url,kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23873/en_US/McAfee%20Labs%20Threat%20Advisory-W32-Pift.pdf; reference:md5,d3c6af8284276b11c2f693c1195b4735; classtype:trojan-activity; sid:2015458; rev:2; metadata:created_at 2012_07_12, updated_at 2012_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5481 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Pift Checkin 2"; flow:established,to_server; content:"/ext1.z"; fast_pattern; http_uri; urilen:7; content:"User-Agent|3a| Mozilla/4.0|0d 0a|"; http_header; reference:url,kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23873/en_US/McAfee%20Labs%20Threat%20Advisory-W32-Pift.pdf; reference:md5,d3c6af8284276b11c2f693c1195b4735; classtype:trojan-activity; sid:2015459; rev:2; metadata:created_at 2012_07_12, updated_at 2012_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5482 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Playtech Downloader Online Gaming Checkin"; flow:to_server,established; content:"/client_update_urls.php"; http_uri; content:"User-Agent|3a| Playtech "; http_header; reference:md5,00740d7d15862efb30629ab1fd7b8242; classtype:trojan-activity; sid:2008365; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5485 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Medfos/Midhos Checkin"; flow:to_server,established; content:"/id="; http_uri; content:"&rt="; distance:0; http_uri; content:"AAAAAAAAAAA"; http_uri; fast_pattern; content:!"Accept|3a 20|"; http_header; content:!"Connection|3a 20|"; http_header; reference:md5,00da8acc14d0e827dbb1326c023fc720; reference:md5,8f561f46fb262cac6bb4cacf3e4e78a6; reference:md5,63491dcc8e897bf442599febe48b824d; classtype:trojan-activity; sid:2014722; rev:4; metadata:created_at 2012_05_08, updated_at 2012_05_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5498 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Jorik.Totem.vg HTTP request"; flow:established,to_server; content:"/?xclzve_"; depth:9; http_uri; reference:md5,cf5df13f8498326f1c6407749b3fe160; classtype:trojan-activity; sid:2015562; rev:2; metadata:created_at 2012_08_03, updated_at 2012_08_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5506 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Lile.A DoS Outbound"; flow:established,to_server; content:"GET"; http_method; content:"UserAgent|3a|"; http_header; content:"Windows 98"; fast_pattern:only; http_header; content:"Host|3a| www.fbi.gov"; http_header; threshold:type limit, track by_src, count 1, seconds 30; reference:url,symantec.com/security_response/writeup.jsp?docid=2005-101311-0945-99&tabid=2; reference:md5,d6d0cd7eca2cef5aad66efbd312a7987; classtype:trojan-activity; sid:2015577; rev:3; metadata:created_at 2012_08_06, updated_at 2012_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5507 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Mirage Campaign checkin"; flow:established,to_server; content:"POST"; http_method; content:"/result?hl="; depth:11; http_uri; content:"&meta="; distance:0; http_uri; content:"Mjtdkj"; depth:6; http_client_body; reference:md5,ce1cdc9c95a6808945f54164b2e4d9d2; reference:url,secureworks.com/research/threats/the-mirage-campaign/; classtype:trojan-activity; sid:2015714; rev:2; metadata:created_at 2012_09_19, updated_at 2012_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5526 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Runner/Bublik Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"G="; http_client_body; nocase; content:"&PG="; http_client_body; nocase; content:"&EPBB="; http_client_body; fast_pattern; nocase; content:!"User-Agent|3a|"; http_header; reference:url,www.spywarecease.com/spyware-list/Spyware_Trojan.Win32.Runner.s.html; reference:url,www.threatexpert.com/threats/trojan-win32-runner.html; reference:md5,6d2919a92d7dda22f4bc7f9a9b15739f; classtype:trojan-activity; sid:2009711; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5531 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Fynloski.A/DarkRat Checkin Outbound"; flow:to_server,established; dsize:<16; content:"KEEPALIVE"; depth:9; pcre:"/^KEEPALIVE\x7c?\d/"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,www.contextis.com/research/blog/darkcometrat/; reference:url,www.eff.org/deeplinks/2012/08/syrian-malware-post; reference:md5,a2f58a4215441276706f18519dae9102; classtype:trojan-activity; sid:2013090; rev:10; metadata:created_at 2010_11_22, updated_at 2010_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5533 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Pushdo.s Checkin"; flow:to_server,established; content:"POST"; http_method; urilen:39; content:"/?ptrxcz_"; fast_pattern:only; http_uri; pcre:"/^\/\?ptrxcz_[a-z0-9A-Z]{30}$/U"; reference:md5,58ffe2b79be4e789be80f92b7f96e20c; classtype:trojan-activity; sid:2015807; rev:3; metadata:created_at 2012_10_05, updated_at 2012_10_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5543 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Backdoor.ADDNEW (DarKDdoser) CnC 3"; flow:to_server,established; dsize:<100; content:"ADDNEW|7C|Stable|7C|"; depth:14; pcre:"/\x7C(NEW|Awaiting commands)/R"; reference:url,blog.fireeye.com/research/2012/11/backdooraddnew-darkddoser-and-gh0st-a-match-made-in-heaven.html; reference:md5,691305b05ae75389526aa7c15b319c3b; classtype:trojan-activity; sid:2015870; rev:2; metadata:created_at 2012_11_06, updated_at 2012_11_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5550 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WORM_VOBFUS Checkin 1"; flow:established,to_server; content:"GET"; http_method; urilen:5; content:"/1/?"; http_uri; depth:4; content:"MSIE 7.0|3b|"; http_user_agent; content:".ddns"; fast_pattern; http_header; distance:0; content:".eu|0d 0a|"; distance:1; within:5; http_header; pcre:"/Host\x3a \d{5}\x2eddns[a-z0-9]\x2eeu\r\n$/H"; reference:md5,f127ed76dc5e48f69a1070f314488ce2; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/watch-out-for-worm_vobfus/; classtype:trojan-activity; sid:2015968; rev:8; metadata:created_at 2012_11_29, updated_at 2012_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5556 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Necurs"; flow:to_server,established; content:"POST"; http_method; content:"/iis/host.aspx"; http_uri; fast_pattern; content:!"User-Agent|3a|"; http_header; content:"application/octet-stream"; http_header; reference:md5,871ecf11ddd7ffe294cab82bcaf9c310; reference:url,blogs.technet.com/b/mmpc/archive/2012/12/06/unexpected-reboot-necurs.aspx; classtype:trojan-activity; sid:2016000; rev:2; metadata:created_at 2012_12_07, updated_at 2012_12_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5557 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kuluoz.B Request"; flow:established,to_server; content:"GET"; http_method; pcre:"/\/[a-f0-9]+$/Ui"; content:"Windows NT 9.0|3b|"; http_header; pcre:"/^Host\x3a\s*(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?\r?$/Hmi"; reference:md5,0282bc929bae27ef95733cfa390b10e0; classtype:trojan-activity; sid:2015985; rev:4; metadata:created_at 2012_12_04, updated_at 2012_12_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5608 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Zbot.ivgw Downloading EXE"; flow:to_server,established; content:"/forum/images.php?id"; http_uri; nocase; fast_pattern:only; content:"Mozilla/6"; http_user_agent; depth:9; content:" MSIE "; http_user_agent; distance:0; reference:md5,e8e3d22203f9549d6c5f361dfe51f8c6; classtype:trojan-activity; sid:2016425; rev:5; metadata:created_at 2013_02_18, updated_at 2013_02_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5609 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Likseput.B Checkin"; flow:established,to_server; content:"|3b|Trident/4.0 "; fast_pattern; http_user_agent; pcre:"/User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$/Hmi"; reference:md5,95d85aa629a786bb67439a064c4349ec; classtype:trojan-activity; sid:2016432; rev:4; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5610 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Likseput.A Checkin Windows Vista/7/8"; flow:to_server,established; content:"User-Agent|3a| 6|2e|"; http_header; content:"|5c|"; within:64; http_header; content:"Host|3a| "; http_header; distance:0; content:!"|0d 0a|"; distance:-6; within:2; http_header; pcre:"/User\-Agent\x3a\x206\.[0-2]\x20\d\d\x3a\d\d\x20/Hi"; reference:md5,b5e9ce72771217680efaeecfafe3da3f; reference:url,threatexpert.com/report.aspx?md5=4b6f5e62d7913fc1ab6c71b5b909ecbf; classtype:trojan-activity; sid:2016433; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5611 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:5; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5613 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 2 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 1"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016436; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5614 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 3 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 2"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016437; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5615 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related"; flow:established,from_server; flowbits:isset,ET.webc2; file_data; content:"/R"; reference:url,www.mandiant.com/apt1; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,0cf9e999c574ec89595263446978dc9f; classtype:trojan-activity; sid:2016449; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5625 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Namsoth.A Checkin/NEWSREELS APT1 Related"; flow:established,to_server; content:"POST"; http_method; content:"name="; depth:5; http_client_body; content:"&userid="; distance:0; http_client_body; content:"&other"; distance:4; within:6; http_client_body; pcre:"/&userid=\d{4}&other=[MF]/P"; reference:md5,a2cd1189860b9ba214421aab86ecbc8a; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016439; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5626 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN STARSYPOUND Client Checkin"; flow:established,from_server; content:"*(SY)# "; depth:7; reference:md5,8442ae37b91f279a9f06de4c60b286a3; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016444; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5627 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CLOVER Checkin APT1 Related"; flow:established,to_server; content:"/Default.asp"; http_uri; content:"Accept: image/gif,image/x-xbitmap"; http_header; content:" MSIE "; http_header; content:"Cookie|3a 20|PREF=86845632017245|0d 0a|"; fast_pattern; reference:url,www.mandiant.com/apt1; reference:md5,29c691978af80dc23c4df96b5f6076bb; classtype:trojan-activity; sid:2016452; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5628 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CLOVER Download UA"; flow:established,to_server; content:"User-Agent|3a 20|Mozilla/5.0 (Windows|3b| Windows NT 5.1|3b| en-US|3b| rv|3a|1.8.0.12) Firefox/1.5.0.12|0d 0a|"; http_header; fast_pattern:66,20; reference:url,www.mandiant.com/apt1; reference:md5,29c691978af80dc23c4df96b5f6076bb; classtype:trojan-activity; sid:2016453; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5629 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-DIV UA"; flow:established,to_server; content:"User-Agent|3a| Microsoft Internet Explorer Exelon "; http_header; fast_pattern:27,20; reference:url,www.mandiant.com/apt1; reference:md5,1e5ec6c06e4f6bb958dcbb9fc636009d; classtype:trojan-activity; sid:2016454; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5631 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related"; flow:established,from_server; file_data; content:"/R"; reference:url,www.mandiant.com/apt1; reference:md5,b5e9ce72771217680efaeecfafe3da3f; classtype:trojan-activity; sid:2016455; rev:3; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5632 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-KT3 Intial Connection Beacon APT1 Related"; flow:established,to_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:set,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:trojan-activity; sid:2016456; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5633 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related"; flow:established,from_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:isset,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:trojan-activity; sid:2016457; rev:3; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5634 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Sluegot.A Checkin WEBC2-YAHOO APT1 Related"; flow:to_server,established; content:"User-Agent|3a| IPHONE"; http_header; pcre:"/User-Agent\x3a\sIPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})/Hi"; reference:url,www.securelist.com/en/descriptions/24052976/Trojan.Win32.Scar.ddxe; reference:md5,0149b7bd7218aab4e257d28469fddb0d; reference:md5,6f9992c486195edcf0bf2f6ee6c3ec74; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016461; rev:4; metadata:created_at 2011_06_27, updated_at 2011_06_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5635 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN WEBC2-UGX Embedded CnC Response APT1"; flow:established,from_server; flowbits:isset,ET.webc2ugx; file_data; content:""; within:150; reference:url,intelreport.mandiant.com; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,fcdaa67e33357f64bc4ce7b57491fc53; classtype:trojan-activity; sid:2016451; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5936 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/GMUnpacker.Downloader Download Instructions Response From CnC"; flow:established,to_client; file_data; content:"<AD>"; within:4; content:"<TIPAD>"; distance:0; content:"<POPUP>"; distance:0; content:"<REG>HKEY_LOCAL_MACHINE|5c|SOFTWARE|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|"; distance:0; reference:md5,43e89125ad40b18d22e01f997da8929a; classtype:trojan-activity; sid:2017891; rev:2; metadata:created_at 2013_12_19, updated_at 2013_12_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5942 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 7"; flow:to_server,established; dsize:>11; content:"|79 95|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x95/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a2469f4913f1607e4207ba0a8768491c; classtype:trojan-activity; sid:2017913; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5943 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 8"; flow:to_server,established; dsize:>11; content:"|79 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,be92836bee1e8abc1d19d1c552e6c115; classtype:trojan-activity; sid:2017914; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5944 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 9"; flow:to_server,established; dsize:>11; content:"|7a 9b|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7a\x9b/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a88e0e5a2c8fd31161b5e4a31e1307a0; classtype:trojan-activity; sid:2017915; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5945 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 10"; flow:to_server,established; dsize:>11; byte_jump:4,0,from_beginning,little,post_offset -1; isdataat:!2,relative; content:"|78 9c|"; fast_pattern:only; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,a88e0e5a2c8fd31161b5e4a31e1307a0; classtype:trojan-activity; sid:2017916; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5946 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for whoismama.ru"; flow:established,to_client; content:"www.whoismama.ru"; fast_pattern:only; nocase; reference:md5,cca1713888b0534954234cf31dd5a7d4; classtype:trojan-activity; sid:2017940; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5947 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for dewart.ru"; flow:established,to_client; content:"www.deweart.ru"; fast_pattern:only; nocase; reference:md5,6e0a6c4a06a446f70ae1463129711122; classtype:trojan-activity; sid:2017941; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5948 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for anlogtewron.ru"; flow:established,to_client; content:"www.anlogtewron.ru"; fast_pattern:only; nocase; reference:md5,c13c3e331f05d61a7204fb4599b07709; classtype:trojan-activity; sid:2017942; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5949 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for erjentronem.ru"; flow:established,to_client; content:"www.erjentronem.ru"; fast_pattern:only; nocase; reference:md5,05ddaa5b6b56123e792fd67bb03376bc; classtype:trojan-activity; sid:2017943; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5950 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 14"; flow:to_server,established; dsize:>11; byte_extract:4,0,c_size,little; byte_test:4,>,c_size,4,little; content:"|08 01|"; offset:2; depth:2; content:"|79 94|"; offset:13; depth:2; pcre:"/^.{8}[\x20-\x7e]+?\x79\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,9fae15fa8ab6bb8d78d609bdceafe28e; classtype:trojan-activity; sid:2017944; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_08, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5951 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kishop.A checkin"; flow:to_server; content:"POST"; http_method; content:".php?mark="; http_uri; content:"&type="; http_uri; content:"&theos="; http_uri; reference:md5,bad7cd3c534c95867f5dbe5c5169a4da; classtype:trojan-activity; sid:2017964; rev:2; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5955 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Ferret DDOS Bot CnC Beacon 2"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a 20|Mozilla|20|"; fast_pattern; http_header; content:"m"; depth:1; http_client_body; pcre:"/^m(?:ode)?=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(?:wid)?=/P"; reference:md5,f582667d5ce743436fb24771eb22a0e8; reference:url,www.arbornetworks.com/asert/2013/12/a-business-of-ferrets/; classtype:trojan-activity; sid:2017917; rev:5; metadata:created_at 2014_01_02, updated_at 2014_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5956 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN StartPage jsp checkin"; flow:to_server,established; urilen:27<>40; content:"POST"; http_method; content:"/201"; http_uri; fast_pattern:only; content:".jsp"; http_uri; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT 5.2|3b 20|.NET CLR 1.1.4322|3b 20|.NET CLR 2.0.50727|3b 20|InfoPath.1)|0d 0a|"; http_header; content:!"Accept-Language|3A 20|"; http_header; content:!"Referer|3A 20|"; http_header; pcre:"/^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$/U"; threshold:type both,track by_src,count 2,seconds 60; reference:md5,bb7bbb0646e705ab036d73d920983256; classtype:trojan-activity; sid:2017967; rev:3; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5957 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 2012:2014 (msg:"ET TROJAN Win32.Morix.B checkin"; flow:to_server,established; content:"|00 00 42 42 43 42 43|"; offset:2; depth:7; reference:md5,25623fa3a64f6bed301822f8fe6aa9b5; classtype:trojan-activity; sid:2017922; rev:3; metadata:created_at 2014_01_02, updated_at 2014_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5958 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kelihos.F Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:<13; content:".htm"; fast_pattern:only; http_uri; pcre:"/^\/[^\x2f]+?\.htm$/U"; content:!"BridgitAgent"; http_user_agent; content:!"Accept"; http_header; content:!"Referer"; http_header; content:!"Content-Type"; http_header; content:"Content-Length|3a 20|"; http_header; content:!"0|0d 0a|"; within:3; http_header; content:"|0d 0a|"; distance:0; http_header; reference:md5,00db349caf2eefc3be5ee30b8b8947a2; classtype:trojan-activity; sid:2017191; rev:3; metadata:created_at 2013_07_24, updated_at 2013_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5964 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Java/Jacksbot Check-in"; flow:established,to_server; content:"|00 2d 00 68 00 20 00 32 00 66 00|"; pcre:"/^(?:4\x00[1-9a-f]|5\x00[\da])/Rs"; content:"|00 33 00 61 00|"; within:5; reference:md5,6d93fc6132ae6938013cdd95354bff4e; classtype:trojan-activity; sid:2017983; rev:3; metadata:created_at 2014_01_17, updated_at 2014_01_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5966 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 18"; flow:to_server,established; dsize:>11; content:"|7b 9e|"; offset:8; byte_jump:4,-10,little,relative,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,1f46b1e0a7fe83d24352e98b3ab3fc3f; classtype:trojan-activity; sid:2018013; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_27, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5968 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Limitless Logger Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|Limitless Logger|20 3a 20 3a|"; nocase; fast_pattern:9,20; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018015; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5969 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Limitless Logger Sending Data over SMTP 2"; flow:to_server,established; content:"Limitless Logger successfully ran on this computer."; nocase; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018016; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5970 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Win32/Antilam.2_0 Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|CigiCigi Logger"; fast_pattern:4,20; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018018; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5971 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/LockscreenBEI.Scareware Cnc Beacon"; flow:established,to_server; urilen:18; content:"GET"; http_method; content:"/reboot/index.html"; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; reference:md5,04948b6045730d4ec626f79504c7f9ad; reference:md5,9fff65c23fe403d25c08a5cdd3dc775d; classtype:trojan-activity; sid:2018023; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5972 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 19"; flow:to_server,established; dsize:>11; content:"|78 9c|"; offset:8; byte_jump:4,-6,little,relative,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,2b0f0479b14069b378fb454c92086897; classtype:trojan-activity; sid:2018032; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_28, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5976 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Banker.AALV checkin"; flow:to_server,established; content:"CHEGOU-NOIS"; fast_pattern; content:"|20 7c 20|PLUGIN|3a|"; distance:0; content:"|20 7c 20|BROWSER|3a|"; reference:md5,74bfd81b345a6ef36be5fcf6964af6e1; classtype:trojan-activity; sid:2018034; rev:1; metadata:created_at 2014_01_29, updated_at 2014_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5977 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Win32.Genome.boescz Checkin"; flow:to_server,established; content:"|0d 0a|Subject|3a 20|TenInfect"; fast_pattern:9,9; content:"|0d 0a 0d 0a|TenInfect"; distance:0; reference:md5,313535d09865f3629423cd0e9b2903b2; reference:url,www.virustotal.com/en/file/75c454bbcfc06375ad1e8b45d4167d7830083202f06c6309146e9a4870cddfba/analysis/; classtype:trojan-activity; sid:2018033; rev:3; metadata:created_at 2014_01_29, updated_at 2014_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5978 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 3"; dsize:>11; content:"|7b 9e|"; fast_pattern:only; byte_jump:4,0,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,2eed956920934a78200899ef05ace0d8; classtype:trojan-activity; sid:2017548; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2013_09_30, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5984 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 15"; flow:to_server,established; dsize:>11; content:"FWKJGH"; offset:8; depth:6; byte_jump:4,0,little,from_beginning,post_offset 5; isdataat:!2,relative; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,edd8c8009fc1ce2991eef6069ae6bf82; classtype:trojan-activity; sid:2017974; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_16, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5985 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 20"; flow:to_server,established; dsize:>11; content:"|7d 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7d\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a037b3241c0b957efe6037b25570292f; classtype:trojan-activity; sid:2018054; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5986 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 444 (msg:"ET TROJAN W32/FakeAlert.FT.gen.Eldorado Downloading DLL"; flow:to_server,established; content:"SIZE libcurl-4.dll|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018072; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5989 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/FakeAlert.FT.gen.Eldorado Downloading VBS"; flow:to_server,established; content:"SIZE explore.vbs|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018073; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5990 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/StoredBt.A Activity"; flow:to_server,established; content:".php?a1="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; pcre:"/\.php\?a1=\d+&a2=(?:[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|(?:[A-Za-z0-9\+\/]{4})*(?:[A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(?:&a\d+=[^&]+)+$/U"; reference:md5,e8e9eb1cd4be7ab27743887be2aa28e9; classtype:trojan-activity; sid:2018074; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5991 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 23"; flow:to_server,established; dsize:>11; content:"|78 9c|"; offset:8; byte_jump:4,-18,relative,little,from_beginning, post_offset 1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?.{2}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,db1c4342f617798bcb2ba5655d32bf67; classtype:trojan-activity; sid:2018075; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5992 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 24"; flow:to_server,established; dsize:>11; content:"|7c 9f|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?\x7c\x9f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,0be9e3f4507a8ee23bb0c2b6c218d1cc; classtype:trojan-activity; sid:2018076; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5993 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32.Blackshades/Shadesrat Backdoor CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/gate.php"; http_uri; content:"crypt"; http_client_body; depth:5; content:"="; http_client_body; within:3; reference:md5,9d11cfb7799089823483b72daec5fd2b; reference:md5,a01451eae2d47872ce796bb85f116710; classtype:trojan-activity; sid:2018079; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5994 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 26"; flow:to_server,established; dsize:>11; content:"|71 94|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x71\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,b316680fd2578a2781ee9497888bd1e4; classtype:trojan-activity; sid:2018085; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5995 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DirtJumper Activity"; flow:established,to_server; content:"POST"; http_method; content:!"Referer|3a|"; http_header; content:"&req="; http_client_body; pcre:"/^\d+?=\d+?(?:&ver=\d+?)?&req=\d+?(?:&r=)?$/P"; content:"Host|3a|"; http_header; depth:5; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,5474129345d9756649c871f9c8b46287; reference:md5,ff5608e00d5e6e81af9c993461479e43; classtype:trojan-activity; sid:2018094; rev:2; metadata:created_at 2014_02_06, updated_at 2014_02_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5996 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 25"; flow:to_server,established; dsize:>11; content:"|7a 5d|"; offset:8; byte_jump:4,-12,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{10}\x7a\x5d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,794eac549f98320b818037b8074da320; classtype:trojan-activity; sid:2018077; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5997 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"<html><body>hi!<|2F|body><|2F|html>"; within:30; reference:url,research.zscaler.com/2014/02/new-zbot-variant-goes-above-and-beyond.html; reference:url,techhelplist.com/index.php/tech-tutorials/41-misc/465-asprox-botnet-advertising-fraud-general-overview-1; reference:md5,df5ab239bdf09a8716cabbdfa1d6a724; classtype:trojan-activity; sid:2018097; rev:2; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5998 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Rshot.Backdoor File Upload CnC Beacon"; flow:established,to_server; urilen:13; content:"POST"; http_method; content:"/uploadb.php?"; fast_pattern; http_uri; content:"name=|22|archivo|22|"; http_client_body; content:".dmp|22|"; http_client_body; distance:0; reference:md5,08881eb702a1525f7792c3fef19ae9ff; classtype:trojan-activity; sid:2018100; rev:2; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5999 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Woai.Dropper Config Request"; flow:established,to_server; content:"/client/config.ini"; http_uri; content:"|3B 29 0D 0A|"; http_header; pcre:"/User\x2DAgent\x3A\x20[^\r\n]*MSIE[^\r\n]*\x3B\x29\x0D\x0A/H"; reference:md5,0425a66e3b268ef8cbdd481d8e44b227; classtype:trojan-activity; sid:2018102; rev:5; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6000 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Jackpos Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"something"; depth:9; http_user_agent; content:"mac="; fast_pattern; depth:4; http_client_body; content:"&t1="; http_client_body; content:"&t2="; http_client_body; pcre:"/^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=/P"; reference:md5,aa9686c3161242ba61b779aa325e9d24; reference:md5,88e721f62470f8bd267810fbaa29104f; reference:url,intelcrawler.com/about/press10; classtype:trojan-activity; sid:2018108; rev:3; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6002 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS Query for Known Chewbacca CnC Server"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|5ji235jysrvwfgmb|05|onion|00|"; fast_pattern; distance:0; reference:md5,21f8b9d9a6fa3a0cd3a3f0644636bf09; reference:url,usa.visa.com/download/merchants/Alert-ChewbaccaMalware-030614.pdf; reference:url,symantec.com/security_response/earthlink_writeup.jsp?docid=2013-121813-2446-99; classtype:trojan-activity; sid:2018114; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6003 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Almanahe.B Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:1; content:"ClientUpdate"; fast_pattern:only; http_user_agent; content:!"Accept|3a 20|"; content:!"Referer|3a 20|"; reference:url,www.virustotal.com/en/file/f80fc95e44d90a8e02de4fde0ea5e58227cbbde7b6d3848c1f8afbd5ed0affe7/analysis/; reference:md5,1d331ef7d24f6316947e94f737d1f219; classtype:trojan-activity; sid:2018123; rev:3; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6009 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/Win32.FraudPack User-Agent (Downloader MLR 1.0.0)"; flow:to_server,established; content:"Downloader MLR 1.0.0"; http_user_agent; depth:20; reference:md5,c9d54e9086357491bd1fdf8d8d804dce; classtype:trojan-activity; sid:2018112; rev:4; metadata:created_at 2013_11_04, updated_at 2013_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6011 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Jackpos Checkin 2"; flow:to_server,established; content:"/post/echo"; fast_pattern:only; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/^\/post\/echo$/U"; reference:md5,aa9686c3161242ba61b779aa325e9d24; reference:md5,88e721f62470f8bd267810fbaa29104f; reference:url,intelcrawler.com/about/press10; classtype:trojan-activity; sid:2018128; rev:2; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6012 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET TROJAN Win32/Tapazom.A"; flow:established,to_server; content:"GIVEME|7c|"; reference:md5,dc7284b199d212e73c26a21a0913c69d; classtype:trojan-activity; sid:2018133; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6013 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET TROJAN Win32/Tapazom.A 2"; flow:established,to_server; content:"GETSERVER|7c|"; reference:md5,030f3840d2729243280d3cea3d99d8e6; classtype:trojan-activity; sid:2018134; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6014 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN MSIL.Zapchast Checkin"; flow:to_server,established; content:"/files/def"; http_uri; pcre:"/^\/files\/def$/U"; content:"AutoIt"; depth:6; http_user_agent; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:url,www.virustotal.com/en/file/9f41604b71d1c9a4c094d0aa2685ffa49cc0d4ba19b20b7c22467eafb671064c analysis/; reference:md5,63586aef2be494150a492d822147055a; classtype:trojan-activity; sid:2018142; rev:3; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6018 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon"; flow:established,to_server; content:"/dnsmake.txt"; fast_pattern; http_uri; content:"Indy Library"; http_user_agent; reference:md5,dd3e5b41238a73d627c6c48108a15452; classtype:trojan-activity; sid:2018150; rev:3; metadata:created_at 2014_02_17, updated_at 2014_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6019 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Blackbeard Downloader"; flow:established,to_server; content:"/load"; http_uri; content:"p="; http_uri; content:"&t="; http_uri; content:"User-Agent|3a| IE|0d 0a|"; http_header; fast_pattern; pcre:"/[\?&]p=\d&t=\d(&|$)/U"; reference:md5,2f6f13eced7fce495168059530246d77; reference:url,blog.avast.com/2014/01/15/win3264blackbeard-pigeon-stealthiness-techniques-in-64-bit-windows-part-1/; classtype:trojan-activity; sid:2018110; rev:5; metadata:created_at 2014_01_23, updated_at 2014_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6021 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 28"; flow:to_server,established; dsize:>11; content:"|7f 9b|"; offset:8; byte_jump:4,-10,little,relative,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7f\x9b/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,52849773bc0d08eb9dfcb0df2b7caf33; classtype:trojan-activity; sid:2018166; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_21, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6023 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Generic CnC"; flow:established,to_server; content:" Mini BackDoor|00|"; offset:9; depth:20; reference:md5,398b6622a2c86d472a4340d3e79e654b; classtype:trojan-activity; sid:2018167; rev:1; metadata:created_at 2014_02_21, updated_at 2014_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6024 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gh0st Trojan CnC 3"; flow:established,to_server; dsize:14; content:"Gh0st"; depth:5; reference:md5,6a814cacb0c4b464d85ab874f68a5344; classtype:trojan-activity; sid:2018165; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_21, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6025 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 27"; flow:to_server,established; dsize:>11; content:"|7c 9c|"; offset:8; byte_jump:4,-6,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7c\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,29aabeba14f6b5950edcd2a5d99acc94; classtype:trojan-activity; sid:2018153; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_18, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6026 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN W32/FakeFlash.Dropper Initial CnC Beacon"; flow:established,to_server; dsize:8; content:"PutToken"; depth:8; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018185; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6027 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN W32/FakeFlash.Dropper Initial CnC Beacon Acknowledgement"; flow:established,to_client; dsize:12; content:"TokenRecived"; depth:12; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018186; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6028 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN W32/FakeFlash.Dropper PutInformation CnC Beacon"; flow:established,to_server; dsize:18; content:"PutInformation_New"; depth:18; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018187; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6029 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN W32/FakeFlash.Dropper GetInformation CnC Beacon Acknowledgement"; flow:established,to_client; dsize:14; content:"GetInformation"; depth:14; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018188; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6030 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Trojan.Delf-5496 New Infection Report"; flow:established,to_server; dsize:<500; content:"|7c|OnConnect|7c|"; depth:20; pcre:"/^\d+?\x7cOnConnect\x7c/"; reference:url,doc.emergingthreats.net/2008908; reference:md5,3a7f11fbaf815cd2338d633de175e252; classtype:trojan-activity; sid:2008908; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6032 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kryptik.BSYO Checkin 2"; flow:to_server,established; content:"/cmd?version="; fast_pattern:only; http_uri; content:"&aid="; http_uri; content:"&id="; http_uri; content:"&os="; http_uri; pcre:"/&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=/U"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:trojan-activity; sid:2018198; rev:4; metadata:created_at 2014_01_22, updated_at 2014_01_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6034 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Matsnu.L Checkin"; flow:to_server,established; content:"GET"; http_method; content:".php?text="; http_uri; content:"&img_url=http"; distance:0; http_uri; content:"&rpt=simage&pos="; distance:0; http_uri; fast_pattern; content:" Windows NT 5.0"; http_user_agent; nocase; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TROJAN%3AWIN32/MATSNU.L; reference:md5,38b1862a42a6453d8ccdf1c2d2eff018; classtype:trojan-activity; sid:2018200; rev:3; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6035 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Win32.Geral Checkin"; content:".asp?MAC="; nocase; http_uri; fast_pattern:only; content:"&ver="; nocase; http_uri; pcre:"/\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$/Ui"; content:!"Referer|3a|"; http_header; reference:md5,f01260fff3d6fb705fc8afaa3ea54564; classtype:trojan-activity; sid:2018201; rev:2; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6036 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Qakbot.Bot Version 8 CnC Beacon"; flow:established,to_server; urilen:7<>32; content:"POST"; http_method; content:".php"; http_uri; content:!"Referer|3a 20|"; http_header; content:"v="; http_client_body; depth:2; content:"&c="; http_client_body; fast_pattern; pcre:"/^\/[b-u][A-Za-z0-9]{6,25}\.php$/U"; reference:url,www.anubisnetworks.com/the-return-of-qakbot/; reference:md5,e9201c8b126ac40229e9ce3f82f5c608; reference:md5,749a7bf2ad84212bd78e46d240a4f434; classtype:trojan-activity; sid:2018204; rev:3; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6037 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kryptik.BSYO Checkin"; flow:to_server,established; content:"/log?"; http_uri; content:"|7c|aid="; fast_pattern:only; http_uri; content:"|7c|version="; http_uri; content:"|7c|id="; http_uri; content:"|7c|os="; http_uri; pcre:"/\/log\?(start|install)\x7caid=/U"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:trojan-activity; sid:2018205; rev:3; metadata:created_at 2014_03_04, updated_at 2014_03_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6038 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Hack.PcClient.g CnC (OUTBOUND) XOR b5"; flow:to_server,established; content:"|d0 cd d0 db d4 d8 d0|"; content:"|d9 da d2 dc db|"; distance:0; content:"|d1 da d6 d8 d1|"; distance:0; content:"|dd da c6 c1 db d4 d8 d0|"; fast_pattern; distance:0; content:"|c2 dc db d1 da c2 c6|"; distance:0; reference:md5,dfd6b93dac698dccd9ef565a172123f3; classtype:trojan-activity; sid:2018154; rev:3; metadata:created_at 2014_02_18, updated_at 2014_02_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6041 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SMSHoax Riskware checkin"; flow:to_server; content:"POST"; http_method; content:"/api.php"; http_uri; content:"YWx0X2FwaV9iYXNlX3Vy"; depth:20; http_client_body; reference:md5,4b779acb1a0e726cee73fc2ca8a6a0be; classtype:trojan-activity; sid:2018230; rev:2; metadata:created_at 2014_03_06, updated_at 2014_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6042 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Havex RAT CnC Server Response"; flow:established,from_server; file_data; content:"|3c 21 2d 2d|havexhavex|2d 2d 3e|"; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:trojan-activity; sid:2018243; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6044 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Havex RAT CnC Server Response HTML Tag"; flow:established,from_server; file_data; content:"|3c|mega http|2d|equiv|3d|"; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:trojan-activity; sid:2018244; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6045 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Citadel Activity POST"; flow:to_server,established; urilen:15; content:"POST"; http_method; content:"/pk/request.flv"; http_uri; content:!"Content-Type|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,a354873df6dbce59e801380cee39ac17; classtype:trojan-activity; sid:2017582; rev:4; metadata:created_at 2013_10_11, updated_at 2013_10_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6048 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN RDP Brute Force Bot Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/cmd.php"; http_uri; content:"Browser"; depth:7; http_user_agent; content:"name=|22|data|22|"; http_client_body; content:"{ |22|bad|22 20 3a 20|"; http_client_body; content:", |22|bruting|22 20 3a 20|"; fast_pattern:only; http_client_body; content:", |22|checked|22 20 3a 20|"; http_client_body; reference:md5,c0c1f1a69a1b59c6f2dab18135a73919; reference:md5,e310cf7385ae4d15956e461c6d118c91; reference:md5,d316d208a66248c09986896f671f1db1; reference:url,www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop/; classtype:trojan-activity; sid:2018253; rev:6; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6049 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Expiro.CD Check-in"; flow:established,to_server; content:"/gate.php?user="; http_uri; fast_pattern:only; content:"&id="; http_uri; nocase; content:"&type="; http_uri; pcre:"/\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+(?:$|&)/U"; content:!"User-Agent|3a|"; http_header; reference:md5,c6e161a948f4474849d5740b2f27964a; classtype:trojan-activity; sid:2018255; rev:2; metadata:created_at 2014_03_12, updated_at 2014_03_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6050 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Self-Signed Cert Observed in Various Zbot Strains"; flow:established,from_server; content:"|55 04 0a 13 02|XX"; content:"|55 04 0a 13 02|XX"; distance:0; reference:md5,00e7afce84c84cd70fe329d8bb8c0731; classtype:trojan-activity; sid:2018284; rev:2; metadata:created_at 2014_03_17, updated_at 2014_03_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6053 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BKDR_SLOTH.A Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:10; content:"/help.html"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Mozilla/5.0 (compatible|3b| MSIE 7.0|3b| Windows NT 6.0)"; http_user_agent; reference:md5,185e930a19ad1a99c226d59ef563e28c; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/the-siesta-campaign-a-new-targeted-attack-awakens/; reference:url,fireeye.com/blog/technical/targeted-attack/2014/03/a-detailed-examination-of-the-siesta-campaign.html; classtype:trojan-activity; sid:2018285; rev:4; metadata:created_at 2014_03_17, updated_at 2014_03_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6054 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 31"; flow:to_server,established; dsize:>11; content:"|7d 94|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7d\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,ece8808981043f830bacc4133d68e394; classtype:trojan-activity; sid:2018287; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_03_17, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6055 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Bladabindi/njrat CnC Keep-Alive (INBOUND)"; flow:from_server,established; content:"P[endof]"; dsize:8; reference:md5,0ae2261385c482d55519be9b0e4afef3; reference:url,anubis.iseclab.org/?action=result&task_id=1043e1f5f61319b944d51d0d6d7e23f2e; reference:md5,41a0a4c0831dbcbbfd877c7d37b671e0; reference:url,www.fireeye.com/blog/technical/botnet-activities-research/2012/09/the-story-behind-backdoorlv.html; classtype:trojan-activity; sid:2017417; rev:9; metadata:created_at 2012_07_30, updated_at 2012_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6068 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.WinSpy.pob Sending Data over SMTP"; flow:to_server,established; content:"filename="; content:"PC_Active_Time.txt"; within:19; content:"|0d 0a|"; within:3; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018019; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6069 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN MultiThreat/Winspy.RAT Keep-Alive (flowbit set)"; flow:established,to_server; dsize:2; content:"/P"; depth:2; flowbits:set,WinSpy.KeepAlive; flowbits:noalert; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; reference:md5,815576890789003a7575c2948508c6b1; classtype:trojan-activity; sid:2018291; rev:1; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6070 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus GameOver Checkin"; flow:established,to_server; content:"POST"; http_method; content:"Host|3a| default"; http_header; fast_pattern:only; content:"X-ID|3a 20|"; http_header; pcre:"/^Host\x3a\x20default(?:\x3a\d{1,5})?\r?$/Hmi"; reference:md5,bd850c21254c33cd9f6be41aafc6bf46; classtype:trojan-activity; sid:2018296; rev:2; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6074 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Stoberox.B"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"Host|3a|"; http_header; depth:5; content:"Connection|3a 20|Close|0d 0a|"; http_header; content:"Accept-Encoding|3a 20|none|0d 0a|"; http_header; fast_pattern:3,20; content:!"Referer"; http_header; pcre:"/^[a-zA-Z0-9\+\/]+={0,2}$/P"; reference:md5,6ca1690720b3726bc76ef0e7310c9ee7; classtype:trojan-activity; sid:2018300; rev:3; metadata:created_at 2014_03_20, updated_at 2014_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6075 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CSON Checkin - APT1 Related"; flow:to_server,established; content:"/Default.aspx?INDEX="; http_uri; pcre:"/\?ID=[A-Z]{10}$/U"; content:!"User-Agent|3a| Mozilla"; http_header; reference:url,www.threatexpert.com/report.aspx?md5=ba45339da92ca4622b472ac458f4c8f2; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FSmall.XR; reference:url,intelreport.mandiant.com/; reference:md5,8dd6a7fe83bd9682187d956f160ffb47; classtype:trojan-activity; sid:2016460; rev:7; metadata:created_at 2011_10_06, updated_at 2011_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6076 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dorkbot Loader Payload Request"; flow:established,to_server; content:"Mozilla/4.0|0D 0A|Host|3a|"; http_header; content:".exe"; http_uri; fast_pattern; urilen:<11; reference:md5,3452c20fd0df69ccfdea520a6515208a; classtype:trojan-activity; sid:2016578; rev:5; metadata:created_at 2013_03_15, updated_at 2013_03_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6077 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Sisproc"; flow:established,to_server; content:"/page_"; content:"Cookie|3a 20|XX=0|3b 20|BX=0"; reference:url,www.fireeye.com/blog/technical/malware-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html; reference:md5,aaf73666cbd750ed22b80ed836d2b1e4; classtype:trojan-activity; sid:2018320; rev:3; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6079 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Known Sinkhole Response Header"; flow:established,from_server; content:"X-Sinkholed-Domain|3a|"; http_header; reference:md5,723a90462a417337355138cc6aba2290; classtype:trojan-activity; sid:2017662; rev:3; metadata:created_at 2013_11_04, updated_at 2013_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6080 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET TROJAN Bozok.RAT checkin"; flow:to_server; content:"|00 00 00|"; offset:1; depth:4; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:64; content:"|00 7C 00|"; within:12; content:"|00 7C 00|"; within:5; content:"|00 7C 00|0|00 7c 00|2|00|"; within:32; reference:md5,a45d3564d1fa27161b33712f035a5962; reference:url,www.fireeye.com/blog/technical/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html; classtype:trojan-activity; sid:2018325; rev:3; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6081 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit Install CnC Beacon"; flow:established,to_server; urilen:9; content:"POST"; http_method; content:"/install/"; http_uri; content:"q="; http_client_body; depth:2; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018331; rev:2; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6082 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/get/?q="; http_uri; content:"win32"; depth:5; http_user_agent; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018332; rev:3; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6083 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Dorkbot.AR Join IRC channel"; flow:to_server,established; content:"NICK n|7B|"; nocase; pcre:"/^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,7e76c7db8706511fc59508af4aef27fa; classtype:trojan-activity; sid:2016768; rev:4; metadata:created_at 2013_04_17, updated_at 2013_04_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6084 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hangover Campaign Keylogger 2 checkin"; flow:established,to_server; content:"/access.php"; fast_pattern; http_uri; content:"sendfile"; depth:8; nocase; http_user_agent; reference:md5,0b38f87841ed347cc2a5ffa510a1c8f6; reference:url,enterprise.norman.com/resources/files/unveiling_an_indian_cyberattack_infrastructure_appendixes.pdf; classtype:trojan-activity; sid:2016862; rev:4; metadata:created_at 2013_05_20, updated_at 2013_05_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6085 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Mal/Ransom-CE Connectivity Check"; flow:established,to_server; content:"POST"; http_method; content:"/windows"; fast_pattern:only; http_uri; pcre:"/\/windows$/U"; content:"MSIE"; http_user_agent; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; http_header; depth:11; content:"Host|3a 20|www.microsoft.com|0d 0a|"; http_header; reference:md5,6faa7077de347ee0fa8c991934c2c3a5; reference:md5,a1fe3a7ff1ec997411b71212483eea33; reference:md5,97c0000473c5004d2e8c0464e322f429; classtype:trojan-activity; sid:2018295; rev:3; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6086 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/install/?q="; http_uri; content:"win32"; depth:5; http_user_agent; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018345; rev:6; metadata:created_at 2014_04_01, updated_at 2014_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6089 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Trojan-Gypikon Server Check-in Response"; flow:established,from_server; dsize:16; content:"|85 19 00 00 25 04 00 00 00 00|"; content:"|40 00 00 00 00|"; distance:1; within:6; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018130; rev:3; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6101 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Trojan-Gypikon Sending Data"; flow:established,to_server; content:"@"; pcre:"/^(?:x(?:86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/R"; content:" OS|3a 20|Win"; within:8; content:" CPU|3a|"; distance:0; content:"Hz|2c|RAM|3a|"; distance:0; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018129; rev:4; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6102 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12 SET"; flow:to_server,established; dsize:8; content:"|00 00|"; offset:2; depth:2; content:"|00 00|"; distance:2; within:2; flowbits:set,ET.gh0stFmly; flowbits:noalert; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,3b1abb60bafbab204aeddf8acdf58ac9; classtype:trojan-activity; sid:2017935; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6103 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.BAT.Qhost - SET"; flow:established,to_server; content:"GET"; http_method; content:"/stat/tuk/"; http_uri; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014758; rev:5; metadata:created_at 2012_05_16, updated_at 2012_05_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6104 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET 110 (msg:"ET TROJAN Gh0st_Apple Checkin"; flow:to_server,established; content:"GET"; http_method; content:".gif?pid"; fast_pattern; content:"&v="; content:"Mozilla/4.0("; http_user_agent; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; reference:md5,82644661f6639c9fcb021ad197b565f7; classtype:trojan-activity; sid:2017412; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2013_09_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6106 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor Win32/Zegost.Q CnC traffic (OUTBOUND)"; flow:to_server,established; dsize:>11; content:"|55 60 67 6c 69 70 9a|"; offset:8; depth:7; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,4f0d365408b439eb9aaf0b2352abb662; classtype:trojan-activity; sid:2018390; rev:1; metadata:created_at 2014_04_15, updated_at 2014_04_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6107 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PlugX Checkin"; flow:to_server,established; content:"POST"; http_method; pcre:"/^\/[A-F0-9]{24}$/U"; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; depth:13; pcre:"/^[A-Z]{4}/RH"; content:"1|3a 20|0|0d 0a|"; fast_pattern; http_header; within:6; content:!"Referer"; http_header; reference:url,fireeye.com/blog/technical/cyber-exploits/2013/11/exploit-proliferation-additional-threat-groups-acquire-cve-2013-3906.html; reference:md5,17f9f999e1814b99601446f8ce7eb816; classtype:trojan-activity; sid:2017714; rev:6; metadata:created_at 2013_11_13, updated_at 2013_11_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6108 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Fake/Short Google Search Appliance UA Win32/Ranbyus and Others"; flow:established,to_server; content:"User-Agent|3a 20|gsa-crawler|0d 0a|"; nocase; http_header; fast_pattern:5,20; reference:url,developers.google.com/search-appliance/documentation/50/help_mini/crawl_headers; reference:md5,98b58bd8a5138a31105e118e755a3773; reference:md5,c07a6035e9c7fed2467afab1a9dbcf40; classtype:trojan-activity; sid:2017937; rev:3; metadata:created_at 2014_01_07, updated_at 2014_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6111 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Bifrose/Cycbot Checkin 2"; flow:established,to_server; content:"GET "; depth:4; content:"chrome/9.0"; http_user_agent; pcre:"/\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D/U"; reference:md5,8c4f90bb59c05269c6c6990ec434eab6; classtype:trojan-activity; sid:2014163; rev:9; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6112 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN GreenDou Downloader User-Agent (hello crazyk)"; flow:established,to_server; content:"User-Agent|3A 20|hello crazyk"; http_header; reference:md5,67d52ae285ac82f959b3675550de8a2d; reference:md5,e668a501bd107de161378a9fd9c5d1f2; classtype:trojan-activity; sid:2018404; rev:2; metadata:created_at 2014_04_21, updated_at 2014_04_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6115 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN hacker87 checkin"; flow:to_server,established; content:"POST"; http_method; content:"/AppEn.php"; fast_pattern:only; http_uri; content:"parameter="; depth:10; http_client_body; reference:md5,0d7dd2a6c69f2ae7e575ee8640432c4b; classtype:trojan-activity; sid:2018420; rev:2; metadata:created_at 2014_04_24, updated_at 2014_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6120 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Cutwail.BE Checkin 2"; flow:established,from_client; dsize:32; content:"|00 00 00 00 FF FF FF FF 3F 57|"; depth:10; content:"|FE FF FF FF FF FF FF FF FF FF FF|"; distance:3; within:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,c6d256edcc8879717539f348706061f2; reference:md5,8f17e2a9e7c6cbec772ae56dfffb13cb; classtype:trojan-activity; sid:2014272; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6122 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Cutwail.BE Checkin 1"; flow:established,from_client; dsize:234; content:"|16 03 00 00 37 01 00 00 33 03 00|"; depth:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,4352407efc8891215b514a54db5b8a1d; reference:md5,45ab3554f3d60d07fc5228faff7784e1; classtype:trojan-activity; sid:2014271; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6123 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop icmp $HOME_NET any -> any any (msg:"ET TROJAN Backdoor.Win32.RShot Ping Outbound"; icode:0; itype:8; icmp_id:512; dsize:32; content:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; reference:md5,34477e29f7408966d2703f3471741618; reference:md5,adf4c3a16f5f6d4baa634b2c50bf7454; classtype:trojan-activity; sid:2014270; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6124 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan-Spy.Win32.Zbot.qgxi Checkin"; flow:to_server,established; content:".php?bot="; http_uri; fast_pattern:only; content:"bot="; depth:4; http_cookie; reference:md5,0b450a92f29181065bc6601333f01b07; reference:md5,548fbf4dde27e725c0a1544f61362b50; reference:url,arbornetworks.com/asert/2014/04/trojan-eclipse-a-bad-moon-rising; classtype:trojan-activity; sid:2018412; rev:8; metadata:created_at 2013_10_31, updated_at 2013_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6127 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.A.FakeAV Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/404.php?"; nocase; http_uri; content:"type=stats"; nocase; http_uri; content:"affid="; nocase; http_uri; content:"subid="; nocase; http_uri; reference:url,securelist.com/en/descriptions/24405309/Trojan.Win32.FakeAV.dlbc; reference:md5,ac0ba9e186aee9cf9889d71158485715; classtype:trojan-activity; sid:2014083; rev:5; metadata:created_at 2012_01_02, updated_at 2012_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6128 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Zbot.InfoStealer WindowsUpdate Connectivity Check With Opera UA"; flow:established,to_server; content:"GET"; http_method; urilen:1; content:"User-Agent|3A| Opera/9.25 (Windows NT 6.0|3B| U|3B|"; http_header; fast_pattern:12,20; content:"Host|3A| windowsupdate.microsoft.com"; http_header; content:"Connection|3A| Close"; http_header; content:!"Referer|3A|"; http_header; content:!"Accept"; http_header; reference:md5,aa696180cd0369e264ed8e9137a4f254; classtype:trojan-activity; sid:2018419; rev:6; metadata:created_at 2014_04_24, updated_at 2014_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6136 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PandoraRat/Refroso.bsp Activity"; flow:established,to_server; content:"|c3 b8 ba ab a0 bc b0 b1 c1 7c|"; depth:10; content:"|7c|N|7c|"; within:200; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018467; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6138 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PandoraRat/Refroso.bsp Directory Listing Sent To Server"; flow:established,to_server; content:"|7C|DIR#0#bin|7C|DIR#0"; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018468; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6139 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Downloader.Win32.Tesch.A Server CnC Checkin Reply"; flow:established,to_client; content:"|02 00 06|"; depth:3; content:"|01 BB|"; distance:4; within:2; fast_pattern; reference:md5,86b5491831522f3c7bdcdacb17417514; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018477; rev:1; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6142 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Downloader.Win32.Tesch.A Server CnC Sending Executable"; flow:established,to_client; content:"This Program must be"; fast_pattern:only; content:"|0B 00|"; depth:2; content:"|00|MZ"; distance:14; within:3; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,28173e257188ce3b3cc663be661bc2c4; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018479; rev:1; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6143 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Hicrazyk.A Downloader Install CnC Beacon"; flow:established,to_server; content:"/setup/?name="; http_uri; fast_pattern:only; content:"&ini="; http_uri; content:"&v="; http_uri; content:"NSISDL/"; depth:7; http_user_agent; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=TrojanDownloader%3AWin32%2FHicrazyk.A&ThreatID=-2147281007; reference:md5,ddb8110ec415b7b6f43c0ef2b4076d45; classtype:trojan-activity; sid:2018435; rev:7; metadata:created_at 2014_04_29, updated_at 2014_04_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6144 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Urausy.C Checkin 4"; flow:to_server,established; urilen:>80; content:"GET"; http_method; pcre:"/\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$/Ui"; content:"User-Agent|3a| Mozilla/5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| Trident/5.0)|0d 0a|"; fast_pattern:57,20; depth:77; http_header; content:!"Referer|3a| "; http_header; content:!"Accept|3a| "; http_header; reference:md5,0032856449dbef5e63b8ed2f7a61fff9; classtype:trojan-activity; sid:2017903; rev:3; metadata:created_at 2013_12_26, updated_at 2013_12_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6149 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Urausy.C response"; flow:from_server,established; file_data; content:"|0d 0a|<?xml version="; depth:16; content:"<interval>"; distance:0; content:"</interval>"; distance:0; content:"<timeout>"; distance:0; content:"</timeout>"; distance:0; content:"|d1 81 d1 81 d1 8b d0 bb d0 be d0 ba 20|c&c -->"; fast_pattern:only; reference:md5,6213597f40ecb3e7cf2ab3ee5c8b1c70; classtype:trojan-activity; sid:2018499; rev:3; metadata:created_at 2014_05_23, updated_at 2014_05_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6150 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Enosch.A gtalk connectivity check"; flow:to_server; content:"/index.html"; http_uri; content:"User-Agent|3A 20|gtalk|0d 0a|"; depth:19 ; http_header; pcre:"/^User-Agent\x3a\x20gtalk\r\nHost\x3a\x20www\.google\.com\r\n(?:\r\n)?$/H"; reference:md5,b13db8b21289971b3c88866d202fad49; classtype:trojan-activity; sid:2018508; rev:3; metadata:created_at 2014_05_30, updated_at 2014_05_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6154 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan-Dropper.Win32.Agent.ksja"; flow:established,to_server; content:".php?m="; http_uri; fast_pattern:only; content:"User-Agent|3a| Mozilla/4.0 (Compatible|3b| MSIE 6.0|3b 29 0d 0a|Host|3a|"; depth:54; http_header; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php\?m=[A-F0-9]{12}/U"; reference:md5,3b440e052da726942763d11cf9e3f72c; classtype:trojan-activity; sid:2018507; rev:3; metadata:created_at 2014_05_29, updated_at 2014_05_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6155 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN SSL Cert Observed with Unkown Trojan (statswas)"; flow:established,from_server; content:"|0c|statswas.com"; nocase; fast_pattern:only; reference:md5,9c087d528beefd22743666af772465fc; classtype:trojan-activity; sid:2018515; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_06_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6156 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent"; flow:established,to_server; content:"rome0321"; http_user_agent; depth:8; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018519; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6158 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (SBTCM)"; flow:established,to_server; content:"User-Agent|3a 20|SBTCM|0d 0a|"; http_header; fast_pattern:12,7; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018524; rev:2; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6159 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (x09)"; flow:established,to_server; content:"User-Agent|3a 20 09 0d 0a|"; http_header; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018529; rev:2; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6160 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (rhyno321)"; flow:established,to_server; content:"rhyno321"; depth:8; http_user_agent; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018523; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6161 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (slayer)"; flow:established,to_server; content:"slayer"; http_user_agent; depth:6; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018525; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6162 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (Vulture)"; flow:established,to_server; content:"Vulture"; http_user_agent; depth:7; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018526; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6163 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (VHIbot/1.0)"; flow:established,to_server; content:"VHIbot/1.0"; http_user_agent; depth:10; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018527; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6164 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (xehanort321)"; flow:established,to_server; content:"xehanort321"; http_user_agent; depth:11; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018528; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6165 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Trojan.Agent.U3D7V0 Checkin"; flow:established, to_server; content: "GET"; http_method; content:"/getc"; http_uri; content:"/?c="; http_uri; fast_pattern:only; pcre:"/^\/getc(?:loud|onf)\/\?c=/Ui"; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5, 97572a7a0690ba1643525bf6666b74c6; classtype:trojan-activity; sid:2018530; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6166 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Registration Request"; flow:established,to_server; content:"GET"; http_method; content:"/image/"; http_uri; content:".jpg"; http_uri; pcre:"/^\x2fimage\x2f[A-Za-z0-9\+_-]+\x2ejpg$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; fast_pattern:55,20; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018546; rev:6; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6167 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Ping"; flow:established,to_server; content:"GET"; http_method; content:"/history/"; fast_pattern; depth:9; http_uri; content:".asp"; http_uri; pcre:"/^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018547; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6168 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot PUT File Response"; flow:established,to_server; content:"GET"; http_method; content:"/docs/name="; fast_pattern; depth:11; http_uri; pcre:"/^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018549; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6169 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Etumbot.B Requesting RC4 Key"; flow:to_server,established; content:"/home/index.asp?typeid="; nocase; http_uri; fast_pattern:only; content:"Referer|3a| http|3a|//www.google.com/|0d 0a|"; http_header; pcre:"/^\/home\/index\.asp\?typeid=(?:1[13]?|[3579])$/Ui"; reference:md5,82d4850a02375a7447d2d0381b642a72; reference:md5,ff5a7a610746ab5492cc6ab284138852; reference:url,arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf; classtype:trojan-activity; sid:2018552; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6170 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Command Status Message"; flow:established,to_server; content:"GET"; http_method; content:"/tech/s.asp?m="; fast_pattern; depth:14; http_uri; pcre:"/^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018548; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6173 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot GET File Initial Response"; flow:established,to_server; content:"GET"; http_method; content:"/manage/asp/item.asp?id="; fast_pattern; depth:24; http_uri; pcre:"/^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018550; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6174 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot GET File Data Upload"; flow:established,to_server; content:"GET"; http_method; content:"/article/30441/Review.asp?id="; fast_pattern; depth:29; http_uri; pcre:"/^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018551; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6175 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hangover related campaign Checkin"; flow:established,to_server; content:"post.php?filename="; fast_pattern; http_uri; content:"&folder="; http_uri; distance:0; pcre:"/\/\/?$/U"; content:!"Referer|3a|"; http_header; reference:md5,0392fb51816dd9583f9cb206a2cf02d9; reference:url,bluecoat.com/security-blog/2014-06-10/snake-grass-python-based-malware-used-targeted-attacks; classtype:trojan-activity; sid:2018566; rev:2; metadata:created_at 2014_06_16, updated_at 2014_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6177 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Citadel Download From CnC Server /files/ attachment"; flow:established,to_client; flowbits:isset,et.citadel; content:"Content-Disposition|3a| attachment|3b| filename=|22 25 32 65|/files/"; fast_pattern:33,20; http_header; reference:md5,280ffd0653d150906a65cd513fcafc27; reference:md5,f1c8cc93d4e0aabd4713621fe271abc8; reference:url,arbornetworks.com/asert/2014/06/the-citadel-and-gameover-campaigns-of-5cb682c10440b2ebaf9f28c1fe438468/; classtype:trojan-activity; sid:2018599; rev:7; metadata:created_at 2014_06_24, updated_at 2014_06_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6184 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Sharik Checkin"; flow:established,to_server; dsize:10; content:"34feGaeRAd"; fast_pattern:only; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018614; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6187 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Sharik C2 Incoming Traffic"; flow:established,from_server; dsize:18; content:"|0d 00 07 01 00 81 7c e4 04 c0 d4 01 00 19 c0 c2 04 00|"; fast_pattern:only; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018615; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6188 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Sharik C2 Incoming Crafted Request"; flow:established,from_server; content:"|4d 00 02 02 00|"; depth:5; fast_pattern; content:"/"; distance:4; within:5; content:" HTTP/1."; distance:0; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018616; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6189 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Downloader.Win32.Tesch.A Bot Command Checkin 1"; flow:established,to_server; dsize:51; content:"|03 00 30 01 01 00|"; fast_pattern; depth:6; flowbits:set,ET.Tesch; reference:md5,86b5491831522f3c7bdcdacb17417514; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018478; rev:2; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6192 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Antifulai.APT CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:".php?secue="; http_uri; fast_pattern:only; content:"&pro="; http_uri; content:"|2c|"; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:url,secureworks.com/resources/blog/research/apt-campaign-leverages-the-cueisfry-trojan-and-microsoft-word-vulnerability-cve-2014-1761/; reference:md5,1c29b24d4d4ef7568f519c470b51bbed; classtype:trojan-activity; sid:2018631; rev:4; metadata:created_at 2014_05_19, updated_at 2014_05_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6198 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 36"; flow:to_server,established; dsize:>11; content:"|79 da|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\xda/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5b50cc5215694841b9faea0fde472648; classtype:trojan-activity; sid:2018636; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6202 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 37"; flow:to_server,established; dsize:>11; content:"|79 9d|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x9d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,f80fc82b5ff8f65f02ba7af363f84264; classtype:trojan-activity; sid:2018637; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6203 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 38"; flow:to_server,established; dsize:>11; content:"|49 a5|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x49\xa5/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,c8564898ab2598a075cbb478d104e750; classtype:trojan-activity; sid:2018638; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6204 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 39"; flow:to_server,established; dsize:>11; content:"|7b 9e|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,3134e62b117f9994e173c262b1bcbca5; classtype:trojan-activity; sid:2018639; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6205 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BANKER.WIN32.BANBRA.BEEC Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/black/?"; fast_pattern:only; http_uri; content:"tipo="; depth:5; http_client_body; content:"&cliente="; http_client_body; reference:md5,ceb6684ffce35dcbfae4afde3b6fd4bd; classtype:trojan-activity; sid:2018641; rev:3; metadata:created_at 2014_07_03, updated_at 2014_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6206 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET TROJAN TrojanSpy.Win32/Banker.AMB SQL Checkin"; flow:established,to_server; content:"I|00|N|00|S|00|E|00|R|00|T"; content:"I|00|N|00|T|00|O"; distance:0; content:"B|00|R|00|O|00|W|00|S|00|E|00|R|00|L|00|O|00|G|00|U|00|S|00|B|00|"; reference:md5,dd141287cb45a2067592eeb9d3aa7162; classtype:trojan-activity; sid:2018645; rev:2; metadata:created_at 2014_07_07, updated_at 2014_07_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6208 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.Bancos Checkin via SMTP"; flow:to_server,established; content:"Subject|3a| "; content:"Foi Instalado"; nocase; fast_pattern:only; pcre:"/^Subject\x3a [^\r\n]+?Foi Instalado/mi"; metadata: former_category TROJAN; reference:md5,7f5709c924bb1417a180a4fa8311a2e9; classtype:trojan-activity; sid:2018646; rev:1; metadata:tag Banking_Trojan, created_at 2014_07_07, malware_family Bancos, updated_at 2018_04_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6209 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Banload.BTQP Checkin 1"; flow:established,to_server; content:"GET"; http_method; content:".asp?IDPC="; fast_pattern:only; http_uri; pcre:"/\.asp\?IDPC=[^\x26]*?