""ET TROJAN Possible DarkHotel Landing M3""
SID: 2021612
Revision: 1
Class Type: trojan-activity
Metadata: created_at 2015_08_11, updated_at 2015_08_11
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "HTA|3a|APPLICATION"
-
Value: "|27|&#x"
-
Value: "classid"
Within:
PCRE: "/^\s?=\s?\x22\x27(?:l|&#(?:x[64]c|108|76)\x3b)(?:s|&#(?:x[75]3|115|83)\x3b)(?:i|&#(?:x[64]9|105|73)\x3b)(?:d|&#(?:x[64]4|100|68)\x3b)(?:\x3a|&#(?:x3a|58)\x3b)(?![a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+(?:(?:\x5c|&#)(?:5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(?:\x25|&#x)(?:4[123456]|6[123456]|3\d|2D))/Rsi"
Special Options:
-
file_data
-
nocase
-
nocase