""ET TROJAN WORM_VOBFUS Requesting exe""
SID: 2015969
Revision: 12
Class Type: trojan-activity
Metadata: created_at 2012_11_30, updated_at 2014_05_16
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: 1024:
Flow: established,to_server
Contents:
-
Value: "|3f|" Depth: 11 Offset: 6
-
Value: "GET " Depth: 4
-
Value: "|0d 0a|User-Agent|3a 20|Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.1|3b| SV1)|0d 0a|Host|3a 20|"
Within: 77
PCRE: "/^[^\r\n]+?(\r\nConnection\x3a Keep-Alive)?\r\n\r\n$/Ri"
Special Options: