""ET P2P Phatbot Control Connection""

SID: 2000015

Revision: 6

Class Type: trojan-activity

Metadata: created_at 2010_07_30, updated_at 2010_07_30

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: any

Flow: established

Contents:

• Value: "Wonk-"

• Value: "|00|#waste|00|"

Within: 15

PCRE:

Special Options:

source