""ET TROJAN Win32.Hyteod.acox Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response""
SID: 2020741
Revision: 1
Class Type: trojan-activity
Metadata: created_at 2015_03_25, updated_at 2015_03_25
Reference:
Protocol: udp
Source Network: any
Source Port: 53
Destination Network: $HOME_NET
Destination Port: any
Flow:
Contents:
-
Value: "|00 01 00 00 00 01|" Depth: 6 Offset: 4
-
Value: "|02|su|00|"
-
Value: "|32|"
Within: 1
PCRE: "/^[a-z0-9]{50}/R"
Special Options: