""ET TROJAN Trojan.SpamBanker Report via SMTP""

SID: 2019931

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2014_12_13, updated_at 2014_12_13

Reference:

  • md5

  • 9c1aac05bd3212a3abcd7cce9c6c4c77

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: [25,587]

Flow: established,to_server

Contents:

  • Value: "From|3a|"

  • Value: "Subject|3a 20|Keylogger"

  • Value: "X-Library|3a 20|Indy"

Within:

PCRE: "/^Keylogger\r$/m"

Special Options:

  • nocase

source