""ET TROJAN Ruskill/Palevo CnC PONG""

SID: 2013246

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2011_07_11, updated_at 2011_07_11

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: 1024:

Destination Network: $EXTERNAL_NET

Destination Port: 1024:

Flow: established,to_server

Contents:

• Value: "PONG |3a|hub.us.com" Depth: 16

Within:

PCRE:

Special Options:

source