""ET TROJAN Ruskill/Palevo Download Command""
SID: 2013245
Revision: 3
Class Type: trojan-activity
Metadata: created_at 2011_07_11, updated_at 2011_07_11
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: 1024:
Destination Network: $EXTERNAL_NET
Destination Port: 1024:
Flow: established,to_server
Contents:
-
Value: "PRIVMSG #" Depth: 9
-
Value: "|3a 5b|d=|22|http|3a|//"
Within:
PCRE:
Special Options: