""ET TROJAN Dridex Base64 Executable""

SID: 2022595

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2016_03_05, updated_at 2016_03_05

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

• Value: "200"

• Value: "|47 4f 44 5a 49 4c 4c 41|"

• Value: "<div style=|22|display|3a|none|22| id=|22|" Depth: 30

Within:

PCRE: "/^(?P[a-z])\x22\sname=\x22(?P=id)\x22>TVqQAA/Rsi"

Special Options:

• http_stat_code

• http_cookie

• file_data

source