""ET TROJAN Vobus/Beebone Sinkhole DNS Reply""

SID: 2020889

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2015_04_11, former_category MALWARE, updated_at 2022_07_13

Reference:

Protocol: udp

Source Network: any

Source Port: 53

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

  • Value: "|00 01 00 01|"

  • Value: "|00 04 2E F4 15 04|"

Within: 6

PCRE:

Special Options:

source