""ET TROJAN Dmechant Exfil Passwords via SMTP""

SID: 2033414

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2021_07_25, updated_at 2021_07_25

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: [25,465,587,2525]

Flow: established,to_server

Contents:

  • Value: "|0d 0a|Subject|3a 20|Passwords|3a 3a 3a 3a|"

  • Value: "Username|3a 20|"

  • Value: "CompName|3a 20|"

  • Value: "Password|20 3a 20|"

  • Value: "Application|20 3a 20|"

  • Value: "========"

Within:

PCRE:

Special Options:

  • fast_pattern

source