""ET TROJAN Red Leaves HTTP CnC Beacon (APT10 implant)""

SID: 2024175

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_04_04, deployment Perimeter, malware_family RedLeaves, malware_family Red_Leaves, signature_severity Major, tag APT, tag APT10, tag RedLeaves, tag c2, updated_at 2017_04_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST " Depth: 5

  • Value: "/index.php|20|HTTP/1.1|0d 0a|"

  • Value: !"Content-Type|3a|"

  • Value: !"User-Agent|3a|"

  • Value: !"Accept-"

  • Value: !"Referer|3a|"

  • Value: "Accept|3a 20|/|0d 0a|"

  • Value: "Connection|3a 20|Keep-Alive"

  • Value: "Host|3a 20|"

  • Value: "dex.php|20|HTTP/1.1|0d 0a|Co"

Within:

PCRE: "/^POST\x20\/(?:[A-Z]+\/)?index.php\x20/"

Special Options:

source