""ET TROJAN Skeleton Key Filename in SMB Traffic (Unicode)""

SID: 2020177

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2015_01_13, updated_at 2015_02_07

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: [139,445]

Flow: to_server,established

Contents:

• Value: "|FF|SMB|a2|" Depth: 5 Offset: 4

• Value: "|5c 00|o|00|l|00|e|00|6|00|4|00|.|00|d|00|l|00|l"

Within:

PCRE:

Special Options:

source