[Snort-sigs] Lovgate.F rule

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work. 
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# 
# $Id$
#
# 

Rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"VIRUS Lovgate Fileshare 139"; dsize > 500; content:"|40 00 00 C0 2E 61 73 70 61 63 6B 00|"; rev:1;)  

--

Sid:

--

Summary:
When Lovgate worm is active it copies itself to network shares when using port 139 for netbios-ss.
--

Impact:

--

Detailed Information:
I took 6 samples of Lovgate.F and opened them up with a hex editor looking for similar code.
Once I had found some hex that I could identify Lovgate with I based my rule on that. The code
I found was at the beginning of the excecutable where the aspack signature is.
I've tried copying the virus across the network maybe 10-15 times and the rule catches it whe netbios
uses port 139. I've noticed that sometimes netbios copies over port 445 so I needed another rule to scan
that port.
In the above rule I removed the sid since I am using >1,000,000 for this rule
--

Attack Scenarios:

--

Ease of Attack:

--

False Positives:
I realize that some other programs will be using aspack to pack their programs. This may or may not be a problem with this rule.
--

False Negatives:

--

Corrective Action:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

--

Contributors:
Tom McLaughlin
tom.mclaughlin@kp.org
--

Additional References:
http://www.f-secure.com/v-descs/lovgate.shtml