\x26(?:Status=|Msg=)[^\x26]*?$/Ui"; content:"Mozilla/3.0 (compatible|3b| Indy Library)"; http_user_agent; content:!"Referer"; http_header; reference:md5,03092adccde639ba26ef2e192c49f62d; classtype:trojan-activity; sid:2018649; rev:4; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6210 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Banload2.KZU Checkin 1"; flow:established,to_server; content:"POST"; http_method; content:"OPC="; nocase; fast_pattern:only; http_client_body; pcre:"/^OPC=\d/Pi"; content:"Accept-Encoding|3a| identity|0d 0a|User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:!"Referer"; http_header; reference:md5,b67e23e4a0248c71b71e73e37d52c906; classtype:trojan-activity; sid:2018653; rev:2; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6211 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Banload2.KZU Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:".hlp"; nocase; fast_pattern:only; http_uri; content:"Accept-Encoding|3a| identity|0d 0a|User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:!"Referer"; http_header; pcre:"/^\/[^\x2f]+?\.hlp$/Ui"; reference:md5,b67e23e4a0248c71b71e73e37d52c906; classtype:trojan-activity; sid:2018654; rev:3; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6212 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Banload.BTQP Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:".asp?IDPC="; fast_pattern:only; http_uri; content:"&so="; nocase; http_uri; content:"&user"; http_uri; nocase; content:"&versao"; http_uri; nocase; content:"&pcname="; http_uri; nocase; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; content:!"Referer"; http_header; reference:md5,03092adccde639ba26ef2e192c49f62d; classtype:trojan-activity; sid:2018650; rev:3; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6213 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CyberGate RAT Checkin"; flow:to_server,established; content:".php?"; http_uri; content:"email="; http_uri; content:"&serverid="; http_uri; content:"User|3a|"; http_uri; content:"PC|3a|"; http_uri; content:!"Referer"; http_header; reference:md5,24d9f082b849b4c698e6b012500d441a; classtype:trojan-activity; sid:2018659; rev:2; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6214 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CyberGate RAT User-Agent (USER_CHECK)"; flow:to_server,established; content:"USER_CHECK"; depth:10; http_user_agent; reference:md5,24d9f082b849b4c698e6b012500d441a; classtype:trojan-activity; sid:2018660; rev:3; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6215 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FakeAV.dfze/FakeAV!IK Checkin"; flow:established,to_server; urilen:>150; content:"GET"; http_method; content:"= HTTP/1.1|0D 0A|Host|3a| "; fast_pattern:only; content:!"User-Agent|3a| "; http_header; content:"|0D 0A|Cache-Control|3a| no-cache|0D 0A 0D 0A|"; pcre:"/^\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/U"; content:!"pandora.com"; http_header; content:!"wordpress.com"; http_header; reference:md5,fe1e735ec10fb8836691fe2f2ac7ea44; classtype:trojan-activity; sid:2014409; rev:5; metadata:created_at 2012_03_21, updated_at 2012_03_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6216 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Minirem"; flow: established,to_server; urilen:>18; content:"GET"; http_method; content:"/FC001/"; fast_pattern; depth:7; http_uri; content:"Microsoft Internet Explorer"; http_user_agent; reference:md5,d92075280872b9fe4f541f090bf0076c; classtype:trojan-activity; sid:2018664; rev:6; metadata:created_at 2014_01_22, updated_at 2014_01_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6217 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; pcre:"/^..[\x0d-\x20](?=\d{0,27}[a-z])(?=[a-z]{0,27}\d)[a-z0-9]{21,28}(?:\x03(?:biz|com|net|org))\x00\x00\x01\x00\x01/Rs"; threshold: type both, track by_dst, count 12, seconds 120; reference:url, blog.malcovery.com/blog/breaking-gameover-zeus-returns; reference:md5,5e5e46145409fb4a5c8a004217eef836; classtype:trojan-activity; sid:2018666; rev:4; metadata:created_at 2014_07_11, updated_at 2014_07_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6218 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Upatre Common URI Struct July 15 2014"; flow:established,to_server; content:"/0/"; http_uri; content:"Service Pack "; http_uri; distance:2; within:13; pcre:"/\/0\/$/U"; content:!"Referer|3a|"; http_header; reference:md5,79772d72082a082a0048569ba2dfe5a3; classtype:trojan-activity; sid:2018678; rev:3; metadata:created_at 2014_07_15, updated_at 2014_07_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6222 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any any -> any 53 (msg:"ET TROJAN DNS Possible User trying to visit POSHCODER.A .onion link outside of torbrowser"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|zpwibfsmoowehdsm|05|onion|00|"; nocase; distance:0; reference:md5,01f4b1d9b2aafb86d5ccfa00e277fb9d; classtype:trojan-activity; sid:2018679; rev:1; metadata:created_at 2014_07_15, updated_at 2014_07_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6223 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Aibatook checkin 2"; flow:established,to_server; content:"GET"; http_method; urilen:7; content:"/u.html"; http_uri; fast_pattern:only; content:"User-Agent|3A| Mozilla/5.0 (compatible|3B| MSIE 10.0|3B| Windows NT 6.1|3B| Trident/6.0)"; http_header; content:!"Accept"; http_header; content:!"Referer|3A|"; http_header; reference:url,welivesecurity.com/2014/07/16/win32aibatook/; reference:md5,d5e8adfefbcc3667734b8df4ae066be6; classtype:trojan-activity; sid:2018687; rev:2; metadata:created_at 2014_07_17, updated_at 2014_07_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6225 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,26,587,2525] (msg:"ET TROJAN Predator Pain Sending Data over SMTP"; flow:established,to_server; content:"Subject|3a 20|Predator Pain v"; fast_pattern:4,20; reference:md5,e774a7e6ca28487db649458f48230199; reference:url,stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html; classtype:trojan-activity; sid:2018688; rev:3; metadata:created_at 2014_07_17, updated_at 2014_07_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6227 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587,2525] (msg:"ET TROJAN Predator Logger Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|Predator Logger|20|"; fast_pattern:5,20; reference:md5,91f885e08d627097fb1116a3d4634b82; reference:url,stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html; classtype:trojan-activity; sid:2018017; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6228 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|11|bloggershop.co.vu"; distance:1; within:19; nocase; reference:md5,fe56b5a28eac390aa8cfb1402360958b; reference:url,sslbl.abuse.ch; classtype:trojan-activity; sid:2018494; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_05_21, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6231 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Asterope Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?ver="; http_uri; content:"&id="; distance:0; http_uri; content:"&os="; distance:0; http_uri; content:"&res="; distance:0; http_uri; content:"Accept-Asterope|3a|"; http_header; fast_pattern:only; reference:md5,19190ef53877979191f6889c6a795f31; classtype:trojan-activity; sid:2018750; rev:3; metadata:created_at 2014_06_23, updated_at 2014_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6234 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN XPSecurityCenter FakeAV Checkin"; flow:to_server,established; content:"/XPSecurityCenter/"; http_uri; content:"User-Agent|3a| Internet Explorer 6.0|0d 0a|"; http_header; reference:md5,1c5eb2ea27210cf19c6ab24b7cc104b9; classtype:trojan-activity; sid:2018761; rev:3; metadata:created_at 2012_07_13, updated_at 2012_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6235 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hupigon.DF Checkin"; flow:to_server,established; content:"/ip.txt"; http_uri; urilen:7; content:"User-Agent|3a| Huai_Huai|0d 0a|"; http_header; reference:md5,ee600bdcc45989750dee846b5049f935; reference:md5,1051f7176fe0a50414649d369e752e98; classtype:trojan-activity; sid:2018762; rev:3; metadata:created_at 2012_07_13, updated_at 2012_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6236 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Zbot.Variant CnC Response"; flow:established,from_server; flowbits:isset,ET.zbot.ua.2106509; content:"200"; http_stat_code; content:"Content-Length|3a| 0|0d 0a|Content-Type|3a| text/html|0d 0a|"; http_header; fast_pattern:11,20; pcre:"/^(\r\n)?$/HR"; reference:md5,0c4d7d9138de7d7919e3b3c33ac2f851; classtype:trojan-activity; sid:2018764; rev:4; metadata:created_at 2013_04_26, updated_at 2013_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6238 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Swizzor User-Agent (Swizz03r)"; flow:established,to_server; content:"GET"; http_method; content:"Swizz03r Download Agent"; nocase; depth:23; http_user_agent; reference:md5,5d232faca6d2b082b450b8ee4e238483; classtype:trojan-activity; sid:2018765; rev:4; metadata:created_at 2013_06_03, updated_at 2013_06_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6239 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|sslbl.abuse.ch"; distance:1; within:15; content:"|1b|we_love_selfsigned@abuse.ch"; distance:0; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:trojan-activity; sid:2018767; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Likely Malicious SSL Cert With Script Tags"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"<script>"; content:"</script>"; distance:0; content:"|55 04 03|"; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:trojan-activity; sid:2018768; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6241 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (default)"; flow:established,to_server; content:".php"; http_uri; content:"default"; depth:7; http_user_agent; content:"mode="; depth:5; http_client_body; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018522; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6242 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Kbot.Backdoor Variant CnC Beacon"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/stat.php"; nocase; http_uri; content:"id="; depth:3; http_client_body; content:"&build_id="; fast_pattern:only; http_client_body; pcre:"/&build_id=[A-F0-9]+$/Pi"; reference:md5,1df0ceab582ae94c83d7d2c79389e178; classtype:trojan-activity; sid:2018078; rev:3; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Locker DL URI Struct Jul 25 2014"; flow:to_server,established; content:"/wp-content/themes/"; http_uri; depth:19; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/wp-content\/themes\/[^\x2f]+\/[a-z0-9]+$/U"; pcre:"/^User-Agent\x3a[^\r\n]+(?:MSIE|rv\x3a11\.0)[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(?:\r\n)?$/H"; reference:md5,dc4d0bd7fb9e647501c3b0d75aa2be65; classtype:trojan-activity; sid:2018787; rev:2; metadata:created_at 2014_07_25, updated_at 2014_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6244 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.KLPROXY Checkin via SMTP"; flow:to_server,established; content:"Subject|3a|"; content:"C-H-E-G-O A-V-I-S-O! |2e 3a 3a|Infect|3a 3a 2e|"; distance:5; within:33; reference:md5,422ce789b284eb5aa32124a6bbe86000; classtype:trojan-activity; sid:2018798; rev:2; metadata:created_at 2014_07_28, updated_at 2014_07_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6246 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DoS.Linux/Elknot.G Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|Linux|20|"; offset:2; depth:21; fast_pattern:1,20; pcre:"/^\d/R"; reference:md5,917a2a3d8c30282acbe7b1ff121a4336; classtype:trojan-activity; sid:2018808; rev:1; metadata:created_at 2014_07_30, updated_at 2014_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6248 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|badsokspad.in"; distance:1; within:14; reference:md5,c4fe829fc49bb9efec92fe4a8a5d29fc; classtype:trojan-activity; sid:2018852; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6249 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backoff POS Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php"; http_uri; content:"&op="; depth:4; http_client_body; content:"&id="; http_client_body; content:"&ui="; http_client_body; content:"&wv="; http_client_body; fast_pattern:only; content:"&bv="; http_client_body; pcre:"/^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)/P"; reference:md5,d0c74483f20c608a0a89c5ba05c2197f; classtype:trojan-activity; sid:2018857; rev:6; metadata:created_at 2014_03_05, updated_at 2014_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6250 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 40"; flow:to_server,established; dsize:>11; content:"|7c 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7c\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,984ec607cbaefdd2ce977c9a07a3e175; classtype:trojan-activity; sid:2018880; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_08_01, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6251 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Troj/ReRol.A Checkin 1"; flow:established,to_server; urilen:18; content:"POST"; http_method; content:"/project/check.asp"; http_uri; fast_pattern:only; content:"Content-Length|3a 20|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|20 28|compatible|3b 29 0d 0a|"; distance:0; http_header; content:!"Referer|3a 20|"; http_header; reference:url,blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2; reference:md5,12854bb8d1e6a590e1bd578267e4f8c9; classtype:trojan-activity; sid:2018882; rev:4; metadata:created_at 2014_07_14, updated_at 2014_07_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6252 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Troj/ReRol.A Checkin 2"; flow:established,to_server; urilen:7; content:"POST"; http_method; content:"/dr.asp"; http_uri; fast_pattern:only; content:"Content-Length|3a 20|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|20 28|compatible|3b 29 0d 0a|"; distance:0; http_header; content:!"Referer|3a 20|"; http_header; reference:url,blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2; reference:md5,c0656b66b9f4180e59e1fd2f9f1a85f2; classtype:trojan-activity; sid:2018883; rev:3; metadata:created_at 2014_07_14, updated_at 2014_07_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6253 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Mysayad Checkin 1"; flow:established,to_server; content:"HEAD"; http_method; urilen:17; content:"/GlobalUpdate.upt"; fast_pattern:only; http_uri; content:!"Referer"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,799600122930bbc64b7dac987ea8bb39; reference:url,vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/; classtype:trojan-activity; sid:2018889; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6258 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Mysayad Checkin 2"; flow:established,to_server; content:"HEAD"; http_method; urilen:9; content:"/all.wipe"; fast_pattern:only; http_uri; content:!"Referer"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,799600122930bbc64b7dac987ea8bb39; reference:url,vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/; classtype:trojan-activity; sid:2018890; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6259 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kronos Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"Referer|3a|"; http_header; content:"/upfornow/connect.php"; http_uri; fast_pattern:only; content:"Content-Length|3a| "; http_header; reference:md5,f085395253a40ce8ca077228c2322010; reference:url,securityblog.s21sec.com/2014/08/kronos-is-here.html; classtype:trojan-activity; sid:2018891; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6260 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Pushdo.S CnC response"; flow:established,from_server; flowbits:isset,ET.Pushdo.S; content:"X-GeoIP-Country-Code|3a| "; http_header; content:"X-Real-IP|3a| "; http_header; reference:md5,27aef1d328da442d3bd02c50c1a6b651; classtype:trojan-activity; sid:2018897; rev:2; metadata:created_at 2014_08_05, updated_at 2014_08_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6264 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BITTERBUG Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php?compname="; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/\.php\?compname=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\x20_{}\.~]{1,14}_/U"; reference:md5,34c7f12b4e8f2b81143453af12442ee0; reference:md5,48bbae6ee277b5693b40ecf51919d3a6; classtype:trojan-activity; sid:2018900; rev:2; metadata:created_at 2014_08_06, updated_at 2014_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6265 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BITTERBUG Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/vtris"; fast_pattern:only; http_uri; content:".php?srs="; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/\/vtris\d?\.php\?srs=\d{1,10}$/U"; reference:md5,34c7f12b4e8f2b81143453af12442ee0; reference:md5,48bbae6ee277b5693b40ecf51919d3a6; classtype:trojan-activity; sid:2018901; rev:2; metadata:created_at 2014_08_06, updated_at 2014_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6266 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Zemot Config Download"; flow:established,to_server; content:"GET"; http_method; content:"/soft"; http_uri; content:".dll"; http_uri; fast_pattern:only; pcre:"/\/soft(?:32|64)\.dll$/Ui"; content:"Accept|3a 20|*/*|0d 0a|Connection|3a 20|Close|0d 0a|"; depth:32; http_header; content:"User-Agent|3a|"; http_header; content:!"Referer"; http_header; reference:md5,5a99a6a6cd8600ea88a8fcc1409b82f4; classtype:trojan-activity; sid:2018661; rev:3; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6268 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Trojan Dropped By Archie.EK"; flow:established,to_server; content:".exe"; http_uri; fast_pattern:only; pcre:"/^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe/Ui"; content:!"Referer|3a|"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,e6c91ab176887e5c79bb59277c651dfd; classtype:trojan-activity; sid:2018928; rev:3; metadata:created_at 2014_08_13, updated_at 2014_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6273 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|12|alohafriends12.com"; distance:1; within:19; reference:md5,9c98ef776a651cc4269acde3755d3a5a; classtype:trojan-activity; sid:2018935; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_08_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6274 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Suspicious X-mailer Synapse"; flow:established,to_server; content:"produced by Synapse"; fast_pattern:only; content:"X|2d|mailer|3a 20|Synapse|20 2d 20|Pascal TCP|2f|IP library by Lukas Gebauer"; reference:md5,954acc71ffaa7010c603d74e76dfc70b; reference:url,www.joewein.net/spam/spam-joejob.htm; classtype:trojan-activity; sid:2018936; rev:2; metadata:created_at 2014_08_14, updated_at 2014_08_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6275 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/PSW.Steam.NBP Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/data2.php?file="; fast_pattern:only; http_uri; content:"Mozilla/4.0 (compatible|3b| Synapse)"; depth:33; http_user_agent; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,17d2b62f2fa20f407485437de17787fb; reference:md5,bec091077138a1cac49db00495d456e7; classtype:trojan-activity; sid:2018949; rev:3; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6282 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ShellBot.C retrieval"; flow:from_server,established; file_data; content:"my $processo"; content:"my @adms="; distance:0; content:"my @canais="; distance:0; content:"|23|gh|30|sts"; distance:0; within:10; reference:md5,3e44252394078c8fd792da1583525d0c; reference:url,pastebin.com/0dAciksC; reference:url,pastebin.com/C0arvGxU; classtype:trojan-activity; sid:2018953; rev:2; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6283 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Python.Ragua Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/WebCam/Cam.txt"; nocase; http_uri; fast_pattern:only; content:"Python-urllib/"; depth:14; http_user_agent; nocase; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:url,securelist.com/blog/research/66108/el-machete/; reference:md5,a8602b4c35f426107c9667d804470745; classtype:trojan-activity; sid:2018968; rev:3; metadata:created_at 2014_08_20, updated_at 2014_08_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6287 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Suspicious User-Agent (Asteria md5)"; flow:to_server,established; content:"d9d385b3522b242398af91fd425b386d"; depth:32; http_user_agent; reference:md5,56c16ad7da8cecb429dccb168aef46b7; classtype:trojan-activity; sid:2018985; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2014_08_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6296 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PlugX variant"; flow:to_server,established; content:"GET"; http_method; content:"/p/"; depth:3; http_uri; pcre:"/^\/p\/(?:p(?:hphphphphphphp|thon)|(?:dropytho|admmmom)n|u(?:pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)/U"; content:"code.google.com"; fast_pattern:only; http_header; content:!"Referer|3a 20|"; http_header; content:!"User-Agent|3a 20|"; http_header; content:!"Connection|3a 20|"; http_header; threshold: type both, count 1, seconds 30, track by_src; reference:md5,f92e9e3e86856b5c0ee465f77a440abb; reference:url,researchcenter.paloaltonetworks.com/2014/08/attacks-east-asia-using-google-code-command-control/; reference:url,www.fireeye.com/blog/technical/targeted-attack/2014/08/operation-poisoned-hurricane.html; classtype:trojan-activity; sid:2018984; rev:7; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6297 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Xema dropping file"; flow:to_server,established; content:"/pruebas.doc"; http_uri; fast_pattern:only; content:!"Referer"; http_header; reference:md5,f5fbdb120594f4da7f638122d6635933; classtype:trojan-activity; sid:2018994; rev:2; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6298 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows net start Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"These Windows services are started|3a 0d|"; fast_pattern:8,16; content:"The command completed successfully|2e|"; distance:0; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019001; rev:1; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6300 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows ipconfig Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Windows IP Configuration|0d|"; fast_pattern:8,16; content:"Ethernet adapter Local Area Connection|3a|"; distance:0; content:"Physical Address"; content:"IP Address"; content:"Subnet Mask"; content:"Default Gateway"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019000; rev:3; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6301 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows systeminfo Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Host Name|3a|"; content:"OS Name|3a|"; content:"OS Version|3a|"; content:"OS Manufacturer|3a|"; content:"Microsoft Corporation"; distance:0; content:"OS Configuration|3a|"; content:"OS Build Type|3a|"; content:"Registered Owner|3a|"; content:"Registered Organization|3a|"; content:"Product ID|3a|"; content:"Original Install Date|3a|"; content:"System Up Time|3a|"; content:"System Manufacturer|3a|"; content:"System Model|3a|"; content:"System type|3a|"; content:"Processor|28|s|29 3a|"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019002; rev:1; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6302 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dirt Jumper/Russkill3 Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0"; content:"k="; fast_pattern; depth:2; http_client_body; pcre:"/k=\d{15}/P"; reference:md5,10e7af7057833a19097cb22ba0bd1b99; reference:url,asert.arbornetworks.com/2011/08/dirt-jumper-caught/; reference:url,www.deependresearch.org/2011/10/dirt-jumper-ddos-bot-new-versions-new.html; classtype:trojan-activity; sid:2013439; rev:10; metadata:created_at 2011_08_03, updated_at 2011_08_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6304 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/publickey/"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,b61145a54698753cecf8748359c9d81e; classtype:trojan-activity; sid:2018579; rev:7; metadata:created_at 2014_06_12, updated_at 2014_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6307 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN Dyreza RAT Checkin Response"; flow:established,to_client; content:"|a5 46 da 53 0a 00 68 00 65 00 6c 00 6c 00 6f|"; offset:4; depth:15; reference:md5,b61145a54698753cecf8748359c9d81e; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018596; rev:3; metadata:created_at 2014_06_12, updated_at 2014_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6308 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyreza RAT Fake Server Header"; flow:established,to_client; content:"HTTP/1."; depth:7; content:"Server|3A| Stalin"; http_header; fast_pattern:only; reference:md5,7e3e28320d209a586917668e3b8eac40; classtype:trojan-activity; sid:2018775; rev:3; metadata:created_at 2014_07_25, updated_at 2014_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6309 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin 3"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/replace/"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,4d1d43789e038c6a03c07083ca0b0809; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018749; rev:6; metadata:created_at 2014_07_21, updated_at 2014_07_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6310 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/NAT/"; distance:0; http_uri; fast_pattern; content:"|20|NAT/"; distance:0; http_uri; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,2a835747b7442b1d58ab30abc90d3b0f; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018683; rev:6; metadata:created_at 2014_07_16, updated_at 2014_07_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6311 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo POST Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Content-Length|3a 20|59|0d 0a|Host|3a 20|"; depth:26; http_header; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\n(?:\r\n)?$/RH"; pcre:"/^\/[\/a-z0-9]+$/Ui"; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018771; rev:5; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6312 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo Cookie"; flow:established,to_client; content:"tfardci_session="; depth:16; http_cookie; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018770; rev:4; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6313 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows arp -a Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Interface|3a|"; content:"--- 0x"; distance:0; content:"Internet Address"; content:"Physical Address"; fast_pattern; distance:0; content:"Type"; content:"dynamic"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019080; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6317 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows set Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"ALLUSERSPROFILE="; fast_pattern; content:"APPDATA="; distance:0; content:"CLIENTNAME="; content:"CommonProgramFiles="; distance:0; content:"COMPUTERNAME="; content:"ComSpec="; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019081; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6318 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 41"; flow:to_server,established; dsize:>11; content:"|c3 70|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\xc3\x70/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,23bb9c2ed95e942f886d544fefd20d70; classtype:trojan-activity; sid:2019083; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_08_28, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6320 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Syrian Malware Checkin"; flow:established,to_server; content:"|2f|j|7c|n|5c|"; offset:2; depth:5; content:"[endof]"; fast_pattern; distance:0; reference:url,fireeye.com/blog/technical/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html; reference:md5,a8cf815c3800202d448d035300985dc7; classtype:trojan-activity; sid:2019084; rev:1; metadata:created_at 2014_08_29, updated_at 2014_08_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6321 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12"; flow:to_server,established; flowbits:isset,ET.gh0stFmly; content:"|78 9c 0b cf cc|"; depth:5; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,3b1abb60bafbab204aeddf8acdf58ac9; classtype:trojan-activity; sid:2017936; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6323 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Popwin Checkin"; flow:to_server,established; content:"/soft/xiaomi"; fast_pattern:only; http_uri; content:".asp"; content:"API-Guide test program"; depth:22; http_user_agent; content:!"Referer|3a|"; content:!"Accept|3a 20|"; reference:url,www.virustotal.com/en/file/79dfb0ea0d788dd388a1d1856402f04ddcdc42b7134ffc80747b339937216cbb analysis/; reference:md5,dd762c69049fbd00c22f70f109baa26e; classtype:trojan-activity; sid:2018143; rev:5; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6324 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HighTide trojan Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/?"; http_uri; depth:2; content:"Trident/5.0|29 0d 0a|"; fast_pattern; http_header; content:"Referer|3A| http|3A|//www.google.com/|0D 0A|"; http_header; pcre:"/^\/\?\d(?:[A-Za-z0-9~_]{4})*(?:[A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$/U"; reference:md5,6e59861931fa2796ee107dc27bfdd480; reference:url,fireeye.com/blog/technical/botnet-activities-research/2014/09/darwins-favorite-apt-group-2.html; classtype:trojan-activity; sid:2019113; rev:2; metadata:created_at 2014_09_04, updated_at 2014_09_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6329 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Bapy.Downloader PE Download Request"; flow:established,to_server; content:"GET"; http_method; urilen:9; content:"/tmps."; http_uri; fast_pattern:only; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; pcre:"/[a-z]\d{2}$/U"; reference:md5,e256976cedda8c9d07a21ca0e5c2f86c; classtype:trojan-activity; sid:2019127; rev:2; metadata:created_at 2014_09_05, updated_at 2014_09_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6333 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Bravix.Dropper CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/get.php?file=cmds/main"; http_uri; content:!"Referer|3A|"; http_header; reference:md5,19484a240a16c7faea84dcac0c38d118; classtype:trojan-activity; sid:2019128; rev:2; metadata:created_at 2014_09_05, updated_at 2014_09_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6334 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Dervec.gen Connectivity Check to Google"; flow:established,to_server; content:"HOST|3a|"; depth:5; http_header; content:"www.google.com|0d 0a|"; within:17; http_header; content:"|00 00 00 00 00 00 00 00 00 00|"; offset:35; depth:10; reference:md5,5eaae2d6a4b5d338b83ea5d97af93672; classtype:trojan-activity; sid:2019129; rev:10; metadata:created_at 2012_06_12, updated_at 2012_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6335 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Frosparf.B Downloading Hosts File"; flow:established,from_server; file_data; content:"9.9.9.9 "; within:8; pcre:"/^(?:[a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?(?:[a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]/R"; reference:md5,4ad55877464aa92e49231d913d00eb69; classtype:trojan-activity; sid:2019142; rev:2; metadata:created_at 2014_09_09, updated_at 2014_09_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6339 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Possible Zeus GameOver Connectivity Check 2"; flow:established,to_server; urilen:1; content:"Connection|3a 20|Close"; http_header; fast_pattern:only; content:"Host|3a 20|windowsupdate.microsoft.com|0d 0a|"; http_header; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:md5,236bde81355e075e7ed6bcdc60daefcb; classtype:trojan-activity; sid:2019155; rev:2; metadata:created_at 2014_09_10, updated_at 2014_09_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6348 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TSPY_POCARDL.U Possible FTP Login"; flow:established,to_server; content:"USER user drupalzf"; reference:md5,ceb5b99c13b107cf07331bcbddb43b1f; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019159; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6349 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DecebalPOS Checkin"; flow:established,to_server; content:"GET"; http_method; content:".php?&co="; http_uri; fast_pattern:only; content:"&us="; http_uri; content:"&av="; http_uri; content:"&os="; http_uri; content:"&tr2="; http_uri; reference:md5,87cfa0addda5c0e0fc34f3847408e557; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019160; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6350 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DecebalPOS User-Agent"; flow:established,to_server; content:"Decebalv"; depth:8; http_user_agent; reference:md5,87cfa0addda5c0e0fc34f3847408e557; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019161; rev:3; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6351 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win.Trojan.Chewbacca connectivity check"; flow:established,to_server; content:"GET"; http_method; content:"/ip/"; http_uri; content:"User-Agent|3A| Mozilla/4.0 (compatible|3b| Synapse|29 0d 0a|"; http_header; fast_pattern:36,11; content:!"Accept"; http_header; content:!"Referer"; http_header; reference:md5,21f8b9d9a6fa3a0cd3a3f0644636bf09; reference:url,www.symantec.com/security_response/earthlink_writeup.jsp?docid=2013-121813-2446-99; classtype:trojan-activity; sid:2019162; rev:4; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6352 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN JackPOS XOR Encoded HTTP Client Body (key AA)"; flow:established,to_server; content:"|AB AB|"; depth:2; http_client_body; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; http_client_body; fast_pattern:only; reference:md5,3959fb5b5909d9c6fb9c9a408d35f67a; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019164; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6354 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Stobox Connectivity Check"; flow:established,to_server; content:"/windowsupdate/v6/thanks.aspx?ln=en&&thankspage="; http_uri; fast_pattern:28,20; content:"Host|3a 20|update.microsoft.com|0d 0a|"; http_header; depth:28; content:!"Accept-Language|3a|"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; content:"|0d 0a 0d 0a|"; threshold: type both, count 5, seconds 300, track by_src; reference:md5,aba20c8289b37b10d42979730674a2ca; classtype:trojan-activity; sid:2019166; rev:4; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6356 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Tinba Server Response"; flow:established,to_client; flowbits:isset,ET.Tinba.Checkin; file_data; content:"|64 b4 dc a4|"; within:4; reference:md5,1e644fe146f62bd2fc585b8df6712ff6; classtype:trojan-activity; sid:2019169; rev:4; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6362 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DoS.Linux/Elknot.E Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|10 27 60 ea|Linux|20|"; offset:4; depth:64; reference:md5,9a2a00f4bba2f3e0b1211a1f0cb48896; classtype:trojan-activity; sid:2019171; rev:2; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6369 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Query to Known CnC Domain msnsolution.nicaze.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"nicaze|03|net"; fast_pattern; distance:0; reference:md5,89332c92d0360095e2dda8385d400258; classtype:trojan-activity; sid:2014139; rev:4; metadata:created_at 2012_01_21, updated_at 2012_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6391 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN MSIL/Spy.RapidStealer.B Checkin"; flow:established,to_server; urilen:14; content:"POST"; http_method; content:"/key/index.php"; http_uri; fast_pattern:only; content:"dir="; depth:4; http_client_body; content:"&data="; distance:0; http_client_body; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,c14690b90459744a300a02f45b32168a; reference:url,quequero.org/2014/09/win32-blackberrybbc-malware-analysis/; classtype:trojan-activity; sid:2019179; rev:2; metadata:created_at 2014_09_16, updated_at 2014_09_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6402 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miras C2 Activity"; flow:established,to_server; content:"|36 36 36 36 58 36 36 36|"; offset:2; depth:8; reference:md5,98a3a68f76ed2eba763eb7bfb6648562; classtype:trojan-activity; sid:2018979; rev:2; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6403 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kuluoz/Asprox Activity"; flow:established,to_server; content:"POST"; http_method; pcre:"/^\/(?:[A-Fa-f0-9]+|index\.php)$/U"; content:"|80 00 00 00|"; depth:4; http_client_body; content:!"Referer"; http_header; flowbits:set,ET.Kuluoz; reference:md5,a3e0f51356d48124fba25485d1871b28; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; reference:url,blog.fortinet.com/post/changes-in-the-asprox-botnet; classtype:trojan-activity; sid:2017895; rev:8; metadata:created_at 2013_12_23, updated_at 2013_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6404 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download 3"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"return |22|PROXY"; pcre:"/^[^\x3b]+\\x(?:[57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])/Ri"; reference:md5,6f2dc4ba05774f3e5ebf6c502db48a71; classtype:trojan-activity; sid:2019191; rev:13; metadata:created_at 2014_09_18, updated_at 2014_09_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6405 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download 2"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"|22|PROXY"; distance:0; pcre:"/^(?P<q>[\x22\x27])(?:(?!(?P=q))[^\r\n\x2c])+?(?P=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c/m"; reference:md5,6e4a990b1540fa6b5896034b976ccecf; classtype:trojan-activity; sid:2019190; rev:14; metadata:created_at 2014_09_18, updated_at 2014_09_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6407 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings Checkin"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"cs="; http_client_body; content:"&p="; http_client_body; content:"&m="; http_client_body; reference:md5,ae9899722707fc2c9716138580787026; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019197; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6408 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings Data Exfiltration"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"cs="; http_client_body; content:"&m="; http_client_body; content:"&ls="; http_client_body; reference:md5,4196c67648003a18f61573a77b6d3be6; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019198; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6409 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings POST with Fake UA and Accept Header"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"Accept|3a 20 3f 2a 0d 0a|"; depth:12; http_header; reference:md5,ae9899722707fc2c9716138580787026; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019199; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6410 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Georgian Targeted Attack - Trojan Checkin"; flow:established,to_server; content:"/index312.php?ver="; http_uri; content:"&cam="; http_uri; content:"&p=spy"; http_uri; content:"&id="; http_uri; reference:md5,d4af87ba30c59d816673df165511e466; reference:url,dea.gov.ge/uploads/CERT%20DOCS/Cyber%20Espionage.pdf; classtype:trojan-activity; sid:2015850; rev:3; metadata:created_at 2012_10_31, updated_at 2012_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6421 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/ppp/ta.php"; http_uri; fast_pattern:only; pcre:"/Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/H"; reference:md5,ca15e5e96aee8b18ca6f3c185a690cea; classtype:trojan-activity; sid:2018183; rev:4; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6446 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request"; flow:established,to_server; content:"2p/"; http_uri; content:".exe"; fast_pattern; http_uri; pcre:"/\/p?2p\/[0-9]{1,2}\.exe$/U"; reference:md5,ca15e5e96aee8b18ca6f3c185a690cea; classtype:trojan-activity; sid:2018184; rev:5; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6447 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon 10/4/2014"; flow:established,to_server; content:"POST"; http_method; content:"/ccc/tab.php"; http_uri; fast_pattern:only; pcre:"/Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/H"; reference:md5,94d5d99b910f9184573a01873fdc42fc; classtype:trojan-activity; sid:2018384; rev:3; metadata:created_at 2014_04_11, updated_at 2014_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6449 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request 10/4/2014"; flow:established,to_server; urilen:<11; content:"/2p/"; http_uri; content:".exe"; fast_pattern; http_uri; pcre:"/^\x2F2p\x2F[a-z]{1,2}\.exe$/U"; reference:md5,94d5d99b910f9184573a01873fdc42fc; classtype:trojan-activity; sid:2018385; rev:3; metadata:created_at 2014_04_11, updated_at 2014_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6450 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/BillGates Checkin"; flow:established,to_server; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 f4 01 00 00 32 00 00 00 e8 03|"; distance:0; content:"|01 01 02 00 00 00 01 00 00 00|"; distance:0; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:trojan-activity; sid:2019207; rev:1; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6461 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Linux/BillGates Checkin Response"; flow:established,from_server; dsize:20; content:"|08 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 e8 fd 00 00|"; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:trojan-activity; sid:2019208; rev:1; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6462 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/AES.DDoS Sending Real/Fake CPU&BW Info"; flow:established,to_server; content:"INFO|3a|"; depth:5; pcre:"/^\d/R"; content:"|25 7c|"; distance:0; threshold: type both, count 1, seconds 30, track by_src; reference:md5,d8059b555dde05e184c0b16bbff523f1; classtype:trojan-activity; sid:2019177; rev:3; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6463 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 3"; flow:to_server,established; content:"|33 33|"; offset:2; depth:2; content:!"|33 33|"; within:2; content:"|33 33|"; distance:2; within:2; content:!"|33 33|"; within:2; content:"|33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33|"; pcre:"/[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33/R"; reference:md5,c150f9738142278e2d39417a7ef53cae; classtype:trojan-activity; sid:2019203; rev:2; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6465 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/Yangji.A Checkin"; flow:established,to_server; dsize:1024; content:"cngameanti|7c|"; depth:11; pcre:"/^\x2d?\d/R"; reference:md5,b5badeb16414cba66999742601c092b8; classtype:trojan-activity; sid:2019229; rev:1; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6467 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [443,$HTTP_PORTS] (msg:"ET TROJAN Pushdo v3 Checkin"; flow:established,to_server; dsize:20; content:"|02 00 00 00|"; depth:4; reference:md5,776d6c20a7016cb0f0db354785fe0d71; classtype:trojan-activity; sid:2019235; rev:1; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6469 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Kuluoz/Asprox CnC Response"; flow:from_server,established; flowbits:isset,ET.Kuluoz; content:"|0d 0a 0d 0a|"; content:"|0d 0a 80 00 00 00|"; distance:2; within:6; reference:md5,a3e0f51356d48124fba25485d1871b28; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; reference:url,blog.fortinet.com/post/changes-in-the-asprox-botnet; classtype:trojan-activity; sid:2019187; rev:5; metadata:created_at 2014_09_17, updated_at 2014_09_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6470 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BlackEnergy v2 POST Request"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"id="; http_client_body; content:"&bid="; http_client_body; content:"&dv="; http_client_body; content:"&dpv="; http_client_body; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:url,f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf; reference:md5,948cd0bf83a670c05401c8b67d2eb310; classtype:trojan-activity; sid:2019281; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6473 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BlackEnergy POST Request"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"id="; depth:3; http_client_body; content:"&bid="; distance:0; http_client_body; fast_pattern; content:"&t="; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:url,f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf; reference:md5,72372ffac0ee73dc8b6d237878e119c1; classtype:trojan-activity; sid:2019283; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6474 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Boleteiro checking stolen boleto payment information"; flow:to_server,established; content:"Vencimento="; fast_pattern:only; http_uri; content:"&Valor="; http_uri; content:"&Sacado="; http_uri; content:"&URL="; http_uri; content:"&Browser=Chrome"; http_uri; reference:md5,3cffb955c08f6c1546bfeae37a215787; reference:url,symantec.com/security_response/writeup.jsp?docid=2014-091718-2034-99&tabid=2; classtype:trojan-activity; sid:2019243; rev:4; metadata:created_at 2014_09_25, updated_at 2014_09_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6475 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 1"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb 2d 8e ea 67 c4 08 ea|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,edaaaa6527a6f42c96f27ce2e427cd39; classtype:trojan-activity; sid:2019305; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6477 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 2"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8b 77 b3 d1 92 8c 7d 48|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,edaaaa6527a6f42c96f27ce2e427cd39; classtype:trojan-activity; sid:2019306; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6478 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 3"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9b f5 c0 6b 03 3a 00 3f|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,510b4db9aa400583e7927afa5f956179; classtype:trojan-activity; sid:2019307; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6479 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows netstat Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Active Connections|0d|"; content:"Proto"; content:"Local Address"; content:"Foreign Address"; content:"State"; distance:0; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019003; rev:2; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6486 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Cryptolocker Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:11; content:"/random.php"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Mozilla/5."; http_user_agent; pcre:"/^\d{2,7}$/RV"; reference:md5,01be3fc3243d582d9f93d01401c4f95e; classtype:trojan-activity; sid:2019353; rev:3; metadata:created_at 2014_10_03, updated_at 2014_10_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6487 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpyClicker.ClickFraud Query Instructions CnC Response"; flow:established,to_client; content:"|0D 0A 0D 0A|{|22|query|22 3A|"; content:"|22|tasks|22 3A|"; distance:0; content:"|22|referer|22 3A|"; distance:0; content:"|22|useragent|22 3A|"; distance:0; content:"|22|clickurl|22 3A|"; distance:0; reference:url,stopmalvertising.com/malware-reports/anatomy-of-a-net-click-fraud-bot.html; reference:md5,17b077840ab874a8370c98c840b6c671; classtype:trojan-activity; sid:2019357; rev:2; metadata:created_at 2014_10_06, updated_at 2014_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6489 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpyClicker.ClickFraud CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/feed.dll?pub_id="; http_uri; fast_pattern:only; content:"&ua="; offset:17; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Accept"; http_header; content:!"Referer|3A|"; http_header; reference:url,stopmalvertising.com/malware-reports/anatomy-of-a-net-click-fraud-bot.html; reference:md5,17b077840ab874a8370c98c840b6c671; classtype:trojan-activity; sid:2019355; rev:3; metadata:created_at 2014_10_06, updated_at 2014_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6492 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32.Virut.A joining an IRC Channel"; flow:established,to_server; content:"JOIN &virtu"; depth:27; reference:md5,06b522eacdfe51bed5d041fd672e880f; reference:url,doc.emergingthreats.net/2003603; classtype:trojan-activity; sid:2003603; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6493 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/PSW.Papras.CK file upload"; flow:established,to_server; content:"POST"; http_method; content:"name|3d 22|upload_file|22 3b 20|filename|3d 22|"; fast_pattern:6,20; http_client_body; pcre:"/^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+/U"; reference:md5,5e7cbe7e62a6c5de45092ad0c4852d1a; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019379; rev:3; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6497 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gozi/Ursnif/Papras Connectivity Check"; flow:established,to_server; content:"GET"; http_method; urilen:13; content:"/usdeclar.txt"; http_uri; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,5f3530edbe1fce44e05ad0c96e54efb4; reference:md5,279fc5e6181d58f883a15d5089ce541b; reference:url,krebsonsecurity.com/2013/01/three-men-charged-in-connection-with-gozi-trojan/; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019380; rev:4; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6498 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Ursnif Connectivity Check"; flow:established,to_server; content:"GET"; http_method; urilen:21; content:"/proto/netstrings.txt"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,9134651a7c642798414d867874bdfe2f; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019381; rev:3; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6499 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN TorrentLocker DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|server4love|02|ru|00|"; nocase; fast_pattern:only; reference:md5,8d2e901583b60631dc333d4b396e158b; classtype:trojan-activity; sid:2019396; rev:2; metadata:created_at 2014_10_14, updated_at 2014_10_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6503 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN FrameworkPOS Covert DNS CnC Beacon 1"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"dc"; nocase; distance:7; content:"|06|beacon"; nocase; offset:12; fast_pattern; pcre:"/^[\x0e-\x1e](?:[a-f0-9]{2}){1,3}(?:dc(?:[a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:trojan-activity; sid:2019454; rev:1; metadata:created_at 2014_10_16, updated_at 2014_10_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6506 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN FrameworkPOS Covert DNS CnC Beacon 2"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"dc978a97"; nocase; distance:6; content:"|05|alert"; nocase; offset:12; fast_pattern; pcre:"/^[\x08-\xFF](?:[a-f0-9]{2})*?dc978a97/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:trojan-activity; sid:2019455; rev:1; metadata:created_at 2014_10_16, updated_at 2014_10_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6507 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Zemot Requesting PE"; flow:established,to_server; content:"GET"; http_method; content:"/mod_jshoppi"; http_uri; fast_pattern:only; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/mod_jshoppi(?:-|ng|\/)/U"; reference:md5,b8e0b97c8e9faa6e5daa8f0cac845516; classtype:trojan-activity; sid:2019459; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6508 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex POST Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:>20; content:"Content-Type|3a 20|octet/binary|0d 0a|Accept|3a 20|*/*|0d 0a|"; http_header; fast_pattern:7,20; content:!"Referer|3a|"; http_header; content:!"Accept-Encoding|3a|"; http_header; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\nConnection\x3a[^\r\n]+?\r\nUser-Agent\x3a[^\r\n]+?\r\nContent-Type\x3a\x20octet\/binary\r\nAccept\x3a\x20\*\/\*\r\nAccept-Language\x3a[^\r\n]+?\r\nContent-Length\x3a\x20\d+?\r\n(?:\r\n)?$/H"; reference:md5,68459c32587e08d953d319ceb2d0888b; classtype:trojan-activity; sid:2019478; rev:2; metadata:created_at 2014_10_20, updated_at 2014_10_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6511 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo GET Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:>25; content:"Host|3a 20|"; depth:6; http_header; content:"Content-Type|3a 20|octet/binary|0d 0a|Accept|3a 20|*/*|0d 0a|"; http_header; fast_pattern:7,20; content:!"Referer|3a|"; http_header; content:!"Accept-Encoding|3a|"; http_header; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\nConnection\x3a[^\r\n]+?\r\nUser-Agent\x3a[^\r\n]+?\r\nContent-Type\x3a\x20octet\/binary\r\nAccept\x3a\x20\*\/\*\r\nAccept-Language\x3a[^\r\n]+?\r\n(?:\r\n)?$/H"; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018772; rev:5; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6512 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible IRCBot.DDOS Common Commands"; flow:established,to_client; content:"PRIVMSG "; depth:8; pcre:"/^[^\r\n]*?\x3a[^\r\n]*?(?:port(?:scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(?:\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)/Ri"; reference:md5,ef54080af1782dd29356032b7ff20849; classtype:trojan-activity; sid:2019471; rev:3; metadata:created_at 2014_10_20, updated_at 2014_10_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6513 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN vSkimmer.PoS Checkin"; flow:to_server,established; content:"/process.php?xy="; fast_pattern:only; http_uri; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,a99d5d1652dfcda190c3d412828dcf6d; reference:md5,82d9cab2692ae13fc5b835ea2cbb36d7; reference:url,anubis.iseclab.org/action=result&task_id=1b92f08cdbfb73e64450fd07ec88849b3; classtype:trojan-activity; sid:2018109; rev:4; metadata:created_at 2013_03_12, updated_at 2013_03_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6515 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/24x7Help.ScareWare CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/api/client.asmx/SendData"; http_uri; content:"User-Agent|3A| mFramework HTTPGet"; http_header; fast_pattern:12,18; content:"CFG="; http_client_body; depth:4; content:"&Lng="; http_client_body; distance:0; content:"&sinst="; http_client_body; distance:0; reference:md5,8d2dec745b9ac380beb2a0ea66427d06; classtype:trojan-activity; sid:2019498; rev:3; metadata:created_at 2014_10_23, updated_at 2014_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6516 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Wonton-JH Checkin"; flow:established,to_server; content:"POST"; http_method; content:".asp?M00="; http_uri; fast_pattern; content:"User-Agent|3a 20|Mozilla/4.0 (Compatible|3b| MSIE 6.0|3b 29 0d 0a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.asp\?M00=\d+$/U"; reference:url,blog.cylance.com/emerging-threat-alert-cve-2014-4114; reference:md5,37ca2ecb5e1fc89f73c6adc188ff685d; classtype:trojan-activity; sid:2019502; rev:2; metadata:created_at 2014_10_24, updated_at 2014_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6519 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN JST Perl IrcBot download"; flow:to_client,established; file_data; content:"JST Perl IrcBot"; fast_pattern:only; content:!"<html"; reference:url,pastebin.com/HK8riv9Q; reference:url,www.binarydefense.com/bds/active-shellshock-smtp-botnet-campaign/; reference:md5,77a6c50a06b59df0f3d099b1819a01d9; classtype:trojan-activity; sid:2019509; rev:2; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6523 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Siggen.Dropper CnC Beacon"; flow:established,to_server; content:".jpg?log="; fast_pattern:only; http_uri; content:"&ts="; offset:11; http_uri; content:"&act="; distance:0; http_uri; content:"client|3a 20|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,ee363de2168aab353c829434189350e4; classtype:trojan-activity; sid:2019515; rev:2; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6524 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN OLDBAIT Checkin sptr"; flow:established,to_server; content:"/~"; http_uri; depth:2; content:"/cgi-bin/sptr.cgi?"; http_uri; content:"_"; http_uri; reference:md5,3983c859a217740bf9c5dd67a4647a9d; reference:md5,771bfe5d64138ef4e11e969b408ee0d7; reference:url,thegoldenmessenger.blogspot.de/2012/12/3-disclosure-of-another-0day-malware.html; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; classtype:trojan-activity; sid:2019535; rev:3; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6529 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN OLDBAIT Checkin 2 brvc"; flow:established,to_server; content:"/~"; http_uri; depth:2; content:"/cgi-bin/brvc.cgi?"; http_uri; content:"_"; http_uri; reference:md5,3983c859a217740bf9c5dd67a4647a9d; reference:md5,771bfe5d64138ef4e11e969b408ee0d7; reference:url,thegoldenmessenger.blogspot.de/2012/12/3-disclosure-of-another-0day-malware.html; reference:url,fireeye.com/resources/pdfs/apt28.pdf; classtype:trojan-activity; sid:2019536; rev:2; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6530 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Chopstick Checkin (APT28 Related)"; flow:to_server,established; content:"POST"; http_method; content:"/webhp?rel="; http_uri; fast_pattern; content:"ai="; http_uri; distance:0; pcre:"/^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+/URm"; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; reference:md5,6fc8602c8b3a18765bb6d2307d8a4ae1; classtype:trojan-activity; sid:2019537; rev:3; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6532 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Coreshell Checkin (APT28 Related)"; flow:to_server,established; content:"POST"; http_method; content:"/~xh/sn.cgi?"; http_uri; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$/RUm"; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; reference:md5,272f0fde35dbdfccbca1e33373b3570d; classtype:trojan-activity; sid:2019539; rev:4; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6552 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|b6 8b ac d3 d7 e0 e7 36 f0 b5 63 65 1e 1a 31 ae|"; offset:16; depth:16; reference:md5,184a9d13616702154fb10ff9c5d67041; classtype:trojan-activity; sid:2019589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6557 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|01 ec 7e 05 1d 5f 65 ab db 1c df 93 99 cd 06 21|"; offset:16; depth:16; reference:md5,09d4c2f1f24fbdcb1c286b2f4c5589d2; classtype:trojan-activity; sid:2019590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6558 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|52 13 34 da 18 3d 2f 45 a2 09 93 52 01 23 51 e3|"; offset:16; depth:16; reference:md5,2b825e46ae60a9d15b5a731e57410425; classtype:trojan-activity; sid:2019592; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6559 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|3e 5c d1 68 e7 8c 47 8c ea 2f da 02 fe 43 62 47|"; offset:16; depth:16; reference:md5,afc4d73bde2a536d7a9b7596288ce180; classtype:trojan-activity; sid:2019593; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6560 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 43"; flow:to_server,established; dsize:>11; content:"|83 7f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x83\x7f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5f0c10c1705783d3f32742bce3b2aea5; classtype:trojan-activity; sid:2019602; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_10_30, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6561 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Ropest.H CnC - INBOUND set"; flow:established,from_server; content:"|28 00 00 00 00 01 00 00|"; depth:8; flowbits:set,ET.Zberp; flowbits:noalert; metadata: former_category TROJAN; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:trojan-activity; sid:2025068; rev:1; metadata:created_at 2014_10_30, updated_at 2017_11_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6563 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Ropest.H CnC - INBOUND"; flow:established,from_server; flowbits:isset,ET.Zberp; dsize:24; content:"|10 00 00 00 00 01 00 00|"; depth:8; metadata: former_category TROJAN; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:trojan-activity; sid:2025069; rev:1; metadata:created_at 2014_10_30, updated_at 2017_11_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6564 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Tinba DGA NXDOMAIN Responses (2)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ru|00|"; distance:15; within:4; fast_pattern; content:"|0c|"; distance:-17; within:1; pcre:"/^[a-z]{12}/R"; threshold:type both, track by_src, count 50, seconds 10; reference:md5,5808cc73c78263a8114eb205f510f6a7; reference:url,blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/; classtype:trojan-activity; sid:2019609; rev:1; metadata:created_at 2014_10_31, updated_at 2014_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6567 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Variant.Strictor Dropper"; flow:established,to_server; content:"GET"; http_method; content:".php"; http_uri; content:"os="; http_uri; content:"&osbit="; http_uri; content:"&antiv="; http_uri; content:"Access"; depth:6; fast_pattern; http_user_agent; reference:md5,909b91071c60fc68c27789d912ccf68a; classtype:trojan-activity; sid:2018964; rev:6; metadata:created_at 2014_08_19, updated_at 2014_08_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6570 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backoff Variant Checkin"; flow:established,to_server; content:"GET"; http_method; content:".php?a=start&id="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/&id=[A-F0-9]+$/U"; reference:md5,d8e7983004c5545df6de868bc0c5a947; classtype:trojan-activity; sid:2019636; rev:2; metadata:created_at 2014_11_04, updated_at 2014_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6576 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> $EXTERNAL_NET any (msg:"ET TROJAN Shellshock Backdoor.Perl.Shellbot.F C2"; flow:to_server,established; content:"JOIN #shock 777"; content:"PRIVMSG #shock|20 3a|uid="; distance:0; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:trojan-activity; sid:2019637; rev:1; metadata:created_at 2014_11_04, updated_at 2014_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6577 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Shellshock Backdoor.Perl.Shellbot.F retrieval"; flow:to_client,established; file_data; content:"#you got shellshocked???"; depth:24; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:trojan-activity; sid:2019644; rev:2; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6580 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Bedep SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; content:"|0b|Company Ltd"; distance:1; within:12; fast_pattern; content:"|55 04 0b|"; content:"|06|office"; distance:1; within:7; reference:url,malware-traffic-analysis.net/2014/11/02/index.html; reference:md5,11837229f834d296342b205433e9bc48; classtype:trojan-activity; sid:2019645; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6581 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Bedep SSL Cert"; flow:established,from_server; content:"|09 00 c9 80 9a 85 50 97 cc 97|"; fast_pattern:only; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; content:"|0b|Company Ltd"; distance:1; within:12; content:"|55 04 0b|"; content:"|06|office"; distance:1; within:7; reference:url,malware-traffic-analysis.net/2014/11/02/index.html; reference:md5,11837229f834d296342b205433e9bc48; classtype:trojan-activity; sid:2019646; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6582 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.Banker.ABCG Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"act="; depth:4; http_client_body; content:"&atom="; distance:0; fast_pattern; http_client_body; content:"&id="; distance:0; http_client_body; content:"Mozilla/3.0 (compatible|3b| Indy Library)"; depth:38; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,acad4be4c587b9db9f39268cc4c0c192; reference:md5,b07a6a590c729fcd47ebce37fdd6c90b; classtype:trojan-activity; sid:2019653; rev:3; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6585 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.FakeMS Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:5; content:!"Referer"; http_header; content:"|20|(64|20|=|20|"; http_client_body; content:")|20|EXE|20|=|20|"; distance:1; within:8; http_client_body; pcre:"/^\x5b[^\r\n]+$64\s=\s\d$\sEXE\s=/P"; reference:md5,e606e56a222f788ab5cbcf40842cbc39; reference:md5,099dc535bdd09d6a7bc4edabc8ded5de; classtype:trojan-activity; sid:2019654; rev:6; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6586 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"|22|PROXY"; distance:0; pcre:"/(?:www\.(?:(?:b(?:an(?:co(?:dobrasil|hsbc)|espa)|radesco(?:prime)?|b)|hsbc(?:pr(?:ivatebank|emier)|ba(?:merindus|nk))?|s(?:antander(?:banespa|net)?|erasa(?:experian)?)|uolhost)\.com\.br|c(?:(?:aixa(?:(?:economica(?:federal)?|qui)\.gov|\.(?:com|gov))|onsultasintegradas\.rs\.gov|ef\.(?:com|gov))\.br|redicard\.com(?:\.br)?)|itau(?:p(?:ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(?:ricanexpress\.com(?:\.br)?|x\.com\.br))|(?:(?:b(?:an(?:co(?:dobrasil|hsbc)|risul)|radesco(?:prime)?|b)|hsbc(?:pr(?:ivatebank|emier)|ba(?:merindus|nk))?|s(?:erasa(?:experian)?|antander)|uolhost)\.com|c(?:aixa(?:(?:economica(?:federal)?|qui)\.gov|\.(?:com|gov))|onsultasintegradas\.rs\.gov|ef\.(?:com|gov)|redicard\.com))\.br|itau(?:(?:p(?:ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(?:ricanexpress.com(?:\.br)?|x\.com\.br)|\*(?:linhadefensiva*|hsbc*))/"; reference:md5,3baae632d2476cbd3646c5e1b245d9be; reference:md5,ace343a70fbd26e79358db4c27de73db; classtype:trojan-activity; sid:2014435; rev:14; metadata:created_at 2012_02_28, updated_at 2012_02_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6588 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Smoke Loader Checkin r=gate"; flow:established,to_server; content:".php?r=gate&"; http_uri; content:"&group="; http_uri; distance:0; content:"&debug="; http_uri; distance:0; content:"5.0 (Windows|3b| U|3b| MSIE 9"; http_header; reference:md5,7ef1e61d9b394a972516cc453bf0ec06; classtype:trojan-activity; sid:2014728; rev:6; metadata:created_at 2012_05_09, updated_at 2012_05_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6589 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Archie EK Payload Checkin POST"; flow:established,to_server; content:"POST"; http_method; content:"integritylvl="; depth:13; http_client_body; content:"&osversion="; distance:0; http_client_body; content:"&iselevated="; distance:0; http_client_body; content:"&iever="; distance:0; http_client_body; content:"&isnet20inst="; http_client_body; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,41c0cdde6be5166606008b2d02f3a128; classtype:trojan-activity; sid:2019679; rev:3; metadata:created_at 2014_11_07, updated_at 2014_11_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6595 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"bB"; offset:2; depth:2; http_client_body; content:"MqrU"; within:20; http_client_body; content:"VAMU"; within:29; fast_pattern; http_client_body; content:!"Referer|3a|"; http_header; reference:md5,79d1c8c33062324388d3d563f193a43b; reference:md5,ee3c562151cc9181c6d87602bbf0a285; reference:md5,a42797315c50e335f3de87f6cea61b77; classtype:trojan-activity; sid:2019683; rev:6; metadata:created_at 2014_11_07, updated_at 2014_11_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6596 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Emotet DGA NXDOMAIN Responses"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|eu|00|"; distance:19; within:4; fast_pattern; content:"|10|"; distance:-21; within:1; pcre:"/^[a-z]{16}/R"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,3083b68cb5c2a345972a5f79e735c7b9; classtype:trojan-activity; sid:2019692; rev:1; metadata:created_at 2014_11_11, updated_at 2014_11_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6601 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Emotet CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"<email_accounts_list>"; http_client_body; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,e24831e3f808116b30d85731c545e3ee; classtype:trojan-activity; sid:2019704; rev:2; metadata:created_at 2014_11_12, updated_at 2014_11_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6602 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Alureon Checkin"; flow:established,to_server; content:"POST"; http_method; content:"winver="; depth:7; http_client_body; content:"&ver="; distance:0; http_client_body; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^winver=\d+&ver=\d+$/P"; reference:md5,2155b7942ddc6d7a82e7d96a8c594501; classtype:trojan-activity; sid:2019717; rev:2; metadata:created_at 2014_11_17, updated_at 2014_11_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6616 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Rogue.Win32/FakePAV Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?0="; depth:4; http_uri; fast_pattern; content:"=i"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/\?0=(?:[^&]+?&\d+?=)+?[^=&]+?$/Ui"; reference:md5,6829306e92cfa811b12d9b028eb56a2d; classtype:trojan-activity; sid:2019767; rev:4; metadata:created_at 2014_11_21, updated_at 2014_11_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6628 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CoinVault POST M1"; flow:established,to_server; content:"POST"; http_method; urilen:1; content:"hwid="; depth:5; http_client_body; content:"&func="; http_client_body; fast_pattern:only; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^hwid=[A-F0-9]{4}(?:-[A-F0-9]{4}){7}&func=/P"; reference:url,securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/; reference:md5,8e1bdc1c484bc03880c67424d80e351d; classtype:trojan-activity; sid:2019776; rev:2; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6630 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CoinVault POST M2"; flow:established,to_server; content:"POST"; http_method; content:!"Referer"; http_header; content:"func=getemailurl"; http_client_body; reference:url,securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/; reference:md5,8e1bdc1c484bc03880c67424d80e351d; classtype:trojan-activity; sid:2019777; rev:2; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6631 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Urausy.C Checkin 2"; flow:to_server,established; urilen:>80; content:"GET"; http_method; content:".html"; http_uri; fast_pattern:only; content:!"Referer|3a| "; http_header; content:!"Accept|3a| "; http_header; pcre:"/\/[A-Za-z0-9-_]{75,}\.html$/U"; content:"User-Agent|3a 20|Mozilla/5.0 (compatible|3b| MSIE "; depth:42; http_header; reference:md5,09462f13d7e6aaa0bff2788158343829; reference:md5,b18f80d665f340af91003226a2b974b6; reference:md5,1494b8b9f42753a4bc1762d8f3287db6; classtype:trojan-activity; sid:2016567; rev:6; metadata:created_at 2013_03_13, updated_at 2013_03_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6645 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Hyteod.Downloader CnC Beacon"; flow:established,to_server; content:"/payment_gateway/"; http_uri; content:".gz"; http_uri; content:"OperaMini"; depth:9; http_user_agent; pcre:"/^\x2Fpayment_gateway\x2F[a-z0-9]{3,}\x2Egz$/U"; reference:md5,8258c3d8bab63cacf143cf034e2e7c1a; classtype:trojan-activity; sid:2019824; rev:3; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6648 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Coinminer.Backdoor CnC Beacon"; flow:established,to_server; content:".php?id="; http_uri; content:"Mozzilla/4.0 (copmatible|3B|"; fast_pattern; http_user_agent; reference:md5,8e29a15caef546aab0f19a9a81732163; classtype:trojan-activity; sid:2019826; rev:4; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6649 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Wadolin.Downloader CnC Beacon"; flow:established,to_server; content:"/upgrade-functions.php?v="; fast_pattern; http_uri; content:"&id="; http_uri; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE 6.1|3B| Windows XP)"; http_header; reference:md5,693c007d651bb5a8c6d2a4f5ed65a69c; classtype:trojan-activity; sid:2019827; rev:2; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6650 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/W32.KRBanker.60928.C Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/upload.php"; http_uri; content:"|0d 0a|Accept-Language|3a| zh-cn|0d 0a|"; http_header; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.0|29 0d 0a|"; http_header; content:"name=|22|upload_file1|22 3b 20|"; fast_pattern:only; http_client_body; content:".zip|22 0d 0a|"; http_client_body; content:"Content-Type|3a| application/x-zip-compressed|0d 0a|"; http_client_body; pcre:"/filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n/P"; reference:md5,ec5d7bc9d84551066fff51e36bc41d4d; reference:md5,13bd584bb12ee5dc15c35f5911912b09; classtype:trojan-activity; sid:2019828; rev:3; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6651 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HompesA Activity"; flow:established,to_server; content:"/me/"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; pcre:"/^\/me\/(?:get(?:ref|ua)\.php|videos\.txt)$/U"; reference:md5,8cc58bc4d63f4b78b635d45aa69108f7; classtype:trojan-activity; sid:2019838; rev:2; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6654 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/MSIL.bfsx Checkin"; flow:to_server,established; content:"/infect"; fast_pattern:only; http_uri; content:".php"; offset:7; http_uri; content:"User-Agent|3a 20|Microsoft|0d 0a|"; http_header; pcre:"/\/infect(?:-\d)?