""ET TROJAN Trojan.Kwampirs Outbound GET request""

SID: 2023595

Revision: 3

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2016_12_09, deployment Perimeter, malware_family Trojan_Kwampirs, performance_impact Low, signature_severity Major, updated_at 2017_09_25

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

  • Value: "GET"

  • Value: "?q=KT"

  • Value: !"Referer|3a|"

  • Value: !"Cookie|3a|"

  • Value: !"Accept"

  • Value: "User-Agent|3a 20|Mozilla/" Depth: 20

Within:

PCRE: "/^User-Agent\x3a\x20[^\r\n]+\r\nHost\x3a/H"

Special Options:

  • nocase

  • http_method

  • http_uri

  • http_header

  • http_header

  • http_header

source