""ET CURRENT_EVENTS Underminer EK Flash/WAV Loader""

SID: 2026425

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_09_28, deployment Perimeter, signature_severity Major, tag Underminer_EK, updated_at 2018_09_28

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "Cache-Control|3a 20|private|3b 20|no-store|3b 20|no-cache|0d 0a|"

  • Value: "Content-Encoding|3a 20|gzip|0d 0a|"

  • Value: "X-UA-Compatible|3a 20|IE=9|3b 20|IE=8|3b 20|IE=7"

  • Value: "function getSalt(){"

  • Value: "function getAudioResource(){"

  • Value: "/"

  • Value: ".wav|22 3b|"

  • Value: "<param name=|22|movie|22 20|value=|22|"

  • Value: "/"

  • Value: ".swf|22|"

  • Value: "<embed src=|22|"

  • Value: "/"

  • Value: ".swf|22 20|allowScriptAccess=|22|always|22 20|type=|22|application/x-shockwave-flash|22|"

Within: 69

PCRE:

Special Options:

  • http_stat_code

  • http_header

  • http_header

  • http_header

  • file_data

  • nocase

  • nocase

  • fast_pattern

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

source