""ET TROJAN DDoS.XOR Checkin""

SID: 2020381

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2015_02_07, malware_family XorDDoS, updated_at 2015_02_07

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: to_server,established

Contents:

• Value: "BB2FA36AAA9541F0" Depth: 500

Within:

PCRE:

Special Options:

source