""ET TROJAN Gulpix/PlugX Client Request""

SID: 2018169

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2014_02_21, updated_at 2015_08_19

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "POST /" Depth: 6

• Value: "HTTP/1."

• Value: !"Referer"

• Value: "2|3a 20|"

• Value: "3|3a 20|"

• Value: "1|3a 20|"

Within:

PCRE: "/^(?P[^\r\n\x3a]+)(?P[0-4])\x3a\x20\d+\r\n(?P=vname)(?P((?!(?P=n1))[0-4]))\x3a\x20\d+\r\n(?P=vname)(?P((?!((?P=n1)|(?P=n2)))[0-4]))\x3a\x20\d+\r\n(?P=vname)(?:(?!((?P=n1)|(?P=n2)))[0-4])\x3a\x20\d+\r\n/m"

Special Options:

• fast_pattern

source