""ET TROJAN Win32/Orion Logger SMTP Base64 Exfil""
SID: 2028897
Revision: 2
Class Type: trojan-activity
Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_10_24, deployment Perimeter, former_category MALWARE, malware_family Orion_Logger, signature_severity Major, updated_at 2019_10_24
Reference:
-
md5
-
a96e8c201599af678926ac84020c87e0
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: [25,2525,587]
Flow: to_server,established
Contents:
-
Value: "Subject|3a 20|Orion Logger - System Details - "
-
Value: "PT09PT09PT09PXwgT3Jpb24gTG9nZ2VyIC0gU3lzdGVtIERldGFpbHMgfD09PT09PT09"
Within:
PCRE:
Special Options:
- fast_pattern