""ET TROJAN Kriptovor SMTP Traffic""

SID: 2020884

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2015_04_09, updated_at 2015_04_09

Reference:

  • md5

  • c3ab87f85ca07a7d026d3cbd54029bbe

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: [25,465,587]

Flow: established,to_server

Contents:

  • Value: "|0d 0a|PC|3a 20|"

  • Value: "|0d 0a|Text|3a 20|"

  • Value: "|0d 0a|IP|3a 20|"

  • Value: "|0d 0a|TS|3a 20|"

Within:

PCRE:

Special Options:

source