""ET CURRENT_EVENTS PawnStorm Java Class Stage 2 M1 Aug 28 2015""
SID: 2021727
Revision: 1
Class Type: trojan-activity
Metadata: created_at 2015_08_28, updated_at 2015_08_28
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "|01 00 0e 4c 50 68 61 6e 74 6f 6d 53 75 70 65 72 3b|"
-
Value: "|01 00 32 4c 6a 61 76 61 2f 75 74 69 6c 2f 63 6f 6e 63 75 72 72 65 6e 74 2f 61 74 6f 6d 69 63 2f 41 74 6f 6d 69 63 52 65 66 65 72 65 6e 63 65 41 72 72 61 79 3b|"
Within:
PCRE:
Special Options:
-
file_data
-
fast_pattern