""ET TROJAN Evil JS Ransomware""

SID: 2023747

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_18, deployment Perimeter, malware_family Ransomware, signature_severity Major, tag Ransomware, updated_at 2017_01_18, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "|5c|u006d|5c|u0065|5c|u0073|5c|u0073|5c|u0061|5c|u0067|5c|u0065"

  • Value: ""

  • Value: "Hello.|20|Your|20|UID|3a|"

  • Value: "|65 76 69 6c 20 72 61 6e 73 6f 6d 77 61 72 65|"

  • Value: "|75 6e 69 71 75 65 20 73 74 72 6f 6e 67 65 73 74 20 41 45 53 20 6b 65 79|"

  • Value: "|73 65 6e 64 20 6d 65 20 79 6f 75 72 20 55 49 44 20 74 6f|"

  • Value: "|4c 69 73 74 20 6f 66 20 65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73|"

Within: 100

PCRE:

Special Options:

  • file_data

  • nocase

  • fast_pattern

source