""ET TROJAN Yayih.A Checkin 3""

SID: 2017326

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2013_08_13, updated_at 2013_08_13

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: to_server,established

Contents:

• Value: "GET " Depth: 4

• Value: "/search.asp?newsid="

Offset: 4

• Value: "Mozilla/4.0 (compatible|3b| MSIE 5.0|3b| Windows NT 5.0)|0d 0a|"

Within:

PCRE:

Special Options:

• fast_pattern

source