\.php$/U"; reference:md5,506cd65bdd06f41f8219cd1ed78eac7d; reference:md5,0c39b39ee4a59a8ac5fc1df500da2a88; classtype:trojan-activity; sid:2019840; rev:4; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6656 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Enchanim C2 Client Check-in"; flow:established,to_server; content:"some_magic_code1"; depth:16; reference:md5,2642999a085443e9055b292c4d405e64; reference:md5,37066ed52cd7510bf04808c332599f1c; reference:url,www.seculert.com/blog/2013/04/magic-persistent-threat.html; classtype:trojan-activity; sid:2016772; rev:2; metadata:created_at 2013_04_18, updated_at 2013_04_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6666 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET TROJAN W32/SCKeyLog.InfoStealer Installation Confirmation Via SMTP"; flow:established,to_server; content:"Subject|3A 20|Installation of SC-KeyLog on host"; nocase; reference:url,home.mcafee.com/VirusInfo/VirusProfile.aspx?key=910563; reference:md5,cc439073eeb244e6bcecee8b6774b672; classtype:trojan-activity; sid:2014354; rev:2; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6708 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 20000: (msg:"ET TROJAN Sourtoff Download Simda Request"; flow:established,to_server; dsize:18; content:"|0a 10|"; depth:2; flowbits:set,ET.TROJAN.Sourtoff; flowbits:noalert; reference:md5,5469af0daa10f8acbe552cd2f1f6a6bb; classtype:trojan-activity; sid:2019312; rev:2; metadata:created_at 2014_09_29, updated_at 2014_09_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6715 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Destover RAT Check-in"; flow:established,to_server; content:"|17 03 01 00 0C E2 C4 Fd D9 E8 E3 F2 9F|"; reference:md5,d1c27ee7ce18675974edf42d4eea25c6; reference:url,www.symantec.com/connect/blogs/destover-destructive-malware-has-links-attacks-south-korea; classtype:trojan-activity; sid:2019878; rev:2; metadata:created_at 2014_12_05, updated_at 2014_12_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6716 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cc)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|cc|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019882; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6719 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.ws)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ws|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019883; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6720 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.to)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|to|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019884; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6721 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.in)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|in|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019885; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6722 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.hk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|hk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019886; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6723 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cn)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ck|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019887; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6724 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.tk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|tk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019888; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6725 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.so)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|so|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019889; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6726 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vawtrak/NeverQuest Posting Data"; flow:established,to_server; content:"POST"; http_method; content:".php?i="; http_uri; content:"&data="; http_uri; distance:0; content:"&hash="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/&hash=[^&]+$/U"; flowbits:set,ET.Vawtrak; reference:md5,13c982c3b9c1ef714770820ffa278d2e; classtype:trojan-activity; sid:2019843; rev:3; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6728 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Backdoor.Linux.Turla Download"; flow:from_server,established; flowbits:isset,ET.ELFDownload; content:"__we_are_happy__"; content:"__TREX__STOP__STRING__"; distance:0; content:"/dev/random"; distance:1; within:11; reference:url,securelist.com/blog/research/67962/the-penquin-turla-2/; reference:md5,19fbd8cbfb12482e8020a887d6427315; classtype:trojan-activity; sid:2019896; rev:2; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6729 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN VirRansom/VirLock Checkin"; flow:established,to_server; dsize:4; content:"|94 00 00 00|"; fast_pattern:only; flowbits:set,ET.VirLock; flowbits:noalert; reference:md5,fbeb6ebd498d85b1f404d7bb4acc3b89; classtype:trojan-activity; sid:2019901; rev:1; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6730 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN VirRansom/VirLock Checkin Response"; flow:established,from_server; dsize:4; content:"|74 01 00 00|"; fast_pattern:only; flowbits:isset,ET.VirLock; reference:md5,fbeb6ebd498d85b1f404d7bb4acc3b89; classtype:trojan-activity; sid:2019902; rev:1; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6731 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (smartoptionsinc.com)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|05 11 32 08 1d 81|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0d|Synology Inc."; distance:1; within:14; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019923; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6741 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (ppc.cba.pl)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|11 00 81 3d 59 00 8d f2 04 04 8c 3a d3 d0 8e 36 d4 2a|"; distance:9; within:40; content:"|55 04 03|"; distance:0; content:"|06|cba.pl"; distance:1; within:7; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019924; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6742 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (cargol.cat)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e3 a7 5c ad 38 d2 d7 fe|"; distance:9; within:30; content:"|55 04 0a|"; distance:0; content:"|13|Tirabol Produccions"; distance:1; within:20; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019925; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6743 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN HawkEye Keylogger Report SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a| HawkEye Keylogger"; nocase; reference:md5,3bbd5ae250b2d912a701f8d74d85353b; classtype:trojan-activity; sid:2019926; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6744 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Beastdoor Keylogger Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a 20|Keylogger"; content:"Victim IP-"; reference:md5,ad99a0a85e1410559030464aac390969; classtype:trojan-activity; sid:2019927; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6745 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> any [139,445] (msg:"ET TROJAN Possible Net Crawler SMB Share Access unicode (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,!&,0x80,6,relative; content:"|00|_|00|A|00|u|00|t|00|o|00|S|00|h|00|a|00|r|00|e|00|$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019929; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6747 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> any [139,445] (msg:"ET TROJAN Possible Net Crawler SMB Share Access ascii (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,&,0x80,6,relative; content:"_AutoShare$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019930; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6748 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan.SpamBanker Report via SMTP"; flow:established,to_server; content:"From|3a|"; content:"Subject|3a 20|Keylogger"; fast_pattern:only; nocase; content:"X-Library|3a 20|Indy"; pcre:"/^Keylogger\r$/m"; reference:md5,9c1aac05bd3212a3abcd7cce9c6c4c77; classtype:trojan-activity; sid:2019931; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6749 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan/Win32.Espy Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"SUBJECT|3a| I Q - S P Y KeyLogger ["; content:"victim computer name"; reference:md5,1a9a06b11aa537734931f8098bae6b00; classtype:trojan-activity; sid:2019932; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6750 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan/Downloader.Fosniw.sap Reporting via SMTP"; flow:established,to_server; content:"From|3a|"; content:"Subject|3a 20|keylogger(v0."; fast_pattern:only; nocase; content:"@UserName"; content:"@ComputerName"; reference:md5,e36469241764b8c954a700146ca4c43f; classtype:trojan-activity; sid:2019933; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6751 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS query for Known OphionLocker Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|smu743glzfrxsqcl"; fast_pattern; nocase; distance:0; reference:url,f-secure.com/weblog/archives/00002777.html; reference:md5,e17da8702b71dfb0ee94dbc9e22eed8d; classtype:trojan-activity; sid:2019934; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6752 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.Bancos Sending Stolen info SMTP"; flow:to_server,established; content:"X-Library|3a| Indy"; content:"BIGFONE TOCOU"; fast_pattern:only; content:"Nome Comp"; metadata: former_category TROJAN; reference:md5,f71c41b816eadf221e188f6618798969; classtype:trojan-activity; sid:2019938; rev:1; metadata:tag Banking_Trojan, created_at 2014_12_15, malware_family Bancos, updated_at 2018_04_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6754 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 10001 (msg:"ET TROJAN Win32.Bumrat.B Checkin"; flow:established,to_server; dsize:19; content:"|0f 00 00 00|"; depth:4; content:"mconfig_10"; reference:md5,647edeb30a04eeb30b7f8921645c7369; classtype:trojan-activity; sid:2019941; rev:1; metadata:created_at 2014_12_15, updated_at 2014_12_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6755 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/TinyZBot Checkin (Operation Cleaver)"; flow:established,to_server; content:"POST"; http_method; content:"/checkupdate.asmx"; http_uri; fast_pattern:only; content:"SOAPAction|3a 20 22|http|3a|//tempuri.org/GetServerTime|22 0d 0a|"; http_header; content:"GetServerTime xmlns=|22|http|3a|//tempuri.org/"; http_client_body; content:!"|0d 0a|Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,68cfc418c72b58b770bdccf19805703e; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019942; rev:3; metadata:created_at 2014_12_15, updated_at 2014_12_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6756 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Agent.AIXD Checkin"; flow:to_server,established; content:"/cnc.php?id="; fast_pattern:only; http_uri; content:"&uid="; http_uri; content:"User-Agent|3a| AppleMac|0d 0a|"; http_header; reference:md5,801e450679e9d60f8c64675c432aab33; reference:md5,ad2e8210ca7c2b4b433b3fba65e87b94; reference:md5,f6ea10f719885fbcfb6743724faa94f7; classtype:trojan-activity; sid:2019945; rev:3; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6757 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon"; flow:established,to_server; content:"GET"; http_method; urilen:8; content:"/php.php"; fast_pattern; content:"User-Agent|3A| Mozilla/4.0 (compatible)"; pcre:"/^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/Hmi"; reference:md5,cb53a6e8d65d86076fc0c94dac62aa77; classtype:trojan-activity; sid:2019946; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6758 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/TRCrypt.ULPM Downloader CnC Beacon"; flow:established,to_server; content:".aspx?id="; http_uri; content:"&macaddress="; http_uri; content:"&pcname="; http_uri; content:"&username="; http_uri; content:"&osversion="; http_uri; content:"&versaoatual="; http_uri; fast_pattern; content:"&winkey="; http_uri; reference:md5,3b4f77eefd208f699e6a540878e753a8; classtype:trojan-activity; sid:2019947; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6759 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Symmi.46846 CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/notify.php"; http_uri; fast_pattern:only; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MyApp)"; http_header; content:!"Referer|3A|"; http_header; reference:md5,fe5dc2a4ee8aa084c9da42cd2d1ded2e; classtype:trojan-activity; sid:2019948; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6760 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.Banker.AAXV Retrieving key from Pinterest"; flow:established,to_server; content:"GET"; http_method; content:"/pin/"; depth:5; http_uri; content:"User-Agent|3a 20|Internet Explorer 6.0|0d 0a|"; http_header; fast_pattern:15,20; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,f25a8e3f5265a57269590b84a506b672; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/malware-campaign-targets-south-korean-banks-uses-pinterest-as-cc-channel/; classtype:trojan-activity; sid:2019961; rev:3; metadata:created_at 2014_12_17, updated_at 2014_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6762 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Syrian.Slideshow Sending Information via SMTP"; flow:established,to_server; content:"Subject|3a 20|repo|0d 0a|"; content:"filename=|22|mxtd|22|"; reference:md5,f8bfb82aa92ea6a8e4e0b378781b3859; reference:url,citizenlab.org/2014/12/malware-attack-targeting-syrian-isis-critics; classtype:trojan-activity; sid:2019975; rev:1; metadata:created_at 2014_12_18, updated_at 2014_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6767 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tendrit CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:"/css.ashx?"; depth:10; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/css\.ashx\?[a-z]{2,}=(?:%[A-F0-9]{2})+&/I"; reference:md5,755dad1f37a9d3fae1352dbbc409102c; reference:url,pwc.blogs.com/cyber_security_updates/2014/12/festive-spearphishing-merry-christmas-from-an-apt-actor.html; classtype:trojan-activity; sid:2019985; rev:2; metadata:created_at 2014_12_22, updated_at 2014_12_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6771 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tendrit CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; content:"/favicon?"; depth:9; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/favicon\?[a-z]{2,}=(?:%[A-F0-9]{2})+&/I"; reference:md5,755dad1f37a9d3fae1352dbbc409102c; reference:url,pwc.blogs.com/cyber_security_updates/2014/12/festive-spearphishing-merry-christmas-from-an-apt-actor.html; classtype:trojan-activity; sid:2019986; rev:2; metadata:created_at 2014_12_22, updated_at 2014_12_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6772 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Nurjax Downloading PE"; flow:established,to_server; content:".exe?dummy="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\.exe\?dummy=\d+$/U"; reference:md5,6b7759565454fb7d02fb5bc638136f31; classtype:trojan-activity; sid:2020032; rev:2; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6808 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS query for known Anunak APT Domain (update-java.net)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|update-java|03|net|00|"; nocase; distance:0; fast_pattern; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; reference:md5,0ad4892ead67e65ec3dd4c978fce7d92; classtype:trojan-activity; sid:2020041; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6816 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex Post Check-in Activity"; flow:established,to_server; content:"POST "; depth:5; content:!"Referer|3a|"; content:"User-Agent|3a 20|Mozilla/5.0 (Windows NT 6.1|3b| Trident/7.0|3b| rv|3a|10.0) like Gecko|0d 0a|"; fast_pattern:53,20; content:"Connection|3a 20|Close|0d 0a|"; content:"HTTP/1.1|0d 0a|Host|3a 20|"; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r\n/R"; threshold:type limit,track by_src,count 1,seconds 60; reference:md5,ac6ea1e500de772341a2075a7d916d63; classtype:trojan-activity; sid:2020064; rev:2; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6838 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Dropped by RIG EK"; flow:established,to_server; content:"/Prack"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|InetURL/1.0|0d 0a|"; http_header; reference:md5,18fa3ab45c6fa9da218dd4c35688c5f4; classtype:trojan-activity; sid:2020070; rev:3; metadata:created_at 2014_12_26, updated_at 2014_12_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6840 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Andromeda Checkin Dec 29 2014"; flow:established,to_server; content:"POST"; nocase; http_method; content:"EPF#"; depth:4; fast_pattern; http_client_body; content:"User-Agent|3a 20|Mozilla/4.0|0d 0a|"; http_header; content:!"Referer"; http_header; content:!"Accept"; http_header; content:"Connection|3a 20|close|0d 0a|"; reference:md5,7a1ad388bdcebcbc4cc48a2eff71775f; classtype:trojan-activity; sid:2020076; rev:2; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6842 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 9090 (msg:"ET TROJAN Win32.Akdoor Reporting MAC Address"; flow:to_server,established; dsize:20; content:"|01 00 00 00 0c 00 00 00|"; fast_pattern; pcre:"/^[0-9A-F]{12}$/R"; reference:md5,f5ba42117dd02f50b12542131dcd8b5f; classtype:trojan-activity; sid:2020081; rev:1; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6846 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Worm.Win32.Ngrbot.lof Join IRC channel"; flow:to_server,established; content:"NICK New|7B|"; nocase; pcre:"/^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,dd05fcd2368d8d410a5b85e8d504a435; classtype:trojan-activity; sid:2016849; rev:3; metadata:created_at 2013_05_14, updated_at 2013_05_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6848 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Steam Stealer"; flow:to_server,established; content:"GET"; http_method; content:"/uploads/images/201"; http_uri; fast_pattern:only; content:!"Referer|3a 20|"; http_header; content:!"Accept"; http_header; content:!"User-Agent|3a 20|"; http_header; pcre:"/\.png$/U"; reference:md5,5f50e810668942e8d694faeabab08260; reference:url,blog.0x3a.com/post/107195908164/analysis-of-steam-stealers-and-the-steam-stealer; classtype:trojan-activity; sid:2020095; rev:3; metadata:created_at 2015_01_05, updated_at 2015_01_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6851 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TinyLoader.A Checkin x86"; dsize:12; content:"|00 00 00 00 00 00 00 00 00 00 32 32|"; fast_pattern:only; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020150; rev:1; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6854 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TinyLoader.A Checkin x64"; dsize:12; content:"|00 00 00 00 00 00 00 00 00 00 64 32|"; fast_pattern:only; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020151; rev:1; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6855 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 9000:10000 (msg:"ET TROJAN Win32/Recslurp.D C2 Request (no alert)"; flow:established,to_server; dsize:4; content:"|e8 03 00 00|"; fast_pattern:only; flowbits:set,ET.Reslurp.D.Client; flowbits:noalert; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:trojan-activity; sid:2020154; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6856 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 9000:10000 -> $HOME_NET any (msg:"ET TROJAN Win32/Recslurp.D C2 Response"; flow:established,from_server; flowbits:isset,ET.Reslurp.D.Client; content:"|e8 03 00 00|"; depth:4; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:trojan-activity; sid:2020155; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6857 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Emotet.C Checkin"; flow:to_server,established; content:"POST"; http_method; urilen:1; content:"MASE|0d 0a|"; http_header; content:"name=|22|c1|22 0d 0a 0d 0a|c"; http_client_body; reference:md5,37d530ffa0bf1129f2db63b75fccce28; classtype:trojan-activity; sid:2020156; rev:7; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6858 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Emotet.C Variant Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/download.php?listfiles="; http_uri; content:"Content-Length|3a 20|0|0d 0a|"; http_header; content:!"User-Agent|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; content:!"|0d 0a|Accept"; http_header; reference:md5,cd74438c04b09baa5c32ad0e5a0306e7; classtype:trojan-activity; sid:2020157; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6859 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vawtrak/NeverQuest Posting Data"; flow:established,to_server; content:"POST"; http_method; content:"/0000"; offset:2; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$/Ui"; flowbits:set,ET.Vawtrak; metadata: former_category TROJAN; reference:md5,1a5ee37a6075b5a95faf8f07ad060cc9; classtype:trojan-activity; sid:2025087; rev:2; metadata:created_at 2015_01_08, updated_at 2017_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6861 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/DDoS.M distributed via CVE-2014-6271 Checkin"; flow:established,to_server; content:"BUILD "; depth:6; pcre:"/^(?:MIPS(?:EL)?|POWERPC|ARM|X86)\x0a$/R"; flowbits:set,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; classtype:trojan-activity; sid:2019242; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6863 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M JUNK command"; flow:established,to_client ; content:"JUNK "; depth:5; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020162; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6864 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M GETLOCALIP command"; flow:established,to_client ; content:"GETLOCALIP "; depth:11; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020163; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6865 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M SCANNER command"; flow:established,to_client ; content:"SCANNER "; depth:8; pcre:"/^(?:ON|OFF)/R"; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020164; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6866 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M KILLATTK command"; flow:established,to_client ; content:"KILLATTK "; depth:9; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020165; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6867 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M LOLNOGTFO command"; flow:established,to_client ; content:"LOLNOGTFO "; depth:10; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020166; rev:2; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6868 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Brontok User-Agent Detected (Rivest)"; flow:established,to_server; content:"User-Agent|3a| Rivest|0d 0a|"; http_header; nocase; reference:md5,c83b55ab56f3deb60858cb25d6ded8c4; classtype:trojan-activity; sid:2020179; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6875 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tinba Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:"/|20|HTTP/1.0|0d 0a|Host|3a 20|"; fast_pattern:only; content:"|0d 0a 0d 0a|"; content:!"|00 00 00 00|"; within:4; content:!"|FF FF FF FF|"; within:4; byte_extract:4,0,Tinba.Pivot,relative; byte_test:4,=,Tinba.Pivot,16,relative; byte_test:4,!=,Tinba.Pivot,4,relative; pcre:"/^Host\x3a[^\r\n]+?\r\nContent-Length\x3a\x20\d{2,}\r\n(?:\r\n)?$/H"; flowbits:set,ET.Tinba.Checkin; reference:md5,1e644fe146f62bd2fc585b8df6712ff6; classtype:trojan-activity; sid:2019168; rev:4; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6880 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|qtrudrukmurps7tc"; nocase; distance:0; fast_pattern; reference:md5,35a7f70c5e0cd4814224c96e3c62fa42; classtype:trojan-activity; sid:2020206; rev:1; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6886 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET TROJAN Win32.ChinaZ.DDoSClient Checkin"; flow:established,to_server; content:"Windows "; depth:8; content:"|20|MHZ|00|"; fast_pattern; distance:0; content:"|00|Win"; distance:0; content:"|00|"; distance:2; within:2; reference:md5,8643a44febdf73159b2d5c437dc40cd3; classtype:trojan-activity; sid:2020209; rev:2; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6887 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tzsvejrzduo52siy"; nocase; distance:0; fast_pattern; reference:md5,49e988b04144b478e3f52b2abe8a5572; classtype:trojan-activity; sid:2020210; rev:1; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6888 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/PcClient.AA Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/2015"; http_uri; depth:5; fast_pattern; pcre:"/^\d+?\/(?:\d+?\/-?\d+?\.(?:php|jsp))?$/URi"; content:"Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.2|3b| .NET CLR 1.1.4322|3b| .NET CLR 2.0.50727|3b| InfoPath.1|29 0d 0a|"; http_header; reference:md5,33439543cae709aa7efa58f94e4b2a62; classtype:trojan-activity; sid:2019201; rev:11; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6890 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 44"; flow:to_server,established; dsize:>11; content:"|96 71|"; offset:13; depth:2; byte_jump:4,-15,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]{5}.{4}\x96\x71/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0a09c176351398922770153bdd54c594; classtype:trojan-activity; sid:2020214; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_01_20, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6895 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Nitol.A Checkin 2"; flow:from_client,established; dsize:260; content:"MB|00 00|"; content:"Windows|20|"; distance:0; content:"V1.0|00 00|"; offset:180; fast_pattern; reference:md5,b9096b87cf643c5f86789d995e9e773d; classtype:trojan-activity; sid:2020222; rev:1; metadata:created_at 2015_01_21, updated_at 2015_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6897 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CryptoWall CryptoWall 3.0 Check-in"; flow:established,to_server; content:"POST"; http_method; content:"http|3a 2f 2f|proxy"; depth:12; http_raw_uri; fast_pattern; content:"i2p|0d 0a|"; http_header; content:!"|0d 0a|Accept-"; http_header; content:!"Referer|3a|"; http_header; reference:md5,3c53c9f7ab32a09de89bb44e5f91f9af; classtype:trojan-activity; sid:2020233; rev:2; metadata:created_at 2015_01_21, updated_at 2015_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6904 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Adrom.Backdoor CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:".php?page="; http_uri; content:"&enckey="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\x26enckey\x3D[A-F0-9]+$/U"; reference:md5,c621055803c68e89f3cb141608fd0894; reference:md5,3c2be5202d2d68047c76bdf7e1dfc2be; classtype:trojan-activity; sid:2020293; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6953 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Scieron Retrieving Information Response"; flow:established,from_server; file_data; content:"system"; within:6; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$/R"; flowbits:isset,ET.Trojan.Scieron.Ret; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; reference:md5,a36db258d0f6f085e8e5030d8e9a9bf4; classtype:trojan-activity; sid:2020297; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6955 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Scieron-A UA (HTClient)"; flow:established,to_server; content:"User-Agent|3a 20|HTClient|3b|"; http_header; fast_pattern:12,9; reference:md5,15deb1167a383d20b4232503b2f22b24; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:trojan-activity; sid:2020298; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6956 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Scieron-A Checkin via HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a 20|HTClient|3b|"; http_header; fast_pattern:12,9; pcre:"/^\/\d+$/U"; content:!"Referer|3a 20|"; http_header; content:!"Accept"; http_header; reference:md5,15deb1167a383d20b4232503b2f22b24; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:trojan-activity; sid:2020299; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6957 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN W32/AGENT.NXNX Checkin 2"; flow:to_server,established; dsize:200; content:"D|3a 00 00 00|"; offset:7; depth:13; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$/"; reference:md5,fdcf0e3e3ad69cdd570387c4ce9aa8b3; reference:url,ahnlabasec.tistory.com/1007; reference:url,global.ahnlab.com/global/upload/download/asecreport/ASEC Report_Vol.58_Eng.pdf; classtype:trojan-activity; sid:2020303; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6958 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET 1025 -> $HOME_NET any (msg:"ET TROJAN Possible Mailer Dropped by Dyre SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02 41 55|"; distance:0; content:"|55 04 08|"; distance:0; pcre:"/^.{2}(?P<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(?P=var)/Rs"; reference:md5,dbcdaf617e19d2a35f763ac996cf8cd7; classtype:trojan-activity; sid:2020205; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_01_19, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6960 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN KL-Remote / Cryp_Banker14 RAT connection"; flow:established,to_server; dsize:13; content:"|3c 7c|PRINCIPAL|7c 3e|"; fast_pattern:only; flowbits:set,ET.KLRemote; reference:md5,636edeba541483421e29b81b35f92841; reference:md5,c5763d0ef12dffa213d265596bd1acf9; reference:md5,5e01557b8650616e005a9949cbf5459a; classtype:trojan-activity; sid:2020315; rev:1; metadata:created_at 2015_01_27, updated_at 2015_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6966 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN KL-Remote / Cryp_Banker14 RAT response"; flow:established,from_server; dsize:6; content:"|3c 7c|OK|7c 3e|"; fast_pattern:only; flowbits:isset,ET.KLRemote; reference:md5,636edeba541483421e29b81b35f92841; reference:md5,c5763d0ef12dffa213d265596bd1acf9; reference:md5,5e01557b8650616e005a9949cbf5459a; classtype:trojan-activity; sid:2020316; rev:1; metadata:created_at 2015_01_27, updated_at 2015_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6967 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Mailer CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/action.php?action=get_"; http_uri; fast_pattern:only; content:"Send Mail"; depth:9; http_user_agent; content:!"Referer|3a|"; http_header; pcre:"/^\/action\.php\?action=get_(?:mails|red)$/U"; reference:md5,57e546330fd3a4658dff0e29cbb98214; classtype:trojan-activity; sid:2020330; rev:2; metadata:created_at 2015_01_29, updated_at 2015_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6969 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Mailer CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; content:"/action.php?action="; http_uri; fast_pattern:only; content:"&sent_all="; http_uri; content:"&sent_success="; distance:0; http_uri; content:"&active_connections="; distance:0; http_uri; content:"&queue_connections="; distance:0; http_uri; content:"Send Mail"; depth:9; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,57e546330fd3a4658dff0e29cbb98214; classtype:trojan-activity; sid:2020329; rev:3; metadata:created_at 2015_01_29, updated_at 2015_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6970 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/hello.php"; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a[^\r\n]+?\r\n(?:\r\n)?$/Hi"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020339; rev:2; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6977 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Checkin"; flow:to_server,established; content:"GET"; http_method; content:".php?admin="; fast_pattern:only; content:"&id="; http_uri; content:"&nat="; http_uri; content:"&os="; http_uri; content:"&video="; http_uri; content:"&arch_type="; http_uri; content:"&v="; http_uri; content:"&av_list="; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a[^\r\n]+?\r\n(?:\r\n)?$/Hi"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020340; rev:5; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6978 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Download"; flow:to_server,established; content:"/bn_versions/"; http_uri; fast_pattern:only; content:".exe"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/\/bn_versions\/\d+?\.exe$/U"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020341; rev:4; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6979 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ArcDoor User-Agent (ALIZER)"; flow:established,to_server; content:"User-Agent|3a 20|ALIZER|0d 0a|"; http_header; reference:md5,71bae4762a6d2c446584f1ae991a8fbe; classtype:trojan-activity; sid:2020344; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6980 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ArcDoor Intial Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:!"Accept"; http_header; content:"Content-Length|3a 20|28|0d 0a|"; fast_pattern:only; pcre:"/^[a-z0-9]{11}=\d{16}$/P"; reference:md5,71bae4762a6d2c446584f1ae991a8fbe; classtype:trojan-activity; sid:2020345; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6981 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dropper YABROD Downloading Files"; flow:from_client,established; urilen:11; content:"/Yabrod.pdf"; content:"User-Agent|3a 20|n1|0d 0a|"; fast_pattern:12,4; content:!"Referer|3a 20|"; http_header; content:!"|0d 0a|Accept"; http_header; reference:md5,44df02ac28d80deb45f5c7c48b56a858; reference:url,fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-behind-the-syria-conflict.pdf; classtype:trojan-activity; sid:2020346; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6982 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BePush/Kilim Checkin response"; flow:established,from_server; file_data; content:"Server_ok"; depth:9; flowbits:isset,ET.FB.troj; reference:url,seclists.org/fulldisclosure/2015/Jan/131; reference:md5,cdcc132fad2e819e7ab94e5e564e8968; classtype:trojan-activity; sid:2020349; rev:2; metadata:created_at 2015_02_03, updated_at 2015_02_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6983 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Win32/Critroni Tor DNS Proxy lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|23bteufi2kcqza2l"; distance:0; nocase; reference:md5,194a931aa49583191eedd19478396ebc; classtype:trojan-activity; sid:2019909; rev:3; metadata:created_at 2014_12_10, updated_at 2014_12_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6984 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|3fdzgtam4qk625n6"; nocase; distance:0; fast_pattern; reference:md5,adb0de790bd3fb88490a60f0dddd90fa; classtype:trojan-activity; sid:2020358; rev:1; metadata:created_at 2015_02_04, updated_at 2015_02_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6986 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 45"; flow:to_server,established; dsize:>11; content:"|7a 9a|"; offset:13; depth:2; byte_jump:4,0,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,eb7909105fd05064b14a21465742952c; classtype:trojan-activity; sid:2020371; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6990 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Sakula/Mivast C2 Activity"; flow:established,to_server; content:"POST"; http_method; content:".asp?cstring="; http_uri; fast_pattern:only; content:"&tom="; http_uri; content:"&id="; distance:0; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"|00 00 00 00|"; depth:4; http_client_body; reference:md5,5acc539355258122f8cdc7f5c13368e1; classtype:trojan-activity; sid:2020378; rev:2; metadata:created_at 2015_02_06, updated_at 2015_02_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6993 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.KeyLogger.ODN Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:19; content:"/newage.txt"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,4e83c405f35efd128ab8c324c12dbde9; classtype:trojan-activity; sid:2019467; rev:3; metadata:created_at 2014_10_17, updated_at 2014_10_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7008 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Rovnix.J Checkin 2"; flow:established,to_server; content:"[0]|0d 0a|LP="; http_client_body; content:"|0a|VID="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; content:"POST"; http_method; reference:md5,9471e926eda81b4f797b6cfe273e4e79; classtype:trojan-activity; sid:2020396; rev:2; metadata:created_at 2015_02_11, updated_at 2015_02_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7010 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN MSIL/Golroted.B Keylogger FTP"; flow:established,to_server; content:"STOR Logger_"; reference:md5,b2b82fd662dd0ddf53aa37bb9025bf92; classtype:trojan-activity; sid:2020411; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7011 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN Predator Pain Keylogger FTP"; flow:established,to_server; content:"STOR Predator_Pain"; reference:md5,c9025c9835d1b7d6f0dd2390ea7d5e18; classtype:trojan-activity; sid:2020412; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7012 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Gulcrypt.B Downloading components - set"; flow:established,to_server; urilen:8; content:"GET"; http_method; content:"/manager"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; flowbits:set,ET.Gulcrypt; flowbits:noalert; reference:md5,6c41449d6c3efd4c9f98374a0d132ff6; classtype:trojan-activity; sid:2020420; rev:2; metadata:created_at 2015_02_13, updated_at 2015_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7014 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Gulcrypt.B Downloading components"; flow:established,from_server; flowbits:isset,ET.Gulcrypt; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,6c41449d6c3efd4c9f98374a0d132ff6; classtype:trojan-activity; sid:2020421; rev:2; metadata:created_at 2015_02_13, updated_at 2015_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7015 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex POST CnC Beacon 2"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:!"Referer|3A|"; http_header; content:"Host|3a 20|"; depth:6; http_header; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r?$/RHmi"; content:"Content-Type|3a 20|text/css|0d 0a|Accept|3a 20|image/**|0d 0a|"; distance:0; http_header; fast_pattern:21,20; content:"|0d 0a 0d 0a|"; byte_extract:1,0,Dridex.Pivot,relative; byte_test:1,!=,Dridex.Pivot,0,relative; byte_test:1,=,Dridex.Pivot,7,relative; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:trojan-activity; sid:2020301; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7016 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Arid Viper APT Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"_rtemp.php?n="; http_uri; fast_pattern:only; content:"|0d 0a|REMOTE_USER|3a 20|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,5efc02d416b15554b25d9acec362148e; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-arid-viper.pdf; classtype:trojan-activity; sid:2020436; rev:2; metadata:created_at 2015_02_16, updated_at 2015_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7037 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Chanitor Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|ukzo73z4inzpenmq"; nocase; distance:0; fast_pattern; reference:md5,53752a41ed21172343f678423d6c9a44; classtype:trojan-activity; sid:2020458; rev:1; metadata:created_at 2015_02_17, updated_at 2015_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7039 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex Post Checkin Activity 2"; flow:established,to_server; urilen:20<>100; content:!"Referer|3a|"; http_header; content:"|20|HTTP/1.1|0d 0a|Host|3a 20|"; pcre:"/^Host\x3a\x20(?=[a-z0-9]{0,19}[A-Z])(?=[A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H"; content:"|0d 0a|Connection|3a 20|Close|0d 0a|User-Agent|3a 20|Mozilla/"; http_header; within:41; fast_pattern:4,20; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:trojan-activity; sid:2020302; rev:6; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7052 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Beaugrit.gen.AAAA"; flow:established,to_server; content:"GET"; http_method; content:"/attach/1759CB3B5124F217143044"; http_uri; fast_pattern:only; content:!"Referer|3a 20|"; http_header; reference:md5,fbfe6c2673aec9098e1fc9bf6d7fc059; classtype:trojan-activity; sid:2020479; rev:2; metadata:created_at 2015_02_19, updated_at 2015_02_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7053 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.NSIS.Comame.A Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/9.php?safe="; http_uri; fast_pattern:only; content:"User-Agent|3a 20|NSIS_Inetc (Mozilla|29 0d 0a|"; http_header; content:!"Referer|3a 20|"; http_header; reference:md5,6a15f19a3ccd05f74537464e6df64dab; classtype:trojan-activity; sid:2020480; rev:3; metadata:created_at 2015_02_19, updated_at 2015_02_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7054 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Carbanak APT CnC Beacon 1"; flow:established,to_server; dsize:24; content:"|08|"; depth:1; byte_extract:1,1,Carbanak.Pivot,relative; byte_test:1,!=,Carbanak.Pivot,0,relative; byte_test:1,=,Carbanak.Pivot,3,relative; content:"|00 00 00 02 00 00 00 00 00 00 00 00 00|"; distance:4; within:13; fast_pattern; content:!"|00 00 00|"; within:3; reference:md5,6ae1bb06d10f253116925371c8e3e74b; reference:url,securelist.com/files/2015/02/Carbanak_APT_eng.pdf; classtype:trojan-activity; sid:2020455; rev:2; metadata:created_at 2015_02_17, updated_at 2015_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7062 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/LockScreen CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; urilen:8; content:"/cou.php"; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"Host|3a|"; depth:5; http_header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:\r\n)?$/H"; reference:md5,046e4b3ff7b323f2147f2d5d43b7e5f4; reference:md5,e4ab12da8828a7f1e6c077a2999f8320; classtype:trojan-activity; sid:2020504; rev:2; metadata:created_at 2015_02_23, updated_at 2015_02_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7063 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Sality.3 Checkin"; flow:to_server,established; content:"/?f"; http_uri; fast_pattern:only; content:!"User-Agent|3a| "; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; content:!"Cache-Control|3a 20|"; http_header; pcre:"/\/\?f$/U"; reference:md5,df9516919e75853742e63db318e7d346; classtype:trojan-activity; sid:2020505; rev:2; metadata:created_at 2015_02_23, updated_at 2015_02_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7064 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Athena DDoS Bot Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:!"Referer|3a|"; http_header; content:"a=%"; depth:3; http_client_body; fast_pattern; content:"&b="; distance:0; http_client_body; content:"&c="; distance:0; http_client_body; pcre:"/^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$/P"; reference:md5,19ca0d830cd7b44e5de1ab85f4e17d82; classtype:trojan-activity; sid:2017633; rev:4; metadata:created_at 2013_04_26, updated_at 2013_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7067 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET !1433 (msg:"ET TROJAN Unknown Trojan Downloading PE via MSSQL Connection to Non-Standard Port"; flow:from_server,established; flowbits:isset,ET.MSSQL; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,754b48c57a00b7c9f0e0640166ac7bb5; classtype:trojan-activity; sid:2020569; rev:1; metadata:created_at 2015_02_25, updated_at 2015_02_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7068 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Chanitor .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|brk7tda32wtkxjpa"; nocase; distance:0; fast_pattern; reference:md5,34ad24860495397c994f8ae168d0e639; classtype:trojan-activity; sid:2020581; rev:1; metadata:created_at 2015_02_27, updated_at 2015_02_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7069 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 46"; flow:to_server,established; dsize:>11; content:"|84 60|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x84\x60/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,019ab136fd79147b10ddb3e4162709db; classtype:trojan-activity; sid:2020586; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7071 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Xunpf.A Retrieving DLL"; flow:established,to_server; content:"GET"; http_method; content:"/web_"; http_uri; fast_pattern:only; content:".jpg"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/\/web_[0-9A-F]{12}\.jpg$/U"; reference:md5,dfb7dd8b6975b73dc9c731319a05f86d; classtype:trojan-activity; sid:2020601; rev:2; metadata:created_at 2015_03_03, updated_at 2015_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7072 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Andromeda Downloading Module"; flow:to_server,established; content:"GET"; http_method; content:".pack"; nocase; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\.pack$/Ui"; content:"Mozilla"; http_header; pcre:"/^User-Agent\x3a\x20Mozilla(?:\/4\.0)?\r?$/Hmi"; reference:md5,65125129418e07ce1000aa677b66b72f; classtype:trojan-activity; sid:2018604; rev:5; metadata:created_at 2014_06_24, updated_at 2014_06_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7074 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 55"; flow:to_server,established; dsize:>11; content:"|39 dd|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x39\xdd/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5f42a5b709bf9a1377d2464f936fc841; classtype:trojan-activity; sid:2020614; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7075 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 47"; flow:to_server,established; dsize:>11; content:"|79 9f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x9f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5ad0bb62806297fb8bf159d94f82dbb9; classtype:trojan-activity; sid:2020606; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7076 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 48"; flow:to_server,established; dsize:>11; content:"|da 41|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\xda\x41/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,69ffa441a8c3cf4d8fe643174bebb51d; classtype:trojan-activity; sid:2020607; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7077 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 49"; flow:to_server,established; dsize:>11; content:"|79 dd|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\xdd/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,2e99b9462f95154e9f5b94eeed33a6e3; classtype:trojan-activity; sid:2020608; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7078 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 50"; flow:to_server,established; dsize:>11; content:"|7b 9d|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,1701f8c71b5861a2f2890dc609ef6eda; classtype:trojan-activity; sid:2020609; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7079 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 51"; flow:to_server,established; dsize:>11; content:"|7a 9c|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7a\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,4b70f302c72c94d0b9214808d9f72419; classtype:trojan-activity; sid:2020610; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7080 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 53"; flow:to_server,established; dsize:>11; content:"|70 9c|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5a0e030383c472f7d94c0bcd6af71a90; classtype:trojan-activity; sid:2020612; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7081 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 54"; flow:to_server,established; dsize:>11; content:"|70 9e|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,4d6e0de81f57461337ccfbcce6dc1056; classtype:trojan-activity; sid:2020613; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7082 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Emotet Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; content:"/"; offset:1; http_uri; content:"/"; distance:0; http_uri; content:"MSIE 7.0|3b|"; http_user_agent; fast_pattern; content:"Windows NT 6.0"; within:15; http_user_agent; pcre:"/^\/[A-Za-z0-9]+\/[A-Za-z0-9]+\/$/U"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; reference:md5,3083b68cb5c2a345972a5f79e735c7b9; classtype:trojan-activity; sid:2019693; rev:5; metadata:created_at 2014_11_11, updated_at 2014_11_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7086 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Bayrob Keepalive"; flow:established,to_server; content:"GET"; http_method; urilen:9; content:"/isup.php"; http_uri; fast_pattern:only; content:"Accept-Encoding|3a 20 20 20 20 20 20 20 20 20 20 20 20 20|"; http_raw_header; content:!"Referer|3a|"; http_header; reference:md5,a4a3fab712b04ee901f491d4c704b138; classtype:trojan-activity; sid:2020621; rev:3; metadata:created_at 2015_03_05, updated_at 2015_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7087 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Trapwot FakeAV Post Infection CnC Beacon"; flow:established,to_server; content:"/rp?"; http_uri; fast_pattern:only; content:"v="; http_uri; content:"a="; http_uri; content:"u="; http_uri; content:"d="; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/(?:[^\x2f]+\/)?rp\?[a-z]=/U"; reference:md5,fc962cb08f62e3d6368500a8e747cf73; classtype:trojan-activity; sid:2020645; rev:2; metadata:created_at 2015_03_09, updated_at 2015_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7089 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Onkods.A Downloader Checkin"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|"; depth:12; http_header; pcre:"/^User-Agent\x3a\x20(?=\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(?:\r\n)?$/H"; pcre:"/^\/(?:[a-z]+\/)*?[a-z]+\.exe$/U"; reference:md5,fb570e6d68e708daeceae5dfc544fba2; classtype:trojan-activity; sid:2018121; rev:4; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7091 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot POST Request to C2"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"HTTP/1."; content:"|0D 0A|Accept|3a| */*|0D 0A|User-Agent|3a| Mozilla"; distance:1; within:34; fast_pattern; content:!"Accept-"; http_header; content:!"Content-Type|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^Accept\x3a \*\/\*\r\nUser-Agent\x3a[^\r\n]+?\r\nHost\x3a[^\r\n]+?\r\nContent-Length\x3a[^\r\n]+?\r\n(?:Proxy-)?Connection\x3a[^\r\n]+?\r\n(?:Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(?:\r\n)?$/H"; reference:md5,c86f7ec18b78055a431f7cd1dca65b82; classtype:trojan-activity; sid:2019141; rev:3; metadata:created_at 2014_09_08, updated_at 2014_09_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7092 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Cryptolocker .onion Proxy Domain (juf5pjk4sl7uojh4)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|juf5pjk4sl7uojh4"; fast_pattern; distance:0; nocase; reference:md5,499a46c23afe23de49346adf1b4f3a4f; reference:url,www.mogozobo.com/?p=2371; classtype:trojan-activity; sid:2020670; rev:1; metadata:created_at 2015_03_11, updated_at 2015_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7101 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gamarue/Andromeda Downloading Payload"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|0d 0a|"; fast_pattern:5,20; http_header; pcre:"/^\/[a-z]+\/[a-z]+\.exe$/U"; reference:md5,85d925a76909f29c3f370f35faedb9ea; classtype:trojan-activity; sid:2020683; rev:2; metadata:created_at 2015_03_11, updated_at 2015_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7102 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Trapwot FakeAV Checkin"; flow:established,to_server; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"v="; http_uri; content:"a="; http_uri; content:"u="; http_uri; content:"i=0"; http_uri; fast_pattern:only; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; pcre:"/^\/(?:[a-z]+\/)?[a-z_]+\?[a-z]=/U"; reference:md5,baf71ace207afd3f330c4aba3784e074; classtype:trojan-activity; sid:2020646; rev:4; metadata:created_at 2015_03_09, updated_at 2015_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7103 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vicepass CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/index.php?data="; depth:16; http_uri; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"Host|3a|"; depth:5; http_header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:\r\n)?$/Hmi"; reference:md5,5f1997927e94b98982e5ee2cea095956; classtype:trojan-activity; sid:2020690; rev:2; metadata:created_at 2015_03_13, updated_at 2015_03_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7110 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 56"; flow:to_server,established; dsize:>11; content:"|2e 96|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x2e\x96/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0fc4f20426ab1da2c705a4523d3baa0b; classtype:trojan-activity; sid:2020691; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7111 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 57"; flow:to_server,established; dsize:>11; content:"|7b 9f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9f/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,06be359c6e6396fe105e8b59ac5a992e; classtype:trojan-activity; sid:2020692; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7112 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 58"; flow:to_server,established; dsize:>11; content:"|31 ad|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x31\xad/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,20a72c5af06e054ff840915b6632965f; classtype:trojan-activity; sid:2020693; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7113 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 59"; flow:to_server,established; dsize:>11; content:"|44 df|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x44\xdf/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,6a263de8d3f6d82e73330c84a83057bf; classtype:trojan-activity; sid:2020694; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7114 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 60"; flow:to_server,established; dsize:>11; content:"|70 94|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x94/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0fbca8d9f71265f44513e4f885587301; classtype:trojan-activity; sid:2020695; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7115 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 61"; flow:to_server,established; dsize:>11; content:"|3f a6|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x3f\xa6/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0045ce5ce7d697ecc86f1e44398bf404; classtype:trojan-activity; sid:2020696; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7116 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tinba Checkin 3"; flow:established,to_server; content:"POST"; http_method; content:"Content-Length|3a 20|13|0d 0a|"; http_header; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"|00 04 00 00 00|"; offset:4; depth:5; http_client_body; content:!"|00 00 00 00|"; depth:4; http_client_body; reference:md5,e610d3c383a4f1c8a27aaf018b12c370; classtype:trojan-activity; sid:2020568; rev:4; metadata:created_at 2015_02_25, updated_at 2015_02_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7117 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FakeAV Variant CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php?id="; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Content-T"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php\?id=\d+$/U"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; reference:md5,693ca229558aab99e0a9d3385cacc40c; classtype:trojan-activity; sid:2020706; rev:2; metadata:created_at 2015_03_18, updated_at 2015_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7125 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Agent.WMN CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|User-Agent"; depth:59; http_header; fast_pattern:31,20; content:"="; offset:4; depth:9; http_client_body; content:"=&"; distance:55; within:2; http_client_body; pcre:"/^[a-z]{4,12}=(?:[A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}/P"; reference:md5,3031604f1cf95ee4ccc339c9e4d5b92f; classtype:trojan-activity; sid:2020708; rev:2; metadata:created_at 2015_03_18, updated_at 2015_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7126 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN RocketKitten APT Checkin"; flow:to_server,established; content:"/index.php?c="; http_uri; content:"&r="; http_uri; distance:0; content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|"; fast_pattern:5,20; http_header; content:!"Referer|3a 20|"; http_header; reference:url,isc.sans.edu/forums/diary/Rocket+Kitten+Is+it+still+APT+if+you+can+buy+it+off+the+shelf/19123; reference:md5,f89a4d4ae5cca6d69a5256c96111e707; classtype:trojan-activity; sid:2020078; rev:3; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7127 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M2"; flow:established,to_server; content:"GET"; http_method; content:".php?U3ViamVjdD1"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,c075fa8484d52c3978826c2f07ce9a9c; classtype:trojan-activity; sid:2020718; rev:3; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7129 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FindPOS Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"oprat="; http_client_body; fast_pattern:only; content:"&uid="; http_client_body; content:"&uinfo="; http_client_body; content:"&win="; http_client_body; content:"&vers="; http_client_body; reference:md5,fe0f997d81d88bc11cc03e4d1fd61ebe; classtype:trojan-activity; sid:2020723; rev:3; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7130 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN KeyLogger related to FindPOS CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"uid="; depth:4; http_client_body; content:"&win="; distance:0; http_client_body; content:"&vers="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; reference:md5,593af622a90f2038e35ee980e09c1c3c; reference:url,researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-family-discovered/; reference:url,blogs.cisco.com/security/talos/poseidon; classtype:trojan-activity; sid:2020724; rev:2; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7131 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible Adwind SSL Cert (assylias.Inc)"; flow:established,from_server; content:"|0b|"; content:"|04 1f 23 9d bd|"; distance:18; within:20; content:"|55 04 0a|"; distance:0; content:"|0c|assylias.Inc"; distance:1; within:13; fast_pattern; reference:md5,4e5c28fab23b35dea2d48a1c2db32b56; classtype:trojan-activity; sid:2020728; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_03_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7133 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux.DDoS Checkin"; flow:established,to_server; dsize:1024; content:"VERSONEX|3a|"; depth:9; content:"|7c|Hacker|00 00 00|"; distance:0; reference:md5,0eab12cebbf1c8f25d82c65f34aab9d7; classtype:trojan-activity; sid:2019172; rev:4; metadata:created_at 2014_08_19, updated_at 2014_08_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7134 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kazy Checkin"; flow:to_server,established; content:"/get_"; http_uri; content:"did="; http_uri; content:"Downloader"; depth:10; http_user_agent; reference:md5,73d2dd466df92b77a4c34adcd13e8b50; reference:url,community.emc.com/community/connect/rsaxchange/netwitness/blog/2014/03/28/new-kazy-variant-kazy-forces; classtype:trojan-activity; sid:2018341; rev:7; metadata:created_at 2013_09_11, updated_at 2013_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7137 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:"/sync"; depth:5; http_uri; content:"/?ext="; within:7; http_uri; fast_pattern; content:"&pid="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,aa9542f02b26a554650a9649d2239181; classtype:trojan-activity; sid:2020737; rev:2; metadata:created_at 2015_03_24, updated_at 2015_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7138 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN CryptoLocker .onion Proxy Domain (iezqmd4s2fflmh7n)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|iezqmd4s2fflmh7n"; fast_pattern; distance:0; nocase; reference:md5,1d578c11069c7446ca6d05ff7623a972; classtype:trojan-activity; sid:2020740; rev:1; metadata:created_at 2015_03_24, updated_at 2015_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7140 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32.Chroject.B Receiving ClickFraud Commands from CnC 2"; flow:from_server,established; file_data; content:"<html><title>"; within:13; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$/R"; content:"

12/12/2018 -- 16:31:47 - -- This is Suricata version 4.0.6 RELEASE 12/12/2018 -- 16:31:47 - -- CPUs/cores online: 4 12/12/2018 -- 16:31:47 - -- Netmap: Setting IPS mode 12/12/2018 -- 16:31:47 - -- HTTP memcap: 67108864 12/12/2018 -- 16:31:47 - -- using flow hash instead of active packets 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "bid". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt"; flow:established,to_client; content:"36723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"GetDriverSettings2"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:url,www.zerodayinitiative.com/advisories/ZDI-10-256/; reference:url,www.vupen.com/english/advisories/2010/3023; reference:bid,44966; reference:cve,2010-4321; classtype:attempted-user; sid:2012206; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2011_01_20, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 170 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "bid". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt"; flow:established,to_client; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; reference:bid,45546; reference:cve,CVE-2010-3973; classtype:attempted-user; sid:2012158; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2011_01_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 172 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "bid". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Cisco.AnyConnect.VPNWeb.1"; nocase; distance:0; content:"url"; nocase; distance:0; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=909; reference:bid,48081; reference:cve,2011-2039; reference:cve,2011-2040; classtype:attempted-user; sid:2012930; rev:3; metadata:created_at 2011_06_03, updated_at 2011_06_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 177 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "bid". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Easewe FTP OCX ActiveX Control EaseWeFtp.ocx Remote Code Execution Attempt"; flow:established,to_client; content:"31AE647D-11D1-4E6A-BE2D-90157640019A"; nocase; fast_pattern:only; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)/smi"; reference:bid,48393; classtype:attempted-user; sid:2013119; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2011_06_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 178 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "bid". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Easy Printer Care Software XMLCacheMgr ActiveX Control Remote Code Execution Attempt"; flow:established,to_client; content:"ActiveXObject"; nocase; content:"HPESPRIT.XMLCacheMgr.1"; nocase; distance:0; content:"CacheDocumentXMLWithId"; nocase; distance:0; reference:bid,51396; reference:cve,2011-4786; classtype:attempted-user; sid:2014132; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2012_01_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 306 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> $HOME_NET any (msg:"ET CURRENT_EVENTS SN and CN From MS TS Revoked Cert Chain Seen"; flow:established,from_server; content:"|c1 00 8b 3c 3c 88 11 d1 3e f6 63 ec df 40|"; content:"Microsoft Root Authority"; distance:105; within:24; content:"Microsoft Enforced Licensing Intermediate PCA"; distance:0; content:"|61 1a 02 b7 00 02 00 00 00 12|"; distance:0; content:"Microsoft Enforced Licensing Registration Authority CA"; distance:378; within:54; reference:url,blog.crysys.hu/2012/06/the-flame-malware-wusetupv-exe-certificate-chain/; reference:url,rmhrisk.wpengine.com/?p=52; reference:url,msdn.microsoft.com/en-us/library/aa448396.aspx; reference:md5,1f61d280067e2564999cac20e386041c; classtype:bad-unknown; sid:2014870; rev:4; metadata:created_at 2012_06_08, updated_at 2012_06_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 750 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe Flash Zero Day LadyBoyle Infection Campaign"; flow:established,to_client; file_data; content:"FWS"; distance:0; content:"LadyBoyle"; distance:0; reference:md5,3de314089db35af9baaeefc598f09b23; reference:md5,2568615875525003688839cb8950aeae; reference:url,blog.fireeye.com/research/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.html; reference:url,www.adobe.com/go/apsb13-04; reference:cve,2013-0633; reference:cve,2013-0633; classtype:trojan-activity; sid:2016391; rev:2; metadata:created_at 2013_02_08, updated_at 2013_02_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 887 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS winlogon.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/winlogon.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/winlogon\.exe$/Ui"; reference:md5,fd95cc0bb7d3ea5a0c86d45570df5228; reference:md5,09330c596a33689a610a1b183a651118; classtype:bad-unknown; sid:2016697; rev:13; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 962 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS services.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/services.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/services\.exe$/Ui"; reference:md5,145c06300d61b3a0ce2c944fe7cdcb96; classtype:bad-unknown; sid:2016698; rev:13; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 963 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS smss.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/smss.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/smss\.exe$/Ui"; reference:md5,450dbe96d7f4108474071aca5826fc43; classtype:bad-unknown; sid:2016701; rev:12; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 964 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS csrss.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/csrss.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/csrss\.exe$/Ui"; reference:md5,21a069667a6dba38f06765e414e48824; classtype:bad-unknown; sid:2016702; rev:12; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 965 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS rundll32.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/rundll32.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/rundll32\.exe$/Ui"; reference:md5,ea3dec87f79ff97512c637a5c8868a7e; classtype:bad-unknown; sid:2016703; rev:12; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 966 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS lsass.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/lsass.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/lsass\.exe$/Ui"; reference:md5,d929747212309559cb702dd062fb3e5d; classtype:bad-unknown; sid:2016699; rev:13; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 967 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS explorer.exe in URI"; flow:established,to_server; content:"GET"; http_method; urilen:<100; content:"/explorer.exe"; http_uri; nocase; fast_pattern:only; pcre:"/\/explorer\.exe$/Ui"; reference:md5,de1bc32ad135b14ad3a5cf72566a63ff; classtype:bad-unknown; sid:2016700; rev:13; metadata:created_at 2013_04_01, updated_at 2013_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 968 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php"; flow:established,to_client; file_data; content:"/wp-login.php|0d 0a|"; nocase; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; reference:url,www.arbornetworks.com/asert/2013/08/fort-disco-bruteforce-campaign/; reference:md5,722a1809bd4fd75743083f3577e1e6a4; classtype:trojan-activity; sid:2017310; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, deployment Datacenter, tag Wordpress, signature_severity Major, created_at 2013_08_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1167 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS .PIF File Inside of Zip"; flow:established,from_server; file_data; content:"PK"; within:2; content:".pif"; nocase; fast_pattern; within:500; reference:md5,2e760350a5c692bd94c7c6d1233af72c; classtype:trojan-activity; sid:2018125; rev:5; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1326 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Gamut Spambot Checkin"; flow:established,to_server; content:"file=SenderClient.conf"; http_uri; nocase; fast_pattern:only; pcre:"/file=SenderClient.conf$/Ui"; content:!"Referer|3a 20|"; flowbits:set,ETGamut; reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html; reference:md5,f00f3f47062646f900aa327b1d5ca3a1; classtype:trojan-activity; sid:2018245; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1334 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Gamut Spambot Checkin Response"; flow:established,from_server; file_data; content:"count_threads|09 09 09 3d 09|"; depth:18; fast_pattern; content:"|0a|efficiency_limit|09 09 3d 09|"; distance:1; within:22; flowbits:isset,ETGamut; reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html; reference:md5,f00f3f47062646f900aa327b1d5ca3a1; classtype:trojan-activity; sid:2018246; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1335 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Gamut Spambot Checkin 2"; flow:established,to_server; urilen:6; content:"POST"; http_method; content:"/?8080"; http_uri; fast_pattern:only; content:"name=|22|action|22 0d 0a 0d 0a|"; http_client_body; pcre:"/^(?:Get(?:Subscription(?:EmailsBlock|Content)|PTR|IP)|Port25(?:Close|Open))\x0d\x0a/RP"; content:"name=|22|location|22 0d 0a 0d 0a|"; distance:0; http_client_body; pcre:"/^(?:winload(?:32)?