""ET TROJAN Win32/PSW.Agent.OIN CnC Activity""

SID: 2030560

Revision: 2

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2020_07_20, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2020_07_20

Reference:

• md5

• 4589aaf8f84c91c5e290ddebcc368342

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: [$HTTP_PORTS,886]

Flow: established,to_server

Contents:

• Value: "POST / HTTP/1.1|0d 0a|Connection|3a 20|Keep-Alive|0d 0a|Accept|3a 20|/|0d 0a|Accept-Language|3a 20|en-US,en|3b|q=0.9|0d 0a|User-Agent|3a 20|Mozilla/5.0 (Windows NT 10.0|3b 20|Win64|3b 20|x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36|0d 0a|Content-Length|3a 20|" Depth: 232

• Value: !"&"

• Value: !"Referer|3a 20|"

• Value: "|0d 0a 0d 0a|"

Within:

PCRE: "/^(?:[a-zA-Z0-9+/\x20]{4})*(?:[a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$/R"

Special Options:

• fast_pattern

source