""ET TROJAN Win32.Fareit.A/Pony Downloader Checkin (2)""

SID: 2015799

Revision: 5

Class Type: trojan-activity

Metadata: created_at 2012_10_13, updated_at 2012_10_13

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "ch=1"

• Value: "ch=1" Depth: 4

Within:

PCRE: "/ch=1$/U"

Special Options:

• http_uri

• http_client_body

source