""ET TROJAN Bedep Connectivity Check M2""

SID: 2022467

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2016_01_28, updated_at 2016_01_28

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "/stats/eurofxref/eurofxref-hist-90d.xml"

  • Value: "Host|3a 20|www.ecb.europa.eu|0d 0a|"

  • Value: "Accept|3a 20|text/html, application/xhtml+xml, /|0d 0a|"

Within:

PCRE: "/^(?:Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(?:Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(?:Referer\x3a[^\r\n]+[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+(?: MSIE |rv\x3a11)/Hi"

Special Options:

  • http_method

  • http_uri

  • nocase

  • http_header

  • nocase

  • http_header

source