""ET TROJAN ARM Binary Downloaded via WGET Containing GoAhead and Multiple Camera RCE 0Day Vulnerabilities""

SID: 2024242

Revision: 1

Class Type: trojan-activity

Metadata: attack_target IoT, created_at 2017_04_25, deployment Perimeter, signature_severity Major, updated_at 2017_04_25

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "/set_ftp.cgi"

  • Value: "&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr="

Within:

PCRE:

Special Options:

  • fast_pattern

source