""ET CURRENT_EVENTS RIG encrypted payload M1 Aug 01 2017""

SID: 2024507

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_08_01, deployment Perimeter, malware_family RIG, signature_severity Major, tag RigEK, updated_at 2017_08_01

Reference:

• md5

• 263a2cf88f340b2a755db749be1371ea

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "|73 29 88 ff e0 d1 0e 74|"

Within: 8

PCRE:

Special Options:

• file_data

source