""ET EXPLOIT CVE-2015-2419 As observed in Magnitude EK""

SID: 2023253

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2016_09_21, cve CVE_2015_2419, deployment Perimeter, malware_family Magnitude, signature_severity Major, tag Magnitude_EK, updated_at 2016_09_21

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

  • Value: "|5b 30 78 35 33 2c 20 30 78 35 35 2c 20 30 78 35 36 2c 20 30 78 65 38 2c 20 30 78 30 39 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 30 30 2c 20 30 78 35 65 2c 20 30 78 35 64 2c 20 30 78 35 62 2c 20 30 78 38 62 2c 20 30 78 36 33 2c 20 30 78 30 63 2c 20 30 78 63 32 2c 20 30 78 30 63 2c 20 30 78 30 30 2c 20 30 78 39 30 5d|"

  • Value: "|30 78 31 32 38 65 30 30 32 30|"

  • Value: "|4a 53 4f 4e|"

  • Value: "|73 74 72 69 6e 67 69 66 79|"

Within:

PCRE:

Special Options:

  • file_data

  • nocase

  • nocase

  • nocase

  • nocase

source