""ET TROJAN Skeleton Key Filename in SMB Traffic (ASCII)""

SID: 2020175

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2015_01_13, updated_at 2015_02_07

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: [139,445]

Flow: to_server,established

Contents:

• Value: "|FF|SMB|a2|" Depth: 5 Offset: 4

• Value: "|5c|ole.dll"

Within:

PCRE:

Special Options:

source