""ET TROJAN Win32.Hack.PcClient.g CnC (OUTBOUND) XOR b5""

SID: 2018154

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2014_02_19, updated_at 2014_03_06

Reference:

• md5

• dfd6b93dac698dccd9ef565a172123f3

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: to_server,established

Contents:

• Value: "|d0 cd d0 db d4 d8 d0|"

• Value: "|d9 da d2 dc db|"

• Value: "|d1 da d6 d8 d1|"

• Value: "|dd da c6 c1 db d4 d8 d0|"

• Value: "|c2 dc db d1 da c2 c6|"

Within:

PCRE:

Special Options:

• fast_pattern

source