""ET TROJAN PLATINUM Steganographic HTTP Response Page Inbound""

SID: 2027434

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2019_06_05, malware_family PLATINUM, tag T1001, tag data_obfuscation, tag T1140, tag deobfuscate_decode_payload, updated_at 2019_06_05

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

  • Value: "200"

  • Value: "|3c 21|--1234567890--"

  • Value: "|3c|td|20|bgcolor=|22|"

  • Value: "|3c|td|20|align=|22|"

  • Value: "|20 20 20 20 09|"

  • Value: "|20 20 20 20|"

  • Value: "--1234567890--|3e|"

Within:

PCRE:

Special Options:

  • http_stat_code

  • file_data

  • fast_pattern

source