""ET TROJAN Chthonic CnC Beacon 5""

SID: 2020944

Revision: 7

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2015_04_17, deployment Perimeter, signature_severity Major, tag c2, updated_at 2015_06_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel

Reference:

  • md5

  • 97369af278cc004ce390f68ae94013b6

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: !"Accept-"

  • Value: !"Content-Type|3a|"

  • Value: !"Referer|3a|"

  • Value: !"Content-Length|3a 20|0|0d 0a|"

  • Value: "/ HTTP/1.1|0d 0a|Accept|3a 20|/|0d 0a|User-Agent|3a 20|Mozilla/6."

Within:

PCRE: "/^[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\nConnection\x3a\x20Keep-Alive\r\n(?:Cache-Control|Pragma)\x3a\x20no-cache\r\n\r\n/Rmi"

Special Options:

  • http_method

  • http_header

  • http_header

  • http_header

  • http_header

source