""ET TROJAN Trojan.Delf-5496 New Infection Report""
SID: 2008908
Revision: 5
Class Type: trojan-activity
Metadata: created_at 2010_07_30, updated_at 2014_02_27
Reference:
-
md5
-
3a7f11fbaf815cd2338d633de175e252
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: 1024:
Flow: established,to_server
Contents:
- Value: "|7c|OnConnect|7c|" Depth: 20
Within:
PCRE: "/^\d+?\x7cOnConnect\x7c/"
Special Options: