""ET TROJAN Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses""

SID: 2018316

Revision: 4

Class Type: trojan-activity

Metadata: created_at 2014_03_25, updated_at 2023_05_19

Reference:

• Link

Protocol: udp

Source Network: any

Source Port: 53

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

• Value: "|00 01 00 00 00 01|" Depth: 6 Offset: 4

Within:

PCRE: "/^..[\x0d-\x20][a-z]{13,32}(?:\x03(?:biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01/Rs"

Special Options:

source