|cmms)\x0d\x0a/RP"; content:!"Referer|3a 20|"; reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html; reference:md5,f00f3f47062646f900aa327b1d5ca3a1; classtype:trojan-activity; sid:2018257; rev:2; metadata:created_at 2014_03_12, updated_at 2014_03_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1336 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute Scan (Outgoing)"; flow:to_server,established; urilen:1; content:"/"; http_uri; content:"Microsoft-WebDAV-MiniRedir/5.1.2600"; http_user_agent; depth:35; content:"Referer|3a 20|http|3a|//"; pcre:"/^Host\x3a (?P\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(?P=ipaddr)\//Hs"; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:attempted-recon; sid:2018353; rev:4; metadata:created_at 2014_04_03, updated_at 2014_04_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1362 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute Scan (incoming)"; flow:to_server,established; urilen:1; content:"/"; http_uri; content:"Microsoft-WebDAV-MiniRedir/5.1.2600"; depth:35; http_user_agent; content:"Referer|3a 20|http|3a|//"; pcre:"/^Host\x3a (?P\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(?P=ipaddr)\//Hs"; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:attempted-recon; sid:2018354; rev:4; metadata:created_at 2014_04_03, updated_at 2014_04_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1363 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> any 80 (msg:"ET CURRENT_EVENTS Win32.RBrute http server request"; flow:to_server,established; content:"BlackBerry9000/5.0.0.93 Profile/MIDP-2.0 Configuration/CLDC-2.1 VendorID/831"; http_user_agent; fast_pattern:only; nocase; flowbits:set,ET.Rbrute.incoming; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:trojan-activity; sid:2018355; rev:3; metadata:created_at 2014_04_03, updated_at 2014_04_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1364 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any 80 -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute http response"; flow:to_client,established; file_data; content:"kenji oke|0d 0a|"; depth:24; flowbits:isset,ET.Rbrute.incoming; reference:md5,055a9be75e469f8817c9311390a449f6; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:trojan-activity; sid:2018356; rev:3; metadata:created_at 2014_04_03, updated_at 2014_04_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1365 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS OVH Shared Host SSL Certificate (Observed In Use by Some Trojans)"; flow:established,to_client; content:"|55 04 03|"; byte_test:1,>,11,1,relative; byte_test:1,<,14,1,relative; content:"ssl"; distance:2; within:3; pcre:"/^\d{1,2}/R"; content:".ovh.net"; within:8; reference:url,help.ovh.co.uk/SslOnHosting; reference:md5,63079a2471fc18323f355ec28f36303c; reference:md5,20b1c30ef1f5dae656529b277e5b73fb; classtype:bad-unknown; sid:2018364; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_04_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1369 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Styx Exploit Kit Landing Applet With Payload"; flow:established,to_client; file_data; content:".exe?"; fast_pattern:only; content:" -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible W32/Zbot.InfoStealer SSL Cert Parallels.com"; flow:established,to_client; content:"|16 03 01|"; depth:3; content:"|16 03 01|"; distance:0; content:"|52 14 cb 90|"; distance:0; content:"|12|info@parallels.com"; distance:0; reference:md5,19e17898e99af83e5fff9c3bad553bb2; classtype:trojan-activity; sid:2018418; rev:5; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_04_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1389 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS EXE Download from Google Common Data Storage with no Referer"; flow:established,to_server; content:".exe"; fast_pattern:only; http_uri; content:"Host|3a| commondatastorage.googleapis.com|0d 0a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,9fcbc6def809520e77dd7af984f82fd5; reference:md5,71e752dd4c4df15a910c17eadb8b15ba; classtype:trojan-activity; sid:2018556; rev:2; metadata:created_at 2014_06_11, updated_at 2014_06_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1401 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Aug 20 2014 D1"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|00 89 aa ac b6 40 58 a5 8c|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,70bb2e450fe927ee32884cda6fe948b5; classtype:trojan-activity; sid:2018973; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_08_20, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1420 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 3 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9c c5 8b 5d c7 8a 96 b7|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,0d5ad9759753cb4639cd405eddbe2a16; classtype:trojan-activity; sid:2019104; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1424 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 15 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 aa 95 9f e1 a6 33 7b d9|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,edefcbba2944872f31454fcb98802488; classtype:trojan-activity; sid:2019173; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_15, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1427 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 16 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e4 8c bf 77 7c 33 77 06|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,5dd6e69b1e9049f295e314b523679d98; classtype:trojan-activity; sid:2019178; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_16, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1428 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 16 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e8 66 93 12 61 52 ba b4|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0b|Zatusim.com"; distance:1; within:12; reference:md5,2f52d3921613b2fe06c9eb9051d45e60; classtype:trojan-activity; sid:2019186; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_16, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1429 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Androm SSL Cert Sept 18 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; distance:0; content:"|09 00 bf 91 db e3 f1 fb 7c cc|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:md5,ca2f3e2568ac5c01ecf2747f778e13a1; classtype:trojan-activity; sid:2019196; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1435 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 19 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f8 69 16 89 bb bc f3 d7|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,1da03b89c25c9f8999edb8c1abb0c4ed; classtype:trojan-activity; sid:2019200; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_19, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1436 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 22 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 95 78 dc d3 77 1b bc 30|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,bf019054fced52ff03ed8d371dfd371d; classtype:trojan-activity; sid:2019213; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1439 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Spy.Zbot.ACB SSL Cert Sept 24 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 99 56 02 06 27 f8 97 08|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:md5,2ceda25b44378583dfb6df64b92ac654; classtype:trojan-activity; sid:2019227; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1442 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 26 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb c0 73 38 d6 b1 99 a5|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,0fa515ad9fd1031b7a7891a46f72f122; classtype:trojan-activity; sid:2019275; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_26, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1444 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 26 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c5 86 50 03 11 16 99 16|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,75a2e3c9f8783dfc953f6aeb8a9eda2f; classtype:trojan-activity; sid:2019276; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_26, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1445 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS BlackEnergy Possible SSL Cert Sept 26 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 88 91 e8 ca 54 bb 7d 10|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0b|5.79.80.166"; distance:1; within:12; reference:md5,1821351d67a3dce1045be09e88461fe9; classtype:trojan-activity; sid:2019282; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_26, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1446 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 30 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c3 04 eb 4f 91 0a 85 aa|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,a3dd0964ee346db49192836569b41203; classtype:trojan-activity; sid:2019319; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1449 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 30 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ba c8 fb e2 d7 61 26 81|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,27ec921595f9e05e7e8933e71d336fa7; classtype:trojan-activity; sid:2019320; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1450 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 3 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9e 02 84 39 97 d9 ef df|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,27b8d15950022f53ca4ca7004932cf2b; classtype:trojan-activity; sid:2019342; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1455 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Zbot SSL Cert Oct 9 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 be cf d6 29 b3 79 8f e2|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:md5,3a9f4fc34e121fc2e5c0d7775091714c; classtype:trojan-activity; sid:2019382; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_09, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1469 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 15 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d5 2e c1 9c b6 e5 96 7d|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,05823d6ec6d2a483f94ae1794a06c1a6; classtype:trojan-activity; sid:2019413; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_15, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1480 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 15 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 aa 29 c6 1c 85 a5 85 33|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,38f4f489bd7e59ed91dc6ff95f37999f; classtype:trojan-activity; sid:2019419; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_15, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1481 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Zbot SSL Cert Oct 17 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f6 a0 9e 7c 8c 25 3a d0|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,ae773f234152fb5df1ab35116dbb82bd; classtype:trojan-activity; sid:2019470; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_17, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1482 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Zbot SSL Cert Oct 21 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ca 38 a4 ec ec c1 f1 9a|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,1fedcd44951c3dfb861fa83ddcec2b84; classtype:trojan-activity; sid:2019485; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_21, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1487 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 22 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ca f1 2e 3e cb c1 4a c0|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,f4c26252042b9d520cd832b8b4a66de0; classtype:trojan-activity; sid:2019493; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1488 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 22 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8c 54 a8 06 20 b6 93 90|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,1754d4765a05e4637d2dcdbd1c28eaf1; classtype:trojan-activity; sid:2019494; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1489 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 22 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d6 cd df 4e c0 3c fc 13|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,5159780c47b8df01d5eb00d858b4d35a; classtype:trojan-activity; sid:2019495; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1490 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 22 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d1 be 1b e1 6a 4d bf 01|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,f66bf24aa5516e335873c758d007ed3c; classtype:trojan-activity; sid:2019496; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1491 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 27 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ba 53 8e c8 a2 a1 6c 17|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,e5395918babb67b495a094040efff909; classtype:trojan-activity; sid:2019520; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1493 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 27 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fe d5 e3 3b b2 f8 4e f4|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,e5395918babb67b495a094040efff909; classtype:trojan-activity; sid:2019521; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1494 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 27 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 81 01 15 1a 78 7f e9 6e|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,2841fb14060f579e46a301baf234a1e7; classtype:trojan-activity; sid:2019522; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1495 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Oct 27 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9e 10 4b 4c 47 43 e9 4b|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,bd3fd9f55900e2c63d5f4977053e8f68; classtype:trojan-activity; sid:2019523; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1496 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Trustezeb.J SSL Cert Oct 30 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|17|bestofthebestrussia.com"; distance:1; within:24; reference:md5,2d8211ad47b36893b6e1b3fdceb00012; classtype:trojan-activity; sid:2019605; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1501 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32.Zbot.umpz SSL Cert Nov 4 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|16|boogermanshoptools.net"; distance:1; within:33; reference:md5,c6796076a24f35119ebe441725ec9da7; classtype:trojan-activity; sid:2019639; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1506 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Nov 05 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e9 49 68 e1 31 97 48 3f|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,c078788d86c653f428fc3a62dd030ede; classtype:trojan-activity; sid:2019651; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1509 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Trustezeb.E SSL Cert Nov 05 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|easy-access.me"; distance:1; within:15; reference:md5,b648562ee817b3635fa7725afe28577c; classtype:trojan-activity; sid:2019652; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1510 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Zbot SSL Cert Nov 11 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d1 9e 51 1d eb 97 c1 ea|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|08|Sometown"; distance:1; within:9; reference:md5,37f927437de627777c5b571fc46fb218; classtype:trojan-activity; sid:2019698; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_11, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1518 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Nov 12 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b0 48 5c e9 94 c7 59 03|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,31536d977dfc0e158d8f7a365c0543ec; classtype:trojan-activity; sid:2019705; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1524 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Nov 17 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a6 9e 89 2a 06 f4 80 5f|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,b7214b7ff246175e7b6bbe2db600f98e; classtype:trojan-activity; sid:2019719; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_17, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1525 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Gootkit SSL Cert Dec 10 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d2 a9 3c 29 28 ec b0 b1|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:md5,c05453a18b6dc45bc258a377d2161b1c; classtype:trojan-activity; sid:2019907; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_10, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1549 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Win32/Spy.Zbot.ACB SSL Cert Dec 15 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fe 69 db 33 70 71 2c 70|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:md5,d271218da70d0bceb69c477e7d13dcc8; classtype:trojan-activity; sid:2019936; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_15, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1551 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Zbot SSL Cert Dec 16 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 cc c9 0f 16 44 47 71 3d|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:md5,417a42f5e244ce2f340f16fa2fed0412; classtype:trojan-activity; sid:2019955; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_16, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1553 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:47 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible CVE-2014-6332 Arrays with Offset Dec 23"; flow:established,from_server; file_data; content:"For i=LBound("; pcre:"/^\s*?(?P[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(?P=v1)\s*?\x29\s*?(?:dim\s*?)?(?P[^\s\x3d]+)\s*?\x3d\s*?(?P=v2)\+Cstr\x28\s*?Chr\x28(?P=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(?P=v2)/Rsi"; reference:md5,d2d3c212f430bff2b5f075fa083de047; reference:cve,2014-6332; classtype:trojan-activity; sid:2020067; rev:3; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1558 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS VBA Office Document Dridex Binary Download User-Agent"; flow:established,to_server; content:"User-Agent|3A| KAII"; http_header; fast_pattern:only; reference:md5,cb2903c89d60947fa4badec41e065d71; classtype:trojan-activity; sid:2020758; rev:2; metadata:created_at 2015_03_26, updated_at 2015_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1629 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS VBA Office Document Dridex Binary Download User-Agent 2"; flow:established,to_server; content:"User-Agent|3A| MisterZALALU"; http_header; fast_pattern:4,20; reference:md5,2f53b7669482c2d9216a74050630fbb7; classtype:trojan-activity; sid:2020806; rev:2; metadata:created_at 2015_03_31, updated_at 2015_03_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1630 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Potential Dridex.Maldoc Minimal Executable Request"; flow:established,to_server; urilen:<15; content:"GET"; http_method; content:".exe"; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3A|"; http_header; pcre:"/^\/\d+\/\d+\.exe$/U"; content:"Host|3a|"; depth:5; http_header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:(?:Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(?:\r\n)?$/Hmi"; reference:md5,2cea5182d71b768e8b669cacdea39825; classtype:trojan-activity; sid:2020941; rev:2; metadata:created_at 2015_04_16, updated_at 2015_04_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1653 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|aa|07|hostasa|03|org"; fast_pattern; nocase; distance:0; threshold:type limit,track by_src,count 3,seconds 60; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021326; rev:2; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1726 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (ns1.hostasa.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ns1|07|hostasa|03|org"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021327; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1727 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (ns2.hostasa.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ns2|07|hostasa|03|org"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021328; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1728 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (ns3.hostasa.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ns3|07|hostasa|03|org"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021329; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1729 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (ns4.hostasa.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ns4|07|hostasa|03|org"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021330; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1730 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (gh.dsaj2a1.org)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|gh|07|dsaj2a1|03|org"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021331; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1731 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (navert0p.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|navert0p|03|com"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021332; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1732 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos.F DDoS Attack Participation (wangzongfacai.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|wangzongfacai|03|com"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,3c49b5160b981f06bd5242662f8d0a54; classtype:trojan-activity; sid:2021333; rev:1; metadata:created_at 2015_06_23, updated_at 2015_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1733 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos DDoS Attack Participation (gggatat456.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|gggatat456|03|com"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,5a6bd6b5e00333b8d39ff6be13a346f6; classtype:trojan-activity; sid:2021409; rev:1; metadata:created_at 2015_07_13, updated_at 2015_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1750 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Xorddos DDoS Attack Participation (xxxatat456.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|xxxatat456|03|com"; fast_pattern; nocase; distance:0; threshold:type both,track by_src,count 10,seconds 120; reference:md5,5a6bd6b5e00333b8d39ff6be13a346f6; classtype:trojan-activity; sid:2021410; rev:1; metadata:created_at 2015_07_13, updated_at 2015_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1751 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS Likely Linux/Tsunami DDoS Attack Participation (s-p-o-o-f-e-d.h-o-s-t.name)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|s-p-o-o-f-e-d|07|h-o-s-t|04|name"; fast_pattern; nocase; distance:0; threshold:type limit,track by_src,count 3,seconds 60; reference:md5,c01991d55133d0057c9b721bb141a5d9; classtype:trojan-activity; sid:2021691; rev:1; metadata:created_at 2015_08_19, updated_at 2015_08_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1782 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Aug 31 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}[01]/R"; content:"|55 04 08|"; distance:0; byte_test:1,>,9,1,relative; byte_test:1,<,121,1,relative; pcre:"/^.{2}[A-Z]{10,120}/R"; content:"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; content:"|55 04 03|"; byte_extract:1,1,cnlength,relative; content:!"|2e|"; within:cnlength; content:"|55 04 0b|"; distance:0; content:"|2a 86 48 86 f7 0d 01 09 01|"; fast_pattern; distance:0; pcre:"/^.{2}[a-z]+@[a-z]+\.com[01]/R"; reference:md5,26e83fa8b2f3eccfe975cd451933ae63; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021736; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_08_31, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1797 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Aug 31 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}/R"; content:"|55 04 08|"; distance:0; pcre:"/^.{2}(?P[A-Z][a-z]+).*?\x55\x04\x07.{2}(?P=state)\x0a/Rsi"; content:"|55 04 0a|"; distance:0; content:"|55 04 03|"; byte_extract:1,1,cnlength,relative; content:!"|2e|"; within:cnlength; content:"|55 04 0b|"; distance:0; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; fast_pattern; pcre:"/^.{2}[a-z]+@[a-z]+\.com[01]/R"; reference:md5,26e83fa8b2f3eccfe975cd451933ae63; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021735; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_08_31, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1798 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Upatre/Dyre/Kegotip SSL Cert Sept 14 2015"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}/R"; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|55 04 03|"; pcre:"/^.{2}[A-Z]?[a-z]+ [A-Z]?[a-z]+/Rs"; content:"|55 04 0b|"; distance:0; byte_extract:1,1,oulength,relative; content:!"|2e|"; within:oulength; content:!"|20|"; within:oulength; pcre:"/^[a-zA-Z0-9]+[01]/R"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; pcre:"/^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01]/Rs"; content:"@gmail.com"; fast_pattern:only; reference:md5,f22cad1a3985a5183a76324b448e06f2; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021773; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, signature_severity Critical, created_at 2015_09_14, malware_family Upatre, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1813 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Upatre/Dyre/Kegotip SSL Cert Oct 12 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|0b 30 09 06 03 55 04 06 13 02 43 41 31|"; distance:0; fast_pattern; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; byte_extract:1,1,olength,relative; content:!"|2e|"; within:olength; content:!"|20|"; within:olength; pcre:"/^[a-zA-Z0-9]+[01]/R"; content:"|55 04 03|"; byte_test:1,>,0x40,2,relative; byte_test:1,<,0x5B,2,relative; content:"|55 04 0b|"; distance:0; byte_extract:1,1,oulength,relative; content:!"|2e|"; within:oulength; content:!"|20|"; within:oulength; pcre:"/^[a-zA-Z0-9]+[01]/R"; content:"|55 04 03|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; content:!"support@"; distance:0; pcre:"/^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01]/R"; reference:md5,52faadf69c492e5bea1b3ad77fd7e8b1; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021948; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, signature_severity Critical, created_at 2015_10_13, malware_family Upatre, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1822 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Dyre SSL Cert Sept 2 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}[01]/R"; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; content:"|55 04 03|"; byte_test:1,>,0x40,2,relative; byte_test:1,<,0x5B,2,relative; content:"|55 04 0b|"; distance:0; content:"|2a 86 48 86 f7 0d 01 09 01|"; fast_pattern; distance:0; pcre:"/^.{2}[a-z]+@[a-z]+\.com[01]/R"; content:"|55 04 0a|"; pcre:"/^.(?P.[^01]+).*?\x55\x04\x0b.(?P=orgname)/Rsi"; content:!"Beam Propulsion"; reference:md5,52faadf69c492e5bea1b3ad77fd7e8b1; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021743; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_09_02, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1842 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Potential W32/Dridex Alphanumeric Download Pattern"; flow:established,to_server; urilen:9<>47; content:"GET"; http_method; content:".exe"; http_uri; offset:6; fast_pattern; content:!"Referer|3A|"; http_header; content:"Accept|3a|"; http_header; pcre:"/^\/(?=[a-z\d]{0,18}(?:[a-z]\d|\d[a-z]|~[a-z])[a-z\d]{0,18}(?:\/[a-z\d]{0,18}(?:[a-z]\d|\d[a-z])[a-z\d]{0,18}){1,2}\.exe$)(?=[a-f\d\x2f\x7e]{0,40}[g-z])[a-z0-9~]{2,20}(?:\/[a-z0-9]{2,20}){1,2}\.exe$/U"; pcre:"/^User-Agent\x3a\x20[^\r\n]+?(?:MSIE|rv\x3a11\.0)/Hmi"; reference:md5,03c5bfb5c0c7a936ad62ebe03019edd0; classtype:trojan-activity; sid:2021607; rev:6; metadata:created_at 2015_08_10, updated_at 2015_08_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1865 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Likely Evil Macro EXE DL mar 28 2016"; flow:established,to_server; content:"HEAD"; http_method; content:"User-Agent|3a 20|Microsoft BITS/7.5|0d 0a|"; http_header; fast_pattern:12,20; content:".exe"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a\x20[^\r\n]+(?:xyz|pw)\r?$/Hmi"; reference:md5,d599a63fac0640c21272099f39020fac; classtype:trojan-activity; sid:2022686; rev:4; metadata:created_at 2016_03_30, updated_at 2016_03_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1968 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicious Macro DL EXE May 2016 (Mozilla compatible)"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; nocase; fast_pattern:only; content:"Mozilla/4.0|20|(compatible|3b|)"; http_header; content:"Accept|3a 20|*/*|0d 0a|"; http_header; pcre:"/(?:\/(?:(?:p(?:lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(?:nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(?:ystem\/(?:logs|engine)\/[^\x2f]+?|e(?:rv(?:au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|(?=[a-z]*[0-9])(?=[0-9]*[a-z])(?!setup\d+\.exe$)[a-z0-9]{5,10}|a(?:d(?:min\/images\/\w+|obe)|salam|live|us)|m(?:edia\/files\/\w+|a(?:cros?|rch)|soffice)|d(?:o(?:c(?:\/[a-z0-9]+)?|ne)|bust)|(?:~.+?\/\.[^\x2f]+|\.css)\/.+?|in(?:voice\/[^\x2f]+|fos?)|c(?:onfig|hris|alc)|u(?:swinz\w+|pdate)|xml\/load\/[^\x2f]+|(?:[Dd]ocumen|ve)t|Ozonecrytedserver|w(?:or[dk]|insys)|t(?:mp\/.+?|est)|fa(?:cture|soo)|n(?:otepad|ach)|k(?:be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe$|(?:(?=[a-z0-9]*?[3456789][a-z0-9]*?[3456789])(?=[a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(?:^\/(?:image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)/Ui"; reference:md5,f29a3564b386e7899f45ed5155d16a96; classtype:trojan-activity; sid:2022830; rev:2; metadata:created_at 2016_05_19, updated_at 2016_05_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 1998 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS EXE Download from specific file share site (used in recent maldoc campaign)"; flow:to_server,established; content:".exe"; http_uri; content:"Host|3a 20|a.pomf.cat|0d 0a|"; http_header; fast_pattern; content:!"Referer|3a|"; http_header; reference:md5,c321f38862a24dc8a72a251616b3afdf; classtype:trojan-activity; sid:2022884; rev:2; metadata:created_at 2016_06_09, updated_at 2016_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2006 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016 (userdir dotted quad)"; flow:established,to_server; content:".exe"; http_uri; fast_pattern:only; content:"/~"; http_uri; depth:2; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; pcre:"/^\/\~[a-z]+\/(?:[a-z]+\/)*[a-z]+\.exe$/Ui"; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r$/Hm"; reference:md5,a27bb6ac49f890bbdb97d939ccaa5956; classtype:trojan-activity; sid:2022940; rev:2; metadata:affected_product MS_Office, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_07_01, malware_family MalDocGeneric, performance_impact Low, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2015 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016 (dll generic custom headers)"; flow:established,to_server; content:".dll"; http_uri; fast_pattern:only; content:"GET"; http_method; content:"|0d 0a|accept-Encoding|3a 20|none|0d 0a|accept-Language|3a 20|en-US.q=0.8|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|"; http_header; content:"MSIE 7"; http_header; content:!"Referer|3a|"; content:!"Cookie|3a|"; reference:md5,62e7a146079f99ded1a6b8f2db08ad18; classtype:trojan-activity; sid:2022941; rev:2; metadata:affected_product MS_Office, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_07_01, malware_family MalDocGeneric, performance_impact Low, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2016 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicous Macro DL EXE Jul 01 2016 (exe generic custom headers)"; flow:established,to_server; content:".exe"; http_uri; fast_pattern:only; content:"GET"; http_method; content:"|0d 0a|accept-Encoding|3a 20|none|0d 0a|accept-Language|3a 20|en-US.q=0.8|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|"; http_header; content:"MSIE 7"; http_header; content:!"Referer|3a|"; content:!"Cookie|3a|"; reference:md5,62e7a146079f99ded1a6b8f2db08ad18; classtype:trojan-activity; sid:2022942; rev:2; metadata:affected_product MS_Office, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_07_01, malware_family MalDocGeneric, performance_impact Low, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2017 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Maldoc Downloading EXE Jul 26 2016"; flow:established,to_server;content:!".exe"; http_uri; nocase; pcre:"/\/(?:[a-z0-9]+_){4,}[a-z0-9]+(?:\/[a-f0-9]+)*?\/[a-f0-9]+\.(?![Ee][Xx][Ee])[a-z0-9]+$/U"; content:"|3a 20|Microsoft BITS"; http_header; fast_pattern:only; content:!".microsoft.com|0d 0a|"; http_header; nocase; reference:md5,82fb5101847e734dd9b36f51f1fc73e3; classtype:trojan-activity; sid:2022983; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_07_26, malware_family MalDocGeneric, performance_impact Low, updated_at 2016_08_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2035 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Suspicious Proxifier DL (non-browser observed in maldoc campaigns)"; flow:established,to_server; content:"/distr/Proxifier"; http_uri; nocase; depth:16; fast_pattern; content:!"User-Agent|3a|"; http_header; nocase; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:!"Cookie|3a|"; content:"proxifier.com|0d 0a|"; http_header; nocase; reference:md5,2a0728a6edab6921520a93e10a86d4b2; classtype:trojan-activity; sid:2023138; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_08_26, performance_impact Low, updated_at 2016_08_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2059 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS W32/Dridex Binary Download Mar 23 2016"; flow:to_server,established; content:"GET"; http_method; content:"/dana/home.php"; http_uri; fast_pattern; content:"Accept|3a 20|*/*|0d 0a|Accept-Encoding|3a 20|gzip, deflate|0d 0a|"; http_header; content:"MSIE 7.0"; http_header; content:!"Referer|3a 20|"; http_header; pcre:"/\/home\.php$/U"; reference:md5,2f32bf996e093d5a4107d6daa6c51ec4; classtype:trojan-activity; sid:2022650; rev:3; metadata:created_at 2016_03_24, updated_at 2016_10_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2118 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicious Tor Module Download"; flow:established,to_server; content:"/tor/"; http_uri; fast_pattern:only; content:!"Referer|3a 20|"; http_header; content:!"Accept"; http_header; content:"Content-Type|3a 20|application/x-www-form-urlencoded"; http_header; pcre:"/\/tor\/[^\x2f\x2e]+(?:32|64)\.dll$/Ui"; reference:md5,dacbf4c26c5642c29e69e336e0f111f7; classtype:trojan-activity; sid:2023471; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2016_11_01, performance_impact Low, updated_at 2016_11_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2129 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Pony DLL Download"; flow:established,to_server; content:"/pm"; http_uri; content:".dll"; http_uri; fast_pattern:only; pcre:"/\/pm\d?\.dll$/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; reference:md5,62e7a146079f99ded1a6b8f2db08ad18; classtype:trojan-activity; sid:2022939; rev:3; metadata:affected_product MS_Office, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2016_07_01, malware_family MalDocGeneric, performance_impact Low, updated_at 2017_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2149 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Malicious JS.Nemucod to PS Dropping PE Nov 14 M2"; flow:to_server,established; content:"GET"; http_method; content:".php?f="; http_uri; fast_pattern:only; content:!"Referer"; http_header; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b|"; http_header; pcre:"/^\/\w+\.php\?f=[a-z]?\d{1,3}(?:\.(?:dat|gif))?$/U"; reference:md5,551c440d76be5ab9932d8f3e8f65726e; classtype:trojan-activity; sid:2023754; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2016_11_28, performance_impact Low, updated_at 2017_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2211 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicious Macro DL BIN March 2017"; flow:established,to_server; content:"GET"; http_method; content:"?showforum="; http_uri; fast_pattern:only; pcre:"/\?showforum=$/Ui"; content:!".php"; http_uri; content:!"Referer|3a 20|"; http_header; content:!"User-Agent|3a 20|"; http_header; metadata: former_category CURRENT_EVENTS; reference:md5,ad575f6795526f2ee5e730f76a3b5346; classtype:trojan-activity; sid:2024109; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_03_29, performance_impact Moderate, updated_at 2017_03_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2279 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS MalDoc Retrieving Payload March 30 2017"; flow:to_server,established; content:"GET"; http_method; content:"/mang.bbk"; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\/mang\.bbk$/Ui"; metadata: former_category CURRENT_EVENTS; reference:md5,33018afc5ef9818eee0f3833d1f738b0; classtype:trojan-activity; sid:2024122; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_03_30, malware_family Maldoc, performance_impact Moderate, updated_at 2017_03_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2280 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Neverquest/Vawtrak Posting Data"; flow:established,to_server; content:"POST"; http_method; content:"/viewforum.php?f="; http_uri; fast_pattern:only; pcre:"/\/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$/U"; content:!"Referer|3a|"; http_header; content:"Content-Type|3a 20|application/octet-stream"; http_header; metadata: former_category CURRENT_EVENTS; reference:md5,0400671fd3804fbf3fd1d6cf707bced4; reference:md5,1dfaeb7b985d2ba039cd158f63b8ae54; classtype:trojan-activity; sid:2018543; rev:3; metadata:created_at 2014_06_06, updated_at 2017_05_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2334 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS CVE-2017-0199 Common Obfus Stage 2 DL"; flow:established,from_server; file_data; content:"|7b 5c 72 74|"; within:4; content:!"|66|"; within:1; content:"|5C 6F 62 6A 61 75 74 6C 69 6E 6B|"; nocase; distance:0; metadata: former_category CURRENT_EVENTS; reference:md5,8168b2305289ecc778216405d1fd7984; reference:cve,2017-0199; classtype:trojan-activity; sid:2024413; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_19, performance_impact Low, updated_at 2017_06_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2385 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl"; flow:to_server,established; content:".hta"; nocase; fast_pattern; http_uri; pcre:"/\.hta(?:[?&]|$)/Ui"; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b| MSIE 7.0|3b|"; http_header; content:!"Referer|3a|"; http_header; content:!"|0d 0a|Cookie|3a|"; metadata: former_category CURRENT_EVENTS; reference:md5,66a42e338e32fb6c02c9d4c56760d89d; classtype:attempted-user; sid:2024449; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, cve 2017_0199, created_at 2017_07_07, updated_at 2017_07_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2392 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe Shared Document Phishing Landing Nov 19 2015"; flow:established,from_server; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"pagename=|22|login|22|"; nocase; content:"Sign in - Adobe"; nocase; distance:0; fast_pattern:2,20; content:"password-revealer"; nocase; distance:0; metadata: former_category CURRENT_EVENTS; reference:md5,ba42e59213f10f5c1bd70ce4813f25d1; classtype:trojan-activity; sid:2023047; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, deployment Perimeter, tag Phishing, signature_severity Major, created_at 2016_08_11, performance_impact Low, updated_at 2017_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2405 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS RIG encrypted payload M1 Aug 01 2017"; flow:established,to_client; file_data; content:"|73 29 88 ff e0 d1 0e 74|"; within:8; metadata: former_category CURRENT_EVENTS; reference:md5,263a2cf88f340b2a755db749be1371ea; classtype:trojan-activity; sid:2024507; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag RigEK, signature_severity Major, created_at 2017_08_01, malware_family RIG, updated_at 2017_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2432 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Nemucod JS Downloader Aug 01 2017"; flow:established,to_server; pcre:"/\/[A-Za-z0-9]{5,9}\?+[A-Za-z0-9]{6,12}=[A-Za-z0-9]{6,12}$/U"; content:"Accept|3a 20 2a 2f 2a 0d 0a|Accept-Language|3a|"; http_header; depth:29; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.0)"; http_user_agent; fast_pattern:30,20; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; metadata: former_category CURRENT_EVENTS; reference:md5,cb558b04216e0e7a9c936945ebee6611; classtype:trojan-activity; sid:2024508; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_08_01, malware_family Nemucod, updated_at 2017_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2433 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Maldoc Downloader Aug 18 2017"; flow:established,to_server; content:"/s.php?id="; http_uri; depth:10; content:!"User-Agent|3a|"; http_header; content:!"Accept|3a|"; http_header; content:!"Cookie|3a|"; pcre:"/^\/s\.php\?id=[a-z0-9]{2,6}$/U"; metadata: former_category CURRENT_EVENTS; reference:md5,5285f1adfc0013fa86218a7d76c0016d; classtype:trojan-activity; sid:2024600; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag MalDoc, signature_severity Major, created_at 2017_08_21, malware_family Maldoc, performance_impact Low, updated_at 2017_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2488 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted payload Oct 19 (1)"; flow:established,to_client; file_data; content:"|1a 3d d0 28 82 1a 6f 08|"; depth:8; fast_pattern; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024907; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2622 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted check-in response Oct 19 (1)"; flow:established,to_client; file_data; content:"|0c 3c|"; depth:2; content:"|04 a3|"; distance:1; within:2; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024909; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2623 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Malicious Macro DL BIN May 2016 (No UA)"; flow:established,to_server; content:"GET"; http_method; content:"/system/"; depth:8; http_uri; nocase; fast_pattern; pcre:"/^(?:cache|logs)\/[^\x2f]+\.(?:exe|dll|doc|bin)$/URi"; http_header_names; content:!"Referer"; reference:md5,c6747ca29d5c28f4349a5a8343d6b025; classtype:trojan-activity; sid:2022834; rev:5; metadata:created_at 2016_05_24, updated_at 2016_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2673 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Potential Dridex.Maldoc Minimal Executable Request"; flow:established,to_server; urilen:<40; content:"GET"; http_method; content:".exe"; http_uri; fast_pattern; content:!"Mozilla/"; http_user_agent; content:!"MstarUpdate"; http_header; content:!".bitdefender.com"; http_host; content:!".homestead.com"; http_host; pcre:"/\/[a-z0-9]+\/[a-z0-9]+\.exe$/Ui"; http_header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a 0d 0a|"; depth:22; isdataat:!1,relative; metadata: former_category CURRENT_EVENTS; reference:md5,28208e19a528bfa95e5662e2d6f2e911; reference:url,blogs.cisco.com/security/dridex-attacks-target-corporate-accounting; classtype:trojan-activity; sid:2020826; rev:7; metadata:created_at 2015_04_01, updated_at 2017_03_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2675 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Qtloader encrypted check-in Oct 19 M1"; flow:established,to_server; content:"|2c 45 32 4d f1 38 55|"; depth:7; http_client_body; fast_pattern; metadata: former_category CURRENT_EVENTS; reference:md5,4f03e360be488a3811d40c113292bc01; classtype:trojan-activity; sid:2024908; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_10_24, performance_impact Low, updated_at 2017_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2701 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Napolar / Shifu SSL Cert Oct 9 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|19|secure.barrentomedear.com"; distance:1; within:26; metadata: former_category CURRENT_EVENTS; reference:md5,958804a1191cb281a3a967de17763cf4; classtype:trojan-activity; sid:2019376; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_10_09, updated_at 2018_03_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 2863 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET !9987 -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set"; content:!"7PYqwfzt"; depth:8; byte_test:1,!&,64,2; byte_test:1,&,32,2; byte_test:1,&,16,2; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014701; rev:12; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3135 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set"; content:!"7PYqwfzt"; depth:8; byte_test:1,&,64,2; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014702; rev:9; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3136 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set"; content:!"7PYqwfzt"; depth:8; byte_test:1,&,64,3; threshold: type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014703; rev:9; metadata:created_at 2012_05_03, updated_at 2016_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3137 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS HOIC with booster outbound"; flow:to_server,established; content:"GET"; http_method; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; content:"If-Modified-Since|3a 20 20|"; http_raw_header; content:"Keep-Alive|3a 20 20|"; http_raw_header; content:"Connection|3a 20 20|"; http_raw_header; content:"User-Agent|3a 20 20|"; http_raw_header; threshold: type both, count 1, seconds 60, track by_src; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018977; rev:3; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3162 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS HOIC with booster inbound"; flow:to_server,established; content:"GET"; http_method; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; content:"If-Modified-Since|3a 20 20|"; http_raw_header; content:"Keep-Alive|3a 20 20|"; http_raw_header; content:"Connection|3a 20 20|"; http_raw_header; content:"User-Agent|3a 20 20|"; http_raw_header; threshold: type both, count 1, seconds 60, track by_dst; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018978; rev:2; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3163 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> any [5555,7547] (msg:"ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE "; flow:to_server,established; content:"urn|3a|dslforum-org|3a|service|3a|Time|3a|1#SetNTPServers"; nocase; http_header; fast_pattern:only; reference:url,devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/; reference:md5,a19d5b596992407796a33c5e15489934; classtype:trojan-activity; sid:2023548; rev:3; metadata:affected_product Eir_D1000_Modem, attack_target Networking_Equipment, deployment Perimeter, signature_severity Major, created_at 2016_11_28, updated_at 2016_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3490 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:48 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http any any -> any [5555,7547] (msg:"ET EXPLOIT Eir D1000 Modem CWMP Exploit Retrieving Wifi Key"; flow:to_server,established; content:"urn|3a|dslforum-org|3a|service|3a|Time|3a|1#SetNTPServers"; nocase; http_header; fast_pattern:only; content:"|3c 75 3a 47 65 74 53 65 63 75 72 69 74 79 4b 65 79 73|"; http_client_body; reference:url,devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/; reference:md5,a19d5b596992407796a33c5e15489934; classtype:trojan-activity; sid:2023549; rev:3; metadata:affected_product Eir_D1000_Modem, attack_target Networking_Equipment, deployment Perimeter, signature_severity Major, created_at 2016_11_28, performance_impact Low, updated_at 2016_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3491 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PlaySushi User-Agent"; flow:established,to_server; content:"User-Agent|3A 20|psi "; http_header; reference:md5,039815a7cb0b7ee52b753a9b79006f97; classtype:trojan-activity; sid:2014261; rev:2; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3876 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.Win32.Sushi.au Checkin"; flow:to_server,established; content:"/inst.php?"; http_uri; content:"User-Agent|3a| psi"; http_header; reference:md5,3aad2075e00d5169299a0a8889afa30b; reference:url,www.securelist.com/en/descriptions/24412036/not-a-virus%3aAdWare.Win32.Sushi.au; classtype:trojan-activity; sid:2014262; rev:4; metadata:created_at 2012_01_21, updated_at 2012_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3877 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/GameVance Adware Checkin"; flow:established,to_server; content:"/inst.asp?d="; http_uri; content:"&cl="; http_uri; content:"&l="; http_uri; content:"&e="; http_uri; content:"&v="; http_uri; content:"&uid="; http_uri; content:"&time="; http_uri; content:"&win="; http_uri; content:"&ac="; http_uri; content:"&ti="; http_uri; content:"&xv="; http_uri; reference:md5,2609c78efbc325d1834e49553a9a9f89; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3aWin32/GameVance; classtype:trojan-activity; sid:2014339; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3878 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/LoudMo.Adware Checkin"; flow:established,to_server; content:"/?aff="; http_uri; content:"Host|3A 20|www.gamebound.com"; http_header; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FLoudmo; reference:md5,fc06c613e83f0d3271beba4fdcda987f; classtype:trojan-activity; sid:2014400; rev:3; metadata:created_at 2012_03_19, updated_at 2012_03_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3949 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Dialer.Adultchat Checkin"; flow:established,to_server; content:"/getclientid.wnk?srv="; http_uri; content:"&ver="; http_uri; content:"&pin="; http_uri; content:"&OSInfo2="; http_uri; content:"&cinfo="; http_uri; content:"retryattempt="; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FDluca.AN&ThreatID=-2147365813; reference:md5,fd2c949dc20b651a53326a3d571641ec; classtype:trojan-activity; sid:2014667; rev:2; metadata:created_at 2012_05_02, updated_at 2012_05_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3951 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Bublik.B/Birele/Variant.Kazy.66443 Checkin"; flow:established,to_server; urilen:12; content:"POST"; http_method; content:"/rdc/rnd.php"; http_uri; reference:md5,48352e3a034a95845864c0f6aad07d39; classtype:trojan-activity; sid:2014767; rev:5; metadata:created_at 2012_05_18, updated_at 2012_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3953 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/OnlineGames Checkin"; flow:established,to_server; content:"/game"; http_uri; content:"/diary/item/"; http_uri; content:"User-Agent|3A| getURLDown|0D 0A|"; http_header; reference:md5,60763078b8860fd59a1d8bea2bf8900b; classtype:trojan-activity; sid:2015017; rev:4; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3956 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User-Agent (Huai_Huai)"; flow:to_server,established; content:"User-Agent|3a| Huai_Huai|0d 0a|"; http_header; reference:md5,ee600bdcc45989750dee846b5049f935; reference:md5,91b9aa25563ae524d3ca4582630eb8eb; reference:md5,1051f7176fe0a50414649d369e752e98; classtype:trojan-activity; sid:2006361; rev:9; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2010_07_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3958 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Win32/SProtector.A Client Checkin"; flow:established,to_server; content:"?data="; http_uri; content:"&version="; http_uri; distance:0; content:"win32"; http_user_agent; depth:5; fast_pattern; reference:md5,38f61d046e575971ed83c4f71accd132; classtype:trojan-activity; sid:2016780; rev:4; metadata:created_at 2013_04_22, updated_at 2013_04_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3981 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware pricepeep Adware.Shopper.297"; flow: established,to_server; content:"GET"; nocase; http_method; content:"/logger/software/hit/"; nocase; http_uri; content:"/?v."; nocase; http_uri; reference:url,virustotal.com/en/file/1ea487b1507305f17a2cd2ab0dbcfac523419dbc27cde38e27cb5c4a8d3c9caf/analysis/; reference:url,lists.clean-mx.com/pipermail/viruswatch/20121222/037085.html; reference:md5,0564e603f9ed646553933cb0d271f906; classtype:trojan-activity; sid:2016917; rev:2; metadata:created_at 2013_05_22, updated_at 2013_05_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3989 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Ezula Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/download/UVid.asp?"; fast_pattern:only; http_uri; reference:md5,dede600f1e78fd20e4515bea1f2bdf61; classtype:trojan-activity; sid:2016938; rev:3; metadata:created_at 2013_05_28, updated_at 2013_05_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3990 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Tibs Checkin"; flow:established,to_server; content:"/adv/"; nocase; http_uri; content:".php?a1="; nocase; http_uri; content:"&a2=Type of Processor|3a|"; nocase; http_uri; content:"&a3=Windows version is "; nocase; http_uri; content:"&a4=Build|3a|"; nocase; http_uri; reference:md5,65448c8678f03253ef380c375d6670ce; classtype:trojan-activity; sid:2002955; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 3991 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Linkular.Adware Icons.dat Second Stage Download"; flow:established,to_server; content:"/downloads/icons.dat"; http_uri; fast_pattern:only; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; reference:md5,7cc162a2ba136baaa38a9ccf46d97a06; classtype:trojan-activity; sid:2017881; rev:3; metadata:created_at 2013_12_17, updated_at 2013_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4002 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE GMUnpackerInstaller.A Checkin"; flow:to_server,established; content:"/new/rar.xml"; fast_pattern:only; nocase; http_uri; content:!"User-Agent|3a| "; nocase; http_header; reference:md5,43e89125ad40b18d22e01f997da8929a; classtype:trojan-activity; sid:2017892; rev:2; metadata:created_at 2013_12_19, updated_at 2013_12_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4003 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/InstallRex.Adware Initial CnC Beacon"; flow:established,to_server; content:"/?step_id="; http_uri; content:"&publisher_id="; http_uri; content:"&page_id="; http_uri; content:"&country_code="; http_uri; content:"&browser_id="; http_uri; content:"&download_id="; http_uri; content:"&hardware_id="; http_uri; reference:md5,9abbb5ea3f55b5182687db69af6cba66; classtype:trojan-activity; sid:2017911; rev:2; metadata:created_at 2014_12_30, updated_at 2014_12_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4004 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/InstallRex.Adware Report CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/?report_version="; http_uri; content:"data="; http_client_body; depth:5; reference:md5,9abbb5ea3f55b5182687db69af6cba66; classtype:trojan-activity; sid:2017912; rev:2; metadata:created_at 2014_12_30, updated_at 2014_12_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4005 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware Initial Checkin"; flow:established,to_server; content:"/updater/"; http_uri; content:"UpdaterResponse"; http_user_agent; depth:15; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018024; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4006 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware POST Checkin"; flow:established,to_server; content:"POST"; content:"UpdaterResponse"; http_user_agent; fast_pattern; depth:15; pcre:"/^\x2F[A-F0-9]{25,40}$/U"; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018025; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4007 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent EXE2"; flow: established,to_server; content:"EXE2"; nocase; depth:4; http_user_agent; reference:md5,112c6db4fb8a9aa18d0cc105662af5a4; classtype:trojan-activity; sid:2018049; rev:3; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4008 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Magania"; flow: established,to_server; flowbits:set,EXE2; flowbits:noalert; content:"GET"; http_method; content:".txt"; http_uri; content:"EXE2"; depth:4; fast_pattern; nocase; http_user_agent; content:!"Accept|3a| "; nocase; http_header; content:!"Referer|3a| "; nocase; http_header; content:!"Connection|3a| "; nocase; http_header; reference:md5,112c6db4fb8a9aa18d0cc105662af5a4; classtype:trojan-activity; sid:2018050; rev:4; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4009 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent Mozi11a"; flow: established,to_server; content:"Mozi11a"; depth:7; http_user_agent; reference:md5,3cf3d4d5de51a8c37e11595159179571; classtype:trojan-activity; sid:2018051; rev:4; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4010 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User-Agent (gettingAnswer)"; flow: established,to_server; content:"gettingAnswer"; depth:13; nocase; http_user_agent; reference:md5,c305a0af3fe84525a993130b7854e3e0; classtype:trojan-activity; sid:2018084; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2014_02_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4012 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BetterInstaller"; flow:to_server,established; content:"GET"; http_method; content:"?v="; http_uri; content:"&uid="; http_uri; content:"&muid="; http_uri; pcre:"/[a-f0-9]{32}\?v=/Ui"; reference:md5,efa0bed2695446eab679083a9f0f89c6; classtype:trojan-activity; sid:2018195; rev:3; metadata:created_at 2014_01_15, updated_at 2014_01_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4014 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.AdWare.iBryte.C Install "; flow:established,to_server; content:"/offers.json?version="; http_uri; content:"&pid=installer&ts="; http_uri; reference:md5,2fae46d1a71a893834a01ed3106b8036; classtype:trojan-activity; sid:2018197; rev:2; metadata:created_at 2014_02_28, updated_at 2014_02_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4015 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Xpire.info Spyware Install Reporting"; flow: to_server,established; content:"/report.php?user_id="; fast_pattern; http_uri; content:"&status="; http_uri; content:"&country_id="; http_uri; content:"Windows Internet"; depth:16; http_user_agent; reference:url,doc.emergingthreats.net/bin/view/Main/2001472; reference:md5,17c204bb156dd7f6a3ebd1547129f347; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FZdesnado.AD&ThreatID=-2147454482; classtype:trojan-activity; sid:2001472; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4017 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Toolbar.CrossRider.A Checkin"; flow:to_server,established; content:".gif?action="; http_uri; content:"&browser="; http_uri; content:"&ver="; http_uri; content:"&bic="; fast_pattern:only; http_uri; content:"&app="; http_uri; content:"&appver="; http_uri; content:"&verifier="; http_uri; reference:md5,55668102739536c1b00bce9e02d8b587; classtype:trojan-activity; sid:2018301; rev:3; metadata:created_at 2012_10_05, updated_at 2012_10_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4018 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.MSIL.Solimba.b GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/dmr/access/"; http_uri; content:"DownloadMR"; nocase; depth:10; http_user_agent; reference:url,virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:trojan-activity; sid:2016905; rev:4; metadata:created_at 2013_05_21, updated_at 2013_05_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4019 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.MSIL.Solimba.b POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/dmr/exception"; http_uri; content:"DownloadMR"; depth:10; nocase; http_user_agent; reference:url,virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:trojan-activity; sid:2016906; rev:4; metadata:created_at 2013_05_21, updated_at 2013_05_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4020 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent Smart-RTP"; flow: established,to_server; content:"Smart-RTP"; depth:9; nocase; http_user_agent; reference:url,www.threatexpert.com/report.aspx?md5=a80f33c94c44556caa2ef46cd5eb863c; reference:url,www.drwebhk.com/en/virus_techinfo/Trojan.DownLoader8.25530.html; reference:md5,2b63ed542eb0e1a4547a2b6e91391dc0; classtype:trojan-activity; sid:2016915; rev:5; metadata:created_at 2013_05_22, updated_at 2013_05_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4021 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AdWare.Win32.Yotoon.hs Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/product-am.php?id="; http_uri; fast_pattern:only; content:"&v="; http_uri; content:"&offer["; distance:0; http_uri; content:"NSISDL/1.2 (Mozilla)"; depth:20; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,20c7226185ed7999e330a46d3501dccb; classtype:trojan-activity; sid:2018307; rev:4; metadata:created_at 2014_03_19, updated_at 2014_03_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4022 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SoundCloud Downloader Install Beacon"; flow:established,to_server; urilen:10; content:"POST"; http_method; content:"/index.php"; http_uri; content:"&OSversion="; http_client_body; content:"&Slv="; http_client_body; content:"&Sysid="; http_client_body; content:"&Sysid1="; http_client_body; content:"&admin="; http_client_body; content:"&browser="; http_client_body; content:"&exe="; http_client_body; content:"&ffver="; http_client_body; content:"&lang_DfltUser="; http_client_body; content:"&ver="; http_client_body; content:"&ts="; http_client_body; reference:url,blog.malwarebytes.org/online-security/2014/03/soundcloud-downloader-always-read-the-eulas/; reference:md5,2e20e446943ecd01d3a668083d81d1fc; classtype:trojan-activity; sid:2018324; rev:2; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4023 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Amonetize.Downloader Executable Download Request"; flow:established,to_server; content:"GET"; http_method; content:"/bundle/"; http_uri; content:"/?p="; http_uri; content:"zz_afi"; depth:6; http_user_agent; reference:md5,23246f740cffc0bd9eb5be2e7703568a; classtype:trojan-activity; sid:2018333; rev:4; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4024 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Linkular.Adware Successful Install Beacon"; flow:established,to_server; content:"/api/success/?s="; http_uri; fast_pattern:only; content:"&c="; http_uri; content:"&cv="; http_uri; content:"&context="; http_uri; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; reference:md5,7cc162a2ba136baaa38a9ccf46d97a06; classtype:trojan-activity; sid:2017880; rev:6; metadata:created_at 2013_12_17, updated_at 2013_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4028 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.PUQD Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/debug/Version/"; fast_pattern:only; http_uri; content:"/trace/"; http_uri; pcre:"/^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(?:mostrarFailed(?:EndLoading|ReadyState)|Get(?:XmlDataRequisites|BinaryData)|(?:DownloadRequisites|down_)Finish|Re(?:cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$/U"; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; content:!"Accept|3a|"; http_header; reference:md5,e44962d7dec79c09a767a1d3e8ce02d8; reference:url,www.virustotal.com/en/file/1a1ff0fc6af6f7922bae906728e1919957998157f3a0cf1f1a0d3292f0eecd85/analysis/; classtype:trojan-activity; sid:2017945; rev:3; metadata:created_at 2014_01_08, updated_at 2014_01_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4032 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/RocketfuelNextUp.Adware CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/evt/?nexcb="; fast_pattern:only; http_uri; content:!"User-Agent|3A|"; http_header; content:"a="; http_client_body; depth:2; content:"&b="; http_client_body; distance:0; pcre:"/^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$/U"; reference:md5,408e8969cd0abd153eab6696f8add363; classtype:trojan-activity; sid:2018565; rev:3; metadata:created_at 2014_06_16, updated_at 2014_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4033 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.MultiInstaller checkin 2"; flow:established, to_server; content:"GET"; http_method; content:"/entrance?s1="; depth:13; http_uri; pcre:"/^\/entrance\?s1=[a-f0-9]{100,}$/Ui"; content:!"Referer|3a|"; http_header; reference:md5,c610d46d97c1b80f027f56d227a003f7; classtype:trojan-activity; sid:2018590; rev:2; metadata:created_at 2014_06_20, updated_at 2014_06_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4035 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OptimizerPro Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/op?sid="; http_uri; content:"&dt="; http_uri; distance:0; content:"&gid="; http_uri; distance:0; reference:md5,d04a7f30c83290b86cac8d762dcc2df5; reference:md5,eba3a996f5b014b2d410f4bf32b8530b; classtype:trojan-activity; sid:2018742; rev:3; metadata:created_at 2013_12_11, updated_at 2013_12_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4036 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SearchSuite Install CnC Beacon"; flow:established,to_server; content:"POST"; http_method; urilen:23; content:"/install_statistics.php"; fast_pattern; http_uri; depth:23; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE|3B| Win32)"; http_header; content:"XML="; http_client_body; depth:4; content:!"Referer|3a|"; http_header; reference:md5,7203a56c3888e819c602e758fce823fa; reference:md5,77e33e8a53e2a0dbc06c921de9b71142; classtype:trojan-activity; sid:2018753; rev:2; metadata:created_at 2014_07_23, updated_at 2014_07_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4038 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MultiPlug.A checkin"; flow:to_server,established; content:"get/?ver="; http_uri; content:"&aid="; http_uri; distance:0; content:"&hid="; http_uri; distance:0; content:"&rid="; http_uri; distance:0; content:"&data="; http_uri; distance:0; content:"&report="; http_uri; distance:0; content:!"Referer|3a 20|"; http_header; pcre:"/^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=/U"; reference:md5,f9556acf36168414ad7d5650eeee7972; reference:md5,69e28b658520528a1473f51e62698c87; classtype:trojan-activity; sid:2018867; rev:2; metadata:created_at 2014_08_01, updated_at 2014_08_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4039 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/iBryte.Adware Affiliate Campaign Executable Download"; flow:established,to_server; content:"GET"; http_method; content:".exe?mode="; fast_pattern:only; http_uri; content:"&subid="; http_uri; content:"&filedescription="; http_uri; content:!"Referer|3a 20|"; http_header; reference:md5,65e5b8e84772f55d761a85bf53c14169; reference:md5,cfda690ebe7bccc5c3063487f6e54086; classtype:trojan-activity; sid:2018367; rev:7; metadata:created_at 2014_04_07, updated_at 2014_04_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4040 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.InstallCore.B Checkin"; flow:established,to_server; urilen:13<>18; content:"POST"; http_method; content:"/?pcrc="; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/^\/\?pcrc=[0-9]{7,10}$/U"; content:"0A0Czut"; depth:7; http_client_body; reference:md5,d933bef7e1118b181add31eb5edc5c73; classtype:trojan-activity; sid:2019511; rev:5; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4045 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DealPly Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/pxl/"; http_uri; fast_pattern:only; content:"e=-1"; http_uri; content:"&c="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,c6ebffb418813ed68ac5ed9f51f83946; classtype:trojan-activity; sid:2019622; rev:2; metadata:created_at 2014_10_31, updated_at 2014_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4046 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SoftonicDownloader.Adware User Agent"; flow:established,to_server; content:"Softonic Downloader/"; http_user_agent; reference:md5,1047b186bb2822dbb5907cd743069261; classtype:trojan-activity; sid:2014355; rev:3; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4047 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32.SoftPulse Checkin"; flow: established, to_server; content:"POST"; http_method; content:"NSIS_Inetc (Mozilla|29|"; depth:20; http_user_agent; content:"|7b 22|event_type|22 3a 22|SPidentifier|22 2c 20 22|environment|22 3a 22|"; depth:45; http_client_body; content:"|22|machine_ID|22 3a 22|"; distance:0; http_client_body; reference:md5,9aa08a2700074c7a8a81e49dc8396e00; reference:md5,50f1fc1085f18a25c09c08566fc1a457; classtype:trojan-activity; sid:2018557; rev:6; metadata:created_at 2014_06_11, updated_at 2014_06_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4048 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DomaIQ Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/index.php"; http_uri; content:"&OSversion="; http_client_body; content:"&Sysid="; http_client_body; content:"&Sysid1="; http_client_body; content:"&X64="; http_client_body; content:"&exe="; http_client_body; content:"&ffver="; http_client_body; content:"&lang_DfltSys="; http_client_body; content:"&lang_DfltUser="; http_client_body; reference:md5,9befc43d2019c5614e7372a16e3a5ce5; classtype:trojan-activity; sid:2019944; rev:3; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4051 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP W32/DownloadGuide.D"; flow:established,to_server; content:"POST"; http_method; content:"/config-from-production"; http_uri; content:"{|22|os|22 3A 22|"; http_client_body; depth:7; content:"|22|lang|22 3A 22|"; http_client_body; distance:0; content:"|22|uid|22 3A 22|"; http_client_body; distance:0; content:"|22|prod|22 3A 22|"; http_client_body; distance:0; reference:md5,294752c7c4fcf4252a9e99bb4df7ff5c; classtype:trojan-activity; sid:2019974; rev:2; metadata:created_at 2014_12_18, updated_at 2014_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4052 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MALWARE W32/WinWrapper.Adware User-Agent"; flow:established,to_server; content:!"Referer|3a|"; http_header; content:"WinWrapper"; depth:10; http_user_agent; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020629; rev:4; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4058 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Application AirInstaller"; flow:to_server,established; urilen:>31; content:"GET"; http_method; content:"/launch/?c="; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"&m="; http_uri; content:"&l="; http_uri; content:"&b="; http_uri; content:"&sid="; http_uri; content:"&os="; http_uri; reference:md5,3eaaf0de35579e5af89ae3dd81d0c592; reference:md5,ac030896aad1b6b0eeb00952dee24c3f; classtype:trojan-activity; sid:2018095; rev:5; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4059 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Application AirInstaller CnC Beacon"; flow:to_server,established; content:"GET"; http_method; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"/log/?"; http_uri; fast_pattern; content:"="; distance:1; within:1; http_uri; content:"&d="; distance:0; http_uri; content:"&o="; http_uri; content:"&r="; http_uri; content:"&s="; http_uri; content:"&t="; http_uri; pcre:"/^\/(?:[^\x2f]+\/)*log\/\?[bc]=/U"; reference:md5,e89ec5e8f89ee6ae4a6b65157c886614; classtype:trojan-activity; sid:2020701; rev:2; metadata:created_at 2015_03_16, updated_at 2015_03_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4060 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/AdWare.Sendori User-Agent"; flow:established,to_server; content:"Sendori-Client"; http_user_agent; depth:14; reference:url,isc.sans.edu/forums/diary/Suspect+Sendori+software/16466; reference:md5,aee8ddf3b36d60d33c571ee798b6bad6; classtype:trojan-activity; sid:2020881; rev:3; metadata:created_at 2015_04_08, updated_at 2015_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4061 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Softpulse PUP Install Failed Beacon"; flow:established,to_server; content:"GET"; http_method; content:"?sentry_version="; http_uri; content:"&sentry_client="; distance:0; http_uri; content:"&sentry_key=84ce05510b844b75acc37de959560a65&sentry_secret=1c9aa912021b4626a5b7a7e589cba678&sentry_data="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,bb9f26d52327979fb9b4d467408eba25; classtype:trojan-activity; sid:2021027; rev:2; metadata:created_at 2015_04_28, updated_at 2015_04_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4062 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Toolbar.Conduit.AG Checkin"; flow:to_server,established; urilen:1; content:"POST"; http_method; content:"User-Agent|3a 20|NSIS_Inetc (Mozilla|29 0d 0a|"; http_header; content:"postInstallReport"; http_client_body; fast_pattern; content:"machineId|22 3a 22|"; http_client_body; reference:md5,8fc00c6696268ae42411a5ebf9d2576f; classtype:trojan-activity; sid:2021094; rev:3; metadata:created_at 2015_05_13, updated_at 2015_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4063 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP.GigaClicks Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/ver/"; http_uri; content:"/sid/"; http_uri; content:"instlog="; http_client_body; fast_pattern; content:!"User-Agent|3a|"; http_header; reference:md5,942fd71fb26b874502f3ba8546e6c164; classtype:trojan-activity; sid:2021099; rev:2; metadata:created_at 2015_05_15, updated_at 2015_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4064 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/Conduit.SearchProtect.O CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/?uid="; http_uri; content:"&affid="; distance:0; http_uri; content:"&inst_date="; distance:0; http_uri; fast_pattern; content:"&prod="; distance:0; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,525917c79e22fa9bc54da36b94437a46; classtype:trojan-activity; sid:2021173; rev:2; metadata:created_at 2015_05_29, updated_at 2015_05_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4065 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.FakeAV.SystemDefender Checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:".php?"; nocase; http_uri; content:"action=stat&wmid="; nocase; http_uri; content:"&event="; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&i1"; nocase; http_uri; content:"&i2"; nocase; http_uri; reference:url,doc.emergingthreats.net/2008732; reference:md5,4d1df7240837832853c8b87606f3dfc2; classtype:trojan-activity; sid:2008732; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4068 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP TheSZ AutoUpdate CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/update.php?p="; http_uri; fast_pattern:only; content:"&v="; http_uri; content:"&id="; distance:0; http_uri; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"User-Agent|3a 20|AutoUpdate|0d 0a|"; http_header; reference:md5,76e54deb6f81edd6b47c854c847d590d; classtype:trojan-activity; sid:2021401; rev:2; metadata:created_at 2015_07_10, updated_at 2015_07_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4069 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DealPly Adware CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/?pcrc="; http_uri; depth:7; fast_pattern; content:"&v="; http_uri; pcre:"/^\/\?pcrc=\d+&v=[\d.]+$/U"; content:!"Referer|3a 20|"; http_header; reference:md5,a34236628ea04e10430e20ac2b9d7ad2; classtype:trojan-activity; sid:2021618; rev:4; metadata:created_at 2015_08_12, updated_at 2015_08_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4072 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUA Boxore User-Agent"; flow:to_server,established; content:"BoxoreClent"; depth:11; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,5cb2e8a9b6935f228623c69f1b17669d; classtype:trojan-activity; sid:2021700; rev:3; metadata:created_at 2015_08_21, updated_at 2015_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4075 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DealPly Adware CnC Beacon 4"; flow:established,to_server; content:"POST"; http_method; content:"/?v="; http_uri; depth:4; fast_pattern; content:"&pcrc="; http_uri; content:!"Referer|3a 20|"; http_header; content:!"Accept-"; http_header; pcre:"/^\/\?v=[\d.]+&pcrc=\d+$/U"; reference:md5,038da581f99c88a4ee6700de440a54ca; classtype:trojan-activity; sid:2022354; rev:2; metadata:created_at 2016_01_13, updated_at 2016_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4078 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/SmartTab PUP Install Activity 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/v"; http_uri; depth:2; content:".asp"; http_uri; content:"User-Agent|3a 20|Mozilla/3.0 (compatible|3b| Indy Library|29 0d 0a|"; http_header; fast_pattern:32,20; pcre:"/\/v\d\/[^.]+\.asp$/Ui"; reference:md5,84fcdf1cd6dc3ee71686835f9489752c; classtype:trojan-activity; sid:2022694; rev:2; metadata:created_at 2016_04_01, updated_at 2016_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4079 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Checkin"; flow:established,to_server; content:"GET"; http_method; content:".sh?do="; http_uri; content:"&d="; http_uri; content:"&inj="; http_uri; content:"&cl="; http_uri; content:"&cs="; http_uri; content:"&id="; http_uri; content:"&se="; http_uri; content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|"; http_header; fast_pattern:5,20; content:!"Referer|3a|"; http_header; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022716; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4080 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Activity 1"; flow:established,to_server; content:"GET"; http_method; content:"?mid="; http_uri; fast_pattern; content:"User-Agent|3a 20|curl/"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$/Ui"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022717; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4081 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit CnC Activity 2"; flow:established,to_server; content:"POST"; http_method; content:!"