""ET CURRENT_EVENTS KaiXin EK Jar URI Struct""

SID: 2020476

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2015_02_19, updated_at 2015_02_19

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "Java/1."

• Value: ".jar"

Within:

PCRE: "/(?:\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(?:b(?:m(?:nw|wn)|n(?:mw|wm)|w(?:mn|nm))|m(?:b(?:nw|wn)|n(?:bw|wb)|w(?:bn|nb))|n(?:b(?:mw|wm)|m(?:bw|wb)|w(?:bm|mb))|w(?:b(?:mn|nm)|m(?:bn|nb)|n(?:bm|mb)))).jar$/U"

Special Options:

• http_header

• fast_pattern

• http_uri

source