""ET TROJAN APT33/CharmingKitten JS/HTA Stage 1 CnC Checkin""

SID: 2026575

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_11_05, deployment Perimeter, performance_impact Low, signature_severity Major, tag APT33, tag CharmingKitten, updated_at 2018_11_05

Reference:

• md5

• e15b3d2c39888fe459dc2d9c8dec331d

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

• Value: "GET|20|" Depth: 4

• Value: ".php?anti="

• Value: "&cliname="

• Value: "HTTP/1.1|0d 0a|"

• Value: "|0d 0a|Accept|3a 20|/|0d|"

• Value: "Accept-Encoding|3a 20|gzip, deflate|0d|"

• Value: "User-Agent|3a|"

• Value: !"|0d 0a|Cache"

• Value: !"|0d 0a|Referer|3a|"

Within:

PCRE:

Special Options:

• fast_pattern

source