""ET TROJAN Win32.Chroject.B ClickFraud Request""

SID: 2020750

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2015_03_26, updated_at 2015_03_27

Reference:

• md5

• 586ad13656f4595723b481d77b6bfb09

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "GET"

• Value: "/item/fmt?ct=" Depth: 13

• Value: "Referer|3a 20|http|3a|//"

Within:

PCRE: "/^Referer\x3a\x20http\x3a\/\/\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\/[a-z_-]+\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$/Hmi"

Special Options:

• http_method

• http_uri

• fast_pattern

• http_header

source