."; http_uri; content:"User-Agent|3a 20|curl/"; http_header; content:"vs_mid="; http_client_body; depth:7; fast_pattern; content:"&br_mid="; http_client_body; content:"&event_type="; http_client_body; content:"diss URL"; http_client_body; nocase; content:!"Referer|3a|"; http_header; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022718; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4082 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Adware.Pirrit Web Injects"; flow:established,to_server; content:"GET"; http_method; content:"/mu?id="; http_uri; fast_pattern; content:"&d="; http_uri; content:"&cl="; http_uri; pcre:"/\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$/Ui"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:trojan-activity; sid:2022719; rev:2; metadata:created_at 2016_04_08, updated_at 2016_04_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4083 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 4"; flow:established,to_server; content:"POST"; http_method; content:"/u/"; depth:3; http_uri; fast_pattern; content:"Connection|3a| Close|0d 0a|"; nocase; http_header; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|"; content:!"Accept"; http_header; content:!"Referer|3a|"; nocase; http_header; content:"a="; depth:2; http_client_body; content:"&c="; http_client_body; distance:0; content:"&r="; http_client_body; distance:0; pcre:"/^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$/P"; reference:md5,3ea75d62966f8c52de16d7849eeb3691; classtype:trojan-activity; sid:2022723; rev:2; metadata:created_at 2016_04_11, updated_at 2016_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4085 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/MediaGet.Adware Installer Download"; flow:established,to_client; content:"Set-Cookie|3A 20 |MediagetDownloaderInfo=installer"; http_raw_header; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; fast_pattern; distance:-64; within:4; flowbits:isnotset,ET.Adobe.Site.Download; reference:url,home.mcafee.com/VirusInfo/VirusProfile.aspx?key=860182; reference:md5,39c1769c39f61dd2ec009de8374352c6; classtype:trojan-activity; sid:2014353; rev:6; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4086 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Successful QuizScope Installation"; flow:established,to_server; content:"GET"; http_method; content:"/qscope/ithankyou"; depth:17; fast_pattern; http_uri; reference:md5,4dae2a394b792c36936a88cfc296f9b9; classtype:trojan-activity; sid:2022812; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4087 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SearchProtect PUA User-Agent Observed"; flow:established,to_server; content:"SearchProtect|3b|"; depth:14; http_user_agent; reference:md5,34e2350c2ed6a9a9e9d444102ae4dd87; classtype:trojan-activity; sid:2022813; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4088 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Conduit Trovi Adware/PUA"; flow:established,to_server; content:"GET"; http_method; content:"/?gd="; http_uri; depth:5; fast_pattern; content:"&ctid="; http_uri; distance:0; content:"&octid="; http_uri; distance:0; content:"&SSPV="; http_uri; distance:0; reference:md5,069ce8c2a553f9bc5a9599d7541943ce; classtype:trojan-activity; sid:2022814; rev:2; metadata:created_at 2016_05_17, updated_at 2016_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4089 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Toolbar.WIDGI User-Agent (WidgiToolbar-)"; flow:to_server,established; content:"POST"; http_method; nocase; content:"WidgiToolbar-"; depth:13; http_user_agent; reference:md5,1785f9784cb4e7400ed6f2c8f0e421c2; classtype:trojan-activity; sid:2022826; rev:2; metadata:created_at 2016_05_18, updated_at 2016_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4095 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP/DriverRestore Sending System Information to Affiliate"; flow:established,to_server; content:".jsp?leadTrackerId="; http_uri; content:"|22|ComputerName|22|"; http_uri; distance:0; content:"|22|UserName|22|"; http_uri; distance:0; content:"|22|IsAdmin|22|"; http_uri; distance:0; content:"User-Agent|3a 20|DriverRestore/"; http_header; fast_pattern:6,20; content:!"Referer|3a 20|"; http_header; reference:md5,4f7f497668e3e716a6f4a53af0924a25; classtype:trojan-activity; sid:2022827; rev:2; metadata:created_at 2016_05_18, updated_at 2016_05_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4096 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TopTools PUP Install Activity"; flow:established,to_server; content:"POST"; http_method; content:"_install.cgi"; http_uri; content:"User-Agent|3a 20|BIDUI18N|0d 0a|"; http_header; content:"name=|22|ufile01|22 3b 20|filename=|22|boundary|22|"; http_client_body; fast_pattern; content:"Content-Type|3a 20|application/octet-stream"; http_client_body; distance:0; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; reference:md5,3e464cff8690c7a2f57542688a278c62; classtype:trojan-activity; sid:2022829; rev:2; metadata:created_at 2016_05_19, updated_at 2016_05_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4097 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/CloudScout Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/QualityCheck/"; http_uri; fast_pattern; content:".php"; distance:0; http_uri; content:!"Referer|3a|"; http_header; content:"dp="; http_client_body; depth:3; content:"&sdp="; http_client_body; distance:0; content:"&a="; http_client_body; distance:0; pcre:"/\.php$/U"; reference:md5,c732b52b245444e3f568d372ce399911; classtype:trojan-activity; sid:2019780; rev:8; metadata:created_at 2014_11_24, updated_at 2016_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4098 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MultiPlug.J Checkin"; flow:established,to_server; urilen:>103; content:"/?q="; http_uri; fast_pattern; depth:4; content:!"Referer|3a 20|"; http_header; content:"GET"; http_method; content:"+"; http_raw_uri; pcre:"/^\/(?:[A-Za-z]+\d?\/)?\?q=(?=[a-z0-9+/]*[A-Z])(?=[A-Z0-9+/]*[a-z])(?=[A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}/U"; content:!"map24.com|0d 0a|"; http_header; content:!"aptrk.com|0d 0a|"; http_header; content:!"Accept-"; http_header; pcre:"/^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r\n\r?$/H"; reference:md5,6b95ddc5238cc0576db7b206af13339e; classtype:trojan-activity; sid:2023707; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_01_09, malware_family PUA, performance_impact Low, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4102 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/BettrExperience.Adware Update Checkin"; flow:established,to_server; content:"/Check.ashx?"; depth:12; http_uri; content:"&e="; http_uri; content:"&n="; http_uri; content:"&mv="; http_uri; content:!"Referer|3a 20|"; reference:md5,b2651071fbd14bff5fb39bd90f447d27; classtype:trojan-activity; sid:2018026; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4105 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ProxyGearPro Proxy Tool PUA"; flow:to_server,established; content:"GET"; http_method; content:"Proxy|20|Gear|20|Pro/"; http_user_agent; fast_pattern; content:!"Referer|3a 20|"; http_header; metadata: former_category MALWARE; reference:md5,b8889db7b4ef74c9302c12781a92a23a; classtype:policy-violation; sid:2024484; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_07_20, performance_impact Moderate, updated_at 2017_07_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4123 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/LoadMoney Adware Activity"; flow:to_server,established; content:"POST"; http_method; content:".htm?v="; http_uri; fast_pattern; content:"&eh="; distance:0; http_uri; content:"&ts="; distance:0; http_uri; content:"&u2="; distance:0; http_uri; content:"Cookie|3a 20|a=h+"; content:!"Referer|3a 20|"; http_header; flowbits:set,ETPTadmoney; metadata: former_category MALWARE; reference:md5,681501695c12112aaf2129ab614481bd; reference:md5,1282b899c41b06dac0adb17e0e603d30; classtype:trojan-activity; sid:2024693; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_06_12, malware_family Neshta, performance_impact Low, updated_at 2017_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4124 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32.SoftPulse Retrieving data"; flow:established,to_server; content:"GET"; http_method; content:"/maxpower-static/templates/"; depth:27; http_uri; http_header_names; content:!"Referer"; reference:md5,4aa02ca6a3f04cf445924a6d657d10e5; classtype:trojan-activity; sid:2019143; rev:5; metadata:created_at 2014_07_22, updated_at 2014_07_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4146 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/DownloadGuide.A"; flow:established,to_server; content:"POST"; http_method; content:"/1/dg/3"; http_uri; fast_pattern; content:"Content-Type|3a 20|application/json"; http_header; content:"{|22|BuildId|22 3a|"; http_client_body; content:"|22|Campaign|22|"; http_client_body; content:"|22|TrackBackUrl|22|"; http_client_body; http_header_names; content:!"Referer"; reference:md5,37b91123a58a48975770241445392aeb; classtype:trojan-activity; sid:2018513; rev:4; metadata:created_at 2014_06_02, updated_at 2014_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4147 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/SoftPulse.H Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:9; content:"/__dmp__/"; http_uri; fast_pattern; content:"data={"; depth:6; http_client_body; http_header_names; content:!"Accept"; content:!"Connection"; content:!"Referer"; reference:md5,6424fb3317b4be3d00e4d489122c9a48; classtype:trojan-activity; sid:2019228; rev:4; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4149 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/BrowseFox.H Checkin 2"; flow:established,to_server; content:"POST"; http_method; urilen:3; content:"/rs"; http_uri; content:"alpha="; http_client_body; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/PR"; http_header_names; content:!"User-Agent"; content:!"Accept"; content:!"Referer"; reference:md5,437a5cb57567c2691ce61a700682eab7; classtype:trojan-activity; sid:2018899; rev:4; metadata:created_at 2014_07_29, updated_at 2014_07_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4151 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PullUpdate.Adware CnC Beacon"; flow:established,to_server; urilen:7; content:"POST"; http_method; content:"?v="; http_uri; fast_pattern; pcre:"/^\/[a-z]{2}\x3Fv\x3D[0-9]$/U"; http_header_names; content:!"Referer"; content:!"Accept"; content:!"User-Agent"; reference:md5,129563c2ab034af094422db408d7d74f; classtype:trojan-activity; sid:2018368; rev:5; metadata:created_at 2014_04_07, updated_at 2014_04_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4152 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/iBryte.Adware Installer Download"; flow:established,to_server; content:"GET"; http_method; content:".exe?mode="; http_uri; content:"&sf="; http_uri; content:"&browser="; http_uri; content:"&useragent="; http_uri; http_header_names; content:!"Referer"; reference:md5,4c80e5f72a2ab8324b981e37b3b0e5d1; classtype:trojan-activity; sid:2020197; rev:5; metadata:created_at 2015_01_16, updated_at 2015_01_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4153 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE AdWare.Win32.BetterSurf.b SSL Cert"; flow:established,from_server; content:"CN=*.tr553.com"; threshold: type limit, track by_src, count 2, seconds 60; reference:md5,54c9288cbbf29062d6d873cba844645a; classtype:trojan-activity; sid:2020712; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_03_19, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4154 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/ELEX Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/v"; depth:2; http_uri; content:"?update"; http_uri; fast_pattern; distance:0; pcre:"/^[0-9]?=[a-z]+/URi"; http_header_names; content:!"User-Agent"; content:!"Accept"; content:!"Referer"; reference:md5, 2fed7fe9d055ebb63897bc2c8996676d; reference:md5,e2fd0d2c44e96cab5017bb8a68ca92a6; classtype:trojan-activity; sid:2019779; rev:6; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4157 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PUP Win32/DownloadAssistant.A Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/launch/"; http_uri; isdataat:!1,relative; http_header_names; content:"X-Crypto-Version"; fast_pattern; content:!"User-Agent"; content:!"Referer"; reference:md5,62a4d32dcb1c495c5583488638452ff9; classtype:trojan-activity; sid:2021283; rev:4; metadata:created_at 2015_06_16, updated_at 2015_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4159 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/WinWrapper.Adware Initial Install Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/api.cgi?act="; http_uri; fast_pattern; content:"&appid="; http_uri; content:"&ts="; http_uri; content:"&dlip="; http_uri; content:"&dlid="; http_uri; content:"&proto="; http_uri; content:"NSIS_Inetc (Mozilla)"; depth:20; http_user_agent; http_header_names; content:!"Referer"; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020627; rev:5; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4162 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/OutBrowse.G Variant Checkin"; flow:to_server,established; content:"/dmresources/instructions"; fast_pattern; http_uri; content:".dat"; http_uri; content:"NSISDL/1.2 (Mozilla)"; depth:20; http_user_agent; http_protocol; content:"HTTP/1.0"; isdataat:!1,relative; http_header_names; content:!"Referer"; reference:md5,d75055c45e2c5293c3e0fbffb299ea6d; reference:url,www.virustotal.com/en/file/95e0eaaee080f2c167464ed6da7e4b7a27937ac64fd3e1792a1aa84c1aed488e analysis/; classtype:trojan-activity; sid:2017992; rev:8; metadata:created_at 2014_01_20, updated_at 2014_01_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4163 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/InstallCore Initial Install Activity 1"; flow:established,to_server; content:"POST"; http_method; content:"/?v="; depth:4; http_uri; content:"&subver="; fast_pattern; distance:0; http_uri; content:"&pcrc="; distance:0; http_uri; pcre:"/^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$/U"; http_header_names; content:!"Accept-"; content:!"Referer"; reference:md5,0a6a0baf77b80706cab665754ecadac9; classtype:trojan-activity; sid:2022807; rev:2; metadata:created_at 2016_05_16, updated_at 2016_05_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4165 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Hadsruda!bit Adware/PUA Installation Activity"; flow:to_server,established; content:"GET"; http_method; content:"?alpha="; http_uri; content:"NSIS_Inetc"; http_user_agent; depth:10; fast_pattern; pcre:"/\?alpha=(?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})/U"; reference:md5,6b58b3eb9bbb0f7297a2e36e615506d3; classtype:trojan-activity; sid:2022850; rev:3; metadata:created_at 2016_06_02, updated_at 2016_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4172 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.MultiInstaller"; flow:established, to_server; content:"GET"; http_method; content:"?s1="; http_uri; fast_pattern; pcre:"/^\/(?:info|entrance|start|debug)\?s1=[a-f0-9]{100,}$/U"; http_header_names; content:!"Referer"; reference:md5, 26973eeddb4781225b7c23d2d9cce996; reference:md5,a74b1602a50b9c7d3262e3f80a6a2e68; classtype:trojan-activity; sid:2018512; rev:6; metadata:created_at 2014_06_02, updated_at 2014_06_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4176 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/PicColor Adware CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"?d="; http_uri; content:"&format=json"; http_uri; isdataat:!1,relative; fast_pattern; http_header_names; content:!"Accept-"; content:!"Referer"; reference:md5,6b173406ffccaa6d0287b795f8de2073; classtype:trojan-activity; sid:2020948; rev:3; metadata:created_at 2015_04_20, updated_at 2015_04_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4177 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DownloadAssistant.A PUP CnC"; flow:established,to_server; content:"POST"; http_method; content:"/v2/"; http_uri; depth:4; fast_pattern; pcre:"/^\/v2\/(?:(?:(?:intro_impr|s)ession|l(?:aunch|og)|exit)/$|c(?:(?:dn_(?:success|check)|ancel)/$|lick/))/U"; http_header_names; content:"X-Crypto-Version"; content:!"User-Agent"; reference:md5,a54f78d0fe6d1a1a09c22a71646c24b3; classtype:trojan-activity; sid:2021282; rev:3; metadata:created_at 2015_06_16, updated_at 2015_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4179 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MALWARE W32/WinWrapper.Adware POST CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/api.cgi?act="; http_uri; fast_pattern; content:"&appid="; http_uri; content:"&proto="; http_uri; content:"WinWrapper"; depth:10; http_user_agent; content:"{|22|appId|22 3a 22|"; http_client_body; content:"|22|uuId|22 3a 22|"; http_client_body; http_header_names; content:!"Referer"; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:trojan-activity; sid:2020628; rev:4; metadata:created_at 2015_03_06, updated_at 2015_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4180 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Adware.Gamevance.AV Checkin"; flow:established,to_server; content:"/aj/"; http_uri; fast_pattern; content:".php?p="; http_uri; http_header_names; content:!"Referer"; reference:url,virustotal.com/en/file/21e04ef285d9df2876bab83dd91a8bd78ecdf0d47a8e4693e2ec1924f642bfc8/analysis/; reference:md5,0134997dff945fbfe62f343bcba782bc; classtype:trojan-activity; sid:2017136; rev:5; metadata:created_at 2013_07_11, updated_at 2013_07_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4181 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 5"; flow:established,to_server; content:"POST"; http_method; content:"/q/"; depth:3; http_uri; fast_pattern; content:"q="; depth:2; http_client_body; pcre:"/^[a-zA-Z0-9_-]+$/PR"; http_connection; content:"close"; nocase; isdataat:!1,relative; http_content_type; content:"application/x-www-form-urlencoded"; depth:33; isdataat:!1,relative; http_header_names; content:!"Accept"; content:!"Referer"; metadata: former_category MALWARE; reference:md5,f0e02ba660cfcb122b89bc780a6555ac; classtype:trojan-activity; sid:2025094; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Internet, tag Adware, signature_severity Major, created_at 2017_12_01, malware_family Adposhel, performance_impact Moderate, updated_at 2017_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4183 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/LoadMoney Adware Activity M2"; flow:to_server,established; content:"GET"; http_method; content:"/software_install?sid="; http_uri; fast_pattern; content:"&sub_id="; distance:0; http_uri; content:"&hash="; distance:0; http_uri; content:"&mid="; distance:0; http_uri; content:"&fname="; distance:0; http_uri; content:!"Referer|3a 20|"; http_header; flowbits:set,ETPTadmoney; metadata: former_category MALWARE; reference:md5,844e53381099d572c3864c7a42ddbbf1; classtype:trojan-activity; sid:2025303; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_02_02, malware_family Loadmoney, performance_impact Moderate, updated_at 2018_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4188 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue.WinPCDefender Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?machine_id={"; http_uri; depth:14; fast_pattern; content:"}"; http_uri; distance:0; isdataat:!1,relative; content:!"Referer"; http_header; content:"anti"; http_host; depth:4; metadata: former_category MALWARE; reference:md5,aa8def27909596f8477a5374f735eec9; reference:url,www.bleepingcomputer.com/virus-removal/remove-antivirus-pro-2017; classtype:trojan-activity; sid:2025358; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_02_14, performance_impact Moderate, updated_at 2018_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4189 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PPI User-Agent (InstallCapital)"; flow:to_server,established; content:"User-Agent|3a 20|InstallCapital"; http_header; metadata: former_category TROJAN; reference:md5,a6a9e8b0432ad557245ac8ad2926ed7c; classtype:trojan-activity; sid:2022246; rev:3; metadata:created_at 2015_12_11, updated_at 2018_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4190 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MALWARE Observed Win32/Foniad Domain (suggedin .info in DNS Lookup)"; dns_query; content:"suggedin.info"; nocase; isdataat:!1,relative; metadata: former_category MALWARE; reference:md5,dc2c0b6a8824f5ababf18913ad6d0793; classtype:trojan-activity; sid:2025531; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_04_17, malware_family Foniad, performance_impact Moderate, updated_at 2018_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4200 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WiseCleaner Installed (PUA)"; flow:established,to_server; content:"POST"; http_method; content:".php?p=install_statistics"; nocase; http_uri; content:"wisecleaner.net"; http_host; fast_pattern; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.0|3b 20|Maxthon)"; http_user_agent; metadata: former_category MALWARE; reference:url,wisecleaner.com; reference:md5,cd6e96207ea60b3e6e46c393fdcc9e0c; classtype:trojan-activity; sid:2025589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2018_06_12, updated_at 2018_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4202 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Antibody Software Installed (PUA)"; flow:established,to_server; content:"GET"; http_method; content:"version.php?ver="; nocase; http_uri; content:"&newinstall="; nocase; http_uri; distance:0; content:"antibody-software.com"; http_host; fast_pattern; content:"Embarcadero URI Client/1.0"; http_user_agent; metadata: former_category MALWARE; reference:url,antibody-software.com; reference:md5,8e22d630b992f9cb4d7f6b0aceebb37f; classtype:trojan-activity; sid:2025590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2018_06_12, updated_at 2018_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4203 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/Adload.AT Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/impression.do"; http_uri; fast_pattern; content:"source="; http_uri; content:"&event="; http_uri; content:"&implementation_id="; http_uri; content:"user_id="; http_uri; content:"&useragent="; http_uri; content:"&sgn="; http_uri; content:"&subid2="; http_uri; content:"&ts="; http_uri; http_header_names; content:!"Referer"; content:!"Accept"; metadata: former_category MALWARE; reference:md5,d15069e44ec849ab26bcefffe6867f10; reference:md5,4ececc2f027a096c2100ec1125d0d151; classtype:trojan-activity; sid:2022893; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Adware, signature_severity Major, created_at 2016_06_13, malware_family MSIL_Adload, updated_at 2018_06_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4204 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [eSentire] Win32/Adware.Adposhel.lgvk CnC Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/inst?data="; http_uri; nocase; content:"Installer event sender/"; http_user_agent; depth:23; fast_pattern; isdataat:!3,relative; http_header_names; content:!"Accept"; content:!"Referer"; metadata: former_category MALWARE; reference:md5,e7c2c1b796dad6210165110b7e8cda7d; classtype:trojan-activity; sid:2025645; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2018_07_10, malware_family Adposhel, performance_impact Low, updated_at 2018_07_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4205 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Ksapp.A Checkin"; flow:to_server,established; content:"/kspp/do?imei="; fast_pattern:only; http_uri; content:"&wid="; http_uri; content:"&type="; http_uri; content:"&step="; http_uri; reference:md5,e6d9776113b29680aec73ac2d1445946; reference:md5,13e6ce4aac7e60b10bfde091c09b9d88; reference:url,anubis.iseclab.org/?action=result&task_id=16b7814b794cd728435e122ca2c2fcdd3; reference:url,www.fortiguard.com/latest/mobile/4158213; reference:url,symantec.com/connect/blogs/mdk-largest-mobile-botnet-china; classtype:trojan-activity; sid:2016318; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2012_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4239 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android TrojanFakeLookout.A"; flow:established,to_server; urilen:13; content:"/controls.php"; http_uri; content:"Dalvik/"; http_user_agent; reference:url,blog.trustgo.com/fakelookout/; reference:md5,65baecf1fe1ec7b074a5255dc5014beb; classtype:trojan-activity; sid:2016343; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_02_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Fakelash.A!tr.spy Checkin"; flow:to_server,established; content:"/data.php?action="; nocase; http_uri; content:"&online="; distance:0; http_uri; content:"&m="; distance:0; http_uri; content:"&ver="; distance:0; http_uri; content:"User-Agent|3a| Dalvik/"; http_header; reference:md5,7dec1c9174d0f688667f6c34c0fa66c2; reference:url,blog.fortiguard.com/android-malware-distributed-by-malicious-sms-in-france/; classtype:trojan-activity; sid:2016344; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_02_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4241 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/FakeTimer.A Reporting to CnC"; flow:to_server,established; content:"/send.php?a_id="; http_uri; content:"&telno="; fast_pattern:only; http_uri; content:"&m_addr="; http_uri; content:"Android"; http_user_agent; reference:url,about-threats.trendmicro.com/Malware.aspx?language=uk&name=ANDROIDOS_FAKETIMER.A; reference:url,anubis.iseclab.org/?action=result&task_id=1ba82b938005acea4ddefc8eff1f4db06; reference:md5,cf9ba4996531d40402efe268c7efda91; reference:md5,537f190d3d469ad1f178024940affcb5; classtype:trojan-activity; sid:2014161; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2012_01_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SMSSend Fake flappy bird APK"; flow:to_server,established; content:"GET"; http_method; content:"/bookmark/getServiceCode?price="; http_uri; fast_pattern:only; content:"Dalvik"; depth:6; http_user_agent; content:!"Referer|3a 20|"; http_header; reference:url,securehoney.net/blog/how-to-dissect-android-flappy-bird-malware.html; reference:md5,6c357ac34d061c97e6237ce9bd1fe003; classtype:trojan-activity; sid:2018306; rev:3; metadata:created_at 2014_03_24, updated_at 2014_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4259 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.KorBanker Successful Fake Banking App Install CnC Server Acknowledgement"; flow:established,to_client; file_data; content:"|7b 22|success|22 3A|1,|22|message|22 3A 22|Product successfully updated.|22|}"; within:55; reference:url,www.fireeye.com/blog/technical/targeted-attack/2013/11/dissecting-android-korbanker.html; reference:md5,a68bbfe91fab666daaf2c070db00022f; reference:md5,a68bbfe91fab666daaf2c070db00022f; classtype:trojan-activity; sid:2017788; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_11_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4260 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AndroidOS/Lotoor.Q"; flow:established, to_server; content: "device_id="; http_uri; pcre:"/^\d{10,20}&imsi=\d{10,15}&device_name=/URi"; content:"&app_id="; http_uri; pcre:"/^[a-f0-9]{30,35}&app_package_name=/URi"; content: "screen_density="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,92608e6ff795862f83d891ad8337b387; classtype:trojan-activity; sid:2018520; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_06_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4261 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Adware.Wapsx.A"; flow:established, to_server; content:"/fengmian/"; fast_pattern:only; content:"meinv6.4.0 qiu shou gou, zhi mai 503 wan ren min bi"; http_user_agent; depth:51; content:!"Referer|3a|"; http_header; reference:md5,37e36531e6dbc3ad0954fd9bb4588fad; classtype:trojan-activity; sid:2018533; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_06_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4262 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Andr/com.sdwiurse"; flow:established,to_server; content:"POST"; http_method; content:"/youxi_up.php"; fast_pattern:only; http_uri; content:"--*****|0d 0a|Content-Disposition|3a| form-data|3b| name=|22|npki|22|"; depth:52; http_client_body; reference:url,fireeye.com/blog/technical/2014/06/what-are-you-doing-dsencrypt-malware.html; reference:md5,04d24eb45d3278400b5fee5c1b06226c; classtype:trojan-activity; sid:2018584; rev:3; metadata:created_at 2014_06_19, updated_at 2014_06_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4264 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET 9999 (msg:"ET MOBILE_MALWARE Android Spyware Dowgin Checkin"; flow:established,to_server; urilen:13; content:"POST"; http_method; content:"/webviewAdReq"; nocase; depth:13; http_uri; reference:md5,45bf9f6e19649d3e1642854ecd82623c; classtype:trojan-activity; sid:2018663; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_10, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4265 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android ScarePakage checkin"; flow:established,to_server; content:"POST"; http_method; content:"/flash/api.php?id="; http_uri; fast_pattern:only; pcre:"/^\/flash\/api\.php\?id=\d/U"; content:"method="; depth:7; http_client_body; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:url,blog.lookout.com/blog/2014/07/16/scarepakage/; reference:url,contagiominidump.blogspot.com/2014/07/android-scarepackage-ransomware.html; reference:md5,645a60e6f4393e4b7e2ae16758dd3a11; classtype:trojan-activity; sid:2018769; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4266 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android ScarePakage checkin 2"; flow:established,to_server; content:"POST"; http_method; urilen:14; content:"/api33/api.php"; http_uri; fast_pattern:only; content:"method="; depth:7; http_client_body; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:url,blog.lookout.com/blog/2014/07/16/scarepakage/; reference:url,contagiominidump.blogspot.com/2014/07/android-scarepackage-ransomware.html; reference:md5,645a60e6f4393e4b7e2ae16758dd3a11; classtype:trojan-activity; sid:2018774; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4267 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AndroidOS.Simplocker Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:5; content:"/1/?1"; http_uri; fast_pattern:only; content:"{|22|n|22 3a 22|"; depth:6; http_client_body; content:"|22 2c 22|d|22 3a 22|"; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:url,welivesecurity.com/2014/07/22/androidsimplocker/; reference:md5,b98cac8f1ce9284f9882ba007878caf1; classtype:trojan-activity; sid:2018781; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_25, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4268 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Worm.AndroidOS.Selfmite.a Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:12; content:"/message.php"; http_uri; fast_pattern:only; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,54b715f6608d4457a9d22cfdd8bddbe6; reference:url,adaptivemobile.com/blog/selfmite-worm; reference:url,computerworld.com/s/article/9249430/Self_propagating_SMS_worm_Selfmite_targets_Android_devices; classtype:trojan-activity; sid:2018792; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_28, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4269 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MOBILE_MALWARE Android/Trogle.A Possible Exfiltration of SMS via SMTP"; flow:established,to_server; content:"MAIL FROM|3a|<a137736513@qq.com>"; nocase; reference:md5,ef819779fc4bee6117c124fb752abf57; classtype:trojan-activity; sid:2018887; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4270 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Spy.Kasandra.A Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/path/DeviceManager.php"; nocase; depth:23; http_uri; content:"func="; depth:5; http_client_body; content:"&deviceid="; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,6df6553b115d9ed837161a9e67146ecf; classtype:trojan-activity; sid:2018888; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4271 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Locker.B Checkin 1"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"method=counter&app_key="; depth:23; http_client_body; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,28726f772f6b4b63fb40696a28afafc9; reference:url,malware.dontneedcoffee.com/2014/08/scarepackageknstant.html; classtype:trojan-activity; sid:2018945; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4272 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Locker.B Checkin 2"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"method=devicestatus"; http_client_body; fast_pattern:only; content:"&app_key="; offset:19; http_client_body; content:"&imei="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,28726f772f6b4b63fb40696a28afafc9; reference:url,malware.dontneedcoffee.com/2014/08/scarepackageknstant.html; classtype:trojan-activity; sid:2018946; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_08_18, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4273 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Youmi.Adware Install Report CnC Beacon"; flow:established,to_server; content:"POST"; http_method; urilen:15; content:"/report/install"; http_uri; fast_pattern:only; content:"data="; http_client_body; depth:5; content:"os="; http_client_body; distance:0; content:"mac="; http_client_body; distance:0; content:"sign="; http_client_body; distance:0; reference:md5,6096ace9002792e625a0cdb6aec3f379; classtype:trojan-activity; sid:2019125; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_09_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4274 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/AppBuyer Checkin 1"; flow:established,to_server; content:"/updatesrv.aspx?f=1"; http_uri; fast_pattern:only; reference:md5,1c32f9f05234cac7dd7a83e3925a3105; reference:url,researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/; classtype:trojan-activity; sid:2019174; rev:2; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4275 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/AppBuyer Checkin 2"; flow:established,to_server; content:"/updatesrv.aspx?f=2&uuid="; http_uri; fast_pattern:only; reference:md5,1c32f9f05234cac7dd7a83e3925a3105; reference:url,researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/; classtype:trojan-activity; sid:2019175; rev:2; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4276 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser Checkin"; flow:to_server,established; content:"GET"; http_method; nocase; content:"/TargetConnect.aspx"; http_uri; content:"&tIMEI="; http_uri; content:"&tIMSI="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019331; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4277 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser sending GPS info"; flow:to_server,established; content:"GET"; http_method; nocase; content:"/TargetUploadGps.aspx"; http_uri; content:"tmac="; http_uri; content:"&JZ="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019332; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4278 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser sending files"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/TargetUploadFile.aspx"; http_uri; content:"tmac="; http_uri; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019333; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4279 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE iOS/Xsser checking library version"; flow:to_server,established; content:"GET"; http_method; nocase; urilen:18; content:"/CheckLibrary.aspx"; http_uri; content:!"Referer|3a|"; http_header; reference:md5,2cba795aff750259a2fc447cdd6ea1c7; reference:url,lacoon.com/lacoon-discovers-xsser-mrat-first-advanced-ios-trojan/; classtype:trojan-activity; sid:2019334; rev:2; metadata:created_at 2014_10_01, updated_at 2014_10_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4280 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Stealthgenie Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/SGCommand.aspx?sgcommand="; fast_pattern:6,20; http_uri; content:"&uid="; http_uri; distance:0; content:"&sid="; http_uri; distance:0; content:"&value="; http_uri; distance:0; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"|20|Android|20|"; http_user_agent; reference:md5,06947ce839a904d6abcb272ff46e7de1; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2014-111416-1306-99&tabid=2; reference:url,engadget.com/2014/09/30/crackdown-on-spying-apps-leads-to-stealthgenie-ceos-arrest/; classtype:trojan-activity; sid:2019805; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_11_25, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4281 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Syria-Twitter Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/contacts"; http_uri; content:"Apache-HttpClient/"; depth:18; http_user_agent; content:"contact|25|26="; depth:11; fast_pattern; http_client_body; pcre:"/\/contacts$/U"; reference:md5,b91315805ef1df07bdbfa07d3a467424; reference:url,www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-behind-the-syria-conflict.pdf; classtype:trojan-activity; sid:2020343; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_02_02, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4286 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon"; flow:established,to_server; content:"/input_data_get_contact.asp?user="; http_uri; content:"&pwd="; http_uri; content:"&addr="; http_uri; reference:url,research.zscaler.com/2015/02/android-banking-trojan-and-sms-stealer.html; reference:md5,ff081c1400a948f2bcc4952fed2c818b; classtype:trojan-activity; sid:2020353; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_02_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4287 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.SMSSend.Y"; flow:established,to_server; content:"/api/log.html|3f|"; http_uri; fast_pattern; content:"c="; http_uri; content:"&o="; http_uri; content:"&n="; http_uri; content:"Apache-HttpClient"; depth:18; http_user_agent; reference:md5,ef79985c90675e7abfb6b9a6bc5a6c65; classtype:trojan-activity; sid:2020729; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_03_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4290 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba.m Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:!"User-Agent|3a 20|"; http_header; content:"content=eyJmaW5nZXJwcmludCI"; fast_pattern; depth:27; http_client_body; reference:md5,0aa69ad64e20bb6cbf72f346ce43ff23; reference:url,www.fireeye.com/blog/threat-research/2014/07/the-service-you-cant-refuse-a-secluded-hijackrat.html; classtype:trojan-activity; sid:2021185; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_06_04, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4292 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"User-Agent|3a| Mozilla/5.0 (Windows NT 5.2|29 20|"; http_header; content:"appid="; depth:6; http_client_body; content:"&model="; http_client_body; content:"&imei="; fast_pattern:only; http_client_body; content:"&connect="; http_client_body; content:"&dpi="; http_client_body; content:"&width="; http_client_body; content:"&cpu="; http_client_body; content:"&phoneno="; http_client_body; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021386; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4293 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Gunpoder Checkin"; flow:to_server,established; content:"/landing?c="; fast_pattern:only; http_uri; content:"&g="; http_uri; content:"&a="; http_uri; content:"&s1="; http_uri; content:"&s2="; http_uri; content:"&s3="; http_uri; content:"&s4="; http_uri; content:"&s5="; http_uri; content:"&s6="; http_uri; content:"&s7="; http_uri; content:"&s8="; http_uri; content:"&s9="; http_uri; content:"&s10="; http_uri; content:"&s11="; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; reference:url,researchcenter.paloaltonetworks.com/2015/07/new-android-malware-family-evades-antivirus-detection-by-using-popular-ad-libraries/; reference:md5,b0b2cd71b4d15bb5f07b8315d7b27822; classtype:trojan-activity; sid:2021392; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4294 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"uuid="; http_client_body; content:"language="; http_client_body; content:"appkey"; http_client_body; content:"model="; http_client_body; content:"operatorsname="; fast_pattern:only; http_client_body; content:"networkname="; http_client_body; content:"networktype="; http_client_body; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021387; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_06, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4295 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE DNS Android/Spy.Feabme.A Query"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|tinduongpho|03|com|00|"; fast_pattern; distance:0; nocase; reference:md5,3ae3cb09c8f54210cb4faf7aa76741ee; reference:url,blog.trustlook.com/2015/07/08/most-successful-malware-on-google-play/; classtype:trojan-activity; sid:2021412; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_07_14, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4296 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Koler.C Checkin"; flow:to_server,established; content:".php?v="; http_uri; content:"&brok="; fast_pattern:only; http_uri; content:"&u="; http_uri; content:"&id="; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/&id=\d{15}$/U"; reference:md5,6ae7b0d04e2fd64a50703910d0eff9cc; classtype:trojan-activity; sid:2019510; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_10_27, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4300 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c Checkin"; flow:to_server,established; urilen:1; content:"POST"; http_method; nocase; content:!"Referer|3a 20|"; http_header; content:"{|22|type|22 3a|"; depth:8; http_client_body; content:",|22|text|22 3a|"; http_client_body; content:",|22|code|22 3a|"; fast_pattern:only; http_client_body; content:",|22|from|22 3a|"; http_client_body; content:"|22|}"; http_client_body; reference:md5,c9d3237885072b796e5849f7b9ec1a64; reference:url,b0n1.blogspot.com.br/2015/11/android-malware-drops-banker-from-png.html?m=1; reference:url,fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html; classtype:trojan-activity; sid:2022137; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_11_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4308 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Android/Fakeinst.KD .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|pc35hiptpcwqezgs"; nocase; distance:0; fast_pattern; reference:url,www.csis.dk/da/csis/blog/4818/; reference:md5,111b71c120167b5b571ee5501ffef65e; classtype:trojan-activity; sid:2022517; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4311 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|yuwurw46taaep6ip"; nocase; distance:0; fast_pattern; reference:md5,58fed8b5b549be7ecbfbc6c63b84a728; classtype:trojan-activity; sid:2022562; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4312 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain 2"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|voooxrrw2wxnoyew"; nocase; distance:0; fast_pattern; reference:md5,8d260ab2bb36aeaf5b033b80b6bc1e6a; classtype:trojan-activity; sid:2022563; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2016_02_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4313 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw/SlemBunk/SLocker Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:!"Referer|3a 20|"; http_header; content:",|22|model|22 3a|"; http_client_body; content:",|22|apps|22 3a 5b 22|"; http_client_body; content:",|22|imei|22 3a|"; fast_pattern:only; http_client_body; pcre:"/^\{\x22(?:os|type)\x22\x3a/P"; reference:md5,c9d3237885072b796e5849f7b9ec1a64; reference:md5,a83ce290469654002bcc64062c39387c; reference:url,www.fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html; classtype:trojan-activity; sid:2022288; rev:5; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2015_12_21, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4314 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE DNS Trojan-Banker.AndroidOS.Marcher.i Query"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tmdxiawceahpbhmb|03|com"; nocase; distance:0; fast_pattern; reference:md5,3c52de547353d94e95cde7d4c219ccac; classtype:trojan-activity; sid:2022975; rev:1; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_07_18, performance_impact Low, updated_at 2016_07_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4316 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher Sending Credit Card Info"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/cards_json.php"; http_uri; content:!"Referer|3a 20|"; http_header; content:"bot_id="; depth:7; fast_pattern; http_client_body; content:"&info="; http_client_body; content:"cardNum"; http_client_body; pcre:"/^bot_id=[a-f0-9]{32}&/P"; pcre:"/\.php$/U"; reference:md5,78c2444fe15a8e58c629076781d9442a; reference:url,blog.fortinet.com/2016/11/01/android-banking-malware-masquerades-as-flash-player-targeting-large-banks-and-popular-social-media-apps; classtype:trojan-activity; sid:2023483; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_03, performance_impact Low, updated_at 2016_11_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4318 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/RequestActionsToExecute"; fast_pattern; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|CommandLine|22 3a|"; depth:15; http_client_body; content:",|22|CurrentDirectory|22 3a|"; http_client_body; pcre:"/\/RequestActionsToExecute$/U"; reference:md5,3c1055f19971d580ef9ced172d8eba3b; reference:url,rednaga.io/2016/11/14/hackingteam_back_for_your_androids/; classtype:trojan-activity; sid:2023507; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4321 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/NotifyLog"; fast_pattern:only; http_uri; content:"|20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|ClientId|22 3a|"; depth:12; http_client_body; content:",|22|Date|22 3a|"; http_client_body; pcre:"/\/NotifyLog$/U"; reference:md5,3c1055f19971d580ef9ced172d8eba3b; reference:url,rednaga.io/2016/11/14/hackingteam_back_for_your_androids/; classtype:trojan-activity; sid:2023508; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4322 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU SSL CnC Cert"; flow:established,from_server; content:"|02|IT"; content:"|03|AAA"; distance:0; content:"|02|BB"; distance:0; content:"|03|EEE"; distance:0; content:"|0d|IT Department"; distance:0; content:"|0a|SASDS_Srv0"; fast_pattern; distance:0; reference:md5,cbd1c2db9ffc6b67cea46d271594c2ae; classtype:trojan-activity; sid:2023509; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_15, updated_at 2016_11_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4323 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin"; flow:to_server,established; content:"lm="; http_uri; content:"/watch/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023680; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4326 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 3"; flow:to_server,established; content:"lm="; http_uri; content:"/find/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023682; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4327 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 4"; flow:to_server,established; content:"lm="; http_uri; content:"/results/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023683; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4328 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 5"; flow:to_server,established; content:"lm="; http_uri; content:"/open/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023684; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4329 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 6"; flow:to_server,established; content:"lm="; http_uri; content:"/close/?"; fast_pattern:only; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023685; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2016_12_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4330 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher SSL CnC Cert"; flow:established,from_server; content:"|00 dd 45 ec 3f 08 74 58 6a|"; content:"|0a|Department"; distance:0; content:"|55 04 03|"; distance:0; content:"|0f|www.example.com"; distance:1; within:16; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023708; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4331 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|rockybalboa|02|at|00|"; nocase; distance:0; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023709; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4332 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|storegoogle|02|at|00|"; nocase; distance:0; fast_pattern; reference:md5,d332560f1fc3e6dc58d94d6fa0dab748; reference:url,www.zscaler.com/blogs/research/android-marcher-now-posing-super-mario-run; classtype:trojan-activity; sid:2023710; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, created_at 2017_01_09, updated_at 2017_01_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4333 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php"; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|Content-Language|3a 20|en-US|0d 0a|Connection|3a 20|Keep-Alive|0d 0a|"; depth:98; http_header; content:!"Referer|3a 20|"; http_header; content:"&method="; fast_pattern:only; http_client_body; pcre:"/^d(?:id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$/P"; pcre:"/\.php$/U"; reference:md5,d6ef9b0cdb49b56c53da3433e30f3fd6; reference:md5,4ddf3ff57db24513a16eacb99ad07675; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:2023933; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_02_16, performance_impact Low, updated_at 2017_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4334 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Femas.b Apps List Exfil"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/functions.php"; fast_pattern:only; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:"apslst="; depth:7; http_client_body; reference:md5,4ddf3ff57db24513a16eacb99ad07675; reference:url,securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/; classtype:trojan-activity; sid:2023934; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_02_16, performance_impact Low, updated_at 2017_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4335 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Comll.Banker RAT CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/n/"; http_uri; content:!"Referer|3a 20|"; http_header; content:"content=eyJ"; http_client_body; depth:11; fast_pattern; content:!"Accept|3a|"; http_header; pcre:"/\/n\/\d{15}$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,a78e904a05d4a9e6a15b6f56b261eab9; classtype:trojan-activity; sid:2018630; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_07_03, updated_at 2017_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4342 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/sdk_api.php?id="; fast_pattern:only; http_uri; content:"&type="; http_uri; content:"Apache-HttpClient/"; depth:18; http_user_agent; content:!"Referer|3a 20|"; http_header; pcre:"/\.php\?id=[a-f0-9]{8}(?:-[a-f0-9]{4}){4}[a-f0-9]{8}&type=/U"; metadata: former_category MOBILE_MALWARE; reference:md5,bc76d516a66e4002461128f62896c6dd; classtype:trojan-activity; sid:2024201; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_04_11, malware_family Android_Ewind, updated_at 2017_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4347 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE AdWare.AndroidOS.Ewind.cd Response"; flow:from_server,established; file_data; content:"[{|22|id|22 3a 22|0|22|,|22|command|22 3a 22|OK|22|}"; depth:26; fast_pattern; metadata: former_category MOBILE_MALWARE; reference:md5,bc76d516a66e4002461128f62896c6dd; classtype:trojan-activity; sid:2024202; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_04_11, malware_family Android_Ewind, updated_at 2017_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4348 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.KorBanker Fake Banking App Install CnC Beacon"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/send_sim_no.php|20|HTTP/1."; fast_pattern; content:!"Referer|3a 20|"; http_header; content:"_no="; http_client_body; depth:16; metadata: former_category MOBILE_MALWARE; reference:url,www.fireeye.com/blog/technical/targeted-attack/2013/11/dissecting-android-korbanker.html; reference:md5,a68bbfe91fab666daaf2c070db00022f; reference:md5,a68bbfe91fab666daaf2c070db00022f; classtype:trojan-activity; sid:2017787; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2013_11_27, updated_at 2017_04_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4349 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Dropper.Abd Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/ad-"; http_uri; content:"|3b 20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"RgQ7"; depth:4; fast_pattern; http_client_body; pcre:"/\/ad-(?:strat|devi)\/$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,66a1dda748d073f5e659b700339c3343; reference:url,www.zscaler.com/blogs/research/malicious-android-ads-leading-drive-downloads; classtype:trojan-activity; sid:2024411; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android_07012016, signature_severity Major, created_at 2017_06_19, updated_at 2017_06_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4350 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a CnC Beacon"; flow:to_server,established; content:"/inj/injek-1.php?id="; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; pcre:"/\?id=(?:[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/U"; metadata: former_category MOBILE_MALWARE; reference:md5,e9542a8bd9f0ab57e40bb8519ac443a2; classtype:trojan-activity; sid:2024426; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_06_26, malware_family Android_Marcher, updated_at 2017_06_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4351 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/get.php|20|HTTP/1."; fast_pattern:only; content:!"Referer|3a 20|"; http_header; content:"info"; http_client_body; pcre:"/(?:^|&|\x22|\{\x22)id(?:=|\x22\x3a\x22)(?:[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(?:&|\x22|$)/P"; metadata: former_category MOBILE_MALWARE; reference:md5,a85990f79268a18329f4040a2ec85591; reference:md5,f48cd0c0e5362142c0c15316fa2635dd; classtype:trojan-activity; sid:2023553; rev:7; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, signature_severity Critical, created_at 2014_04_17, malware_family Android_Hqwar, updated_at 2017_07_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4352 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET MOBILE_MALWARE WireX Botnet DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|axclick|05|store|00|"; fast_pattern; distance:0; nocase; metadata: former_category MOBILE_MALWARE; reference:md5,6af299a2ac9b59f7d551b6e235e0d200; reference:url,blog.cloudflare.com/the-wirex-botnet/; classtype:trojan-activity; sid:2024615; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_08_28, malware_family Android_WireX, updated_at 2017_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4355 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.RedAlert CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/gt|20|HTTP/1."; fast_pattern:only; content:"|0d 0a|Connection|3a 20|keep-alive|0d 0a|Content-Type|3a 20|application/json|0d 0a|"; http_header; content:"|3b 20|Android|20|"; http_user_agent; content:!"Referer|3a 20|"; http_header; metadata: former_category MOBILE_MALWARE; reference:md5,b66010a9c91b17f4d26dc973a97419ac; reference:url,info.phishlabs.com/blog/redalert2-mobile-banking-trojan-actively-updating-its-techniques; classtype:trojan-activity; sid:2024765; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_09_25, malware_family Android_RedAlert, updated_at 2017_09_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4372 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android JadeRAT CnC Beacon"; flow:to_server,established; dsize:<500; content:"@!MyID|3a|"; depth:7; content:"IMEI|3a|"; distance:0; content:"Mobile|20|ID|3a|"; content:"SIM|3a|"; content:"IMSI|3a|"; content:"Android|20|version|3a|"; content:"Model|3a|"; content:"All|20|SD|20|Size|3a|"; fast_pattern:only; content:"Free|20|SD|20|Size|3a|"; content:"Network|20|type|3a|"; metadata: former_category MOBILE_MALWARE; reference:md5,9027f111377598362972745478e40311; reference:url,blog.lookout.com/mobile-threat-jaderat; classtype:trojan-activity; sid:2024895; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_10_23, malware_family Android_JadeRAT, updated_at 2017_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4373 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android JadeRAT CnC Beacon 2"; flow:to_server,established; dsize:22; content:"@!hi|3a|"; depth:5; fast_pattern; pcre:"/^\d{15}\r\n$/R"; metadata: former_category MOBILE_MALWARE; reference:md5,9027f111377598362972745478e40311; reference:url,blog.lookout.com/mobile-threat-jaderat; classtype:trojan-activity; sid:2024896; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2017_10_23, malware_family Android_JadeRAT, updated_at 2017_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4374 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 1"; dns_query; content:"loaderclientarea24.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025014; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4379 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 2"; dns_query; content:"loaderclientarea22.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025015; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4380 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 3"; dns_query; content:"loaderclientarea20.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025016; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4381 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 4"; dns_query; content:"loaderclientarea15.ru"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,c4acc83183ac0fabe92fc02ae5ef3ca4; reference:url,www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/; classtype:trojan-activity; sid:2025017; rev:2; metadata:affected_product Android, attack_target Client_Endpoint, deployment Perimeter, tag Android, created_at 2017_11_22, updated_at 2017_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4382 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Adware.Adwo.A"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?m="; http_uri; content:"&a="; http_uri; content:"&os="; http_uri; content:!"&ComPut="; http_uri; http_header_names; content:!"User-Agent"; reference:md5,bbb0aa6c9f84963dacec55345fe4c47e; classtype:trojan-activity; sid:2023475; rev:3; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2016_11_01, performance_impact Low, updated_at 2016_11_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4384 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android.Trojan.Marcher.U DNS Lookup"; dns_query; content:"sagdzusghcsh.top"; nocase; isdataat:!1,relative; metadata: former_category MOBILE_MALWARE; reference:md5,ccefe18d7b9bc31a8673b9bf82104f48; classtype:trojan-activity; sid:2025273; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2018_01_30, malware_family Android_Marcher, updated_at 2018_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4385 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Fancy Bear Checkin 2"; flow:to_server,established; content:"POST"; http_method; content:"lm="; http_uri; content:"/search/?"; fast_pattern:only; http_uri; content:!"&clid="; http_uri; content:!"&banerid="; http_uri; content:!"&win="; http_uri; pcre:"/\/\?(?:text|from|a(?:gs|q)|oe|btnG|oprnd|utm|channel)=/U"; metadata: former_category MOBILE_MALWARE; reference:md5,6f7523d3019fa190499f327211e01fcb; reference:url,www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/; classtype:trojan-activity; sid:2023681; rev:3; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, signature_severity Major, created_at 2016_12_23, malware_family Fancy_Bear, updated_at 2018_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4386 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Golden Rat Checkin"; flow:to_server,established; content:"<HmzaPacket>|3e 0a 20 20|<Command>"; depth:25; fast_pattern; content:"<MSG>"; within:40; content:"</MSG>|3e 0a 20 20|"; distance:0; content:"</HmzaPacket></HAMZA_DELIMITER_STOP>"; distance:0; metadata: former_category MOBILE_MALWARE; reference:url,csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf; reference:md5,6296586cf9a59b25d1b8ab3eeb0c2a33; classtype:trojan-activity; sid:2025895; rev:1; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_07_25, malware_family Android_GoldenRat, updated_at 2018_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4397 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/data/collectdata-new.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|a|22 3a|"; depth:5; http_client_body; content:"|22|b|22 3a|[{|22|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,cc56d261cbf0ecddcdc70de85af138d1; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025987; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Major, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4448 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a CnC Beacon"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/newuser.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|imei|22 3a|"; depth:8; http_client_body; content:"|22|tag|22 3a|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,cc56d261cbf0ecddcdc70de85af138d1; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025988; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4449 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/admin/data/fcollectdata.php"; http_uri; fast_pattern; isdataat:!1,relative; content:"okhttp/"; depth:7; http_user_agent; content:!"Referer|3a 20|"; http_header; content:"{|22|category|22 3a|"; http_client_body; metadata: former_category MOBILE_MALWARE; reference:md5,b603017bbcee17a76f5b0ee478d2d935; reference:url,drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view; classtype:trojan-activity; sid:2025989; rev:2; metadata:affected_product Android, attack_target Mobile_Client, deployment Perimeter, tag Android, signature_severity Critical, created_at 2018_08_13, malware_family ANdroid_CrazyMango, updated_at 2018_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 4450 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN PoisonIvy.Eu5 Keepalive from CnC"; flow:established,from_server; content:"|3a 62 26 fd 44 34 01 ed a1 ed 88 48 7e f4 6e ca 0d 81 aa 70 c7 da e0 1c fc f2 f1 d2 94 f6 d9 44 f6 c1 92 c4 4f d4 2d 53 a7 5f 59 fd f6 1e 9b 6f|"; depth:48; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:trojan-activity; sid:2014057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2011_12_30, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5208 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Eu5 Keepalive to CnC"; flow:established,to_server; content:"|13 cb df 56 6f f3 20 08 c2 f1 ab d3 6f 75 56 a9|"; offset:16; depth:16; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:trojan-activity; sid:2014056; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2011_12_30, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5209 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Nuclear Checkin"; flow:established,to_server; content:".htm"; http_uri; content:"Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Win32)"; http_header; content:"HOST|3A 20|"; http_header; reference:md5,bd4af162f583899eeb6ce574863b4db6; classtype:trojan-activity; sid:2014121; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag Exploit_Kit, tag Nuclear, signature_severity Critical, created_at 2012_01_12, malware_family Nuclear, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5215 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Ehy Keepalive to CnC"; flow:established,to_server; content:"|19 07 1b 24 3b 7a 9d e7 77 1e 84 f6 0f 60 3e 27|"; offset:16; depth:16; dsize:48; reference:md5,d2311b7208d563ac59c9114f5d422441; classtype:trojan-activity; sid:2014145; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2012_01_23, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5217 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/DelfInject.A CnC Checkin 2"; flow:established,to_server; content:"/gate.php?username="; http_uri; content:"&country="; http_uri; content:"&OS="; http_uri; reference:md5,d8c2f31493692895c45d620723e9a8c3; classtype:trojan-activity; sid:2014164; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5218 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/Mentory CnC Server Providing Update Details"; flow:established,to_client; content:"[UPDATE]|0D 0A|VER ="; content:"URL ="; distance:0; content:"[PATTERN]|0D 0A|VER ="; distance:0; content:"URL ="; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:trojan-activity; sid:2014166; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5219 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/Mentory CnC Server Providing File Info Details"; flow:established,to_client; content:"[DBINFO]|0D 0A|Info ="; content:"Version ="; distance:0; content:"[TotalCount]|0D 0A|Count ="; distance:0; content:"[GaruYac"; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:trojan-activity; sid:2014167; rev:2; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5220 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Query for Known Hostile *test.3322.org.cn Domain"; content:"|01 00 00 01 00 00 00 00 00|"; depth:9; offset:2; content:"test|04|3322|03|org|02|cn"; fast_pattern; nocase; distance:0; reference:url,www.sans.org/reading_room/whitepapers/malicious/detailed-analysis-advanced-persistent-threat-malware_33814; reference:md5,e4afcee06ddaf093982f80dafbf9c447; classtype:trojan-activity; sid:2014267; rev:1; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5231 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.RShot Checkin"; flow:established,to_server; content:"connected#"; depth:10; content:"#Windows "; content:"##"; distance:0; dsize:<120; reference:md5,c0aadd5594d340d8a4909d172017e5d0; classtype:trojan-activity; sid:2014268; rev:1; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5232 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.PEx.942728546 Checkin"; flow:established,to_server; content:".com.exe"; http_uri; fast_pattern; content:"User-Agent|3a| GetRight/"; http_header; reference:md5,25e9e3652e567e70fba00c53738bdf74; reference:url,threatcenter.crdf.fr/?More&ID=74977&D=CRDF.Backdoor.Win32.PEx.942728546; classtype:trojan-activity; sid:2014290; rev:2; metadata:created_at 2012_02_29, updated_at 2012_02_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5236 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Koobface Variant Checkin Attempt"; flow:established,to_server; content:"/ping.php"; http_uri; content:" WinHttp.WinHttpRequest.5|29 0d 0a|"; http_header; reference:md5,62aa9e798746e586fb1f03459a970104; classtype:trojan-activity; sid:2014303; rev:2; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5237 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Backdoor.BlackMonay Checkin"; flow:established,to_server; content:".Php?UserName="; nocase; http_uri; content:"&Bank="; nocase; http_uri; content:"&Money="; nocase; http_uri; content:"Accept-Language|3A 20|zh-cn"; http_header; reference:md5,4a203e37caa2e04671388341419bda69; classtype:trojan-activity; sid:2014306; rev:3; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5238 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN W32/NSIS.TrojanDownloader Second Stage Download Instructions from Server"; flow:established,to_client; content:"|3B 20|Ini download file modue"; nocase; content:"DownUrl="; nocase; distance:0; content:"FileName="; nocase; distance:0; content:"SaveType="; nocase; distance:0; pcre:"/FileName\x3D[^\r\n]*\x2E(dll|exe)/i"; reference:md5,3ce5da32903b52394cff2517df51f599; classtype:trojan-activity; sid:2014312; rev:2; metadata:created_at 2012_03_05, updated_at 2012_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Genome.aetqe Checkin"; flow:established,to_server; content:"/stats/counterz.php?id="; http_uri; content:"&stat="; http_uri; reference:md5,700b7a81d1460a652e5f9f06fc54dcd6; classtype:trojan-activity; sid:2014331; rev:1; metadata:created_at 2012_03_07, updated_at 2012_03_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5242 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET TROJAN SMTP Subject Line Contains C Path and EXE Possible Trojan Reporting Execution Path/Binary Name"; flow:established,to_server; content:"Subject|3A 20|"; content:"C|3A 5C|"; nocase; fast_pattern; within:100; content:".exe"; within:40; pcre:"/Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe/i"; reference:md5,24e937b9f3fd6a04dde46a2bc75d4b18; classtype:bad-unknown; sid:2014343; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Coced.PasswordStealer User-Agent 5.0"; flow:established,to_server; content:"User-Agent|3A 20|5.0|0D 0A|"; http_header; reference:md5,24e937b9f3fd6a04dde46a2bc75d4b18; classtype:trojan-activity; sid:2014344; rev:2; metadata:created_at 2012_03_08, updated_at 2012_03_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5244 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Smart Fortress FakeAV/Kryptik.ABNC Checkin"; flow:established,to_server; content:"/?&affid="; http_uri; fast_pattern; content:"Accept|3a| *//*|0d 0a|"; http_header; reference:md5,fa20c17e5f58e7419b4f0eed318fa95a; reference:url,support.kaspersky.com/viruses/rogue/description?qid=208286259; classtype:trojan-activity; sid:2014293; rev:3; metadata:created_at 2012_02_29, updated_at 2012_02_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5245 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Graybird Checkin"; flow:to_server,established; content:"/count.asp?mac="; http_uri; content:"&os="; http_uri; content:"&av="; http_uri; content:"User-Agent|3a| Post|0d 0a|"; http_header; reference:md5,0fd68129ecbf68ad1290a41429ee3e73; reference:md5,11353f5bdbccdd59d241644701e858e6; classtype:trojan-activity; sid:2014365; rev:3; metadata:created_at 2012_02_11, updated_at 2012_02_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5246 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Lici Initial Checkin"; flow:established,to_server; content:".php?email="; http_uri; content:"&lici="; http_uri; content:"&ver="; http_uri; content:"HTTP/1.0"; content:!"User-Agent|3A|"; http_header; reference:md5,2f4d35e797249e837159ff60b827c601; classtype:trojan-activity; sid:2014119; rev:3; metadata:created_at 2012_01_12, updated_at 2012_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5247 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32-Dynamer.dtc Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/total_visitas.php"; http_uri; content:".php HTTP/1.1|0d 0a|Host|3a| "; content:!"User-Agent|3a| "; http_header; reference:url,microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32/Dynamer!dtc; reference:md5,989ba48e0a9e39b4b6fc5c6bf400c41b; classtype:trojan-activity; sid:2014113; rev:4; metadata:created_at 2012_01_11, updated_at 2012_01_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5406 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Jiwerks.A Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/update.aspx"; http_uri; content:"Accept-Language|3A 20|zh-cn"; http_header; content:"a="; fast_pattern; http_client_body; depth:2; content:"&v="; http_client_body; distance:0; reference:md5,0e47c711d9edee337575b6dbef850514; classtype:trojan-activity; sid:2014133; rev:4; metadata:created_at 2012_01_18, updated_at 2012_01_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5407 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.RShot HTTP Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"|3B| name=|22|bot_id|22 0D 0A 0D 0A|"; fast_pattern; content:" name=|22|os_version|22 0D 0A 0D 0A|"; reference:md5,c0aadd5594d340d8a4909d172017e5d0; classtype:trojan-activity; sid:2014269; rev:5; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5413 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Protux.B POST checkin"; flow:from_client,established; content:"POST"; nocase; http_method; content:"Mozilla/4.8.20 (compatible|3B| MSIE 5.0.2|3B| Win32)|0D 0A|Host|3a| "; http_header; reference:md5,53105ecf3cf6040039e16abb382fb836; classtype:trojan-activity; sid:2014360; rev:4; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5414 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Datamaikon Checkin myAgent"; flow:to_server,established; content:"/index.dat?"; http_uri; content:" myAgent|0d 0a|Host|3a| "; http_header; pcre:"/\/index.dat\?\d{5,9}$/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FDatamaikon.gen!A&ThreatID=-2147312276; reference:md5,a51933ee0f2ade7df98feb7207a2ffaf; classtype:trojan-activity; sid:2014468; rev:3; metadata:created_at 2012_04_04, updated_at 2012_04_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5418 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Yakes.pwo Checkin"; flow:to_server,established; content:"/stat.php?w="; http_uri; content:"&i="; http_uri; content:"&a="; http_uri; content:"User-Agent|3A| Opera/6"; http_header; content:"|3B| LangID="; http_header; reference:md5,d40927e8c4b59a1c2af4f981ef295321; classtype:trojan-activity; sid:2014604; rev:3; metadata:created_at 2012_03_01, updated_at 2012_03_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5429 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy.Es11 Keepalive to CnC"; flow:established,to_server; content:"|89 e7 52 d4 68 64 a7 73 bd 7e 3f 5c f7 99 3a 2e|"; offset:16; depth:16; dsize:48; reference:md5,4a17e9bd99f496c518ddfaaef93384b0; classtype:trojan-activity; sid:2014630; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2012_04_20, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5434 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Session_Id length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_test:1,>,SSL.Client_Hello.length,34,relative; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014634; rev:1; metadata:created_at 2012_04_24, updated_at 2012_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5440 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Cipher_Suite length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_jump:1,34,relative; byte_test:2,>,SSL.Client_Hello.length,0,relative; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014635; rev:1; metadata:created_at 2012_04_24, updated_at 2012_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5441 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ConstructorWin32/Agent.V"; flow:to_server,established; content:"GET http|3A|//"; depth:11; content:"|0D 0A|Pragma|3A| no-catch|0D 0A|"; http_header; content:"|0D 0A|X-HOST|3A| "; http_header; content:"|0D 0A|Content-Length|3A| 0|0D 0A|"; http_header; reference:md5,3305ad96bcfd3a406dc9daa31e538902; classtype:trojan-activity; sid:2014643; rev:7; metadata:created_at 2012_04_26, updated_at 2012_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5443 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Mepaow.Backdoor Initial Checkin to Intermediary Pre-CnC"; flow:established,to_server; content:"/PostView.nhn?blogId="; fast_pattern; http_uri; content:"&logNo="; http_uri; content:"&parentCategoryNo="; http_uri; content:"&userTopListOpen="; http_uri; content:"&userTopListManageOpen="; http_uri; content:"User-Agent|3A 20|Mozilla/4.0 (compatible|3B| Win32|3B| WinHttp.WinHttpRequest.5)|0d 0a|"; http_header; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=1072862; reference:md5,8af17164500aac1c0965b842aca3fed7; classtype:trojan-activity; sid:2014754; rev:6; metadata:created_at 2012_05_17, updated_at 2012_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5446 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpyBanker Infection Confirmation Email 2"; flow:established,to_server; content:"From|3A 20 22|Infected|22|"; reference:md5,f091e8ed0e8f4953ff10ce3bd06dbe54; classtype:trojan-activity; sid:2014762; rev:2; metadata:created_at 2012_05_17, updated_at 2012_05_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5447 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Comrerop Checkin to FTP server"; flow:established,to_server; content:"USER griptoloji|0d 0a|"; fast_pattern:5,12; reference:md5,6b16290b05afd1a9d638737924f2ab5c; classtype:trojan-activity; sid:2014757; rev:4; metadata:created_at 2012_05_15, updated_at 2012_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5449 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN VBS/Wimmie.A Set"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/count.php?m=c&n="; http_uri; content:"_"; distance:0; http_uri; content:"@"; distance:0; http_uri; content:"|0D 0A|Content-Length|3a| 0|0D 0A|"; http_header; reference:url,www.threatexpert.com/report.aspx?md5=6fd7493e56fdc3b0dd8ecd24aea20da1; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AVBS%2FWimmie.A; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf; reference:md5,61474931882dce7b1c67e1f22d26187e; classtype:trojan-activity; sid:2014803; rev:7; metadata:created_at 2011_11_04, updated_at 2011_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5454 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET !6661:6668 -> $HOME_NET any (msg:"ET TROJAN IRC Bot Download http Command"; flow:established,from_server; content:"JOIN |3a|#"; nocase; content:"dl|20|http|3a 2f 2f|"; distance:0; content:"|2e|exe"; distance:0; reference:md5,fa6ae89b101a0367cc98798c7333e3a4; classtype:trojan-activity; sid:2014439; rev:4; metadata:created_at 2012_03_28, updated_at 2012_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5459 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Nutiliers.A Downloader CnC Checkin - Request Encrypted Response"; flow:established,to_server; content:"/js/data/encryptedtest.dll"; http_uri; reference:md5,7b2bfb9d270a5f446f32502d2ed34d67; classtype:trojan-activity; sid:2014962; rev:2; metadata:created_at 2012_06_25, updated_at 2012_06_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5471 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Armageddon CnC Checkin"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3A| ArmageddoN"; nocase; http_header; content:"GetList="; http_client_body; depth:8; reference:md5,3f4c5649d66fc5befc0db47930edb9f6; classtype:trojan-activity; sid:2014963; rev:2; metadata:created_at 2012_06_25, updated_at 2012_06_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5472 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Rogue.Win32/Winwebsec Install 2"; flow:to_server,established; content:"/api/urls/?ts="; http_uri; content:"&affid="; http_uri; content:"GTB0.0|3b|"; http_header; reference:md5,181999985de5feae6f44f9578915417f; classtype:trojan-activity; sid:2014816; rev:5; metadata:created_at 2012_05_24, updated_at 2012_05_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5473 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC POST /common/versions.