""ET TROJAN Fakealert.Rena CnC Checkin 2""

SID: 2013382

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2011_08_09, updated_at 2011_08_09

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "/images/img.php?id="

  • Value: "HTTP/1.1|0d 0a|User-Agent"

  • Value: "|20|HTTP/1.1|0d 0a|User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE|20|"

  • Value: "|3b 20|Windows|20|NT|20|"

  • Value: ")|0d 0a|Host|3a 20|"

  • Value: "Cache-Control|3a 20|no-cache|0d 0a 0d 0a|"

  • Value: !"|0d 0a|Accept"

Within:

PCRE:

Special Options:

source