""ET CURRENT_EVENTS PawnStorm Java Class Stage 1 M1 Aug 28 2015""

SID: 2021726

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2015_08_28, updated_at 2015_08_28

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

• Value: "|01 00 08 47 4f 47 4f 47 4f 47 4f|"

• Value: "|01 00 0c 6a 61 76 61 2f 6e 65 74 2f 55 52 4c|"

• Value: "|01 00 0f 53 74 61 72 74 69 6e 67 20 41 70 70 6c 65 74|"

Within:

PCRE:

Special Options:

• file_data

source