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/common/versions.php"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014979; rev:2; metadata:created_at 2012_06_28, updated_at 2012_06_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5475 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC GET /lost.dat"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/lost.dat"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014980; rev:3; metadata:created_at 2012_06_28, updated_at 2012_06_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5476 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot CnC POST /common/timestamps.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/common/timestamps.php"; http_uri; reference:md5,43d8afa89bd6bf06973af62220d6c158; classtype:trojan-activity; sid:2014999; rev:2; metadata:created_at 2012_07_02, updated_at 2012_07_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5477 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Numnet.Downloader CnC Checkin 1"; flow:established,to_server; content:"/counter/mac_proc.php?cid="; fast_pattern; http_uri; content:"&mid="; http_uri; content:"User-Agent|3A| internet|0D 0A|"; http_header; reference:md5,fbc732c7cd1bbd84956b1e76b53384da; classtype:trojan-activity; sid:2015020; rev:2; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5478 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Numnet.Downloader CnC Checkin 2"; flow:established,to_server; content:"/check_counter.php?pid="; http_uri; content:"&mid="; http_uri; content:"User-Agent|3A| internet|0D 0A|"; http_header; reference:md5,fbc732c7cd1bbd84956b1e76b53384da; classtype:trojan-activity; sid:2015021; rev:2; metadata:created_at 2012_07_03, updated_at 2012_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5479 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Pift Checkin 1"; flow:established,to_server; content:"/plg3.z"; fast_pattern; http_uri; urilen:7; content:"User-Agent|3a| Mozilla/4.0|0d 0a|"; http_header; reference:url,kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23873/en_US/McAfee%20Labs%20Threat%20Advisory-W32-Pift.pdf; reference:md5,d3c6af8284276b11c2f693c1195b4735; classtype:trojan-activity; sid:2015458; rev:2; metadata:created_at 2012_07_12, updated_at 2012_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5481 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Pift Checkin 2"; flow:established,to_server; content:"/ext1.z"; fast_pattern; http_uri; urilen:7; content:"User-Agent|3a| Mozilla/4.0|0d 0a|"; http_header; reference:url,kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23873/en_US/McAfee%20Labs%20Threat%20Advisory-W32-Pift.pdf; reference:md5,d3c6af8284276b11c2f693c1195b4735; classtype:trojan-activity; sid:2015459; rev:2; metadata:created_at 2012_07_12, updated_at 2012_07_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5482 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Playtech Downloader Online Gaming Checkin"; flow:to_server,established; content:"/client_update_urls.php"; http_uri; content:"User-Agent|3a| Playtech "; http_header; reference:md5,00740d7d15862efb30629ab1fd7b8242; classtype:trojan-activity; sid:2008365; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5485 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Medfos/Midhos Checkin"; flow:to_server,established; content:"/id="; http_uri; content:"&rt="; distance:0; http_uri; content:"AAAAAAAAAAA"; http_uri; fast_pattern; content:!"Accept|3a 20|"; http_header; content:!"Connection|3a 20|"; http_header; reference:md5,00da8acc14d0e827dbb1326c023fc720; reference:md5,8f561f46fb262cac6bb4cacf3e4e78a6; reference:md5,63491dcc8e897bf442599febe48b824d; classtype:trojan-activity; sid:2014722; rev:4; metadata:created_at 2012_05_08, updated_at 2012_05_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5498 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.Jorik.Totem.vg HTTP request"; flow:established,to_server; content:"/?xclzve_"; depth:9; http_uri; reference:md5,cf5df13f8498326f1c6407749b3fe160; classtype:trojan-activity; sid:2015562; rev:2; metadata:created_at 2012_08_03, updated_at 2012_08_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5506 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Lile.A DoS Outbound"; flow:established,to_server; content:"GET"; http_method; content:"UserAgent|3a|"; http_header; content:"Windows 98"; fast_pattern:only; http_header; content:"Host|3a| www.fbi.gov"; http_header; threshold:type limit, track by_src, count 1, seconds 30; reference:url,symantec.com/security_response/writeup.jsp?docid=2005-101311-0945-99&tabid=2; reference:md5,d6d0cd7eca2cef5aad66efbd312a7987; classtype:trojan-activity; sid:2015577; rev:3; metadata:created_at 2012_08_06, updated_at 2012_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5507 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Mirage Campaign checkin"; flow:established,to_server; content:"POST"; http_method; content:"/result?hl="; depth:11; http_uri; content:"&meta="; distance:0; http_uri; content:"Mjtdkj"; depth:6; http_client_body; reference:md5,ce1cdc9c95a6808945f54164b2e4d9d2; reference:url,secureworks.com/research/threats/the-mirage-campaign/; classtype:trojan-activity; sid:2015714; rev:2; metadata:created_at 2012_09_19, updated_at 2012_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5526 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Runner/Bublik Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"G="; http_client_body; nocase; content:"&PG="; http_client_body; nocase; content:"&EPBB="; http_client_body; fast_pattern; nocase; content:!"User-Agent|3a|"; http_header; reference:url,www.spywarecease.com/spyware-list/Spyware_Trojan.Win32.Runner.s.html; reference:url,www.threatexpert.com/threats/trojan-win32-runner.html; reference:md5,6d2919a92d7dda22f4bc7f9a9b15739f; classtype:trojan-activity; sid:2009711; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5531 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Fynloski.A/DarkRat Checkin Outbound"; flow:to_server,established; dsize:<16; content:"KEEPALIVE"; depth:9; pcre:"/^KEEPALIVE\x7c?\d/"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,www.contextis.com/research/blog/darkcometrat/; reference:url,www.eff.org/deeplinks/2012/08/syrian-malware-post; reference:md5,a2f58a4215441276706f18519dae9102; classtype:trojan-activity; sid:2013090; rev:10; metadata:created_at 2010_11_22, updated_at 2010_11_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5533 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Pushdo.s Checkin"; flow:to_server,established; content:"POST"; http_method; urilen:39; content:"/?ptrxcz_"; fast_pattern:only; http_uri; pcre:"/^\/\?ptrxcz_[a-z0-9A-Z]{30}$/U"; reference:md5,58ffe2b79be4e789be80f92b7f96e20c; classtype:trojan-activity; sid:2015807; rev:3; metadata:created_at 2012_10_05, updated_at 2012_10_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5543 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Backdoor.ADDNEW (DarKDdoser) CnC 3"; flow:to_server,established; dsize:<100; content:"ADDNEW|7C|Stable|7C|"; depth:14; pcre:"/\x7C(NEW|Awaiting commands)/R"; reference:url,blog.fireeye.com/research/2012/11/backdooraddnew-darkddoser-and-gh0st-a-match-made-in-heaven.html; reference:md5,691305b05ae75389526aa7c15b319c3b; classtype:trojan-activity; sid:2015870; rev:2; metadata:created_at 2012_11_06, updated_at 2012_11_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5550 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WORM_VOBFUS Checkin 1"; flow:established,to_server; content:"GET"; http_method; urilen:5; content:"/1/?"; http_uri; depth:4; content:"MSIE 7.0|3b|"; http_user_agent; content:".ddns"; fast_pattern; http_header; distance:0; content:".eu|0d 0a|"; distance:1; within:5; http_header; pcre:"/Host\x3a \d{5}\x2eddns[a-z0-9]\x2eeu\r\n$/H"; reference:md5,f127ed76dc5e48f69a1070f314488ce2; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/watch-out-for-worm_vobfus/; classtype:trojan-activity; sid:2015968; rev:8; metadata:created_at 2012_11_29, updated_at 2012_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5556 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Necurs"; flow:to_server,established; content:"POST"; http_method; content:"/iis/host.aspx"; http_uri; fast_pattern; content:!"User-Agent|3a|"; http_header; content:"application/octet-stream"; http_header; reference:md5,871ecf11ddd7ffe294cab82bcaf9c310; reference:url,blogs.technet.com/b/mmpc/archive/2012/12/06/unexpected-reboot-necurs.aspx; classtype:trojan-activity; sid:2016000; rev:2; metadata:created_at 2012_12_07, updated_at 2012_12_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5557 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kuluoz.B Request"; flow:established,to_server; content:"GET"; http_method; pcre:"/\/[a-f0-9]+$/Ui"; content:"Windows NT 9.0|3b|"; http_header; pcre:"/^Host\x3a\s*(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?\r?$/Hmi"; reference:md5,0282bc929bae27ef95733cfa390b10e0; classtype:trojan-activity; sid:2015985; rev:4; metadata:created_at 2012_12_04, updated_at 2012_12_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5608 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Zbot.ivgw Downloading EXE"; flow:to_server,established; content:"/forum/images.php?id"; http_uri; nocase; fast_pattern:only; content:"Mozilla/6"; http_user_agent; depth:9; content:" MSIE "; http_user_agent; distance:0; reference:md5,e8e3d22203f9549d6c5f361dfe51f8c6; classtype:trojan-activity; sid:2016425; rev:5; metadata:created_at 2013_02_18, updated_at 2013_02_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5609 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Likseput.B Checkin"; flow:established,to_server; content:"|3b|Trident/4.0 "; fast_pattern; http_user_agent; pcre:"/User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$/Hmi"; reference:md5,95d85aa629a786bb67439a064c4349ec; classtype:trojan-activity; sid:2016432; rev:4; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5610 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Likseput.A Checkin Windows Vista/7/8"; flow:to_server,established; content:"User-Agent|3a| 6|2e|"; http_header; content:"|5c|"; within:64; http_header; content:"Host|3a| "; http_header; distance:0; content:!"|0d 0a|"; distance:-6; within:2; http_header; pcre:"/User\-Agent\x3a\x206\.[0-2]\x20\d\d\x3a\d\d\x20/Hi"; reference:md5,b5e9ce72771217680efaeecfafe3da3f; reference:url,threatexpert.com/report.aspx?md5=4b6f5e62d7913fc1ab6c71b5b909ecbf; classtype:trojan-activity; sid:2016433; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5611 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 1 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 0"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016435; rev:5; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5613 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 2 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 1"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016436; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5614 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin 3 - APT1 Related"; flow:established,to_server; content:"User-Agent|3a| 2"; http_header; content:"|3a|"; http_header; distance:1; within:1; content:"|3a|"; http_header; distance:2; within:1; content:"+"; http_header; distance:2; within:1; flowbits:set,ET.webc2; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016437; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5615 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related"; flow:established,from_server; flowbits:isset,ET.webc2; file_data; content:"/R"; reference:url,www.mandiant.com/apt1; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,0cf9e999c574ec89595263446978dc9f; classtype:trojan-activity; sid:2016449; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5625 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Namsoth.A Checkin/NEWSREELS APT1 Related"; flow:established,to_server; content:"POST"; http_method; content:"name="; depth:5; http_client_body; content:"&userid="; distance:0; http_client_body; content:"&other"; distance:4; within:6; http_client_body; pcre:"/&userid=\d{4}&other=[MF]/P"; reference:md5,a2cd1189860b9ba214421aab86ecbc8a; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016439; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5626 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN STARSYPOUND Client Checkin"; flow:established,from_server; content:"*(SY)# "; depth:7; reference:md5,8442ae37b91f279a9f06de4c60b286a3; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016444; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5627 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CLOVER Checkin APT1 Related"; flow:established,to_server; content:"/Default.asp"; http_uri; content:"Accept: image/gif,image/x-xbitmap"; http_header; content:" MSIE "; http_header; content:"Cookie|3a 20|PREF=86845632017245|0d 0a|"; fast_pattern; reference:url,www.mandiant.com/apt1; reference:md5,29c691978af80dc23c4df96b5f6076bb; classtype:trojan-activity; sid:2016452; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5628 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CLOVER Download UA"; flow:established,to_server; content:"User-Agent|3a 20|Mozilla/5.0 (Windows|3b| Windows NT 5.1|3b| en-US|3b| rv|3a|1.8.0.12) Firefox/1.5.0.12|0d 0a|"; http_header; fast_pattern:66,20; reference:url,www.mandiant.com/apt1; reference:md5,29c691978af80dc23c4df96b5f6076bb; classtype:trojan-activity; sid:2016453; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5629 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-DIV UA"; flow:established,to_server; content:"User-Agent|3a| Microsoft Internet Explorer Exelon "; http_header; fast_pattern:27,20; reference:url,www.mandiant.com/apt1; reference:md5,1e5ec6c06e4f6bb958dcbb9fc636009d; classtype:trojan-activity; sid:2016454; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5631 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related"; flow:established,from_server; file_data; content:"/R"; reference:url,www.mandiant.com/apt1; reference:md5,b5e9ce72771217680efaeecfafe3da3f; classtype:trojan-activity; sid:2016455; rev:3; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5632 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-KT3 Intial Connection Beacon APT1 Related"; flow:established,to_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:set,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:trojan-activity; sid:2016456; rev:2; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5633 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related"; flow:established,from_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:isset,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:trojan-activity; sid:2016457; rev:3; metadata:created_at 2013_02_21, updated_at 2013_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5634 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Sluegot.A Checkin WEBC2-YAHOO APT1 Related"; flow:to_server,established; content:"User-Agent|3a| IPHONE"; http_header; pcre:"/User-Agent\x3a\sIPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})/Hi"; reference:url,www.securelist.com/en/descriptions/24052976/Trojan.Win32.Scar.ddxe; reference:md5,0149b7bd7218aab4e257d28469fddb0d; reference:md5,6f9992c486195edcf0bf2f6ee6c3ec74; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016461; rev:4; metadata:created_at 2011_06_27, updated_at 2011_06_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5635 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN WEBC2-UGX Embedded CnC Response APT1"; flow:established,from_server; flowbits:isset,ET.webc2ugx; file_data; content:""; within:150; reference:url,intelreport.mandiant.com; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,fcdaa67e33357f64bc4ce7b57491fc53; classtype:trojan-activity; sid:2016451; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5936 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/GMUnpacker.Downloader Download Instructions Response From CnC"; flow:established,to_client; file_data; content:"<AD>"; within:4; content:"<TIPAD>"; distance:0; content:"<POPUP>"; distance:0; content:"<REG>HKEY_LOCAL_MACHINE|5c|SOFTWARE|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|"; distance:0; reference:md5,43e89125ad40b18d22e01f997da8929a; classtype:trojan-activity; sid:2017891; rev:2; metadata:created_at 2013_12_19, updated_at 2013_12_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5942 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 7"; flow:to_server,established; dsize:>11; content:"|79 95|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x95/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a2469f4913f1607e4207ba0a8768491c; classtype:trojan-activity; sid:2017913; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5943 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 8"; flow:to_server,established; dsize:>11; content:"|79 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,be92836bee1e8abc1d19d1c552e6c115; classtype:trojan-activity; sid:2017914; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5944 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 9"; flow:to_server,established; dsize:>11; content:"|7a 9b|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7a\x9b/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a88e0e5a2c8fd31161b5e4a31e1307a0; classtype:trojan-activity; sid:2017915; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5945 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 10"; flow:to_server,established; dsize:>11; byte_jump:4,0,from_beginning,little,post_offset -1; isdataat:!2,relative; content:"|78 9c|"; fast_pattern:only; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,a88e0e5a2c8fd31161b5e4a31e1307a0; classtype:trojan-activity; sid:2017916; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_02, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5946 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for whoismama.ru"; flow:established,to_client; content:"www.whoismama.ru"; fast_pattern:only; nocase; reference:md5,cca1713888b0534954234cf31dd5a7d4; classtype:trojan-activity; sid:2017940; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5947 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for dewart.ru"; flow:established,to_client; content:"www.deweart.ru"; fast_pattern:only; nocase; reference:md5,6e0a6c4a06a446f70ae1463129711122; classtype:trojan-activity; sid:2017941; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5948 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for anlogtewron.ru"; flow:established,to_client; content:"www.anlogtewron.ru"; fast_pattern:only; nocase; reference:md5,c13c3e331f05d61a7204fb4599b07709; classtype:trojan-activity; sid:2017942; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5949 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Zbot Variant SSL cert for erjentronem.ru"; flow:established,to_client; content:"www.erjentronem.ru"; fast_pattern:only; nocase; reference:md5,05ddaa5b6b56123e792fd67bb03376bc; classtype:trojan-activity; sid:2017943; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_01_07, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5950 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 14"; flow:to_server,established; dsize:>11; byte_extract:4,0,c_size,little; byte_test:4,>,c_size,4,little; content:"|08 01|"; offset:2; depth:2; content:"|79 94|"; offset:13; depth:2; pcre:"/^.{8}[\x20-\x7e]+?\x79\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,9fae15fa8ab6bb8d78d609bdceafe28e; classtype:trojan-activity; sid:2017944; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_08, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5951 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kishop.A checkin"; flow:to_server; content:"POST"; http_method; content:".php?mark="; http_uri; content:"&type="; http_uri; content:"&theos="; http_uri; reference:md5,bad7cd3c534c95867f5dbe5c5169a4da; classtype:trojan-activity; sid:2017964; rev:2; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5955 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Ferret DDOS Bot CnC Beacon 2"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a 20|Mozilla|20|"; fast_pattern; http_header; content:"m"; depth:1; http_client_body; pcre:"/^m(?:ode)?=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(?:wid)?=/P"; reference:md5,f582667d5ce743436fb24771eb22a0e8; reference:url,www.arbornetworks.com/asert/2013/12/a-business-of-ferrets/; classtype:trojan-activity; sid:2017917; rev:5; metadata:created_at 2014_01_02, updated_at 2014_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5956 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN StartPage jsp checkin"; flow:to_server,established; urilen:27<>40; content:"POST"; http_method; content:"/201"; http_uri; fast_pattern:only; content:".jsp"; http_uri; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT 5.2|3b 20|.NET CLR 1.1.4322|3b 20|.NET CLR 2.0.50727|3b 20|InfoPath.1)|0d 0a|"; http_header; content:!"Accept-Language|3A 20|"; http_header; content:!"Referer|3A 20|"; http_header; pcre:"/^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$/U"; threshold:type both,track by_src,count 2,seconds 60; reference:md5,bb7bbb0646e705ab036d73d920983256; classtype:trojan-activity; sid:2017967; rev:3; metadata:created_at 2014_01_13, updated_at 2014_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5957 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 2012:2014 (msg:"ET TROJAN Win32.Morix.B checkin"; flow:to_server,established; content:"|00 00 42 42 43 42 43|"; offset:2; depth:7; reference:md5,25623fa3a64f6bed301822f8fe6aa9b5; classtype:trojan-activity; sid:2017922; rev:3; metadata:created_at 2014_01_02, updated_at 2014_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5958 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kelihos.F Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:<13; content:".htm"; fast_pattern:only; http_uri; pcre:"/^\/[^\x2f]+?\.htm$/U"; content:!"BridgitAgent"; http_user_agent; content:!"Accept"; http_header; content:!"Referer"; http_header; content:!"Content-Type"; http_header; content:"Content-Length|3a 20|"; http_header; content:!"0|0d 0a|"; within:3; http_header; content:"|0d 0a|"; distance:0; http_header; reference:md5,00db349caf2eefc3be5ee30b8b8947a2; classtype:trojan-activity; sid:2017191; rev:3; metadata:created_at 2013_07_24, updated_at 2013_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5964 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Java/Jacksbot Check-in"; flow:established,to_server; content:"|00 2d 00 68 00 20 00 32 00 66 00|"; pcre:"/^(?:4\x00[1-9a-f]|5\x00[\da])/Rs"; content:"|00 33 00 61 00|"; within:5; reference:md5,6d93fc6132ae6938013cdd95354bff4e; classtype:trojan-activity; sid:2017983; rev:3; metadata:created_at 2014_01_17, updated_at 2014_01_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5966 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 18"; flow:to_server,established; dsize:>11; content:"|7b 9e|"; offset:8; byte_jump:4,-10,little,relative,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,1f46b1e0a7fe83d24352e98b3ab3fc3f; classtype:trojan-activity; sid:2018013; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_27, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5968 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Limitless Logger Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|Limitless Logger|20 3a 20 3a|"; nocase; fast_pattern:9,20; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018015; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5969 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Limitless Logger Sending Data over SMTP 2"; flow:to_server,established; content:"Limitless Logger successfully ran on this computer."; nocase; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018016; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5970 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Win32/Antilam.2_0 Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|CigiCigi Logger"; fast_pattern:4,20; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018018; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5971 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/LockscreenBEI.Scareware Cnc Beacon"; flow:established,to_server; urilen:18; content:"GET"; http_method; content:"/reboot/index.html"; fast_pattern:only; http_uri; content:!"Referer|3a 20|"; http_header; reference:md5,04948b6045730d4ec626f79504c7f9ad; reference:md5,9fff65c23fe403d25c08a5cdd3dc775d; classtype:trojan-activity; sid:2018023; rev:2; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5972 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 19"; flow:to_server,established; dsize:>11; content:"|78 9c|"; offset:8; byte_jump:4,-6,little,relative,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,2b0f0479b14069b378fb454c92086897; classtype:trojan-activity; sid:2018032; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_28, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5976 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Banker.AALV checkin"; flow:to_server,established; content:"CHEGOU-NOIS"; fast_pattern; content:"|20 7c 20|PLUGIN|3a|"; distance:0; content:"|20 7c 20|BROWSER|3a|"; reference:md5,74bfd81b345a6ef36be5fcf6964af6e1; classtype:trojan-activity; sid:2018034; rev:1; metadata:created_at 2014_01_29, updated_at 2014_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5977 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Win32.Genome.boescz Checkin"; flow:to_server,established; content:"|0d 0a|Subject|3a 20|TenInfect"; fast_pattern:9,9; content:"|0d 0a 0d 0a|TenInfect"; distance:0; reference:md5,313535d09865f3629423cd0e9b2903b2; reference:url,www.virustotal.com/en/file/75c454bbcfc06375ad1e8b45d4167d7830083202f06c6309146e9a4870cddfba/analysis/; classtype:trojan-activity; sid:2018033; rev:3; metadata:created_at 2014_01_29, updated_at 2014_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5978 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 3"; dsize:>11; content:"|7b 9e|"; fast_pattern:only; byte_jump:4,0,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,2eed956920934a78200899ef05ace0d8; classtype:trojan-activity; sid:2017548; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2013_09_30, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5984 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 15"; flow:to_server,established; dsize:>11; content:"FWKJGH"; offset:8; depth:6; byte_jump:4,0,little,from_beginning,post_offset 5; isdataat:!2,relative; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,edd8c8009fc1ce2991eef6069ae6bf82; classtype:trojan-activity; sid:2017974; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_16, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5985 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 20"; flow:to_server,established; dsize:>11; content:"|7d 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7d\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,a037b3241c0b957efe6037b25570292f; classtype:trojan-activity; sid:2018054; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5986 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 444 (msg:"ET TROJAN W32/FakeAlert.FT.gen.Eldorado Downloading DLL"; flow:to_server,established; content:"SIZE libcurl-4.dll|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018072; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5989 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/FakeAlert.FT.gen.Eldorado Downloading VBS"; flow:to_server,established; content:"SIZE explore.vbs|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018073; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5990 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/StoredBt.A Activity"; flow:to_server,established; content:".php?a1="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; pcre:"/\.php\?a1=\d+&a2=(?:[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|(?:[A-Za-z0-9\+\/]{4})*(?:[A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(?:&a\d+=[^&]+)+$/U"; reference:md5,e8e9eb1cd4be7ab27743887be2aa28e9; classtype:trojan-activity; sid:2018074; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5991 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 23"; flow:to_server,established; dsize:>11; content:"|78 9c|"; offset:8; byte_jump:4,-18,relative,little,from_beginning, post_offset 1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?.{2}\x78\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,db1c4342f617798bcb2ba5655d32bf67; classtype:trojan-activity; sid:2018075; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5992 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 24"; flow:to_server,established; dsize:>11; content:"|7c 9f|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{8}[\x20-\x7e]+?\x7c\x9f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,0be9e3f4507a8ee23bb0c2b6c218d1cc; classtype:trojan-activity; sid:2018076; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5993 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32.Blackshades/Shadesrat Backdoor CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/gate.php"; http_uri; content:"crypt"; http_client_body; depth:5; content:"="; http_client_body; within:3; reference:md5,9d11cfb7799089823483b72daec5fd2b; reference:md5,a01451eae2d47872ce796bb85f116710; classtype:trojan-activity; sid:2018079; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5994 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 26"; flow:to_server,established; dsize:>11; content:"|71 94|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x71\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,b316680fd2578a2781ee9497888bd1e4; classtype:trojan-activity; sid:2018085; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5995 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DirtJumper Activity"; flow:established,to_server; content:"POST"; http_method; content:!"Referer|3a|"; http_header; content:"&req="; http_client_body; pcre:"/^\d+?=\d+?(?:&ver=\d+?)?&req=\d+?(?:&r=)?$/P"; content:"Host|3a|"; http_header; depth:5; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,5474129345d9756649c871f9c8b46287; reference:md5,ff5608e00d5e6e81af9c993461479e43; classtype:trojan-activity; sid:2018094; rev:2; metadata:created_at 2014_02_06, updated_at 2014_02_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5996 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 25"; flow:to_server,established; dsize:>11; content:"|7a 5d|"; offset:8; byte_jump:4,-12,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{10}\x7a\x5d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,794eac549f98320b818037b8074da320; classtype:trojan-activity; sid:2018077; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5997 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"<html><body>hi!<|2F|body><|2F|html>"; within:30; reference:url,research.zscaler.com/2014/02/new-zbot-variant-goes-above-and-beyond.html; reference:url,techhelplist.com/index.php/tech-tutorials/41-misc/465-asprox-botnet-advertising-fraud-general-overview-1; reference:md5,df5ab239bdf09a8716cabbdfa1d6a724; classtype:trojan-activity; sid:2018097; rev:2; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5998 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Rshot.Backdoor File Upload CnC Beacon"; flow:established,to_server; urilen:13; content:"POST"; http_method; content:"/uploadb.php?"; fast_pattern; http_uri; content:"name=|22|archivo|22|"; http_client_body; content:".dmp|22|"; http_client_body; distance:0; reference:md5,08881eb702a1525f7792c3fef19ae9ff; classtype:trojan-activity; sid:2018100; rev:2; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 5999 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Woai.Dropper Config Request"; flow:established,to_server; content:"/client/config.ini"; http_uri; content:"|3B 29 0D 0A|"; http_header; pcre:"/User\x2DAgent\x3A\x20[^\r\n]*MSIE[^\r\n]*\x3B\x29\x0D\x0A/H"; reference:md5,0425a66e3b268ef8cbdd481d8e44b227; classtype:trojan-activity; sid:2018102; rev:5; metadata:created_at 2014_02_10, updated_at 2014_02_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6000 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Jackpos Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"something"; depth:9; http_user_agent; content:"mac="; fast_pattern; depth:4; http_client_body; content:"&t1="; http_client_body; content:"&t2="; http_client_body; pcre:"/^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=/P"; reference:md5,aa9686c3161242ba61b779aa325e9d24; reference:md5,88e721f62470f8bd267810fbaa29104f; reference:url,intelcrawler.com/about/press10; classtype:trojan-activity; sid:2018108; rev:3; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6002 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS Query for Known Chewbacca CnC Server"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|5ji235jysrvwfgmb|05|onion|00|"; fast_pattern; distance:0; reference:md5,21f8b9d9a6fa3a0cd3a3f0644636bf09; reference:url,usa.visa.com/download/merchants/Alert-ChewbaccaMalware-030614.pdf; reference:url,symantec.com/security_response/earthlink_writeup.jsp?docid=2013-121813-2446-99; classtype:trojan-activity; sid:2018114; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6003 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Almanahe.B Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:1; content:"ClientUpdate"; fast_pattern:only; http_user_agent; content:!"Accept|3a 20|"; content:!"Referer|3a 20|"; reference:url,www.virustotal.com/en/file/f80fc95e44d90a8e02de4fde0ea5e58227cbbde7b6d3848c1f8afbd5ed0affe7/analysis/; reference:md5,1d331ef7d24f6316947e94f737d1f219; classtype:trojan-activity; sid:2018123; rev:3; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6009 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/Win32.FraudPack User-Agent (Downloader MLR 1.0.0)"; flow:to_server,established; content:"Downloader MLR 1.0.0"; http_user_agent; depth:20; reference:md5,c9d54e9086357491bd1fdf8d8d804dce; classtype:trojan-activity; sid:2018112; rev:4; metadata:created_at 2013_11_04, updated_at 2013_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6011 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Jackpos Checkin 2"; flow:to_server,established; content:"/post/echo"; fast_pattern:only; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/^\/post\/echo$/U"; reference:md5,aa9686c3161242ba61b779aa325e9d24; reference:md5,88e721f62470f8bd267810fbaa29104f; reference:url,intelcrawler.com/about/press10; classtype:trojan-activity; sid:2018128; rev:2; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6012 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET TROJAN Win32/Tapazom.A"; flow:established,to_server; content:"GIVEME|7c|"; reference:md5,dc7284b199d212e73c26a21a0913c69d; classtype:trojan-activity; sid:2018133; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6013 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET TROJAN Win32/Tapazom.A 2"; flow:established,to_server; content:"GETSERVER|7c|"; reference:md5,030f3840d2729243280d3cea3d99d8e6; classtype:trojan-activity; sid:2018134; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6014 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN MSIL.Zapchast Checkin"; flow:to_server,established; content:"/files/def"; http_uri; pcre:"/^\/files\/def$/U"; content:"AutoIt"; depth:6; http_user_agent; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:url,www.virustotal.com/en/file/9f41604b71d1c9a4c094d0aa2685ffa49cc0d4ba19b20b7c22467eafb671064c analysis/; reference:md5,63586aef2be494150a492d822147055a; classtype:trojan-activity; sid:2018142; rev:3; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6018 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon"; flow:established,to_server; content:"/dnsmake.txt"; fast_pattern; http_uri; content:"Indy Library"; http_user_agent; reference:md5,dd3e5b41238a73d627c6c48108a15452; classtype:trojan-activity; sid:2018150; rev:3; metadata:created_at 2014_02_17, updated_at 2014_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6019 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Blackbeard Downloader"; flow:established,to_server; content:"/load"; http_uri; content:"p="; http_uri; content:"&t="; http_uri; content:"User-Agent|3a| IE|0d 0a|"; http_header; fast_pattern; pcre:"/[\?&]p=\d&t=\d(&|$)/U"; reference:md5,2f6f13eced7fce495168059530246d77; reference:url,blog.avast.com/2014/01/15/win3264blackbeard-pigeon-stealthiness-techniques-in-64-bit-windows-part-1/; classtype:trojan-activity; sid:2018110; rev:5; metadata:created_at 2014_01_23, updated_at 2014_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6021 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 28"; flow:to_server,established; dsize:>11; content:"|7f 9b|"; offset:8; byte_jump:4,-10,little,relative,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7f\x9b/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,52849773bc0d08eb9dfcb0df2b7caf33; classtype:trojan-activity; sid:2018166; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_21, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6023 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Generic CnC"; flow:established,to_server; content:" Mini BackDoor|00|"; offset:9; depth:20; reference:md5,398b6622a2c86d472a4340d3e79e654b; classtype:trojan-activity; sid:2018167; rev:1; metadata:created_at 2014_02_21, updated_at 2014_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6024 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gh0st Trojan CnC 3"; flow:established,to_server; dsize:14; content:"Gh0st"; depth:5; reference:md5,6a814cacb0c4b464d85ab874f68a5344; classtype:trojan-activity; sid:2018165; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_21, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6025 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 27"; flow:to_server,established; dsize:>11; content:"|7c 9c|"; offset:8; byte_jump:4,-6,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7c\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,29aabeba14f6b5950edcd2a5d99acc94; classtype:trojan-activity; sid:2018153; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_02_18, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6026 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN W32/FakeFlash.Dropper Initial CnC Beacon"; flow:established,to_server; dsize:8; content:"PutToken"; depth:8; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018185; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6027 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN W32/FakeFlash.Dropper Initial CnC Beacon Acknowledgement"; flow:established,to_client; dsize:12; content:"TokenRecived"; depth:12; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018186; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6028 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN W32/FakeFlash.Dropper PutInformation CnC Beacon"; flow:established,to_server; dsize:18; content:"PutInformation_New"; depth:18; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018187; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6029 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN W32/FakeFlash.Dropper GetInformation CnC Beacon Acknowledgement"; flow:established,to_client; dsize:14; content:"GetInformation"; depth:14; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:trojan-activity; sid:2018188; rev:1; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6030 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Trojan.Delf-5496 New Infection Report"; flow:established,to_server; dsize:<500; content:"|7c|OnConnect|7c|"; depth:20; pcre:"/^\d+?\x7cOnConnect\x7c/"; reference:url,doc.emergingthreats.net/2008908; reference:md5,3a7f11fbaf815cd2338d633de175e252; classtype:trojan-activity; sid:2008908; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6032 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kryptik.BSYO Checkin 2"; flow:to_server,established; content:"/cmd?version="; fast_pattern:only; http_uri; content:"&aid="; http_uri; content:"&id="; http_uri; content:"&os="; http_uri; pcre:"/&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=/U"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:trojan-activity; sid:2018198; rev:4; metadata:created_at 2014_01_22, updated_at 2014_01_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6034 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Matsnu.L Checkin"; flow:to_server,established; content:"GET"; http_method; content:".php?text="; http_uri; content:"&img_url=http"; distance:0; http_uri; content:"&rpt=simage&pos="; distance:0; http_uri; fast_pattern; content:" Windows NT 5.0"; http_user_agent; nocase; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TROJAN%3AWIN32/MATSNU.L; reference:md5,38b1862a42a6453d8ccdf1c2d2eff018; classtype:trojan-activity; sid:2018200; rev:3; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6035 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Win32.Geral Checkin"; content:".asp?MAC="; nocase; http_uri; fast_pattern:only; content:"&ver="; nocase; http_uri; pcre:"/\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$/Ui"; content:!"Referer|3a|"; http_header; reference:md5,f01260fff3d6fb705fc8afaa3ea54564; classtype:trojan-activity; sid:2018201; rev:2; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6036 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Qakbot.Bot Version 8 CnC Beacon"; flow:established,to_server; urilen:7<>32; content:"POST"; http_method; content:".php"; http_uri; content:!"Referer|3a 20|"; http_header; content:"v="; http_client_body; depth:2; content:"&c="; http_client_body; fast_pattern; pcre:"/^\/[b-u][A-Za-z0-9]{6,25}\.php$/U"; reference:url,www.anubisnetworks.com/the-return-of-qakbot/; reference:md5,e9201c8b126ac40229e9ce3f82f5c608; reference:md5,749a7bf2ad84212bd78e46d240a4f434; classtype:trojan-activity; sid:2018204; rev:3; metadata:created_at 2014_03_03, updated_at 2014_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6037 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Kryptik.BSYO Checkin"; flow:to_server,established; content:"/log?"; http_uri; content:"|7c|aid="; fast_pattern:only; http_uri; content:"|7c|version="; http_uri; content:"|7c|id="; http_uri; content:"|7c|os="; http_uri; pcre:"/\/log\?(start|install)\x7caid=/U"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:trojan-activity; sid:2018205; rev:3; metadata:created_at 2014_03_04, updated_at 2014_03_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6038 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Hack.PcClient.g CnC (OUTBOUND) XOR b5"; flow:to_server,established; content:"|d0 cd d0 db d4 d8 d0|"; content:"|d9 da d2 dc db|"; distance:0; content:"|d1 da d6 d8 d1|"; distance:0; content:"|dd da c6 c1 db d4 d8 d0|"; fast_pattern; distance:0; content:"|c2 dc db d1 da c2 c6|"; distance:0; reference:md5,dfd6b93dac698dccd9ef565a172123f3; classtype:trojan-activity; sid:2018154; rev:3; metadata:created_at 2014_02_18, updated_at 2014_02_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6041 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SMSHoax Riskware checkin"; flow:to_server; content:"POST"; http_method; content:"/api.php"; http_uri; content:"YWx0X2FwaV9iYXNlX3Vy"; depth:20; http_client_body; reference:md5,4b779acb1a0e726cee73fc2ca8a6a0be; classtype:trojan-activity; sid:2018230; rev:2; metadata:created_at 2014_03_06, updated_at 2014_03_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6042 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Havex RAT CnC Server Response"; flow:established,from_server; file_data; content:"|3c 21 2d 2d|havexhavex|2d 2d 3e|"; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:trojan-activity; sid:2018243; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6044 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Havex RAT CnC Server Response HTML Tag"; flow:established,from_server; file_data; content:"|3c|mega http|2d|equiv|3d|"; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:trojan-activity; sid:2018244; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6045 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Citadel Activity POST"; flow:to_server,established; urilen:15; content:"POST"; http_method; content:"/pk/request.flv"; http_uri; content:!"Content-Type|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,a354873df6dbce59e801380cee39ac17; classtype:trojan-activity; sid:2017582; rev:4; metadata:created_at 2013_10_11, updated_at 2013_10_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6048 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN RDP Brute Force Bot Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/cmd.php"; http_uri; content:"Browser"; depth:7; http_user_agent; content:"name=|22|data|22|"; http_client_body; content:"{ |22|bad|22 20 3a 20|"; http_client_body; content:", |22|bruting|22 20 3a 20|"; fast_pattern:only; http_client_body; content:", |22|checked|22 20 3a 20|"; http_client_body; reference:md5,c0c1f1a69a1b59c6f2dab18135a73919; reference:md5,e310cf7385ae4d15956e461c6d118c91; reference:md5,d316d208a66248c09986896f671f1db1; reference:url,www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop/; classtype:trojan-activity; sid:2018253; rev:6; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6049 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Expiro.CD Check-in"; flow:established,to_server; content:"/gate.php?user="; http_uri; fast_pattern:only; content:"&id="; http_uri; nocase; content:"&type="; http_uri; pcre:"/\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+(?:$|&)/U"; content:!"User-Agent|3a|"; http_header; reference:md5,c6e161a948f4474849d5740b2f27964a; classtype:trojan-activity; sid:2018255; rev:2; metadata:created_at 2014_03_12, updated_at 2014_03_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6050 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Self-Signed Cert Observed in Various Zbot Strains"; flow:established,from_server; content:"|55 04 0a 13 02|XX"; content:"|55 04 0a 13 02|XX"; distance:0; reference:md5,00e7afce84c84cd70fe329d8bb8c0731; classtype:trojan-activity; sid:2018284; rev:2; metadata:created_at 2014_03_17, updated_at 2014_03_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6053 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BKDR_SLOTH.A Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:10; content:"/help.html"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Mozilla/5.0 (compatible|3b| MSIE 7.0|3b| Windows NT 6.0)"; http_user_agent; reference:md5,185e930a19ad1a99c226d59ef563e28c; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/the-siesta-campaign-a-new-targeted-attack-awakens/; reference:url,fireeye.com/blog/technical/targeted-attack/2014/03/a-detailed-examination-of-the-siesta-campaign.html; classtype:trojan-activity; sid:2018285; rev:4; metadata:created_at 2014_03_17, updated_at 2014_03_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6054 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 31"; flow:to_server,established; dsize:>11; content:"|7d 94|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7d\x94/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,ece8808981043f830bacc4133d68e394; classtype:trojan-activity; sid:2018287; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_03_17, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6055 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Bladabindi/njrat CnC Keep-Alive (INBOUND)"; flow:from_server,established; content:"P[endof]"; dsize:8; reference:md5,0ae2261385c482d55519be9b0e4afef3; reference:url,anubis.iseclab.org/?action=result&task_id=1043e1f5f61319b944d51d0d6d7e23f2e; reference:md5,41a0a4c0831dbcbbfd877c7d37b671e0; reference:url,www.fireeye.com/blog/technical/botnet-activities-research/2012/09/the-story-behind-backdoorlv.html; classtype:trojan-activity; sid:2017417; rev:9; metadata:created_at 2012_07_30, updated_at 2012_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6068 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.WinSpy.pob Sending Data over SMTP"; flow:to_server,established; content:"filename="; content:"PC_Active_Time.txt"; within:19; content:"|0d 0a|"; within:3; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018019; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6069 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN MultiThreat/Winspy.RAT Keep-Alive (flowbit set)"; flow:established,to_server; dsize:2; content:"/P"; depth:2; flowbits:set,WinSpy.KeepAlive; flowbits:noalert; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; reference:md5,815576890789003a7575c2948508c6b1; classtype:trojan-activity; sid:2018291; rev:1; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6070 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus GameOver Checkin"; flow:established,to_server; content:"POST"; http_method; content:"Host|3a| default"; http_header; fast_pattern:only; content:"X-ID|3a 20|"; http_header; pcre:"/^Host\x3a\x20default(?:\x3a\d{1,5})?\r?$/Hmi"; reference:md5,bd850c21254c33cd9f6be41aafc6bf46; classtype:trojan-activity; sid:2018296; rev:2; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6074 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Stoberox.B"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"Host|3a|"; http_header; depth:5; content:"Connection|3a 20|Close|0d 0a|"; http_header; content:"Accept-Encoding|3a 20|none|0d 0a|"; http_header; fast_pattern:3,20; content:!"Referer"; http_header; pcre:"/^[a-zA-Z0-9\+\/]+={0,2}$/P"; reference:md5,6ca1690720b3726bc76ef0e7310c9ee7; classtype:trojan-activity; sid:2018300; rev:3; metadata:created_at 2014_03_20, updated_at 2014_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6075 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WEBC2-CSON Checkin - APT1 Related"; flow:to_server,established; content:"/Default.aspx?INDEX="; http_uri; pcre:"/\?ID=[A-Z]{10}$/U"; content:!"User-Agent|3a| Mozilla"; http_header; reference:url,www.threatexpert.com/report.aspx?md5=ba45339da92ca4622b472ac458f4c8f2; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FSmall.XR; reference:url,intelreport.mandiant.com/; reference:md5,8dd6a7fe83bd9682187d956f160ffb47; classtype:trojan-activity; sid:2016460; rev:7; metadata:created_at 2011_10_06, updated_at 2011_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6076 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dorkbot Loader Payload Request"; flow:established,to_server; content:"Mozilla/4.0|0D 0A|Host|3a|"; http_header; content:".exe"; http_uri; fast_pattern; urilen:<11; reference:md5,3452c20fd0df69ccfdea520a6515208a; classtype:trojan-activity; sid:2016578; rev:5; metadata:created_at 2013_03_15, updated_at 2013_03_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6077 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Sisproc"; flow:established,to_server; content:"/page_"; content:"Cookie|3a 20|XX=0|3b 20|BX=0"; reference:url,www.fireeye.com/blog/technical/malware-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html; reference:md5,aaf73666cbd750ed22b80ed836d2b1e4; classtype:trojan-activity; sid:2018320; rev:3; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6079 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Known Sinkhole Response Header"; flow:established,from_server; content:"X-Sinkholed-Domain|3a|"; http_header; reference:md5,723a90462a417337355138cc6aba2290; classtype:trojan-activity; sid:2017662; rev:3; metadata:created_at 2013_11_04, updated_at 2013_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6080 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET TROJAN Bozok.RAT checkin"; flow:to_server; content:"|00 00 00|"; offset:1; depth:4; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:64; content:"|00 7C 00|"; within:12; content:"|00 7C 00|"; within:5; content:"|00 7C 00|0|00 7c 00|2|00|"; within:32; reference:md5,a45d3564d1fa27161b33712f035a5962; reference:url,www.fireeye.com/blog/technical/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html; classtype:trojan-activity; sid:2018325; rev:3; metadata:created_at 2014_03_26, updated_at 2014_03_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6081 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit Install CnC Beacon"; flow:established,to_server; urilen:9; content:"POST"; http_method; content:"/install/"; http_uri; content:"q="; http_client_body; depth:2; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018331; rev:2; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6082 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/get/?q="; http_uri; content:"win32"; depth:5; http_user_agent; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018332; rev:3; metadata:created_at 2014_03_28, updated_at 2014_03_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6083 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Dorkbot.AR Join IRC channel"; flow:to_server,established; content:"NICK n|7B|"; nocase; pcre:"/^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,7e76c7db8706511fc59508af4aef27fa; classtype:trojan-activity; sid:2016768; rev:4; metadata:created_at 2013_04_17, updated_at 2013_04_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6084 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hangover Campaign Keylogger 2 checkin"; flow:established,to_server; content:"/access.php"; fast_pattern; http_uri; content:"sendfile"; depth:8; nocase; http_user_agent; reference:md5,0b38f87841ed347cc2a5ffa510a1c8f6; reference:url,enterprise.norman.com/resources/files/unveiling_an_indian_cyberattack_infrastructure_appendixes.pdf; classtype:trojan-activity; sid:2016862; rev:4; metadata:created_at 2013_05_20, updated_at 2013_05_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6085 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Mal/Ransom-CE Connectivity Check"; flow:established,to_server; content:"POST"; http_method; content:"/windows"; fast_pattern:only; http_uri; pcre:"/\/windows$/U"; content:"MSIE"; http_user_agent; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; http_header; depth:11; content:"Host|3a 20|www.microsoft.com|0d 0a|"; http_header; reference:md5,6faa7077de347ee0fa8c991934c2c3a5; reference:md5,a1fe3a7ff1ec997411b71212483eea33; reference:md5,97c0000473c5004d2e8c0464e322f429; classtype:trojan-activity; sid:2018295; rev:3; metadata:created_at 2014_03_18, updated_at 2014_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6086 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/install/?q="; http_uri; content:"win32"; depth:5; http_user_agent; reference:md5,cb6cb201eab321f7a827bb3cb1b311b6; classtype:trojan-activity; sid:2018345; rev:6; metadata:created_at 2014_04_01, updated_at 2014_04_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6089 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Trojan-Gypikon Server Check-in Response"; flow:established,from_server; dsize:16; content:"|85 19 00 00 25 04 00 00 00 00|"; content:"|40 00 00 00 00|"; distance:1; within:6; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018130; rev:3; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6101 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Trojan-Gypikon Sending Data"; flow:established,to_server; content:"@"; pcre:"/^(?:x(?:86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/R"; content:" OS|3a 20|Win"; within:8; content:" CPU|3a|"; distance:0; content:"Hz|2c|RAM|3a|"; distance:0; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018129; rev:4; metadata:created_at 2014_02_13, updated_at 2014_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6102 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12 SET"; flow:to_server,established; dsize:8; content:"|00 00|"; offset:2; depth:2; content:"|00 00|"; distance:2; within:2; flowbits:set,ET.gh0stFmly; flowbits:noalert; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,3b1abb60bafbab204aeddf8acdf58ac9; classtype:trojan-activity; sid:2017935; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6103 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.BAT.Qhost - SET"; flow:established,to_server; content:"GET"; http_method; content:"/stat/tuk/"; http_uri; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014758; rev:5; metadata:created_at 2012_05_16, updated_at 2012_05_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6104 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET 110 (msg:"ET TROJAN Gh0st_Apple Checkin"; flow:to_server,established; content:"GET"; http_method; content:".gif?pid"; fast_pattern; content:"&v="; content:"Mozilla/4.0("; http_user_agent; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; reference:md5,82644661f6639c9fcb021ad197b565f7; classtype:trojan-activity; sid:2017412; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2013_09_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6106 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor Win32/Zegost.Q CnC traffic (OUTBOUND)"; flow:to_server,established; dsize:>11; content:"|55 60 67 6c 69 70 9a|"; offset:8; depth:7; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,4f0d365408b439eb9aaf0b2352abb662; classtype:trojan-activity; sid:2018390; rev:1; metadata:created_at 2014_04_15, updated_at 2014_04_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6107 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PlugX Checkin"; flow:to_server,established; content:"POST"; http_method; pcre:"/^\/[A-F0-9]{24}$/U"; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; depth:13; pcre:"/^[A-Z]{4}/RH"; content:"1|3a 20|0|0d 0a|"; fast_pattern; http_header; within:6; content:!"Referer"; http_header; reference:url,fireeye.com/blog/technical/cyber-exploits/2013/11/exploit-proliferation-additional-threat-groups-acquire-cve-2013-3906.html; reference:md5,17f9f999e1814b99601446f8ce7eb816; classtype:trojan-activity; sid:2017714; rev:6; metadata:created_at 2013_11_13, updated_at 2013_11_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6108 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Fake/Short Google Search Appliance UA Win32/Ranbyus and Others"; flow:established,to_server; content:"User-Agent|3a 20|gsa-crawler|0d 0a|"; nocase; http_header; fast_pattern:5,20; reference:url,developers.google.com/search-appliance/documentation/50/help_mini/crawl_headers; reference:md5,98b58bd8a5138a31105e118e755a3773; reference:md5,c07a6035e9c7fed2467afab1a9dbcf40; classtype:trojan-activity; sid:2017937; rev:3; metadata:created_at 2014_01_07, updated_at 2014_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6111 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Bifrose/Cycbot Checkin 2"; flow:established,to_server; content:"GET "; depth:4; content:"chrome/9.0"; http_user_agent; pcre:"/\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D/U"; reference:md5,8c4f90bb59c05269c6c6990ec434eab6; classtype:trojan-activity; sid:2014163; rev:9; metadata:created_at 2012_01_27, updated_at 2012_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6112 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN GreenDou Downloader User-Agent (hello crazyk)"; flow:established,to_server; content:"User-Agent|3A 20|hello crazyk"; http_header; reference:md5,67d52ae285ac82f959b3675550de8a2d; reference:md5,e668a501bd107de161378a9fd9c5d1f2; classtype:trojan-activity; sid:2018404; rev:2; metadata:created_at 2014_04_21, updated_at 2014_04_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6115 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN hacker87 checkin"; flow:to_server,established; content:"POST"; http_method; content:"/AppEn.php"; fast_pattern:only; http_uri; content:"parameter="; depth:10; http_client_body; reference:md5,0d7dd2a6c69f2ae7e575ee8640432c4b; classtype:trojan-activity; sid:2018420; rev:2; metadata:created_at 2014_04_24, updated_at 2014_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6120 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Cutwail.BE Checkin 2"; flow:established,from_client; dsize:32; content:"|00 00 00 00 FF FF FF FF 3F 57|"; depth:10; content:"|FE FF FF FF FF FF FF FF FF FF FF|"; distance:3; within:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,c6d256edcc8879717539f348706061f2; reference:md5,8f17e2a9e7c6cbec772ae56dfffb13cb; classtype:trojan-activity; sid:2014272; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6122 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Cutwail.BE Checkin 1"; flow:established,from_client; dsize:234; content:"|16 03 00 00 37 01 00 00 33 03 00|"; depth:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,4352407efc8891215b514a54db5b8a1d; reference:md5,45ab3554f3d60d07fc5228faff7784e1; classtype:trojan-activity; sid:2014271; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6123 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop icmp $HOME_NET any -> any any (msg:"ET TROJAN Backdoor.Win32.RShot Ping Outbound"; icode:0; itype:8; icmp_id:512; dsize:32; content:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; reference:md5,34477e29f7408966d2703f3471741618; reference:md5,adf4c3a16f5f6d4baa634b2c50bf7454; classtype:trojan-activity; sid:2014270; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6124 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan-Spy.Win32.Zbot.qgxi Checkin"; flow:to_server,established; content:".php?bot="; http_uri; fast_pattern:only; content:"bot="; depth:4; http_cookie; reference:md5,0b450a92f29181065bc6601333f01b07; reference:md5,548fbf4dde27e725c0a1544f61362b50; reference:url,arbornetworks.com/asert/2014/04/trojan-eclipse-a-bad-moon-rising; classtype:trojan-activity; sid:2018412; rev:8; metadata:created_at 2013_10_31, updated_at 2013_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6127 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Win32.A.FakeAV Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/404.php?"; nocase; http_uri; content:"type=stats"; nocase; http_uri; content:"affid="; nocase; http_uri; content:"subid="; nocase; http_uri; reference:url,securelist.com/en/descriptions/24405309/Trojan.Win32.FakeAV.dlbc; reference:md5,ac0ba9e186aee9cf9889d71158485715; classtype:trojan-activity; sid:2014083; rev:5; metadata:created_at 2012_01_02, updated_at 2012_01_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6128 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Zbot.InfoStealer WindowsUpdate Connectivity Check With Opera UA"; flow:established,to_server; content:"GET"; http_method; urilen:1; content:"User-Agent|3A| Opera/9.25 (Windows NT 6.0|3B| U|3B|"; http_header; fast_pattern:12,20; content:"Host|3A| windowsupdate.microsoft.com"; http_header; content:"Connection|3A| Close"; http_header; content:!"Referer|3A|"; http_header; content:!"Accept"; http_header; reference:md5,aa696180cd0369e264ed8e9137a4f254; classtype:trojan-activity; sid:2018419; rev:6; metadata:created_at 2014_04_24, updated_at 2014_04_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6136 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PandoraRat/Refroso.bsp Activity"; flow:established,to_server; content:"|c3 b8 ba ab a0 bc b0 b1 c1 7c|"; depth:10; content:"|7c|N|7c|"; within:200; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018467; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6138 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PandoraRat/Refroso.bsp Directory Listing Sent To Server"; flow:established,to_server; content:"|7C|DIR#0#bin|7C|DIR#0"; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018468; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6139 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Downloader.Win32.Tesch.A Server CnC Checkin Reply"; flow:established,to_client; content:"|02 00 06|"; depth:3; content:"|01 BB|"; distance:4; within:2; fast_pattern; reference:md5,86b5491831522f3c7bdcdacb17417514; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018477; rev:1; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6142 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Downloader.Win32.Tesch.A Server CnC Sending Executable"; flow:established,to_client; content:"This Program must be"; fast_pattern:only; content:"|0B 00|"; depth:2; content:"|00|MZ"; distance:14; within:3; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,28173e257188ce3b3cc663be661bc2c4; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018479; rev:1; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6143 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Hicrazyk.A Downloader Install CnC Beacon"; flow:established,to_server; content:"/setup/?name="; http_uri; fast_pattern:only; content:"&ini="; http_uri; content:"&v="; http_uri; content:"NSISDL/"; depth:7; http_user_agent; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=TrojanDownloader%3AWin32%2FHicrazyk.A&ThreatID=-2147281007; reference:md5,ddb8110ec415b7b6f43c0ef2b4076d45; classtype:trojan-activity; sid:2018435; rev:7; metadata:created_at 2014_04_29, updated_at 2014_04_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6144 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Urausy.C Checkin 4"; flow:to_server,established; urilen:>80; content:"GET"; http_method; pcre:"/\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$/Ui"; content:"User-Agent|3a| Mozilla/5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| Trident/5.0)|0d 0a|"; fast_pattern:57,20; depth:77; http_header; content:!"Referer|3a| "; http_header; content:!"Accept|3a| "; http_header; reference:md5,0032856449dbef5e63b8ed2f7a61fff9; classtype:trojan-activity; sid:2017903; rev:3; metadata:created_at 2013_12_26, updated_at 2013_12_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6149 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Urausy.C response"; flow:from_server,established; file_data; content:"|0d 0a|<?xml version="; depth:16; content:"<interval>"; distance:0; content:"</interval>"; distance:0; content:"<timeout>"; distance:0; content:"</timeout>"; distance:0; content:"|d1 81 d1 81 d1 8b d0 bb d0 be d0 ba 20|c&c -->"; fast_pattern:only; reference:md5,6213597f40ecb3e7cf2ab3ee5c8b1c70; classtype:trojan-activity; sid:2018499; rev:3; metadata:created_at 2014_05_23, updated_at 2014_05_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6150 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Enosch.A gtalk connectivity check"; flow:to_server; content:"/index.html"; http_uri; content:"User-Agent|3A 20|gtalk|0d 0a|"; depth:19 ; http_header; pcre:"/^User-Agent\x3a\x20gtalk\r\nHost\x3a\x20www\.google\.com\r\n(?:\r\n)?$/H"; reference:md5,b13db8b21289971b3c88866d202fad49; classtype:trojan-activity; sid:2018508; rev:3; metadata:created_at 2014_05_30, updated_at 2014_05_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6154 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan-Dropper.Win32.Agent.ksja"; flow:established,to_server; content:".php?m="; http_uri; fast_pattern:only; content:"User-Agent|3a| Mozilla/4.0 (Compatible|3b| MSIE 6.0|3b 29 0d 0a|Host|3a|"; depth:54; http_header; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php\?m=[A-F0-9]{12}/U"; reference:md5,3b440e052da726942763d11cf9e3f72c; classtype:trojan-activity; sid:2018507; rev:3; metadata:created_at 2014_05_29, updated_at 2014_05_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6155 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN SSL Cert Observed with Unkown Trojan (statswas)"; flow:established,from_server; content:"|0c|statswas.com"; nocase; fast_pattern:only; reference:md5,9c087d528beefd22743666af772465fc; classtype:trojan-activity; sid:2018515; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_06_03, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6156 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent"; flow:established,to_server; content:"rome0321"; http_user_agent; depth:8; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018519; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6158 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (SBTCM)"; flow:established,to_server; content:"User-Agent|3a 20|SBTCM|0d 0a|"; http_header; fast_pattern:12,7; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018524; rev:2; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6159 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (x09)"; flow:established,to_server; content:"User-Agent|3a 20 09 0d 0a|"; http_header; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018529; rev:2; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6160 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (rhyno321)"; flow:established,to_server; content:"rhyno321"; depth:8; http_user_agent; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018523; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6161 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (slayer)"; flow:established,to_server; content:"slayer"; http_user_agent; depth:6; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018525; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6162 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (Vulture)"; flow:established,to_server; content:"Vulture"; http_user_agent; depth:7; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018526; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6163 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (VHIbot/1.0)"; flow:established,to_server; content:"VHIbot/1.0"; http_user_agent; depth:10; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018527; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6164 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (xehanort321)"; flow:established,to_server; content:"xehanort321"; http_user_agent; depth:11; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018528; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6165 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Trojan.Agent.U3D7V0 Checkin"; flow:established, to_server; content: "GET"; http_method; content:"/getc"; http_uri; content:"/?c="; http_uri; fast_pattern:only; pcre:"/^\/getc(?:loud|onf)\/\?c=/Ui"; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5, 97572a7a0690ba1643525bf6666b74c6; classtype:trojan-activity; sid:2018530; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6166 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Registration Request"; flow:established,to_server; content:"GET"; http_method; content:"/image/"; http_uri; content:".jpg"; http_uri; pcre:"/^\x2fimage\x2f[A-Za-z0-9\+_-]+\x2ejpg$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; fast_pattern:55,20; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018546; rev:6; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6167 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Ping"; flow:established,to_server; content:"GET"; http_method; content:"/history/"; fast_pattern; depth:9; http_uri; content:".asp"; http_uri; pcre:"/^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018547; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6168 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot PUT File Response"; flow:established,to_server; content:"GET"; http_method; content:"/docs/name="; fast_pattern; depth:11; http_uri; pcre:"/^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018549; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6169 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Etumbot.B Requesting RC4 Key"; flow:to_server,established; content:"/home/index.asp?typeid="; nocase; http_uri; fast_pattern:only; content:"Referer|3a| http|3a|//www.google.com/|0d 0a|"; http_header; pcre:"/^\/home\/index\.asp\?typeid=(?:1[13]?|[3579])$/Ui"; reference:md5,82d4850a02375a7447d2d0381b642a72; reference:md5,ff5a7a610746ab5492cc6ab284138852; reference:url,arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf; classtype:trojan-activity; sid:2018552; rev:3; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6170 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot Command Status Message"; flow:established,to_server; content:"GET"; http_method; content:"/tech/s.asp?m="; fast_pattern; depth:14; http_uri; pcre:"/^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018548; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6173 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot GET File Initial Response"; flow:established,to_server; content:"GET"; http_method; content:"/manage/asp/item.asp?id="; fast_pattern; depth:24; http_uri; pcre:"/^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018550; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6174 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN EtumBot GET File Data Upload"; flow:established,to_server; content:"GET"; http_method; content:"/article/30441/Review.asp?id="; fast_pattern; depth:29; http_uri; pcre:"/^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$/Ui"; content:"User-Agent|3a| Mozilla/5.0 |28|compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trident/5.0|29 0d 0a|"; http_header; content:"Referer|3a| http|3a|//www.google.com/"; http_header; reference:url,www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/; reference:md5,ca838b98ca0f516858a8a523dcd1338d; classtype:trojan-activity; sid:2018551; rev:4; metadata:created_at 2014_06_09, updated_at 2014_06_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6175 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hangover related campaign Checkin"; flow:established,to_server; content:"post.php?filename="; fast_pattern; http_uri; content:"&folder="; http_uri; distance:0; pcre:"/\/\/?