""ET TROJAN Python/PBot Browser Hijacker Activity""

SID: 2031148

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_30, deployment Perimeter, signature_severity Major, updated_at 2020_10_31

Reference:

• md5

• f741a2febf0630407ba17945362f3bce

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "GET"

• Value: ".js?streamId="

• Value: "&isAdvpp="

• Value: "|0d 0a|Origin|3a 20|http"

Within:

PCRE: "/.js\?streamId=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(?:true|false)$/Usi"

Special Options:

• http_method

• http_uri

• fast_pattern

• http_uri

• http_header

source