WORM: Berbew Keylogger Upload

This signature detects the Berbew worm as it uploads keylogger information to a listening post. Berbew monitors user keystrokes for financial data and then reports that information to an attacker, via HTTP, to a listening post. Source IP addresses that trigger this signature are extremely likely to be infected with the Berbew worm.

Extended Description

Berbew is a Trojan horse that monitors keystrokes, steals sensitive information, and reports to a remote attacker. It also opens a backdoor and accepts control commands from a remote attacker.

References

URL: http://secunia.com/virus_information/19349 http://www.cit.cornell.edu/computer/security/alerts/berbew.html http://securityresponse.symantec.com/avcenter/venc/data/backdoor.berbew.g.html

Short Name

WORM:BERBEW:KEYLOGGER-UPLOAD

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: Berbew Keylogger Upload

Extended Description

References

Found a potential security threat?