$/U"; content:!"Referer|3a|"; http_header; reference:md5,0392fb51816dd9583f9cb206a2cf02d9; reference:url,bluecoat.com/security-blog/2014-06-10/snake-grass-python-based-malware-used-targeted-attacks; classtype:trojan-activity; sid:2018566; rev:2; metadata:created_at 2014_06_16, updated_at 2014_06_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6177 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Citadel Download From CnC Server /files/ attachment"; flow:established,to_client; flowbits:isset,et.citadel; content:"Content-Disposition|3a| attachment|3b| filename=|22 25 32 65|/files/"; fast_pattern:33,20; http_header; reference:md5,280ffd0653d150906a65cd513fcafc27; reference:md5,f1c8cc93d4e0aabd4713621fe271abc8; reference:url,arbornetworks.com/asert/2014/06/the-citadel-and-gameover-campaigns-of-5cb682c10440b2ebaf9f28c1fe438468/; classtype:trojan-activity; sid:2018599; rev:7; metadata:created_at 2014_06_24, updated_at 2014_06_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6184 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Sharik Checkin"; flow:established,to_server; dsize:10; content:"34feGaeRAd"; fast_pattern:only; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018614; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6187 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Sharik C2 Incoming Traffic"; flow:established,from_server; dsize:18; content:"|0d 00 07 01 00 81 7c e4 04 c0 d4 01 00 19 c0 c2 04 00|"; fast_pattern:only; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018615; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6188 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Sharik C2 Incoming Crafted Request"; flow:established,from_server; content:"|4d 00 02 02 00|"; depth:5; fast_pattern; content:"/"; distance:4; within:5; content:" HTTP/1."; distance:0; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:trojan-activity; sid:2018616; rev:1; metadata:created_at 2014_06_30, updated_at 2014_06_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6189 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET TROJAN Downloader.Win32.Tesch.A Bot Command Checkin 1"; flow:established,to_server; dsize:51; content:"|03 00 30 01 01 00|"; fast_pattern; depth:6; flowbits:set,ET.Tesch; reference:md5,86b5491831522f3c7bdcdacb17417514; reference:md5,2bebb36872b4829f553326e102d014ed; classtype:trojan-activity; sid:2018478; rev:2; metadata:created_at 2014_05_15, updated_at 2014_05_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6192 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Antifulai.APT CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:".php?secue="; http_uri; fast_pattern:only; content:"&pro="; http_uri; content:"|2c|"; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:url,secureworks.com/resources/blog/research/apt-campaign-leverages-the-cueisfry-trojan-and-microsoft-word-vulnerability-cve-2014-1761/; reference:md5,1c29b24d4d4ef7568f519c470b51bbed; classtype:trojan-activity; sid:2018631; rev:4; metadata:created_at 2014_05_19, updated_at 2014_05_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6198 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 36"; flow:to_server,established; dsize:>11; content:"|79 da|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\xda/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5b50cc5215694841b9faea0fde472648; classtype:trojan-activity; sid:2018636; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6202 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 37"; flow:to_server,established; dsize:>11; content:"|79 9d|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x9d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,f80fc82b5ff8f65f02ba7af363f84264; classtype:trojan-activity; sid:2018637; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6203 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 38"; flow:to_server,established; dsize:>11; content:"|49 a5|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x49\xa5/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,c8564898ab2598a075cbb478d104e750; classtype:trojan-activity; sid:2018638; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6204 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 39"; flow:to_server,established; dsize:>11; content:"|7b 9e|"; offset:8; byte_jump:4,0,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]+?.{4}\x7b\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,3134e62b117f9994e173c262b1bcbca5; classtype:trojan-activity; sid:2018639; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_07_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6205 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BANKER.WIN32.BANBRA.BEEC Checkin"; flow:established,to_server; content:"POST"; http_method; content:"/black/?"; fast_pattern:only; http_uri; content:"tipo="; depth:5; http_client_body; content:"&cliente="; http_client_body; reference:md5,ceb6684ffce35dcbfae4afde3b6fd4bd; classtype:trojan-activity; sid:2018641; rev:3; metadata:created_at 2014_07_03, updated_at 2014_07_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6206 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET TROJAN TrojanSpy.Win32/Banker.AMB SQL Checkin"; flow:established,to_server; content:"I|00|N|00|S|00|E|00|R|00|T"; content:"I|00|N|00|T|00|O"; distance:0; content:"B|00|R|00|O|00|W|00|S|00|E|00|R|00|L|00|O|00|G|00|U|00|S|00|B|00|"; reference:md5,dd141287cb45a2067592eeb9d3aa7162; classtype:trojan-activity; sid:2018645; rev:2; metadata:created_at 2014_07_07, updated_at 2014_07_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6208 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.Bancos Checkin via SMTP"; flow:to_server,established; content:"Subject|3a| "; content:"Foi Instalado"; nocase; fast_pattern:only; pcre:"/^Subject\x3a [^\r\n]+?Foi Instalado/mi"; metadata: former_category TROJAN; reference:md5,7f5709c924bb1417a180a4fa8311a2e9; classtype:trojan-activity; sid:2018646; rev:1; metadata:tag Banking_Trojan, created_at 2014_07_07, malware_family Bancos, updated_at 2018_04_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6209 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Banload.BTQP Checkin 1"; flow:established,to_server; content:"GET"; http_method; content:".asp?IDPC="; fast_pattern:only; http_uri; pcre:"/\.asp\?IDPC=[^\x26]*?\x26(?:Status=|Msg=)[^\x26]*?$/Ui"; content:"Mozilla/3.0 (compatible|3b| Indy Library)"; http_user_agent; content:!"Referer"; http_header; reference:md5,03092adccde639ba26ef2e192c49f62d; classtype:trojan-activity; sid:2018649; rev:4; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6210 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Banload2.KZU Checkin 1"; flow:established,to_server; content:"POST"; http_method; content:"OPC="; nocase; fast_pattern:only; http_client_body; pcre:"/^OPC=\d/Pi"; content:"Accept-Encoding|3a| identity|0d 0a|User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:!"Referer"; http_header; reference:md5,b67e23e4a0248c71b71e73e37d52c906; classtype:trojan-activity; sid:2018653; rev:2; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6211 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Downloader.Banload2.KZU Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:".hlp"; nocase; fast_pattern:only; http_uri; content:"Accept-Encoding|3a| identity|0d 0a|User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:!"Referer"; http_header; pcre:"/^\/[^\x2f]+?\.hlp$/Ui"; reference:md5,b67e23e4a0248c71b71e73e37d52c906; classtype:trojan-activity; sid:2018654; rev:3; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6212 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Banload.BTQP Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:".asp?IDPC="; fast_pattern:only; http_uri; content:"&so="; nocase; http_uri; content:"&user"; http_uri; nocase; content:"&versao"; http_uri; nocase; content:"&pcname="; http_uri; nocase; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; content:!"Referer"; http_header; reference:md5,03092adccde639ba26ef2e192c49f62d; classtype:trojan-activity; sid:2018650; rev:3; metadata:created_at 2014_07_08, updated_at 2014_07_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6213 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CyberGate RAT Checkin"; flow:to_server,established; content:".php?"; http_uri; content:"email="; http_uri; content:"&serverid="; http_uri; content:"User|3a|"; http_uri; content:"PC|3a|"; http_uri; content:!"Referer"; http_header; reference:md5,24d9f082b849b4c698e6b012500d441a; classtype:trojan-activity; sid:2018659; rev:2; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6214 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CyberGate RAT User-Agent (USER_CHECK)"; flow:to_server,established; content:"USER_CHECK"; depth:10; http_user_agent; reference:md5,24d9f082b849b4c698e6b012500d441a; classtype:trojan-activity; sid:2018660; rev:3; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6215 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FakeAV.dfze/FakeAV!IK Checkin"; flow:established,to_server; urilen:>150; content:"GET"; http_method; content:"= HTTP/1.1|0D 0A|Host|3a| "; fast_pattern:only; content:!"User-Agent|3a| "; http_header; content:"|0D 0A|Cache-Control|3a| no-cache|0D 0A 0D 0A|"; pcre:"/^\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/U"; content:!"pandora.com"; http_header; content:!"wordpress.com"; http_header; reference:md5,fe1e735ec10fb8836691fe2f2ac7ea44; classtype:trojan-activity; sid:2014409; rev:5; metadata:created_at 2012_03_21, updated_at 2012_03_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6216 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Minirem"; flow: established,to_server; urilen:>18; content:"GET"; http_method; content:"/FC001/"; fast_pattern; depth:7; http_uri; content:"Microsoft Internet Explorer"; http_user_agent; reference:md5,d92075280872b9fe4f541f090bf0076c; classtype:trojan-activity; sid:2018664; rev:6; metadata:created_at 2014_01_22, updated_at 2014_01_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6217 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; pcre:"/^..[\x0d-\x20](?=\d{0,27}[a-z])(?=[a-z]{0,27}\d)[a-z0-9]{21,28}(?:\x03(?:biz|com|net|org))\x00\x00\x01\x00\x01/Rs"; threshold: type both, track by_dst, count 12, seconds 120; reference:url, blog.malcovery.com/blog/breaking-gameover-zeus-returns; reference:md5,5e5e46145409fb4a5c8a004217eef836; classtype:trojan-activity; sid:2018666; rev:4; metadata:created_at 2014_07_11, updated_at 2014_07_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6218 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Upatre Common URI Struct July 15 2014"; flow:established,to_server; content:"/0/"; http_uri; content:"Service Pack "; http_uri; distance:2; within:13; pcre:"/\/0\/$/U"; content:!"Referer|3a|"; http_header; reference:md5,79772d72082a082a0048569ba2dfe5a3; classtype:trojan-activity; sid:2018678; rev:3; metadata:created_at 2014_07_15, updated_at 2014_07_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6222 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any any -> any 53 (msg:"ET TROJAN DNS Possible User trying to visit POSHCODER.A .onion link outside of torbrowser"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|zpwibfsmoowehdsm|05|onion|00|"; nocase; distance:0; reference:md5,01f4b1d9b2aafb86d5ccfa00e277fb9d; classtype:trojan-activity; sid:2018679; rev:1; metadata:created_at 2014_07_15, updated_at 2014_07_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6223 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Aibatook checkin 2"; flow:established,to_server; content:"GET"; http_method; urilen:7; content:"/u.html"; http_uri; fast_pattern:only; content:"User-Agent|3A| Mozilla/5.0 (compatible|3B| MSIE 10.0|3B| Windows NT 6.1|3B| Trident/6.0)"; http_header; content:!"Accept"; http_header; content:!"Referer|3A|"; http_header; reference:url,welivesecurity.com/2014/07/16/win32aibatook/; reference:md5,d5e8adfefbcc3667734b8df4ae066be6; classtype:trojan-activity; sid:2018687; rev:2; metadata:created_at 2014_07_17, updated_at 2014_07_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6225 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,26,587,2525] (msg:"ET TROJAN Predator Pain Sending Data over SMTP"; flow:established,to_server; content:"Subject|3a 20|Predator Pain v"; fast_pattern:4,20; reference:md5,e774a7e6ca28487db649458f48230199; reference:url,stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html; classtype:trojan-activity; sid:2018688; rev:3; metadata:created_at 2014_07_17, updated_at 2014_07_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6227 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587,2525] (msg:"ET TROJAN Predator Logger Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|Predator Logger|20|"; fast_pattern:5,20; reference:md5,91f885e08d627097fb1116a3d4634b82; reference:url,stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html; classtype:trojan-activity; sid:2018017; rev:3; metadata:created_at 2014_01_27, updated_at 2014_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6228 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|11|bloggershop.co.vu"; distance:1; within:19; nocase; reference:md5,fe56b5a28eac390aa8cfb1402360958b; reference:url,sslbl.abuse.ch; classtype:trojan-activity; sid:2018494; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_05_21, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6231 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Asterope Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?ver="; http_uri; content:"&id="; distance:0; http_uri; content:"&os="; distance:0; http_uri; content:"&res="; distance:0; http_uri; content:"Accept-Asterope|3a|"; http_header; fast_pattern:only; reference:md5,19190ef53877979191f6889c6a795f31; classtype:trojan-activity; sid:2018750; rev:3; metadata:created_at 2014_06_23, updated_at 2014_06_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6234 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN XPSecurityCenter FakeAV Checkin"; flow:to_server,established; content:"/XPSecurityCenter/"; http_uri; content:"User-Agent|3a| Internet Explorer 6.0|0d 0a|"; http_header; reference:md5,1c5eb2ea27210cf19c6ab24b7cc104b9; classtype:trojan-activity; sid:2018761; rev:3; metadata:created_at 2012_07_13, updated_at 2012_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6235 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Hupigon.DF Checkin"; flow:to_server,established; content:"/ip.txt"; http_uri; urilen:7; content:"User-Agent|3a| Huai_Huai|0d 0a|"; http_header; reference:md5,ee600bdcc45989750dee846b5049f935; reference:md5,1051f7176fe0a50414649d369e752e98; classtype:trojan-activity; sid:2018762; rev:3; metadata:created_at 2012_07_13, updated_at 2012_07_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6236 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN W32/Zbot.Variant CnC Response"; flow:established,from_server; flowbits:isset,ET.zbot.ua.2106509; content:"200"; http_stat_code; content:"Content-Length|3a| 0|0d 0a|Content-Type|3a| text/html|0d 0a|"; http_header; fast_pattern:11,20; pcre:"/^(\r\n)?$/HR"; reference:md5,0c4d7d9138de7d7919e3b3c33ac2f851; classtype:trojan-activity; sid:2018764; rev:4; metadata:created_at 2013_04_26, updated_at 2013_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6238 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Swizzor User-Agent (Swizz03r)"; flow:established,to_server; content:"GET"; http_method; content:"Swizz03r Download Agent"; nocase; depth:23; http_user_agent; reference:md5,5d232faca6d2b082b450b8ee4e238483; classtype:trojan-activity; sid:2018765; rev:4; metadata:created_at 2013_06_03, updated_at 2013_06_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6239 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|sslbl.abuse.ch"; distance:1; within:15; content:"|1b|we_love_selfsigned@abuse.ch"; distance:0; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:trojan-activity; sid:2018767; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6240 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Likely Malicious SSL Cert With Script Tags"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"<script>"; content:"</script>"; distance:0; content:"|55 04 03|"; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:trojan-activity; sid:2018768; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_24, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6241 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Soraya C2 User-Agent (default)"; flow:established,to_server; content:".php"; http_uri; content:"default"; depth:7; http_user_agent; content:"mode="; depth:5; http_client_body; reference:md5,a95dacba360e45fc03769ea55c546a7b; reference:url,www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/; classtype:trojan-activity; sid:2018522; rev:3; metadata:created_at 2014_06_04, updated_at 2014_06_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6242 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Kbot.Backdoor Variant CnC Beacon"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/stat.php"; nocase; http_uri; content:"id="; depth:3; http_client_body; content:"&build_id="; fast_pattern:only; http_client_body; pcre:"/&build_id=[A-F0-9]+$/Pi"; reference:md5,1df0ceab582ae94c83d7d2c79389e178; classtype:trojan-activity; sid:2018078; rev:3; metadata:created_at 2014_02_05, updated_at 2014_02_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6243 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Locker DL URI Struct Jul 25 2014"; flow:to_server,established; content:"/wp-content/themes/"; http_uri; depth:19; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/wp-content\/themes\/[^\x2f]+\/[a-z0-9]+$/U"; pcre:"/^User-Agent\x3a[^\r\n]+(?:MSIE|rv\x3a11\.0)[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(?:\r\n)?$/H"; reference:md5,dc4d0bd7fb9e647501c3b0d75aa2be65; classtype:trojan-activity; sid:2018787; rev:2; metadata:created_at 2014_07_25, updated_at 2014_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6244 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:49 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.KLPROXY Checkin via SMTP"; flow:to_server,established; content:"Subject|3a|"; content:"C-H-E-G-O A-V-I-S-O! |2e 3a 3a|Infect|3a 3a 2e|"; distance:5; within:33; reference:md5,422ce789b284eb5aa32124a6bbe86000; classtype:trojan-activity; sid:2018798; rev:2; metadata:created_at 2014_07_28, updated_at 2014_07_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6246 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DoS.Linux/Elknot.G Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|Linux|20|"; offset:2; depth:21; fast_pattern:1,20; pcre:"/^\d/R"; reference:md5,917a2a3d8c30282acbe7b1ff121a4336; classtype:trojan-activity; sid:2018808; rev:1; metadata:created_at 2014_07_30, updated_at 2014_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6248 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|badsokspad.in"; distance:1; within:14; reference:md5,c4fe829fc49bb9efec92fe4a8a5d29fc; classtype:trojan-activity; sid:2018852; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_07_30, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6249 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backoff POS Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php"; http_uri; content:"&op="; depth:4; http_client_body; content:"&id="; http_client_body; content:"&ui="; http_client_body; content:"&wv="; http_client_body; fast_pattern:only; content:"&bv="; http_client_body; pcre:"/^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)/P"; reference:md5,d0c74483f20c608a0a89c5ba05c2197f; classtype:trojan-activity; sid:2018857; rev:6; metadata:created_at 2014_03_05, updated_at 2014_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6250 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 40"; flow:to_server,established; dsize:>11; content:"|7c 99|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7c\x99/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,984ec607cbaefdd2ce977c9a07a3e175; classtype:trojan-activity; sid:2018880; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_08_01, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6251 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Troj/ReRol.A Checkin 1"; flow:established,to_server; urilen:18; content:"POST"; http_method; content:"/project/check.asp"; http_uri; fast_pattern:only; content:"Content-Length|3a 20|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|20 28|compatible|3b 29 0d 0a|"; distance:0; http_header; content:!"Referer|3a 20|"; http_header; reference:url,blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2; reference:md5,12854bb8d1e6a590e1bd578267e4f8c9; classtype:trojan-activity; sid:2018882; rev:4; metadata:created_at 2014_07_14, updated_at 2014_07_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6252 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Troj/ReRol.A Checkin 2"; flow:established,to_server; urilen:7; content:"POST"; http_method; content:"/dr.asp"; http_uri; fast_pattern:only; content:"Content-Length|3a 20|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|20 28|compatible|3b 29 0d 0a|"; distance:0; http_header; content:!"Referer|3a 20|"; http_header; reference:url,blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2; reference:md5,c0656b66b9f4180e59e1fd2f9f1a85f2; classtype:trojan-activity; sid:2018883; rev:3; metadata:created_at 2014_07_14, updated_at 2014_07_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6253 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Mysayad Checkin 1"; flow:established,to_server; content:"HEAD"; http_method; urilen:17; content:"/GlobalUpdate.upt"; fast_pattern:only; http_uri; content:!"Referer"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,799600122930bbc64b7dac987ea8bb39; reference:url,vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/; classtype:trojan-activity; sid:2018889; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6258 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Mysayad Checkin 2"; flow:established,to_server; content:"HEAD"; http_method; urilen:9; content:"/all.wipe"; fast_pattern:only; http_uri; content:!"Referer"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,799600122930bbc64b7dac987ea8bb39; reference:url,vinsula.com/2014/07/20/sayad-flying-kitten-infostealer-malware/; classtype:trojan-activity; sid:2018890; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6259 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kronos Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"Referer|3a|"; http_header; content:"/upfornow/connect.php"; http_uri; fast_pattern:only; content:"Content-Length|3a| "; http_header; reference:md5,f085395253a40ce8ca077228c2322010; reference:url,securityblog.s21sec.com/2014/08/kronos-is-here.html; classtype:trojan-activity; sid:2018891; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6260 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Pushdo.S CnC response"; flow:established,from_server; flowbits:isset,ET.Pushdo.S; content:"X-GeoIP-Country-Code|3a| "; http_header; content:"X-Real-IP|3a| "; http_header; reference:md5,27aef1d328da442d3bd02c50c1a6b651; classtype:trojan-activity; sid:2018897; rev:2; metadata:created_at 2014_08_05, updated_at 2014_08_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6264 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BITTERBUG Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:".php?compname="; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/\.php\?compname=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\x20_{}\.~]{1,14}_/U"; reference:md5,34c7f12b4e8f2b81143453af12442ee0; reference:md5,48bbae6ee277b5693b40ecf51919d3a6; classtype:trojan-activity; sid:2018900; rev:2; metadata:created_at 2014_08_06, updated_at 2014_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6265 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BITTERBUG Checkin 2"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/vtris"; fast_pattern:only; http_uri; content:".php?srs="; http_uri; content:!"User-Agent|3a| "; http_header; pcre:"/\/vtris\d?\.php\?srs=\d{1,10}$/U"; reference:md5,34c7f12b4e8f2b81143453af12442ee0; reference:md5,48bbae6ee277b5693b40ecf51919d3a6; classtype:trojan-activity; sid:2018901; rev:2; metadata:created_at 2014_08_06, updated_at 2014_08_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6266 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Zemot Config Download"; flow:established,to_server; content:"GET"; http_method; content:"/soft"; http_uri; content:".dll"; http_uri; fast_pattern:only; pcre:"/\/soft(?:32|64)\.dll$/Ui"; content:"Accept|3a 20|*/*|0d 0a|Connection|3a 20|Close|0d 0a|"; depth:32; http_header; content:"User-Agent|3a|"; http_header; content:!"Referer"; http_header; reference:md5,5a99a6a6cd8600ea88a8fcc1409b82f4; classtype:trojan-activity; sid:2018661; rev:3; metadata:created_at 2014_07_09, updated_at 2014_07_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6268 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Trojan Dropped By Archie.EK"; flow:established,to_server; content:".exe"; http_uri; fast_pattern:only; pcre:"/^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe/Ui"; content:!"Referer|3a|"; http_header; content:!"User-Agent|3a|"; http_header; reference:md5,e6c91ab176887e5c79bb59277c651dfd; classtype:trojan-activity; sid:2018928; rev:3; metadata:created_at 2014_08_13, updated_at 2014_08_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6273 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|12|alohafriends12.com"; distance:1; within:19; reference:md5,9c98ef776a651cc4269acde3755d3a5a; classtype:trojan-activity; sid:2018935; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_08_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6274 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Suspicious X-mailer Synapse"; flow:established,to_server; content:"produced by Synapse"; fast_pattern:only; content:"X|2d|mailer|3a 20|Synapse|20 2d 20|Pascal TCP|2f|IP library by Lukas Gebauer"; reference:md5,954acc71ffaa7010c603d74e76dfc70b; reference:url,www.joewein.net/spam/spam-joejob.htm; classtype:trojan-activity; sid:2018936; rev:2; metadata:created_at 2014_08_14, updated_at 2014_08_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6275 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/PSW.Steam.NBP Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/data2.php?file="; fast_pattern:only; http_uri; content:"Mozilla/4.0 (compatible|3b| Synapse)"; depth:33; http_user_agent; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,17d2b62f2fa20f407485437de17787fb; reference:md5,bec091077138a1cac49db00495d456e7; classtype:trojan-activity; sid:2018949; rev:3; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6282 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN ShellBot.C retrieval"; flow:from_server,established; file_data; content:"my $processo"; content:"my @adms="; distance:0; content:"my @canais="; distance:0; content:"|23|gh|30|sts"; distance:0; within:10; reference:md5,3e44252394078c8fd792da1583525d0c; reference:url,pastebin.com/0dAciksC; reference:url,pastebin.com/C0arvGxU; classtype:trojan-activity; sid:2018953; rev:2; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6283 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Python.Ragua Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/WebCam/Cam.txt"; nocase; http_uri; fast_pattern:only; content:"Python-urllib/"; depth:14; http_user_agent; nocase; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:url,securelist.com/blog/research/66108/el-machete/; reference:md5,a8602b4c35f426107c9667d804470745; classtype:trojan-activity; sid:2018968; rev:3; metadata:created_at 2014_08_20, updated_at 2014_08_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6287 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Suspicious User-Agent (Asteria md5)"; flow:to_server,established; content:"d9d385b3522b242398af91fd425b386d"; depth:32; http_user_agent; reference:md5,56c16ad7da8cecb429dccb168aef46b7; classtype:trojan-activity; sid:2018985; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, deployment Perimeter, tag User_Agent, signature_severity Major, created_at 2014_08_22, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6296 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PlugX variant"; flow:to_server,established; content:"GET"; http_method; content:"/p/"; depth:3; http_uri; pcre:"/^\/p\/(?:p(?:hphphphphphphp|thon)|(?:dropytho|admmmom)n|u(?:pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)/U"; content:"code.google.com"; fast_pattern:only; http_header; content:!"Referer|3a 20|"; http_header; content:!"User-Agent|3a 20|"; http_header; content:!"Connection|3a 20|"; http_header; threshold: type both, count 1, seconds 30, track by_src; reference:md5,f92e9e3e86856b5c0ee465f77a440abb; reference:url,researchcenter.paloaltonetworks.com/2014/08/attacks-east-asia-using-google-code-command-control/; reference:url,www.fireeye.com/blog/technical/targeted-attack/2014/08/operation-poisoned-hurricane.html; classtype:trojan-activity; sid:2018984; rev:7; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6297 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Xema dropping file"; flow:to_server,established; content:"/pruebas.doc"; http_uri; fast_pattern:only; content:!"Referer"; http_header; reference:md5,f5fbdb120594f4da7f638122d6635933; classtype:trojan-activity; sid:2018994; rev:2; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6298 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows net start Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"These Windows services are started|3a 0d|"; fast_pattern:8,16; content:"The command completed successfully|2e|"; distance:0; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019001; rev:1; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6300 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows ipconfig Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Windows IP Configuration|0d|"; fast_pattern:8,16; content:"Ethernet adapter Local Area Connection|3a|"; distance:0; content:"Physical Address"; content:"IP Address"; content:"Subnet Mask"; content:"Default Gateway"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019000; rev:3; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6301 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows systeminfo Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Host Name|3a|"; content:"OS Name|3a|"; content:"OS Version|3a|"; content:"OS Manufacturer|3a|"; content:"Microsoft Corporation"; distance:0; content:"OS Configuration|3a|"; content:"OS Build Type|3a|"; content:"Registered Owner|3a|"; content:"Registered Organization|3a|"; content:"Product ID|3a|"; content:"Original Install Date|3a|"; content:"System Up Time|3a|"; content:"System Manufacturer|3a|"; content:"System Model|3a|"; content:"System type|3a|"; content:"Processor|28|s|29 3a|"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019002; rev:1; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6302 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dirt Jumper/Russkill3 Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0"; content:"k="; fast_pattern; depth:2; http_client_body; pcre:"/k=\d{15}/P"; reference:md5,10e7af7057833a19097cb22ba0bd1b99; reference:url,asert.arbornetworks.com/2011/08/dirt-jumper-caught/; reference:url,www.deependresearch.org/2011/10/dirt-jumper-ddos-bot-new-versions-new.html; classtype:trojan-activity; sid:2013439; rev:10; metadata:created_at 2011_08_03, updated_at 2011_08_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6304 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/publickey/"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,b61145a54698753cecf8748359c9d81e; classtype:trojan-activity; sid:2018579; rev:7; metadata:created_at 2014_06_12, updated_at 2014_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6307 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN Dyreza RAT Checkin Response"; flow:established,to_client; content:"|a5 46 da 53 0a 00 68 00 65 00 6c 00 6c 00 6f|"; offset:4; depth:15; reference:md5,b61145a54698753cecf8748359c9d81e; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018596; rev:3; metadata:created_at 2014_06_12, updated_at 2014_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6308 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyreza RAT Fake Server Header"; flow:established,to_client; content:"HTTP/1."; depth:7; content:"Server|3A| Stalin"; http_header; fast_pattern:only; reference:md5,7e3e28320d209a586917668e3b8eac40; classtype:trojan-activity; sid:2018775; rev:3; metadata:created_at 2014_07_25, updated_at 2014_07_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6309 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin 3"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/replace/"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,4d1d43789e038c6a03c07083ca0b0809; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018749; rev:6; metadata:created_at 2014_07_21, updated_at 2014_07_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6310 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dyreza RAT Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"_W"; http_uri; content:"|2e|"; distance:6; within:1; http_uri; content:"/NAT/"; distance:0; http_uri; fast_pattern; content:"|20|NAT/"; distance:0; http_uri; content:!"Accept|3a|"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,2a835747b7442b1d58ab30abc90d3b0f; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018683; rev:6; metadata:created_at 2014_07_16, updated_at 2014_07_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6311 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo POST Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Content-Length|3a 20|59|0d 0a|Host|3a 20|"; depth:26; http_header; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\n(?:\r\n)?$/RH"; pcre:"/^\/[\/a-z0-9]+$/Ui"; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018771; rev:5; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6312 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo Cookie"; flow:established,to_client; content:"tfardci_session="; depth:16; http_cookie; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018770; rev:4; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6313 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows arp -a Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Interface|3a|"; content:"--- 0x"; distance:0; content:"Internet Address"; content:"Physical Address"; fast_pattern; distance:0; content:"Type"; content:"dynamic"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019080; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6317 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows set Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"ALLUSERSPROFILE="; fast_pattern; content:"APPDATA="; distance:0; content:"CLIENTNAME="; content:"CommonProgramFiles="; distance:0; content:"COMPUTERNAME="; content:"ComSpec="; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019081; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6318 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 41"; flow:to_server,established; dsize:>11; content:"|c3 70|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\xc3\x70/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,23bb9c2ed95e942f886d544fefd20d70; classtype:trojan-activity; sid:2019083; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_08_28, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6320 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Syrian Malware Checkin"; flow:established,to_server; content:"|2f|j|7c|n|5c|"; offset:2; depth:5; content:"[endof]"; fast_pattern; distance:0; reference:url,fireeye.com/blog/technical/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html; reference:md5,a8cf815c3800202d448d035300985dc7; classtype:trojan-activity; sid:2019084; rev:1; metadata:created_at 2014_08_29, updated_at 2014_08_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6321 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 12"; flow:to_server,established; flowbits:isset,ET.gh0stFmly; content:"|78 9c 0b cf cc|"; depth:5; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,3b1abb60bafbab204aeddf8acdf58ac9; classtype:trojan-activity; sid:2017936; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_01_06, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6323 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.Popwin Checkin"; flow:to_server,established; content:"/soft/xiaomi"; fast_pattern:only; http_uri; content:".asp"; content:"API-Guide test program"; depth:22; http_user_agent; content:!"Referer|3a|"; content:!"Accept|3a 20|"; reference:url,www.virustotal.com/en/file/79dfb0ea0d788dd388a1d1856402f04ddcdc42b7134ffc80747b339937216cbb analysis/; reference:md5,dd762c69049fbd00c22f70f109baa26e; classtype:trojan-activity; sid:2018143; rev:5; metadata:created_at 2014_02_14, updated_at 2014_02_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6324 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HighTide trojan Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/?"; http_uri; depth:2; content:"Trident/5.0|29 0d 0a|"; fast_pattern; http_header; content:"Referer|3A| http|3A|//www.google.com/|0D 0A|"; http_header; pcre:"/^\/\?\d(?:[A-Za-z0-9~_]{4})*(?:[A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$/U"; reference:md5,6e59861931fa2796ee107dc27bfdd480; reference:url,fireeye.com/blog/technical/botnet-activities-research/2014/09/darwins-favorite-apt-group-2.html; classtype:trojan-activity; sid:2019113; rev:2; metadata:created_at 2014_09_04, updated_at 2014_09_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6329 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Bapy.Downloader PE Download Request"; flow:established,to_server; content:"GET"; http_method; urilen:9; content:"/tmps."; http_uri; fast_pattern:only; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; pcre:"/[a-z]\d{2}$/U"; reference:md5,e256976cedda8c9d07a21ca0e5c2f86c; classtype:trojan-activity; sid:2019127; rev:2; metadata:created_at 2014_09_05, updated_at 2014_09_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6333 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Bravix.Dropper CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/get.php?file=cmds/main"; http_uri; content:!"Referer|3A|"; http_header; reference:md5,19484a240a16c7faea84dcac0c38d118; classtype:trojan-activity; sid:2019128; rev:2; metadata:created_at 2014_09_05, updated_at 2014_09_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6334 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/Dervec.gen Connectivity Check to Google"; flow:established,to_server; content:"HOST|3a|"; depth:5; http_header; content:"www.google.com|0d 0a|"; within:17; http_header; content:"|00 00 00 00 00 00 00 00 00 00|"; offset:35; depth:10; reference:md5,5eaae2d6a4b5d338b83ea5d97af93672; classtype:trojan-activity; sid:2019129; rev:10; metadata:created_at 2012_06_12, updated_at 2012_06_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6335 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Frosparf.B Downloading Hosts File"; flow:established,from_server; file_data; content:"9.9.9.9 "; within:8; pcre:"/^(?:[a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?(?:[a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]/R"; reference:md5,4ad55877464aa92e49231d913d00eb69; classtype:trojan-activity; sid:2019142; rev:2; metadata:created_at 2014_09_09, updated_at 2014_09_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6339 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Possible Zeus GameOver Connectivity Check 2"; flow:established,to_server; urilen:1; content:"Connection|3a 20|Close"; http_header; fast_pattern:only; content:"Host|3a 20|windowsupdate.microsoft.com|0d 0a|"; http_header; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:md5,236bde81355e075e7ed6bcdc60daefcb; classtype:trojan-activity; sid:2019155; rev:2; metadata:created_at 2014_09_10, updated_at 2014_09_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6348 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TSPY_POCARDL.U Possible FTP Login"; flow:established,to_server; content:"USER user drupalzf"; reference:md5,ceb5b99c13b107cf07331bcbddb43b1f; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019159; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6349 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DecebalPOS Checkin"; flow:established,to_server; content:"GET"; http_method; content:".php?&co="; http_uri; fast_pattern:only; content:"&us="; http_uri; content:"&av="; http_uri; content:"&os="; http_uri; content:"&tr2="; http_uri; reference:md5,87cfa0addda5c0e0fc34f3847408e557; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019160; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6350 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DecebalPOS User-Agent"; flow:established,to_server; content:"Decebalv"; depth:8; http_user_agent; reference:md5,87cfa0addda5c0e0fc34f3847408e557; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019161; rev:3; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6351 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win.Trojan.Chewbacca connectivity check"; flow:established,to_server; content:"GET"; http_method; content:"/ip/"; http_uri; content:"User-Agent|3A| Mozilla/4.0 (compatible|3b| Synapse|29 0d 0a|"; http_header; fast_pattern:36,11; content:!"Accept"; http_header; content:!"Referer"; http_header; reference:md5,21f8b9d9a6fa3a0cd3a3f0644636bf09; reference:url,www.symantec.com/security_response/earthlink_writeup.jsp?docid=2013-121813-2446-99; classtype:trojan-activity; sid:2019162; rev:4; metadata:created_at 2014_08_18, updated_at 2014_08_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6352 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN JackPOS XOR Encoded HTTP Client Body (key AA)"; flow:established,to_server; content:"|AB AB|"; depth:2; http_client_body; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; http_client_body; fast_pattern:only; reference:md5,3959fb5b5909d9c6fb9c9a408d35f67a; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019164; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6354 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Stobox Connectivity Check"; flow:established,to_server; content:"/windowsupdate/v6/thanks.aspx?ln=en&&thankspage="; http_uri; fast_pattern:28,20; content:"Host|3a 20|update.microsoft.com|0d 0a|"; http_header; depth:28; content:!"Accept-Language|3a|"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; content:"|0d 0a 0d 0a|"; threshold: type both, count 5, seconds 300, track by_src; reference:md5,aba20c8289b37b10d42979730674a2ca; classtype:trojan-activity; sid:2019166; rev:4; metadata:created_at 2014_09_11, updated_at 2014_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6356 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Tinba Server Response"; flow:established,to_client; flowbits:isset,ET.Tinba.Checkin; file_data; content:"|64 b4 dc a4|"; within:4; reference:md5,1e644fe146f62bd2fc585b8df6712ff6; classtype:trojan-activity; sid:2019169; rev:4; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6362 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN DoS.Linux/Elknot.E Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|10 27 60 ea|Linux|20|"; offset:4; depth:64; reference:md5,9a2a00f4bba2f3e0b1211a1f0cb48896; classtype:trojan-activity; sid:2019171; rev:2; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6369 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Query to Known CnC Domain msnsolution.nicaze.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"nicaze|03|net"; fast_pattern; distance:0; reference:md5,89332c92d0360095e2dda8385d400258; classtype:trojan-activity; sid:2014139; rev:4; metadata:created_at 2012_01_21, updated_at 2012_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6391 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN MSIL/Spy.RapidStealer.B Checkin"; flow:established,to_server; urilen:14; content:"POST"; http_method; content:"/key/index.php"; http_uri; fast_pattern:only; content:"dir="; depth:4; http_client_body; content:"&data="; distance:0; http_client_body; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,c14690b90459744a300a02f45b32168a; reference:url,quequero.org/2014/09/win32-blackberrybbc-malware-analysis/; classtype:trojan-activity; sid:2019179; rev:2; metadata:created_at 2014_09_16, updated_at 2014_09_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6402 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miras C2 Activity"; flow:established,to_server; content:"|36 36 36 36 58 36 36 36|"; offset:2; depth:8; reference:md5,98a3a68f76ed2eba763eb7bfb6648562; classtype:trojan-activity; sid:2018979; rev:2; metadata:created_at 2014_08_21, updated_at 2014_08_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6403 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kuluoz/Asprox Activity"; flow:established,to_server; content:"POST"; http_method; pcre:"/^\/(?:[A-Fa-f0-9]+|index\.php)$/U"; content:"|80 00 00 00|"; depth:4; http_client_body; content:!"Referer"; http_header; flowbits:set,ET.Kuluoz; reference:md5,a3e0f51356d48124fba25485d1871b28; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; reference:url,blog.fortinet.com/post/changes-in-the-asprox-botnet; classtype:trojan-activity; sid:2017895; rev:8; metadata:created_at 2013_12_23, updated_at 2013_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6404 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download 3"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"return |22|PROXY"; pcre:"/^[^\x3b]+\\x(?:[57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])/Ri"; reference:md5,6f2dc4ba05774f3e5ebf6c502db48a71; classtype:trojan-activity; sid:2019191; rev:13; metadata:created_at 2014_09_18, updated_at 2014_09_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6405 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download 2"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"|22|PROXY"; distance:0; pcre:"/^(?P<q>[\x22\x27])(?:(?!(?P=q))[^\r\n\x2c])+?(?P=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c/m"; reference:md5,6e4a990b1540fa6b5896034b976ccecf; classtype:trojan-activity; sid:2019190; rev:14; metadata:created_at 2014_09_18, updated_at 2014_09_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6407 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings Checkin"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"cs="; http_client_body; content:"&p="; http_client_body; content:"&m="; http_client_body; reference:md5,ae9899722707fc2c9716138580787026; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019197; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6408 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings Data Exfiltration"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"cs="; http_client_body; content:"&m="; http_client_body; content:"&ls="; http_client_body; reference:md5,4196c67648003a18f61573a77b6d3be6; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019198; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6409 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN NewPosThings POST with Fake UA and Accept Header"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/4.0(compatible|3b| MSIE 7.0b|3b| Windows NT 6.0)"; fast_pattern:7,20; http_header; content:"Accept|3a 20 3f 2a 0d 0a|"; depth:12; http_header; reference:md5,ae9899722707fc2c9716138580787026; reference:url,arbornetworks.com/asert/2014/09/lets-talk-about-newposthings/; classtype:trojan-activity; sid:2019199; rev:2; metadata:created_at 2014_09_19, updated_at 2014_09_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6410 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Georgian Targeted Attack - Trojan Checkin"; flow:established,to_server; content:"/index312.php?ver="; http_uri; content:"&cam="; http_uri; content:"&p=spy"; http_uri; content:"&id="; http_uri; reference:md5,d4af87ba30c59d816673df165511e466; reference:url,dea.gov.ge/uploads/CERT%20DOCS/Cyber%20Espionage.pdf; classtype:trojan-activity; sid:2015850; rev:3; metadata:created_at 2012_10_31, updated_at 2012_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6421 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/ppp/ta.php"; http_uri; fast_pattern:only; pcre:"/Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/H"; reference:md5,ca15e5e96aee8b18ca6f3c185a690cea; classtype:trojan-activity; sid:2018183; rev:4; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6446 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request"; flow:established,to_server; content:"2p/"; http_uri; content:".exe"; fast_pattern; http_uri; pcre:"/\/p?2p\/[0-9]{1,2}\.exe$/U"; reference:md5,ca15e5e96aee8b18ca6f3c185a690cea; classtype:trojan-activity; sid:2018184; rev:5; metadata:created_at 2014_02_26, updated_at 2014_02_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6447 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon 10/4/2014"; flow:established,to_server; content:"POST"; http_method; content:"/ccc/tab.php"; http_uri; fast_pattern:only; pcre:"/Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/H"; reference:md5,94d5d99b910f9184573a01873fdc42fc; classtype:trojan-activity; sid:2018384; rev:3; metadata:created_at 2014_04_11, updated_at 2014_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6449 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zeus.Downloader Campaign Second Stage Executable Request 10/4/2014"; flow:established,to_server; urilen:<11; content:"/2p/"; http_uri; content:".exe"; fast_pattern; http_uri; pcre:"/^\x2F2p\x2F[a-z]{1,2}\.exe$/U"; reference:md5,94d5d99b910f9184573a01873fdc42fc; classtype:trojan-activity; sid:2018385; rev:3; metadata:created_at 2014_04_11, updated_at 2014_04_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6450 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/BillGates Checkin"; flow:established,to_server; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 f4 01 00 00 32 00 00 00 e8 03|"; distance:0; content:"|01 01 02 00 00 00 01 00 00 00|"; distance:0; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:trojan-activity; sid:2019207; rev:1; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6461 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Linux/BillGates Checkin Response"; flow:established,from_server; dsize:20; content:"|08 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 e8 fd 00 00|"; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:trojan-activity; sid:2019208; rev:1; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6462 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/AES.DDoS Sending Real/Fake CPU&BW Info"; flow:established,to_server; content:"INFO|3a|"; depth:5; pcre:"/^\d/R"; content:"|25 7c|"; distance:0; threshold: type both, count 1, seconds 30, track by_src; reference:md5,d8059b555dde05e184c0b16bbff523f1; classtype:trojan-activity; sid:2019177; rev:3; metadata:created_at 2014_09_15, updated_at 2014_09_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6463 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 3"; flow:to_server,established; content:"|33 33|"; offset:2; depth:2; content:!"|33 33|"; within:2; content:"|33 33|"; distance:2; within:2; content:!"|33 33|"; within:2; content:"|33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33|"; pcre:"/[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33/R"; reference:md5,c150f9738142278e2d39417a7ef53cae; classtype:trojan-activity; sid:2019203; rev:2; metadata:created_at 2014_09_22, updated_at 2014_09_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6465 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/Yangji.A Checkin"; flow:established,to_server; dsize:1024; content:"cngameanti|7c|"; depth:11; pcre:"/^\x2d?\d/R"; reference:md5,b5badeb16414cba66999742601c092b8; classtype:trojan-activity; sid:2019229; rev:1; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6467 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [443,$HTTP_PORTS] (msg:"ET TROJAN Pushdo v3 Checkin"; flow:established,to_server; dsize:20; content:"|02 00 00 00|"; depth:4; reference:md5,776d6c20a7016cb0f0db354785fe0d71; classtype:trojan-activity; sid:2019235; rev:1; metadata:created_at 2014_09_24, updated_at 2014_09_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6469 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Kuluoz/Asprox CnC Response"; flow:from_server,established; flowbits:isset,ET.Kuluoz; content:"|0d 0a 0d 0a|"; content:"|0d 0a 80 00 00 00|"; distance:2; within:6; reference:md5,a3e0f51356d48124fba25485d1871b28; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; reference:url,blog.fortinet.com/post/changes-in-the-asprox-botnet; classtype:trojan-activity; sid:2019187; rev:5; metadata:created_at 2014_09_17, updated_at 2014_09_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6470 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BlackEnergy v2 POST Request"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"id="; http_client_body; content:"&bid="; http_client_body; content:"&dv="; http_client_body; content:"&dpv="; http_client_body; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:url,f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf; reference:md5,948cd0bf83a670c05401c8b67d2eb310; classtype:trojan-activity; sid:2019281; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6473 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN BlackEnergy POST Request"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"id="; depth:3; http_client_body; content:"&bid="; distance:0; http_client_body; fast_pattern; content:"&t="; distance:0; http_client_body; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:url,f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf; reference:md5,72372ffac0ee73dc8b6d237878e119c1; classtype:trojan-activity; sid:2019283; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6474 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Infostealer.Boleteiro checking stolen boleto payment information"; flow:to_server,established; content:"Vencimento="; fast_pattern:only; http_uri; content:"&Valor="; http_uri; content:"&Sacado="; http_uri; content:"&URL="; http_uri; content:"&Browser=Chrome"; http_uri; reference:md5,3cffb955c08f6c1546bfeae37a215787; reference:url,symantec.com/security_response/writeup.jsp?docid=2014-091718-2034-99&tabid=2; classtype:trojan-activity; sid:2019243; rev:4; metadata:created_at 2014_09_25, updated_at 2014_09_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6475 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 1"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb 2d 8e ea 67 c4 08 ea|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,edaaaa6527a6f42c96f27ce2e427cd39; classtype:trojan-activity; sid:2019305; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6477 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 2"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8b 77 b3 d1 92 8c 7d 48|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,edaaaa6527a6f42c96f27ce2e427cd39; classtype:trojan-activity; sid:2019306; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6478 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Dyre SSL Cert 3"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9b f5 c0 6b 03 3a 00 3f|"; distance:0; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,510b4db9aa400583e7927afa5f956179; classtype:trojan-activity; sid:2019307; rev:3; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_09_29, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6479 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Windows netstat Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Active Connections|0d|"; content:"Proto"; content:"Local Address"; content:"Foreign Address"; content:"State"; distance:0; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019003; rev:2; metadata:created_at 2014_08_25, updated_at 2014_08_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6486 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Cryptolocker Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:11; content:"/random.php"; http_uri; fast_pattern:only; content:!"Accept|3a|"; http_header; content:!"Referer|3a|"; http_header; content:"Mozilla/5."; http_user_agent; pcre:"/^\d{2,7}$/RV"; reference:md5,01be3fc3243d582d9f93d01401c4f95e; classtype:trojan-activity; sid:2019353; rev:3; metadata:created_at 2014_10_03, updated_at 2014_10_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6487 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN SpyClicker.ClickFraud Query Instructions CnC Response"; flow:established,to_client; content:"|0D 0A 0D 0A|{|22|query|22 3A|"; content:"|22|tasks|22 3A|"; distance:0; content:"|22|referer|22 3A|"; distance:0; content:"|22|useragent|22 3A|"; distance:0; content:"|22|clickurl|22 3A|"; distance:0; reference:url,stopmalvertising.com/malware-reports/anatomy-of-a-net-click-fraud-bot.html; reference:md5,17b077840ab874a8370c98c840b6c671; classtype:trojan-activity; sid:2019357; rev:2; metadata:created_at 2014_10_06, updated_at 2014_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6489 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/SpyClicker.ClickFraud CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/feed.dll?pub_id="; http_uri; fast_pattern:only; content:"&ua="; offset:17; http_uri; content:!"User-Agent|3A|"; http_header; content:!"Accept"; http_header; content:!"Referer|3A|"; http_header; reference:url,stopmalvertising.com/malware-reports/anatomy-of-a-net-click-fraud-bot.html; reference:md5,17b077840ab874a8370c98c840b6c671; classtype:trojan-activity; sid:2019355; rev:3; metadata:created_at 2014_10_06, updated_at 2014_10_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6492 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32.Virut.A joining an IRC Channel"; flow:established,to_server; content:"JOIN &virtu"; depth:27; reference:md5,06b522eacdfe51bed5d041fd672e880f; reference:url,doc.emergingthreats.net/2003603; classtype:trojan-activity; sid:2003603; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6493 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/PSW.Papras.CK file upload"; flow:established,to_server; content:"POST"; http_method; content:"name|3d 22|upload_file|22 3b 20|filename|3d 22|"; fast_pattern:6,20; http_client_body; pcre:"/^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+/U"; reference:md5,5e7cbe7e62a6c5de45092ad0c4852d1a; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019379; rev:3; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6497 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gozi/Ursnif/Papras Connectivity Check"; flow:established,to_server; content:"GET"; http_method; urilen:13; content:"/usdeclar.txt"; http_uri; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,5f3530edbe1fce44e05ad0c96e54efb4; reference:md5,279fc5e6181d58f883a15d5089ce541b; reference:url,krebsonsecurity.com/2013/01/three-men-charged-in-connection-with-gozi-trojan/; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019380; rev:4; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6498 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Ursnif Connectivity Check"; flow:established,to_server; content:"GET"; http_method; urilen:21; content:"/proto/netstrings.txt"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,9134651a7c642798414d867874bdfe2f; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019381; rev:3; metadata:created_at 2014_10_09, updated_at 2014_10_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6499 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN TorrentLocker DNS Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|server4love|02|ru|00|"; nocase; fast_pattern:only; reference:md5,8d2e901583b60631dc333d4b396e158b; classtype:trojan-activity; sid:2019396; rev:2; metadata:created_at 2014_10_14, updated_at 2014_10_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6503 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN FrameworkPOS Covert DNS CnC Beacon 1"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"dc"; nocase; distance:7; content:"|06|beacon"; nocase; offset:12; fast_pattern; pcre:"/^[\x0e-\x1e](?:[a-f0-9]{2}){1,3}(?:dc(?:[a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:trojan-activity; sid:2019454; rev:1; metadata:created_at 2014_10_16, updated_at 2014_10_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6506 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN FrameworkPOS Covert DNS CnC Beacon 2"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"dc978a97"; nocase; distance:6; content:"|05|alert"; nocase; offset:12; fast_pattern; pcre:"/^[\x08-\xFF](?:[a-f0-9]{2})*?dc978a97/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:trojan-activity; sid:2019455; rev:1; metadata:created_at 2014_10_16, updated_at 2014_10_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6507 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Zemot Requesting PE"; flow:established,to_server; content:"GET"; http_method; content:"/mod_jshoppi"; http_uri; fast_pattern:only; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/mod_jshoppi(?:-|ng|\/)/U"; reference:md5,b8e0b97c8e9faa6e5daa8f0cac845516; classtype:trojan-activity; sid:2019459; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6508 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex POST Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:>20; content:"Content-Type|3a 20|octet/binary|0d 0a|Accept|3a 20|*/*|0d 0a|"; http_header; fast_pattern:7,20; content:!"Referer|3a|"; http_header; content:!"Accept-Encoding|3a|"; http_header; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\nConnection\x3a[^\r\n]+?\r\nUser-Agent\x3a[^\r\n]+?\r\nContent-Type\x3a\x20octet\/binary\r\nAccept\x3a\x20\*\/\*\r\nAccept-Language\x3a[^\r\n]+?\r\nContent-Length\x3a\x20\d+?\r\n(?:\r\n)?$/H"; reference:md5,68459c32587e08d953d319ceb2d0888b; classtype:trojan-activity; sid:2019478; rev:2; metadata:created_at 2014_10_20, updated_at 2014_10_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6511 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex/Bugat/Feodo GET Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:>25; content:"Host|3a 20|"; depth:6; http_header; content:"Content-Type|3a 20|octet/binary|0d 0a|Accept|3a 20|*/*|0d 0a|"; http_header; fast_pattern:7,20; content:!"Referer|3a|"; http_header; content:!"Accept-Encoding|3a|"; http_header; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r\nConnection\x3a[^\r\n]+?\r\nUser-Agent\x3a[^\r\n]+?\r\nContent-Type\x3a\x20octet\/binary\r\nAccept\x3a\x20\*\/\*\r\nAccept-Language\x3a[^\r\n]+?\r\n(?:\r\n)?$/H"; reference:md5,2ddb6cb347eb7939545a1801c72f1f3f; classtype:trojan-activity; sid:2018772; rev:5; metadata:created_at 2014_07_24, updated_at 2014_07_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6512 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible IRCBot.DDOS Common Commands"; flow:established,to_client; content:"PRIVMSG "; depth:8; pcre:"/^[^\r\n]*?\x3a[^\r\n]*?(?:port(?:scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(?:\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)/Ri"; reference:md5,ef54080af1782dd29356032b7ff20849; classtype:trojan-activity; sid:2019471; rev:3; metadata:created_at 2014_10_20, updated_at 2014_10_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6513 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN vSkimmer.PoS Checkin"; flow:to_server,established; content:"/process.php?xy="; fast_pattern:only; http_uri; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,a99d5d1652dfcda190c3d412828dcf6d; reference:md5,82d9cab2692ae13fc5b835ea2cbb36d7; reference:url,anubis.iseclab.org/action=result&task_id=1b92f08cdbfb73e64450fd07ec88849b3; classtype:trojan-activity; sid:2018109; rev:4; metadata:created_at 2013_03_12, updated_at 2013_03_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6515 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/24x7Help.ScareWare CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/api/client.asmx/SendData"; http_uri; content:"User-Agent|3A| mFramework HTTPGet"; http_header; fast_pattern:12,18; content:"CFG="; http_client_body; depth:4; content:"&Lng="; http_client_body; distance:0; content:"&sinst="; http_client_body; distance:0; reference:md5,8d2dec745b9ac380beb2a0ea66427d06; classtype:trojan-activity; sid:2019498; rev:3; metadata:created_at 2014_10_23, updated_at 2014_10_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6516 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Wonton-JH Checkin"; flow:established,to_server; content:"POST"; http_method; content:".asp?M00="; http_uri; fast_pattern; content:"User-Agent|3a 20|Mozilla/4.0 (Compatible|3b| MSIE 6.0|3b 29 0d 0a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.asp\?M00=\d+$/U"; reference:url,blog.cylance.com/emerging-threat-alert-cve-2014-4114; reference:md5,37ca2ecb5e1fc89f73c6adc188ff685d; classtype:trojan-activity; sid:2019502; rev:2; metadata:created_at 2014_10_24, updated_at 2014_10_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6519 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN JST Perl IrcBot download"; flow:to_client,established; file_data; content:"JST Perl IrcBot"; fast_pattern:only; content:!"<html"; reference:url,pastebin.com/HK8riv9Q; reference:url,www.binarydefense.com/bds/active-shellshock-smtp-botnet-campaign/; reference:md5,77a6c50a06b59df0f3d099b1819a01d9; classtype:trojan-activity; sid:2019509; rev:2; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6523 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Siggen.Dropper CnC Beacon"; flow:established,to_server; content:".jpg?log="; fast_pattern:only; http_uri; content:"&ts="; offset:11; http_uri; content:"&act="; distance:0; http_uri; content:"client|3a 20|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,ee363de2168aab353c829434189350e4; classtype:trojan-activity; sid:2019515; rev:2; metadata:created_at 2014_10_27, updated_at 2014_10_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6524 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN OLDBAIT Checkin sptr"; flow:established,to_server; content:"/~"; http_uri; depth:2; content:"/cgi-bin/sptr.cgi?"; http_uri; content:"_"; http_uri; reference:md5,3983c859a217740bf9c5dd67a4647a9d; reference:md5,771bfe5d64138ef4e11e969b408ee0d7; reference:url,thegoldenmessenger.blogspot.de/2012/12/3-disclosure-of-another-0day-malware.html; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; classtype:trojan-activity; sid:2019535; rev:3; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6529 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN OLDBAIT Checkin 2 brvc"; flow:established,to_server; content:"/~"; http_uri; depth:2; content:"/cgi-bin/brvc.cgi?"; http_uri; content:"_"; http_uri; reference:md5,3983c859a217740bf9c5dd67a4647a9d; reference:md5,771bfe5d64138ef4e11e969b408ee0d7; reference:url,thegoldenmessenger.blogspot.de/2012/12/3-disclosure-of-another-0day-malware.html; reference:url,fireeye.com/resources/pdfs/apt28.pdf; classtype:trojan-activity; sid:2019536; rev:2; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6530 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Chopstick Checkin (APT28 Related)"; flow:to_server,established; content:"POST"; http_method; content:"/webhp?rel="; http_uri; fast_pattern; content:"ai="; http_uri; distance:0; pcre:"/^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+/URm"; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; reference:md5,6fc8602c8b3a18765bb6d2307d8a4ae1; classtype:trojan-activity; sid:2019537; rev:3; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6532 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Coreshell Checkin (APT28 Related)"; flow:to_server,established; content:"POST"; http_method; content:"/~xh/sn.cgi?"; http_uri; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$/RUm"; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; reference:md5,272f0fde35dbdfccbca1e33373b3570d; classtype:trojan-activity; sid:2019539; rev:4; metadata:created_at 2014_10_28, updated_at 2014_10_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6552 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|b6 8b ac d3 d7 e0 e7 36 f0 b5 63 65 1e 1a 31 ae|"; offset:16; depth:16; reference:md5,184a9d13616702154fb10ff9c5d67041; classtype:trojan-activity; sid:2019589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6557 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|01 ec 7e 05 1d 5f 65 ab db 1c df 93 99 cd 06 21|"; offset:16; depth:16; reference:md5,09d4c2f1f24fbdcb1c286b2f4c5589d2; classtype:trojan-activity; sid:2019590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6558 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|52 13 34 da 18 3d 2f 45 a2 09 93 52 01 23 51 e3|"; offset:16; depth:16; reference:md5,2b825e46ae60a9d15b5a731e57410425; classtype:trojan-activity; sid:2019592; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6559 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|3e 5c d1 68 e7 8c 47 8c ea 2f da 02 fe 43 62 47|"; offset:16; depth:16; reference:md5,afc4d73bde2a536d7a9b7596288ce180; classtype:trojan-activity; sid:2019593; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PoisonIvy, signature_severity Critical, created_at 2014_10_29, malware_family PoisonIvy, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6560 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 43"; flow:to_server,established; dsize:>11; content:"|83 7f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x83\x7f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5f0c10c1705783d3f32742bce3b2aea5; classtype:trojan-activity; sid:2019602; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2014_10_30, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6561 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Ropest.H CnC - INBOUND set"; flow:established,from_server; content:"|28 00 00 00 00 01 00 00|"; depth:8; flowbits:set,ET.Zberp; flowbits:noalert; metadata: former_category TROJAN; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:trojan-activity; sid:2025068; rev:1; metadata:created_at 2014_10_30, updated_at 2017_11_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6563 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Ropest.H CnC - INBOUND"; flow:established,from_server; flowbits:isset,ET.Zberp; dsize:24; content:"|10 00 00 00 00 01 00 00|"; depth:8; metadata: former_category TROJAN; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:trojan-activity; sid:2025069; rev:1; metadata:created_at 2014_10_30, updated_at 2017_11_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6564 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Tinba DGA NXDOMAIN Responses (2)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ru|00|"; distance:15; within:4; fast_pattern; content:"|0c|"; distance:-17; within:1; pcre:"/^[a-z]{12}/R"; threshold:type both, track by_src, count 50, seconds 10; reference:md5,5808cc73c78263a8114eb205f510f6a7; reference:url,blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/; classtype:trojan-activity; sid:2019609; rev:1; metadata:created_at 2014_10_31, updated_at 2014_10_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6567 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Variant.Strictor Dropper"; flow:established,to_server; content:"GET"; http_method; content:".php"; http_uri; content:"os="; http_uri; content:"&osbit="; http_uri; content:"&antiv="; http_uri; content:"Access"; depth:6; fast_pattern; http_user_agent; reference:md5,909b91071c60fc68c27789d912ccf68a; classtype:trojan-activity; sid:2018964; rev:6; metadata:created_at 2014_08_19, updated_at 2014_08_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6570 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backoff Variant Checkin"; flow:established,to_server; content:"GET"; http_method; content:".php?a=start&id="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/&id=[A-F0-9]+$/U"; reference:md5,d8e7983004c5545df6de868bc0c5a947; classtype:trojan-activity; sid:2019636; rev:2; metadata:created_at 2014_11_04, updated_at 2014_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6576 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> $EXTERNAL_NET any (msg:"ET TROJAN Shellshock Backdoor.Perl.Shellbot.F C2"; flow:to_server,established; content:"JOIN #shock 777"; content:"PRIVMSG #shock|20 3a|uid="; distance:0; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:trojan-activity; sid:2019637; rev:1; metadata:created_at 2014_11_04, updated_at 2014_11_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6577 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Shellshock Backdoor.Perl.Shellbot.F retrieval"; flow:to_client,established; file_data; content:"#you got shellshocked???"; depth:24; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:trojan-activity; sid:2019644; rev:2; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6580 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET TROJAN Bedep SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; content:"|0b|Company Ltd"; distance:1; within:12; fast_pattern; content:"|55 04 0b|"; content:"|06|office"; distance:1; within:7; reference:url,malware-traffic-analysis.net/2014/11/02/index.html; reference:md5,11837229f834d296342b205433e9bc48; classtype:trojan-activity; sid:2019645; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6581 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Bedep SSL Cert"; flow:established,from_server; content:"|09 00 c9 80 9a 85 50 97 cc 97|"; fast_pattern:only; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; content:"|0b|Company Ltd"; distance:1; within:12; content:"|55 04 0b|"; content:"|06|office"; distance:1; within:7; reference:url,malware-traffic-analysis.net/2014/11/02/index.html; reference:md5,11837229f834d296342b205433e9bc48; classtype:trojan-activity; sid:2019646; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_11_05, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6582 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.Banker.ABCG Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"act="; depth:4; http_client_body; content:"&atom="; distance:0; fast_pattern; http_client_body; content:"&id="; distance:0; http_client_body; content:"Mozilla/3.0 (compatible|3b| Indy Library)"; depth:38; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,acad4be4c587b9db9f39268cc4c0c192; reference:md5,b07a6a590c729fcd47ebce37fdd6c90b; classtype:trojan-activity; sid:2019653; rev:3; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6585 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.FakeMS Checkin"; flow:established,to_server; content:"POST"; http_method; urilen:5; content:!"Referer"; http_header; content:"|20|(64|20|=|20|"; http_client_body; content:")|20|EXE|20|=|20|"; distance:1; within:8; http_client_body; pcre:"/^\x5b[^\r\n]+$64\s=\s\d$\sEXE\s=/P"; reference:md5,e606e56a222f788ab5cbcf40842cbc39; reference:md5,099dc535bdd09d6a7bc4edabc8ded5de; classtype:trojan-activity; sid:2019654; rev:6; metadata:created_at 2014_11_05, updated_at 2014_11_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6586 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Infostealer.Banprox Proxy.pac Download"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"|22|PROXY"; distance:0; pcre:"/(?:www\.