#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED Ransomware Locky .onion Payment Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|32kl2rwsjvqjeui7"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:2022659; rev:2;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Ransomware Locky CnC Beacon"; flow:established,to_server; urilen:9; content:"POST"; http_method; content:"/main.php"; http_uri; fast_pattern; content:!"Referer|3a|"; http_header; content:!"Accept"; http_header; content:"Content-Length|3a 20|10"; http_header; content:"|0d 0a|"; distance:1; within:2; http_header; content:"Connection|3a 20|Keep-Alive|0d 0a|"; distance:0; http_header; pcre:"/\.php$/U"; pcre:"/^.{0,15}[^\x20-\x7e\r\n]/Ps"; reference:md5,b06d9dd17c69ed2ae75d9e40b2631b42; classtype:trojan-activity; sid:2022538; rev:5;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN Ransomware Locky .onion Payment Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|6dtxgqam4crv6rr6"; nocase; distance:0; fast_pattern; reference:md5,b06d9dd17c69ed2ae75d9e40b2631b42; classtype:trojan-activity; sid:2022548; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN Ransomware Locky .onion Payment Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|twbers4hmi6dx65f"; fast_pattern; distance:0; nocase; reference:url,www.hybrid-analysis.com/sample/02b21d4a90a2a50506711a9c120b1e51f77084eba25688f7db2b9571037465dc?environmentId=1; classtype:trojan-activity; sid:2022560; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN Ransomware Locky .onion Payment Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|i3ezlvkoi7fwyood"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:2022589; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN Ransomware Locky .onion Payment Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|lpholfnvwbukqwye"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:2022590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [445,139] (msg:"ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 Unicode"; flow:to_server,established; content:"|ff|SMB|a2|"; offset:4; depth:5; byte_test:1,&,0x80,6,relative; content:"|00|.|00|l|00|o|00|c|00|k|00|y|00 00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2022637; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [445,139] (msg:"ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII"; flow:to_server,established; content:"|ff|SMB|a2|"; offset:4; depth:5; byte_test:1,!&,0x80,6,relative; content:".locky|00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2022638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [445,139] (msg:"ET TROJAN Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v2"; flow:to_server,established; content:"|FE|SMB|40 00|"; offset:4; depth:6; content:"|05 00|"; distance:6; within:2; content:"|00|.|00|l|00|o|00|c|00|k|00|y|00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2022639; rev:4;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky Payment)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|32kl2rwsjvqjeui7"; fast_pattern; distance:0; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2022660; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN ABUSE.CH Ransomware Domain Detected (Locky Payment)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|twbers4hmi6dc65f"; fast_pattern; distance:0; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2022663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Ransomware Locky CnC Beacon"; flow:established,to_server; content:"POST"; http_method; urilen:11; content:"/submit.php"; http_uri; fast_pattern; content:!"Referer|3a|"; http_header; content:"www-form-urlencoded|0d 0a|"; http_header; content:!"Accept"; http_header; content:"User-Agent|3a|"; http_header; pcre:"/[\x80-\xff]/P"; reference:md5,042b2e41a14b67570a993ef909621954; classtype:trojan-activity; sid:2022665; rev:4;)
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN Ransomware Locky Possible Payment Page"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|25z5g623wpqpdwis"; fast_pattern; distance:0; nocase; classtype:trojan-activity; sid:2022680; rev:1;)