""ET MALWARE Win32/Hadsruda!bit Adware/PUA Installation Activity""

SID: 2022850

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2016_06_02, updated_at 2019_08_14

Reference:

• md5

• 6b58b3eb9bbb0f7297a2e36e615506d3

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "GET"

• Value: "?alpha="

• Value: "User-Agent|3a 20|NSIS_Inetc"

Within:

PCRE: "/\?alpha=(?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})/U"

Special Options:

• http_method

• http_uri

• http_header

• fast_pattern

source