(?:(?:b(?:an(?:co(?:dobrasil|hsbc)|espa)|radesco(?:prime)?|b)|hsbc(?:pr(?:ivatebank|emier)|ba(?:merindus|nk))?|s(?:antander(?:banespa|net)?|erasa(?:experian)?)|uolhost)\.com\.br|c(?:(?:aixa(?:(?:economica(?:federal)?|qui)\.gov|\.(?:com|gov))|onsultasintegradas\.rs\.gov|ef\.(?:com|gov))\.br|redicard\.com(?:\.br)?)|itau(?:p(?:ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(?:ricanexpress\.com(?:\.br)?|x\.com\.br))|(?:(?:b(?:an(?:co(?:dobrasil|hsbc)|risul)|radesco(?:prime)?|b)|hsbc(?:pr(?:ivatebank|emier)|ba(?:merindus|nk))?|s(?:erasa(?:experian)?|antander)|uolhost)\.com|c(?:aixa(?:(?:economica(?:federal)?|qui)\.gov|\.(?:com|gov))|onsultasintegradas\.rs\.gov|ef\.(?:com|gov)|redicard\.com))\.br|itau(?:(?:p(?:ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(?:ricanexpress.com(?:\.br)?|x\.com\.br)|\*(?:linhadefensiva*|hsbc*))/"; reference:md5,3baae632d2476cbd3646c5e1b245d9be; reference:md5,ace343a70fbd26e79358db4c27de73db; classtype:trojan-activity; sid:2014435; rev:14; metadata:created_at 2012_02_28, updated_at 2012_02_28;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6588 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Smoke Loader Checkin r=gate"; flow:established,to_server; content:".php?r=gate&"; http_uri; content:"&group="; http_uri; distance:0; content:"&debug="; http_uri; distance:0; content:"5.0 (Windows|3b| U|3b| MSIE 9"; http_header; reference:md5,7ef1e61d9b394a972516cc453bf0ec06; classtype:trojan-activity; sid:2014728; rev:6; metadata:created_at 2012_05_09, updated_at 2012_05_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6589 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Archie EK Payload Checkin POST"; flow:established,to_server; content:"POST"; http_method; content:"integritylvl="; depth:13; http_client_body; content:"&osversion="; distance:0; http_client_body; content:"&iselevated="; distance:0; http_client_body; content:"&iever="; distance:0; http_client_body; content:"&isnet20inst="; http_client_body; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,41c0cdde6be5166606008b2d02f3a128; classtype:trojan-activity; sid:2019679; rev:3; metadata:created_at 2014_11_07, updated_at 2014_11_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6595 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"bB"; offset:2; depth:2; http_client_body; content:"MqrU"; within:20; http_client_body; content:"VAMU"; within:29; fast_pattern; http_client_body; content:!"Referer|3a|"; http_header; reference:md5,79d1c8c33062324388d3d563f193a43b; reference:md5,ee3c562151cc9181c6d87602bbf0a285; reference:md5,a42797315c50e335f3de87f6cea61b77; classtype:trojan-activity; sid:2019683; rev:6; metadata:created_at 2014_11_07, updated_at 2014_11_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6596 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Emotet DGA NXDOMAIN Responses"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|eu|00|"; distance:19; within:4; fast_pattern; content:"|10|"; distance:-21; within:1; pcre:"/^[a-z]{16}/R"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,3083b68cb5c2a345972a5f79e735c7b9; classtype:trojan-activity; sid:2019692; rev:1; metadata:created_at 2014_11_11, updated_at 2014_11_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6601 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Emotet CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"<email_accounts_list>"; http_client_body; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php$/U"; reference:md5,e24831e3f808116b30d85731c545e3ee; classtype:trojan-activity; sid:2019704; rev:2; metadata:created_at 2014_11_12, updated_at 2014_11_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6602 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Alureon Checkin"; flow:established,to_server; content:"POST"; http_method; content:"winver="; depth:7; http_client_body; content:"&ver="; distance:0; http_client_body; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^winver=\d+&ver=\d+$/P"; reference:md5,2155b7942ddc6d7a82e7d96a8c594501; classtype:trojan-activity; sid:2019717; rev:2; metadata:created_at 2014_11_17, updated_at 2014_11_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6616 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Rogue.Win32/FakePAV Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?0="; depth:4; http_uri; fast_pattern; content:"=i"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/\?0=(?:[^&]+?&\d+?=)+?[^=&]+?$/Ui"; reference:md5,6829306e92cfa811b12d9b028eb56a2d; classtype:trojan-activity; sid:2019767; rev:4; metadata:created_at 2014_11_21, updated_at 2014_11_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6628 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CoinVault POST M1"; flow:established,to_server; content:"POST"; http_method; urilen:1; content:"hwid="; depth:5; http_client_body; content:"&func="; http_client_body; fast_pattern:only; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^hwid=[A-F0-9]{4}(?:-[A-F0-9]{4}){7}&func=/P"; reference:url,securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/; reference:md5,8e1bdc1c484bc03880c67424d80e351d; classtype:trojan-activity; sid:2019776; rev:2; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6630 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CoinVault POST M2"; flow:established,to_server; content:"POST"; http_method; content:!"Referer"; http_header; content:"func=getemailurl"; http_client_body; reference:url,securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/; reference:md5,8e1bdc1c484bc03880c67424d80e351d; classtype:trojan-activity; sid:2019777; rev:2; metadata:created_at 2014_11_24, updated_at 2014_11_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6631 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Urausy.C Checkin 2"; flow:to_server,established; urilen:>80; content:"GET"; http_method; content:".html"; http_uri; fast_pattern:only; content:!"Referer|3a| "; http_header; content:!"Accept|3a| "; http_header; pcre:"/\/[A-Za-z0-9-_]{75,}\.html$/U"; content:"User-Agent|3a 20|Mozilla/5.0 (compatible|3b| MSIE "; depth:42; http_header; reference:md5,09462f13d7e6aaa0bff2788158343829; reference:md5,b18f80d665f340af91003226a2b974b6; reference:md5,1494b8b9f42753a4bc1762d8f3287db6; classtype:trojan-activity; sid:2016567; rev:6; metadata:created_at 2013_03_13, updated_at 2013_03_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6645 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Hyteod.Downloader CnC Beacon"; flow:established,to_server; content:"/payment_gateway/"; http_uri; content:".gz"; http_uri; content:"OperaMini"; depth:9; http_user_agent; pcre:"/^\x2Fpayment_gateway\x2F[a-z0-9]{3,}\x2Egz$/U"; reference:md5,8258c3d8bab63cacf143cf034e2e7c1a; classtype:trojan-activity; sid:2019824; rev:3; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6648 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Coinminer.Backdoor CnC Beacon"; flow:established,to_server; content:".php?id="; http_uri; content:"Mozzilla/4.0 (copmatible|3B|"; fast_pattern; http_user_agent; reference:md5,8e29a15caef546aab0f19a9a81732163; classtype:trojan-activity; sid:2019826; rev:4; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6649 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Wadolin.Downloader CnC Beacon"; flow:established,to_server; content:"/upgrade-functions.php?v="; fast_pattern; http_uri; content:"&id="; http_uri; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MSIE 6.1|3B| Windows XP)"; http_header; reference:md5,693c007d651bb5a8c6d2a4f5ed65a69c; classtype:trojan-activity; sid:2019827; rev:2; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6650 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/W32.KRBanker.60928.C Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/upload.php"; http_uri; content:"|0d 0a|Accept-Language|3a| zh-cn|0d 0a|"; http_header; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.0|29 0d 0a|"; http_header; content:"name=|22|upload_file1|22 3b 20|"; fast_pattern:only; http_client_body; content:".zip|22 0d 0a|"; http_client_body; content:"Content-Type|3a| application/x-zip-compressed|0d 0a|"; http_client_body; pcre:"/filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n/P"; reference:md5,ec5d7bc9d84551066fff51e36bc41d4d; reference:md5,13bd584bb12ee5dc15c35f5911912b09; classtype:trojan-activity; sid:2019828; rev:3; metadata:created_at 2014_12_01, updated_at 2014_12_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6651 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HompesA Activity"; flow:established,to_server; content:"/me/"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; pcre:"/^\/me\/(?:get(?:ref|ua)\.php|videos\.txt)$/U"; reference:md5,8cc58bc4d63f4b78b635d45aa69108f7; classtype:trojan-activity; sid:2019838; rev:2; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6654 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan/MSIL.bfsx Checkin"; flow:to_server,established; content:"/infect"; fast_pattern:only; http_uri; content:".php"; offset:7; http_uri; content:"User-Agent|3a 20|Microsoft|0d 0a|"; http_header; pcre:"/\/infect(?:-\d)?\.php$/U"; reference:md5,506cd65bdd06f41f8219cd1ed78eac7d; reference:md5,0c39b39ee4a59a8ac5fc1df500da2a88; classtype:trojan-activity; sid:2019840; rev:4; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6656 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Enchanim C2 Client Check-in"; flow:established,to_server; content:"some_magic_code1"; depth:16; reference:md5,2642999a085443e9055b292c4d405e64; reference:md5,37066ed52cd7510bf04808c332599f1c; reference:url,www.seculert.com/blog/2013/04/magic-persistent-threat.html; classtype:trojan-activity; sid:2016772; rev:2; metadata:created_at 2013_04_18, updated_at 2013_04_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6666 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET TROJAN W32/SCKeyLog.InfoStealer Installation Confirmation Via SMTP"; flow:established,to_server; content:"Subject|3A 20|Installation of SC-KeyLog on host"; nocase; reference:url,home.mcafee.com/VirusInfo/VirusProfile.aspx?key=910563; reference:md5,cc439073eeb244e6bcecee8b6774b672; classtype:trojan-activity; sid:2014354; rev:2; metadata:created_at 2012_03_09, updated_at 2012_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6708 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 20000: (msg:"ET TROJAN Sourtoff Download Simda Request"; flow:established,to_server; dsize:18; content:"|0a 10|"; depth:2; flowbits:set,ET.TROJAN.Sourtoff; flowbits:noalert; reference:md5,5469af0daa10f8acbe552cd2f1f6a6bb; classtype:trojan-activity; sid:2019312; rev:2; metadata:created_at 2014_09_29, updated_at 2014_09_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6715 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Destover RAT Check-in"; flow:established,to_server; content:"|17 03 01 00 0C E2 C4 Fd D9 E8 E3 F2 9F|"; reference:md5,d1c27ee7ce18675974edf42d4eea25c6; reference:url,www.symantec.com/connect/blogs/destover-destructive-malware-has-links-attacks-south-korea; classtype:trojan-activity; sid:2019878; rev:2; metadata:created_at 2014_12_05, updated_at 2014_12_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6716 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cc)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|cc|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019882; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6719 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.ws)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ws|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019883; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6720 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.to)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|to|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019884; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6721 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.in)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|in|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019885; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6722 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.hk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|hk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019886; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6723 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.cn)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ck|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019887; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6724 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.tk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|tk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019888; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6725 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp any 53 -> $HOME_NET any (msg:"ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.so)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|so|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019889; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6726 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vawtrak/NeverQuest Posting Data"; flow:established,to_server; content:"POST"; http_method; content:".php?i="; http_uri; content:"&data="; http_uri; distance:0; content:"&hash="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/&hash=[^&]+$/U"; flowbits:set,ET.Vawtrak; reference:md5,13c982c3b9c1ef714770820ffa278d2e; classtype:trojan-activity; sid:2019843; rev:3; metadata:created_at 2014_12_02, updated_at 2014_12_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6728 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Backdoor.Linux.Turla Download"; flow:from_server,established; flowbits:isset,ET.ELFDownload; content:"__we_are_happy__"; content:"__TREX__STOP__STRING__"; distance:0; content:"/dev/random"; distance:1; within:11; reference:url,securelist.com/blog/research/67962/the-penquin-turla-2/; reference:md5,19fbd8cbfb12482e8020a887d6427315; classtype:trojan-activity; sid:2019896; rev:2; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6729 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN VirRansom/VirLock Checkin"; flow:established,to_server; dsize:4; content:"|94 00 00 00|"; fast_pattern:only; flowbits:set,ET.VirLock; flowbits:noalert; reference:md5,fbeb6ebd498d85b1f404d7bb4acc3b89; classtype:trojan-activity; sid:2019901; rev:1; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6730 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN VirRansom/VirLock Checkin Response"; flow:established,from_server; dsize:4; content:"|74 01 00 00|"; fast_pattern:only; flowbits:isset,ET.VirLock; reference:md5,fbeb6ebd498d85b1f404d7bb4acc3b89; classtype:trojan-activity; sid:2019902; rev:1; metadata:created_at 2014_12_09, updated_at 2014_12_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6731 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (smartoptionsinc.com)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|05 11 32 08 1d 81|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0d|Synology Inc."; distance:1; within:14; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019923; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6741 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (ppc.cba.pl)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|11 00 81 3d 59 00 8d f2 04 04 8c 3a d3 d0 8e 36 d4 2a|"; distance:9; within:40; content:"|55 04 03|"; distance:0; content:"|06|cba.pl"; distance:1; within:7; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019924; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6742 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Dalexis.A Possible SSL Cert (cargol.cat)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e3 a7 5c ad 38 d2 d7 fe|"; distance:9; within:30; content:"|55 04 0a|"; distance:0; content:"|13|Tirabol Produccions"; distance:1; within:20; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019925; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2014_12_12, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6743 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN HawkEye Keylogger Report SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a| HawkEye Keylogger"; nocase; reference:md5,3bbd5ae250b2d912a701f8d74d85353b; classtype:trojan-activity; sid:2019926; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6744 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Beastdoor Keylogger Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a 20|Keylogger"; content:"Victim IP-"; reference:md5,ad99a0a85e1410559030464aac390969; classtype:trojan-activity; sid:2019927; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6745 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> any [139,445] (msg:"ET TROJAN Possible Net Crawler SMB Share Access unicode (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,!&,0x80,6,relative; content:"|00|_|00|A|00|u|00|t|00|o|00|S|00|h|00|a|00|r|00|e|00|$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019929; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6747 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp any any -> any [139,445] (msg:"ET TROJAN Possible Net Crawler SMB Share Access ascii (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,&,0x80,6,relative; content:"_AutoShare$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019930; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6748 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan.SpamBanker Report via SMTP"; flow:established,to_server; content:"From|3a|"; content:"Subject|3a 20|Keylogger"; fast_pattern:only; nocase; content:"X-Library|3a 20|Indy"; pcre:"/^Keylogger\r$/m"; reference:md5,9c1aac05bd3212a3abcd7cce9c6c4c77; classtype:trojan-activity; sid:2019931; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6749 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan/Win32.Espy Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"SUBJECT|3a| I Q - S P Y KeyLogger ["; content:"victim computer name"; reference:md5,1a9a06b11aa537734931f8098bae6b00; classtype:trojan-activity; sid:2019932; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6750 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Trojan/Downloader.Fosniw.sap Reporting via SMTP"; flow:established,to_server; content:"From|3a|"; content:"Subject|3a 20|keylogger(v0."; fast_pattern:only; nocase; content:"@UserName"; content:"@ComputerName"; reference:md5,e36469241764b8c954a700146ca4c43f; classtype:trojan-activity; sid:2019933; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6751 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS query for Known OphionLocker Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|smu743glzfrxsqcl"; fast_pattern; nocase; distance:0; reference:url,f-secure.com/weblog/archives/00002777.html; reference:md5,e17da8702b71dfb0ee94dbc9e22eed8d; classtype:trojan-activity; sid:2019934; rev:1; metadata:created_at 2014_12_12, updated_at 2014_12_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6752 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Infostealer.Bancos Sending Stolen info SMTP"; flow:to_server,established; content:"X-Library|3a| Indy"; content:"BIGFONE TOCOU"; fast_pattern:only; content:"Nome Comp"; metadata: former_category TROJAN; reference:md5,f71c41b816eadf221e188f6618798969; classtype:trojan-activity; sid:2019938; rev:1; metadata:tag Banking_Trojan, created_at 2014_12_15, malware_family Bancos, updated_at 2018_04_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6754 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 10001 (msg:"ET TROJAN Win32.Bumrat.B Checkin"; flow:established,to_server; dsize:19; content:"|0f 00 00 00|"; depth:4; content:"mconfig_10"; reference:md5,647edeb30a04eeb30b7f8921645c7369; classtype:trojan-activity; sid:2019941; rev:1; metadata:created_at 2014_12_15, updated_at 2014_12_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6755 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/TinyZBot Checkin (Operation Cleaver)"; flow:established,to_server; content:"POST"; http_method; content:"/checkupdate.asmx"; http_uri; fast_pattern:only; content:"SOAPAction|3a 20 22|http|3a|//tempuri.org/GetServerTime|22 0d 0a|"; http_header; content:"GetServerTime xmlns=|22|http|3a|//tempuri.org/"; http_client_body; content:!"|0d 0a|Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,68cfc418c72b58b770bdccf19805703e; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019942; rev:3; metadata:created_at 2014_12_15, updated_at 2014_12_15;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6756 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Agent.AIXD Checkin"; flow:to_server,established; content:"/cnc.php?id="; fast_pattern:only; http_uri; content:"&uid="; http_uri; content:"User-Agent|3a| AppleMac|0d 0a|"; http_header; reference:md5,801e450679e9d60f8c64675c432aab33; reference:md5,ad2e8210ca7c2b4b433b3fba65e87b94; reference:md5,f6ea10f719885fbcfb6743724faa94f7; classtype:trojan-activity; sid:2019945; rev:3; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6757 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon"; flow:established,to_server; content:"GET"; http_method; urilen:8; content:"/php.php"; fast_pattern; content:"User-Agent|3A| Mozilla/4.0 (compatible)"; pcre:"/^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/Hmi"; reference:md5,cb53a6e8d65d86076fc0c94dac62aa77; classtype:trojan-activity; sid:2019946; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6758 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/TRCrypt.ULPM Downloader CnC Beacon"; flow:established,to_server; content:".aspx?id="; http_uri; content:"&macaddress="; http_uri; content:"&pcname="; http_uri; content:"&username="; http_uri; content:"&osversion="; http_uri; content:"&versaoatual="; http_uri; fast_pattern; content:"&winkey="; http_uri; reference:md5,3b4f77eefd208f699e6a540878e753a8; classtype:trojan-activity; sid:2019947; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6759 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Symmi.46846 CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/notify.php"; http_uri; fast_pattern:only; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| MyApp)"; http_header; content:!"Referer|3A|"; http_header; reference:md5,fe5dc2a4ee8aa084c9da42cd2d1ded2e; classtype:trojan-activity; sid:2019948; rev:2; metadata:created_at 2014_12_16, updated_at 2014_12_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6760 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.Banker.AAXV Retrieving key from Pinterest"; flow:established,to_server; content:"GET"; http_method; content:"/pin/"; depth:5; http_uri; content:"User-Agent|3a 20|Internet Explorer 6.0|0d 0a|"; http_header; fast_pattern:15,20; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,f25a8e3f5265a57269590b84a506b672; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/malware-campaign-targets-south-korean-banks-uses-pinterest-as-cc-channel/; classtype:trojan-activity; sid:2019961; rev:3; metadata:created_at 2014_12_17, updated_at 2014_12_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6762 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET TROJAN Syrian.Slideshow Sending Information via SMTP"; flow:established,to_server; content:"Subject|3a 20|repo|0d 0a|"; content:"filename=|22|mxtd|22|"; reference:md5,f8bfb82aa92ea6a8e4e0b378781b3859; reference:url,citizenlab.org/2014/12/malware-attack-targeting-syrian-isis-critics; classtype:trojan-activity; sid:2019975; rev:1; metadata:created_at 2014_12_18, updated_at 2014_12_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6767 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tendrit CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:"/css.ashx?"; depth:10; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/css\.ashx\?[a-z]{2,}=(?:%[A-F0-9]{2})+&/I"; reference:md5,755dad1f37a9d3fae1352dbbc409102c; reference:url,pwc.blogs.com/cyber_security_updates/2014/12/festive-spearphishing-merry-christmas-from-an-apt-actor.html; classtype:trojan-activity; sid:2019985; rev:2; metadata:created_at 2014_12_22, updated_at 2014_12_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6771 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tendrit CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; content:"/favicon?"; depth:9; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/favicon\?[a-z]{2,}=(?:%[A-F0-9]{2})+&/I"; reference:md5,755dad1f37a9d3fae1352dbbc409102c; reference:url,pwc.blogs.com/cyber_security_updates/2014/12/festive-spearphishing-merry-christmas-from-an-apt-actor.html; classtype:trojan-activity; sid:2019986; rev:2; metadata:created_at 2014_12_22, updated_at 2014_12_22;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6772 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Nurjax Downloading PE"; flow:established,to_server; content:".exe?dummy="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\.exe\?dummy=\d+$/U"; reference:md5,6b7759565454fb7d02fb5bc638136f31; classtype:trojan-activity; sid:2020032; rev:2; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6808 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS query for known Anunak APT Domain (update-java.net)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|update-java|03|net|00|"; nocase; distance:0; fast_pattern; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; reference:md5,0ad4892ead67e65ec3dd4c978fce7d92; classtype:trojan-activity; sid:2020041; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6816 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex Post Check-in Activity"; flow:established,to_server; content:"POST "; depth:5; content:!"Referer|3a|"; content:"User-Agent|3a 20|Mozilla/5.0 (Windows NT 6.1|3b| Trident/7.0|3b| rv|3a|10.0) like Gecko|0d 0a|"; fast_pattern:53,20; content:"Connection|3a 20|Close|0d 0a|"; content:"HTTP/1.1|0d 0a|Host|3a 20|"; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r\n/R"; threshold:type limit,track by_src,count 1,seconds 60; reference:md5,ac6ea1e500de772341a2075a7d916d63; classtype:trojan-activity; sid:2020064; rev:2; metadata:created_at 2014_12_23, updated_at 2014_12_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6838 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Dropped by RIG EK"; flow:established,to_server; content:"/Prack"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|InetURL/1.0|0d 0a|"; http_header; reference:md5,18fa3ab45c6fa9da218dd4c35688c5f4; classtype:trojan-activity; sid:2020070; rev:3; metadata:created_at 2014_12_26, updated_at 2014_12_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6840 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Andromeda Checkin Dec 29 2014"; flow:established,to_server; content:"POST"; nocase; http_method; content:"EPF#"; depth:4; fast_pattern; http_client_body; content:"User-Agent|3a 20|Mozilla/4.0|0d 0a|"; http_header; content:!"Referer"; http_header; content:!"Accept"; http_header; content:"Connection|3a 20|close|0d 0a|"; reference:md5,7a1ad388bdcebcbc4cc48a2eff71775f; classtype:trojan-activity; sid:2020076; rev:2; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6842 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 9090 (msg:"ET TROJAN Win32.Akdoor Reporting MAC Address"; flow:to_server,established; dsize:20; content:"|01 00 00 00 0c 00 00 00|"; fast_pattern; pcre:"/^[0-9A-F]{12}$/R"; reference:md5,f5ba42117dd02f50b12542131dcd8b5f; classtype:trojan-activity; sid:2020081; rev:1; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6846 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Worm.Win32.Ngrbot.lof Join IRC channel"; flow:to_server,established; content:"NICK New|7B|"; nocase; pcre:"/^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,dd05fcd2368d8d410a5b85e8d504a435; classtype:trojan-activity; sid:2016849; rev:3; metadata:created_at 2013_05_14, updated_at 2013_05_14;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6848 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Steam Stealer"; flow:to_server,established; content:"GET"; http_method; content:"/uploads/images/201"; http_uri; fast_pattern:only; content:!"Referer|3a 20|"; http_header; content:!"Accept"; http_header; content:!"User-Agent|3a 20|"; http_header; pcre:"/\.png$/U"; reference:md5,5f50e810668942e8d694faeabab08260; reference:url,blog.0x3a.com/post/107195908164/analysis-of-steam-stealers-and-the-steam-stealer; classtype:trojan-activity; sid:2020095; rev:3; metadata:created_at 2015_01_05, updated_at 2015_01_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6851 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TinyLoader.A Checkin x86"; dsize:12; content:"|00 00 00 00 00 00 00 00 00 00 32 32|"; fast_pattern:only; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020150; rev:1; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6854 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN TinyLoader.A Checkin x64"; dsize:12; content:"|00 00 00 00 00 00 00 00 00 00 64 32|"; fast_pattern:only; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020151; rev:1; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6855 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 9000:10000 (msg:"ET TROJAN Win32/Recslurp.D C2 Request (no alert)"; flow:established,to_server; dsize:4; content:"|e8 03 00 00|"; fast_pattern:only; flowbits:set,ET.Reslurp.D.Client; flowbits:noalert; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:trojan-activity; sid:2020154; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6856 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET 9000:10000 -> $HOME_NET any (msg:"ET TROJAN Win32/Recslurp.D C2 Response"; flow:established,from_server; flowbits:isset,ET.Reslurp.D.Client; content:"|e8 03 00 00|"; depth:4; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:trojan-activity; sid:2020155; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6857 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Emotet.C Checkin"; flow:to_server,established; content:"POST"; http_method; urilen:1; content:"MASE|0d 0a|"; http_header; content:"name=|22|c1|22 0d 0a 0d 0a|c"; http_client_body; reference:md5,37d530ffa0bf1129f2db63b75fccce28; classtype:trojan-activity; sid:2020156; rev:7; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6858 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Emotet.C Variant Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/download.php?listfiles="; http_uri; content:"Content-Length|3a 20|0|0d 0a|"; http_header; content:!"User-Agent|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; content:!"|0d 0a|Accept"; http_header; reference:md5,cd74438c04b09baa5c32ad0e5a0306e7; classtype:trojan-activity; sid:2020157; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6859 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vawtrak/NeverQuest Posting Data"; flow:established,to_server; content:"POST"; http_method; content:"/0000"; offset:2; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$/Ui"; flowbits:set,ET.Vawtrak; metadata: former_category TROJAN; reference:md5,1a5ee37a6075b5a95faf8f07ad060cc9; classtype:trojan-activity; sid:2025087; rev:2; metadata:created_at 2015_01_08, updated_at 2017_11_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6861 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux/DDoS.M distributed via CVE-2014-6271 Checkin"; flow:established,to_server; content:"BUILD "; depth:6; pcre:"/^(?:MIPS(?:EL)?|POWERPC|ARM|X86)\x0a$/R"; flowbits:set,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; classtype:trojan-activity; sid:2019242; rev:2; metadata:created_at 2014_09_26, updated_at 2014_09_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6863 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M JUNK command"; flow:established,to_client ; content:"JUNK "; depth:5; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020162; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6864 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M GETLOCALIP command"; flow:established,to_client ; content:"GETLOCALIP "; depth:11; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020163; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6865 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M SCANNER command"; flow:established,to_client ; content:"SCANNER "; depth:8; pcre:"/^(?:ON|OFF)/R"; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020164; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6866 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M KILLATTK command"; flow:established,to_client ; content:"KILLATTK "; depth:9; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020165; rev:1; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6867 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET TROJAN Linux/DDoS.M LOLNOGTFO command"; flow:established,to_client ; content:"LOLNOGTFO "; depth:10; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020166; rev:2; metadata:created_at 2015_01_12, updated_at 2015_01_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6868 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Brontok User-Agent Detected (Rivest)"; flow:established,to_server; content:"User-Agent|3a| Rivest|0d 0a|"; http_header; nocase; reference:md5,c83b55ab56f3deb60858cb25d6ded8c4; classtype:trojan-activity; sid:2020179; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6875 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tinba Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:"/|20|HTTP/1.0|0d 0a|Host|3a 20|"; fast_pattern:only; content:"|0d 0a 0d 0a|"; content:!"|00 00 00 00|"; within:4; content:!"|FF FF FF FF|"; within:4; byte_extract:4,0,Tinba.Pivot,relative; byte_test:4,=,Tinba.Pivot,16,relative; byte_test:4,!=,Tinba.Pivot,4,relative; pcre:"/^Host\x3a[^\r\n]+?\r\nContent-Length\x3a\x20\d{2,}\r\n(?:\r\n)?$/H"; flowbits:set,ET.Tinba.Checkin; reference:md5,1e644fe146f62bd2fc585b8df6712ff6; classtype:trojan-activity; sid:2019168; rev:4; metadata:created_at 2014_09_12, updated_at 2014_09_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6880 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|qtrudrukmurps7tc"; nocase; distance:0; fast_pattern; reference:md5,35a7f70c5e0cd4814224c96e3c62fa42; classtype:trojan-activity; sid:2020206; rev:1; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6886 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET TROJAN Win32.ChinaZ.DDoSClient Checkin"; flow:established,to_server; content:"Windows "; depth:8; content:"|20|MHZ|00|"; fast_pattern; distance:0; content:"|00|Win"; distance:0; content:"|00|"; distance:2; within:2; reference:md5,8643a44febdf73159b2d5c437dc40cd3; classtype:trojan-activity; sid:2020209; rev:2; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6887 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tzsvejrzduo52siy"; nocase; distance:0; fast_pattern; reference:md5,49e988b04144b478e3f52b2abe8a5572; classtype:trojan-activity; sid:2020210; rev:1; metadata:created_at 2015_01_19, updated_at 2015_01_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6888 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor.Win32/PcClient.AA Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/2015"; http_uri; depth:5; fast_pattern; pcre:"/^\d+?\/(?:\d+?\/-?\d+?\.(?:php|jsp))?$/URi"; content:"Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.2|3b| .NET CLR 1.1.4322|3b| .NET CLR 2.0.50727|3b| InfoPath.1|29 0d 0a|"; http_header; reference:md5,33439543cae709aa7efa58f94e4b2a62; classtype:trojan-activity; sid:2019201; rev:11; metadata:created_at 2014_01_31, updated_at 2014_01_31;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6890 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 44"; flow:to_server,established; dsize:>11; content:"|96 71|"; offset:13; depth:2; byte_jump:4,-15,relative,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]{5}.{4}\x96\x71/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0a09c176351398922770153bdd54c594; classtype:trojan-activity; sid:2020214; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_01_20, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6895 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Nitol.A Checkin 2"; flow:from_client,established; dsize:260; content:"MB|00 00|"; content:"Windows|20|"; distance:0; content:"V1.0|00 00|"; offset:180; fast_pattern; reference:md5,b9096b87cf643c5f86789d995e9e773d; classtype:trojan-activity; sid:2020222; rev:1; metadata:created_at 2015_01_21, updated_at 2015_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6897 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN CryptoWall CryptoWall 3.0 Check-in"; flow:established,to_server; content:"POST"; http_method; content:"http|3a 2f 2f|proxy"; depth:12; http_raw_uri; fast_pattern; content:"i2p|0d 0a|"; http_header; content:!"|0d 0a|Accept-"; http_header; content:!"Referer|3a|"; http_header; reference:md5,3c53c9f7ab32a09de89bb44e5f91f9af; classtype:trojan-activity; sid:2020233; rev:2; metadata:created_at 2015_01_21, updated_at 2015_01_21;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6904 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Adrom.Backdoor CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:".php?page="; http_uri; content:"&enckey="; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\x26enckey\x3D[A-F0-9]+$/U"; reference:md5,c621055803c68e89f3cb141608fd0894; reference:md5,3c2be5202d2d68047c76bdf7e1dfc2be; classtype:trojan-activity; sid:2020293; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6953 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Scieron Retrieving Information Response"; flow:established,from_server; file_data; content:"system"; within:6; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$/R"; flowbits:isset,ET.Trojan.Scieron.Ret; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; reference:md5,a36db258d0f6f085e8e5030d8e9a9bf4; classtype:trojan-activity; sid:2020297; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6955 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Scieron-A UA (HTClient)"; flow:established,to_server; content:"User-Agent|3a 20|HTClient|3b|"; http_header; fast_pattern:12,9; reference:md5,15deb1167a383d20b4232503b2f22b24; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:trojan-activity; sid:2020298; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6956 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Scieron-A Checkin via HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a 20|HTClient|3b|"; http_header; fast_pattern:12,9; pcre:"/^\/\d+$/U"; content:!"Referer|3a 20|"; http_header; content:!"Accept"; http_header; reference:md5,15deb1167a383d20b4232503b2f22b24; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:trojan-activity; sid:2020299; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6957 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN W32/AGENT.NXNX Checkin 2"; flow:to_server,established; dsize:200; content:"D|3a 00 00 00|"; offset:7; depth:13; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$/"; reference:md5,fdcf0e3e3ad69cdd570387c4ce9aa8b3; reference:url,ahnlabasec.tistory.com/1007; reference:url,global.ahnlab.com/global/upload/download/asecreport/ASEC Report_Vol.58_Eng.pdf; classtype:trojan-activity; sid:2020303; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6958 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET 1025 -> $HOME_NET any (msg:"ET TROJAN Possible Mailer Dropped by Dyre SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02 41 55|"; distance:0; content:"|55 04 08|"; distance:0; pcre:"/^.{2}(?P<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(?P=var)/Rs"; reference:md5,dbcdaf617e19d2a35f763ac996cf8cd7; classtype:trojan-activity; sid:2020205; rev:4; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_01_19, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6960 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN KL-Remote / Cryp_Banker14 RAT connection"; flow:established,to_server; dsize:13; content:"|3c 7c|PRINCIPAL|7c 3e|"; fast_pattern:only; flowbits:set,ET.KLRemote; reference:md5,636edeba541483421e29b81b35f92841; reference:md5,c5763d0ef12dffa213d265596bd1acf9; reference:md5,5e01557b8650616e005a9949cbf5459a; classtype:trojan-activity; sid:2020315; rev:1; metadata:created_at 2015_01_27, updated_at 2015_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6966 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN KL-Remote / Cryp_Banker14 RAT response"; flow:established,from_server; dsize:6; content:"|3c 7c|OK|7c 3e|"; fast_pattern:only; flowbits:isset,ET.KLRemote; reference:md5,636edeba541483421e29b81b35f92841; reference:md5,c5763d0ef12dffa213d265596bd1acf9; reference:md5,5e01557b8650616e005a9949cbf5459a; classtype:trojan-activity; sid:2020316; rev:1; metadata:created_at 2015_01_27, updated_at 2015_01_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6967 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Mailer CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/action.php?action=get_"; http_uri; fast_pattern:only; content:"Send Mail"; depth:9; http_user_agent; content:!"Referer|3a|"; http_header; pcre:"/^\/action\.php\?action=get_(?:mails|red)$/U"; reference:md5,57e546330fd3a4658dff0e29cbb98214; classtype:trojan-activity; sid:2020330; rev:2; metadata:created_at 2015_01_29, updated_at 2015_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6969 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Unknown Mailer CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; content:"/action.php?action="; http_uri; fast_pattern:only; content:"&sent_all="; http_uri; content:"&sent_success="; distance:0; http_uri; content:"&active_connections="; distance:0; http_uri; content:"&queue_connections="; distance:0; http_uri; content:"Send Mail"; depth:9; http_user_agent; content:!"Referer|3a|"; http_header; reference:md5,57e546330fd3a4658dff0e29cbb98214; classtype:trojan-activity; sid:2020329; rev:3; metadata:created_at 2015_01_29, updated_at 2015_01_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6970 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/hello.php"; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a[^\r\n]+?\r\n(?:\r\n)?$/Hi"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020339; rev:2; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6977 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Checkin"; flow:to_server,established; content:"GET"; http_method; content:".php?admin="; fast_pattern:only; content:"&id="; http_uri; content:"&nat="; http_uri; content:"&os="; http_uri; content:"&video="; http_uri; content:"&arch_type="; http_uri; content:"&v="; http_uri; content:"&av_list="; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a[^\r\n]+?\r\n(?:\r\n)?$/Hi"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020340; rev:5; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6978 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN f0xy Download"; flow:to_server,established; content:"/bn_versions/"; http_uri; fast_pattern:only; content:".exe"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/\/bn_versions\/\d+?\.exe$/U"; reference:md5,160634d784c256d29563117554685c31; reference:url,community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx; classtype:trojan-activity; sid:2020341; rev:4; metadata:created_at 2015_01_30, updated_at 2015_01_30;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6979 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ArcDoor User-Agent (ALIZER)"; flow:established,to_server; content:"User-Agent|3a 20|ALIZER|0d 0a|"; http_header; reference:md5,71bae4762a6d2c446584f1ae991a8fbe; classtype:trojan-activity; sid:2020344; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6980 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN ArcDoor Intial Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:!"Accept"; http_header; content:"Content-Length|3a 20|28|0d 0a|"; fast_pattern:only; pcre:"/^[a-z0-9]{11}=\d{16}$/P"; reference:md5,71bae4762a6d2c446584f1ae991a8fbe; classtype:trojan-activity; sid:2020345; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6981 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dropper YABROD Downloading Files"; flow:from_client,established; urilen:11; content:"/Yabrod.pdf"; content:"User-Agent|3a 20|n1|0d 0a|"; fast_pattern:12,4; content:!"Referer|3a 20|"; http_header; content:!"|0d 0a|Accept"; http_header; reference:md5,44df02ac28d80deb45f5c7c48b56a858; reference:url,fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-behind-the-syria-conflict.pdf; classtype:trojan-activity; sid:2020346; rev:2; metadata:created_at 2015_02_02, updated_at 2015_02_02;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6982 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BePush/Kilim Checkin response"; flow:established,from_server; file_data; content:"Server_ok"; depth:9; flowbits:isset,ET.FB.troj; reference:url,seclists.org/fulldisclosure/2015/Jan/131; reference:md5,cdcc132fad2e819e7ab94e5e564e8968; classtype:trojan-activity; sid:2020349; rev:2; metadata:created_at 2015_02_03, updated_at 2015_02_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6983 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Win32/Critroni Tor DNS Proxy lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|23bteufi2kcqza2l"; distance:0; nocase; reference:md5,194a931aa49583191eedd19478396ebc; classtype:trojan-activity; sid:2019909; rev:3; metadata:created_at 2014_12_10, updated_at 2014_12_10;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6984 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Critroni Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|3fdzgtam4qk625n6"; nocase; distance:0; fast_pattern; reference:md5,adb0de790bd3fb88490a60f0dddd90fa; classtype:trojan-activity; sid:2020358; rev:1; metadata:created_at 2015_02_04, updated_at 2015_02_04;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6986 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 45"; flow:to_server,established; dsize:>11; content:"|7a 9a|"; offset:13; depth:2; byte_jump:4,0,little,from_beginning,post_offset -1; isdataat:!2,relative; pcre:"/^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,eb7909105fd05064b14a21465742952c; classtype:trojan-activity; sid:2020371; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_02_05, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6990 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Sakula/Mivast C2 Activity"; flow:established,to_server; content:"POST"; http_method; content:".asp?cstring="; http_uri; fast_pattern:only; content:"&tom="; http_uri; content:"&id="; distance:0; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"|00 00 00 00|"; depth:4; http_client_body; reference:md5,5acc539355258122f8cdc7f5c13368e1; classtype:trojan-activity; sid:2020378; rev:2; metadata:created_at 2015_02_06, updated_at 2015_02_06;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 6993 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Spy.KeyLogger.ODN Checkin"; flow:established,to_server; content:"GET"; http_method; urilen:19; content:"/newage.txt"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; reference:md5,4e83c405f35efd128ab8c324c12dbde9; classtype:trojan-activity; sid:2019467; rev:3; metadata:created_at 2014_10_17, updated_at 2014_10_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7008 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Rovnix.J Checkin 2"; flow:established,to_server; content:"[0]|0d 0a|LP="; http_client_body; content:"|0a|VID="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; content:"POST"; http_method; reference:md5,9471e926eda81b4f797b6cfe273e4e79; classtype:trojan-activity; sid:2020396; rev:2; metadata:created_at 2015_02_11, updated_at 2015_02_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7010 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN MSIL/Golroted.B Keylogger FTP"; flow:established,to_server; content:"STOR Logger_"; reference:md5,b2b82fd662dd0ddf53aa37bb9025bf92; classtype:trojan-activity; sid:2020411; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7011 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET TROJAN Predator Pain Keylogger FTP"; flow:established,to_server; content:"STOR Predator_Pain"; reference:md5,c9025c9835d1b7d6f0dd2390ea7d5e18; classtype:trojan-activity; sid:2020412; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7012 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Gulcrypt.B Downloading components - set"; flow:established,to_server; urilen:8; content:"GET"; http_method; content:"/manager"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; flowbits:set,ET.Gulcrypt; flowbits:noalert; reference:md5,6c41449d6c3efd4c9f98374a0d132ff6; classtype:trojan-activity; sid:2020420; rev:2; metadata:created_at 2015_02_13, updated_at 2015_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7014 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32/Gulcrypt.B Downloading components"; flow:established,from_server; flowbits:isset,ET.Gulcrypt; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,6c41449d6c3efd4c9f98374a0d132ff6; classtype:trojan-activity; sid:2020421; rev:2; metadata:created_at 2015_02_13, updated_at 2015_02_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7015 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex POST CnC Beacon 2"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:!"Referer|3A|"; http_header; content:"Host|3a 20|"; depth:6; http_header; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\r?$/RHmi"; content:"Content-Type|3a 20|text/css|0d 0a|Accept|3a 20|image/**|0d 0a|"; distance:0; http_header; fast_pattern:21,20; content:"|0d 0a 0d 0a|"; byte_extract:1,0,Dridex.Pivot,relative; byte_test:1,!=,Dridex.Pivot,0,relative; byte_test:1,=,Dridex.Pivot,7,relative; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:trojan-activity; sid:2020301; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7016 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Arid Viper APT Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"_rtemp.php?n="; http_uri; fast_pattern:only; content:"|0d 0a|REMOTE_USER|3a 20|"; http_header; content:!"Referer|3a|"; http_header; reference:md5,5efc02d416b15554b25d9acec362148e; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-arid-viper.pdf; classtype:trojan-activity; sid:2020436; rev:2; metadata:created_at 2015_02_16, updated_at 2015_02_16;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7037 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Chanitor Variant .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|ukzo73z4inzpenmq"; nocase; distance:0; fast_pattern; reference:md5,53752a41ed21172343f678423d6c9a44; classtype:trojan-activity; sid:2020458; rev:1; metadata:created_at 2015_02_17, updated_at 2015_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7039 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Dridex Post Checkin Activity 2"; flow:established,to_server; urilen:20<>100; content:!"Referer|3a|"; http_header; content:"|20|HTTP/1.1|0d 0a|Host|3a 20|"; pcre:"/^Host\x3a\x20(?=[a-z0-9]{0,19}[A-Z])(?=[A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H"; content:"|0d 0a|Connection|3a 20|Close|0d 0a|User-Agent|3a 20|Mozilla/"; http_header; within:41; fast_pattern:4,20; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:trojan-activity; sid:2020302; rev:6; metadata:created_at 2015_01_23, updated_at 2015_01_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7052 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Beaugrit.gen.AAAA"; flow:established,to_server; content:"GET"; http_method; content:"/attach/1759CB3B5124F217143044"; http_uri; fast_pattern:only; content:!"Referer|3a 20|"; http_header; reference:md5,fbfe6c2673aec9098e1fc9bf6d7fc059; classtype:trojan-activity; sid:2020479; rev:2; metadata:created_at 2015_02_19, updated_at 2015_02_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7053 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.NSIS.Comame.A Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/9.php?safe="; http_uri; fast_pattern:only; content:"User-Agent|3a 20|NSIS_Inetc (Mozilla|29 0d 0a|"; http_header; content:!"Referer|3a 20|"; http_header; reference:md5,6a15f19a3ccd05f74537464e6df64dab; classtype:trojan-activity; sid:2020480; rev:3; metadata:created_at 2015_02_19, updated_at 2015_02_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7054 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Carbanak APT CnC Beacon 1"; flow:established,to_server; dsize:24; content:"|08|"; depth:1; byte_extract:1,1,Carbanak.Pivot,relative; byte_test:1,!=,Carbanak.Pivot,0,relative; byte_test:1,=,Carbanak.Pivot,3,relative; content:"|00 00 00 02 00 00 00 00 00 00 00 00 00|"; distance:4; within:13; fast_pattern; content:!"|00 00 00|"; within:3; reference:md5,6ae1bb06d10f253116925371c8e3e74b; reference:url,securelist.com/files/2015/02/Carbanak_APT_eng.pdf; classtype:trojan-activity; sid:2020455; rev:2; metadata:created_at 2015_02_17, updated_at 2015_02_17;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7062 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/LockScreen CnC Beacon 2"; flow:established,to_server; content:"GET"; http_method; urilen:8; content:"/cou.php"; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"Host|3a|"; depth:5; http_header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:\r\n)?$/H"; reference:md5,046e4b3ff7b323f2147f2d5d43b7e5f4; reference:md5,e4ab12da8828a7f1e6c077a2999f8320; classtype:trojan-activity; sid:2020504; rev:2; metadata:created_at 2015_02_23, updated_at 2015_02_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7063 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Sality.3 Checkin"; flow:to_server,established; content:"/?f"; http_uri; fast_pattern:only; content:!"User-Agent|3a| "; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; content:!"Cache-Control|3a 20|"; http_header; pcre:"/\/\?f$/U"; reference:md5,df9516919e75853742e63db318e7d346; classtype:trojan-activity; sid:2020505; rev:2; metadata:created_at 2015_02_23, updated_at 2015_02_23;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7064 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Athena DDoS Bot Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:!"Referer|3a|"; http_header; content:"a=%"; depth:3; http_client_body; fast_pattern; content:"&b="; distance:0; http_client_body; content:"&c="; distance:0; http_client_body; pcre:"/^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$/P"; reference:md5,19ca0d830cd7b44e5de1ab85f4e17d82; classtype:trojan-activity; sid:2017633; rev:4; metadata:created_at 2013_04_26, updated_at 2013_04_26;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7067 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $EXTERNAL_NET any -> $HOME_NET !1433 (msg:"ET TROJAN Unknown Trojan Downloading PE via MSSQL Connection to Non-Standard Port"; flow:from_server,established; flowbits:isset,ET.MSSQL; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,754b48c57a00b7c9f0e0640166ac7bb5; classtype:trojan-activity; sid:2020569; rev:1; metadata:created_at 2015_02_25, updated_at 2015_02_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7068 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Chanitor .onion Proxy Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|brk7tda32wtkxjpa"; nocase; distance:0; fast_pattern; reference:md5,34ad24860495397c994f8ae168d0e639; classtype:trojan-activity; sid:2020581; rev:1; metadata:created_at 2015_02_27, updated_at 2015_02_27;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7069 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 46"; flow:to_server,established; dsize:>11; content:"|84 60|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x84\x60/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,019ab136fd79147b10ddb3e4162709db; classtype:trojan-activity; sid:2020586; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_03, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7071 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Xunpf.A Retrieving DLL"; flow:established,to_server; content:"GET"; http_method; content:"/web_"; http_uri; fast_pattern:only; content:".jpg"; http_uri; content:!"Referer|3a|"; http_header; pcre:"/\/web_[0-9A-F]{12}\.jpg$/U"; reference:md5,dfb7dd8b6975b73dc9c731319a05f86d; classtype:trojan-activity; sid:2020601; rev:2; metadata:created_at 2015_03_03, updated_at 2015_03_03;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7072 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Andromeda Downloading Module"; flow:to_server,established; content:"GET"; http_method; content:".pack"; nocase; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\.pack$/Ui"; content:"Mozilla"; http_header; pcre:"/^User-Agent\x3a\x20Mozilla(?:\/4\.0)?\r?$/Hmi"; reference:md5,65125129418e07ce1000aa677b66b72f; classtype:trojan-activity; sid:2018604; rev:5; metadata:created_at 2014_06_24, updated_at 2014_06_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7074 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 55"; flow:to_server,established; dsize:>11; content:"|39 dd|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x39\xdd/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5f42a5b709bf9a1377d2464f936fc841; classtype:trojan-activity; sid:2020614; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7075 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 47"; flow:to_server,established; dsize:>11; content:"|79 9f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\x9f/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5ad0bb62806297fb8bf159d94f82dbb9; classtype:trojan-activity; sid:2020606; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7076 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 48"; flow:to_server,established; dsize:>11; content:"|da 41|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\xda\x41/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,69ffa441a8c3cf4d8fe643174bebb51d; classtype:trojan-activity; sid:2020607; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7077 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 49"; flow:to_server,established; dsize:>11; content:"|79 dd|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x79\xdd/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,2e99b9462f95154e9f5b94eeed33a6e3; classtype:trojan-activity; sid:2020608; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7078 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 50"; flow:to_server,established; dsize:>11; content:"|7b 9d|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9d/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,1701f8c71b5861a2f2890dc609ef6eda; classtype:trojan-activity; sid:2020609; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7079 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 51"; flow:to_server,established; dsize:>11; content:"|7a 9c|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7a\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,4b70f302c72c94d0b9214808d9f72419; classtype:trojan-activity; sid:2020610; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7080 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 53"; flow:to_server,established; dsize:>11; content:"|70 9c|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x9c/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,5a0e030383c472f7d94c0bcd6af71a90; classtype:trojan-activity; sid:2020612; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7081 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 54"; flow:to_server,established; dsize:>11; content:"|70 9e|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x9e/s"; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,4d6e0de81f57461337ccfbcce6dc1056; classtype:trojan-activity; sid:2020613; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_04, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7082 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Emotet Checkin"; flow:established,to_server; content:"POST"; http_method; content:!"Accept-"; http_header; content:!"Referer|3a|"; http_header; content:"/"; offset:1; http_uri; content:"/"; distance:0; http_uri; content:"MSIE 7.0|3b|"; http_user_agent; fast_pattern; content:"Windows NT 6.0"; within:15; http_user_agent; pcre:"/^\/[A-Za-z0-9]+\/[A-Za-z0-9]+\/$/U"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; reference:md5,3083b68cb5c2a345972a5f79e735c7b9; classtype:trojan-activity; sid:2019693; rev:5; metadata:created_at 2014_11_11, updated_at 2014_11_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7086 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.Bayrob Keepalive"; flow:established,to_server; content:"GET"; http_method; urilen:9; content:"/isup.php"; http_uri; fast_pattern:only; content:"Accept-Encoding|3a 20 20 20 20 20 20 20 20 20 20 20 20 20|"; http_raw_header; content:!"Referer|3a|"; http_header; reference:md5,a4a3fab712b04ee901f491d4c704b138; classtype:trojan-activity; sid:2020621; rev:3; metadata:created_at 2015_03_05, updated_at 2015_03_05;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7087 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Trapwot FakeAV Post Infection CnC Beacon"; flow:established,to_server; content:"/rp?"; http_uri; fast_pattern:only; content:"v="; http_uri; content:"a="; http_uri; content:"u="; http_uri; content:"d="; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^\/(?:[^\x2f]+\/)?rp\?[a-z]=/U"; reference:md5,fc962cb08f62e3d6368500a8e747cf73; classtype:trojan-activity; sid:2020645; rev:2; metadata:created_at 2015_03_09, updated_at 2015_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7089 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Onkods.A Downloader Checkin"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; fast_pattern:only; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|"; depth:12; http_header; pcre:"/^User-Agent\x3a\x20(?=\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(?:\r\n)?$/H"; pcre:"/^\/(?:[a-z]+\/)*?[a-z]+\.exe$/U"; reference:md5,fb570e6d68e708daeceae5dfc544fba2; classtype:trojan-activity; sid:2018121; rev:4; metadata:created_at 2014_02_12, updated_at 2014_02_12;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7091 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Zbot POST Request to C2"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"HTTP/1."; content:"|0D 0A|Accept|3a| */*|0D 0A|User-Agent|3a| Mozilla"; distance:1; within:34; fast_pattern; content:!"Accept-"; http_header; content:!"Content-Type|3a|"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^Accept\x3a \*\/\*\r\nUser-Agent\x3a[^\r\n]+?\r\nHost\x3a[^\r\n]+?\r\nContent-Length\x3a[^\r\n]+?\r\n(?:Proxy-)?Connection\x3a[^\r\n]+?\r\n(?:Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(?:\r\n)?$/H"; reference:md5,c86f7ec18b78055a431f7cd1dca65b82; classtype:trojan-activity; sid:2019141; rev:3; metadata:created_at 2014_09_08, updated_at 2014_09_08;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7092 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN Cryptolocker .onion Proxy Domain (juf5pjk4sl7uojh4)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|juf5pjk4sl7uojh4"; fast_pattern; distance:0; nocase; reference:md5,499a46c23afe23de49346adf1b4f3a4f; reference:url,www.mogozobo.com/?p=2371; classtype:trojan-activity; sid:2020670; rev:1; metadata:created_at 2015_03_11, updated_at 2015_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7101 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Gamarue/Andromeda Downloading Payload"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0|0d 0a|"; fast_pattern:5,20; http_header; pcre:"/^\/[a-z]+\/[a-z]+\.exe$/U"; reference:md5,85d925a76909f29c3f370f35faedb9ea; classtype:trojan-activity; sid:2020683; rev:2; metadata:created_at 2015_03_11, updated_at 2015_03_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7102 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Trapwot FakeAV Checkin"; flow:established,to_server; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"v="; http_uri; content:"a="; http_uri; content:"u="; http_uri; content:"i=0"; http_uri; fast_pattern:only; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; pcre:"/^\/(?:[a-z]+\/)?[a-z_]+\?[a-z]=/U"; reference:md5,baf71ace207afd3f330c4aba3784e074; classtype:trojan-activity; sid:2020646; rev:4; metadata:created_at 2015_03_09, updated_at 2015_03_09;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7103 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Vicepass CnC Beacon"; flow:established,to_server; content:"GET"; http_method; content:"/index.php?data="; depth:16; http_uri; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; content:"Host|3a|"; depth:5; http_header; pcre:"/^Host\x3a[^\r\n]+\r\n(?:\r\n)?$/Hmi"; reference:md5,5f1997927e94b98982e5ee2cea095956; classtype:trojan-activity; sid:2020690; rev:2; metadata:created_at 2015_03_13, updated_at 2015_03_13;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7110 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 56"; flow:to_server,established; dsize:>11; content:"|2e 96|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x2e\x96/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0fc4f20426ab1da2c705a4523d3baa0b; classtype:trojan-activity; sid:2020691; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7111 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 57"; flow:to_server,established; dsize:>11; content:"|7b 9f|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x7b\x9f/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/PcClient.ZR&ThreatID=-2147325231; reference:md5,06be359c6e6396fe105e8b59ac5a992e; classtype:trojan-activity; sid:2020692; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7112 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 58"; flow:to_server,established; dsize:>11; content:"|31 ad|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x31\xad/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,20a72c5af06e054ff840915b6632965f; classtype:trojan-activity; sid:2020693; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7113 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 59"; flow:to_server,established; dsize:>11; content:"|44 df|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x44\xdf/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,6a263de8d3f6d82e73330c84a83057bf; classtype:trojan-activity; sid:2020694; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7114 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 60"; flow:to_server,established; dsize:>11; content:"|70 94|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x70\x94/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0fbca8d9f71265f44513e4f885587301; classtype:trojan-activity; sid:2020695; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7115 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 61"; flow:to_server,established; dsize:>11; content:"|3f a6|"; offset:8; byte_jump:4,-10,relative,little,from_beginning, post_offset -1; isdataat:!2,relative; pcre:"/^[\x20-\x7e]+?.{8}\x3f\xa6/s"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32/PcClient.ZR&ThreatID=-2147325231; reference:md5,0045ce5ce7d697ecc86f1e44398bf404; classtype:trojan-activity; sid:2020696; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag PCRAT, tag Gh0st, tag RAT, signature_severity Critical, created_at 2015_03_13, malware_family Gh0st, malware_family PCRAT, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7116 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Tinba Checkin 3"; flow:established,to_server; content:"POST"; http_method; content:"Content-Length|3a 20|13|0d 0a|"; http_header; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"|00 04 00 00 00|"; offset:4; depth:5; http_client_body; content:!"|00 00 00 00|"; depth:4; http_client_body; reference:md5,e610d3c383a4f1c8a27aaf018b12c370; classtype:trojan-activity; sid:2020568; rev:4; metadata:created_at 2015_02_25, updated_at 2015_02_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7117 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FakeAV Variant CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php?id="; http_uri; fast_pattern:only; content:!"User-Agent|3a|"; http_header; content:!"Accept"; http_header; content:!"Content-T"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\.php\?id=\d+$/U"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P"; reference:md5,693ca229558aab99e0a9d3385cacc40c; classtype:trojan-activity; sid:2020706; rev:2; metadata:created_at 2015_03_18, updated_at 2015_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7125 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Agent.WMN CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|User-Agent"; depth:59; http_header; fast_pattern:31,20; content:"="; offset:4; depth:9; http_client_body; content:"=&"; distance:55; within:2; http_client_body; pcre:"/^[a-z]{4,12}=(?:[A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}/P"; reference:md5,3031604f1cf95ee4ccc339c9e4d5b92f; classtype:trojan-activity; sid:2020708; rev:2; metadata:created_at 2015_03_18, updated_at 2015_03_18;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7126 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN RocketKitten APT Checkin"; flow:to_server,established; content:"/index.php?c="; http_uri; content:"&r="; http_uri; distance:0; content:"User-Agent|3a 20|Mozilla/5.0|0d 0a|"; fast_pattern:5,20; http_header; content:!"Referer|3a 20|"; http_header; reference:url,isc.sans.edu/forums/diary/Rocket+Kitten+Is+it+still+APT+if+you+can+buy+it+off+the+shelf/19123; reference:md5,f89a4d4ae5cca6d69a5256c96111e707; classtype:trojan-activity; sid:2020078; rev:3; metadata:created_at 2015_12_29, updated_at 2015_12_29;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7127 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M2"; flow:established,to_server; content:"GET"; http_method; content:".php?U3ViamVjdD1"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; reference:md5,c075fa8484d52c3978826c2f07ce9a9c; classtype:trojan-activity; sid:2020718; rev:3; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7129 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN FindPOS Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"oprat="; http_client_body; fast_pattern:only; content:"&uid="; http_client_body; content:"&uinfo="; http_client_body; content:"&win="; http_client_body; content:"&vers="; http_client_body; reference:md5,fe0f997d81d88bc11cc03e4d1fd61ebe; classtype:trojan-activity; sid:2020723; rev:3; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7130 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN KeyLogger related to FindPOS CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; content:"uid="; depth:4; http_client_body; content:"&win="; distance:0; http_client_body; content:"&vers="; distance:0; http_client_body; content:!"Referer|3a|"; http_header; reference:md5,593af622a90f2038e35ee980e09c1c3c; reference:url,researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-family-discovered/; reference:url,blogs.cisco.com/security/talos/poseidon; classtype:trojan-activity; sid:2020724; rev:2; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7131 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Possible Adwind SSL Cert (assylias.Inc)"; flow:established,from_server; content:"|0b|"; content:"|04 1f 23 9d bd|"; distance:18; within:20; content:"|55 04 0a|"; distance:0; content:"|0c|assylias.Inc"; distance:1; within:13; fast_pattern; reference:md5,4e5c28fab23b35dea2d48a1c2db32b56; classtype:trojan-activity; sid:2020728; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag SSL_Malicious_Cert, signature_severity Major, created_at 2015_03_23, updated_at 2016_07_01;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7133 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Linux.DDoS Checkin"; flow:established,to_server; dsize:1024; content:"VERSONEX|3a|"; depth:9; content:"|7c|Hacker|00 00 00|"; distance:0; reference:md5,0eab12cebbf1c8f25d82c65f34aab9d7; classtype:trojan-activity; sid:2019172; rev:4; metadata:created_at 2014_08_19, updated_at 2014_08_19;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7134 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Kazy Checkin"; flow:to_server,established; content:"/get_"; http_uri; content:"did="; http_uri; content:"Downloader"; depth:10; http_user_agent; reference:md5,73d2dd466df92b77a4c34adcd13e8b50; reference:url,community.emc.com/community/connect/rsaxchange/netwitness/blog/2014/03/28/new-kazy-variant-kazy-forces; classtype:trojan-activity; sid:2018341; rev:7; metadata:created_at 2013_09_11, updated_at 2013_09_11;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7137 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 1"; flow:established,to_server; content:"GET"; http_method; content:"/sync"; depth:5; http_uri; content:"/?ext="; within:7; http_uri; fast_pattern; content:"&pid="; distance:0; http_uri; content:!"Referer|3a|"; http_header; reference:md5,aa9542f02b26a554650a9649d2239181; classtype:trojan-activity; sid:2020737; rev:2; metadata:created_at 2015_03_24, updated_at 2015_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7138 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop udp $HOME_NET any -> any 53 (msg:"ET TROJAN CryptoLocker .onion Proxy Domain (iezqmd4s2fflmh7n)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|iezqmd4s2fflmh7n"; fast_pattern; distance:0; nocase; reference:md5,1d578c11069c7446ca6d05ff7623a972; classtype:trojan-activity; sid:2020740; rev:1; metadata:created_at 2015_03_24, updated_at 2015_03_24;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7140 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32.Chroject.B Receiving ClickFraud Commands from CnC 2"; flow:from_server,established; file_data; content:"<html><title>"; within:13; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$/R"; content:""; fast_pattern:only; flowbits:isset,ET.Chroject; reference:md5,586ad13656f4595723b481d77b6bfb09; classtype:trojan-activity; sid:2020749; rev:4; metadata:created_at 2015_03_25, updated_at 2015_03_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7150 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32.Chroject.B ClickFraud Request"; flow:to_server,established; content:"GET"; http_method; content:"/item/fmt?ct="; depth:13; http_uri; fast_pattern; content:"Referer|3a 20|http|3a|//"; http_header; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$/RHmi"; reference:md5,586ad13656f4595723b481d77b6bfb09; classtype:trojan-activity; sid:2020750; rev:4; metadata:created_at 2015_03_25, updated_at 2015_03_25;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7151 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M1"; flow:established,to_server; content:"GET"; http_method; content:"/state"; http_uri; fast_pattern:only; content:".php?"; http_uri; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/\/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$/U"; reference:md5,c075fa8484d52c3978826c2f07ce9a9c; classtype:trojan-activity; sid:2020717; rev:5; metadata:created_at 2015_03_20, updated_at 2015_03_20;)" from file /usr/local/etc/suricata/suricata_8280_em4/rules/suricata.rules at line 7152 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_REFERENCE_UNKNOWN(150)] - unknown reference key "md5". Supported keys are defined in reference.config file. Please have a look at the conf param "reference-config-file" 12/12/2018 -- 16:31:50 - -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Win32.Chroject.B Receiving ClickFraud Commands from CnC 1"; flow:from_server,established; file_data; content:"/title>