""ET TROJAN SiameseKitten/Lyceum/Hexane MSIL/Shark CnC Checkin""

SID: 2033760

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2021_08_22, malware_family Shark, updated_at 2021_09_08

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "?q="

  • Value: "&qi="

  • Value: "&q1="

  • Value: "&q2="

  • Value: "&q3="

  • Value: "|28|Windows|20|NT|20|10.0|3b 20|Win64|3b 20|x64|29|"

  • Value: "Sec-Fetch-Dest|3a 20|document|0d|"

Within:

PCRE: "/^If-None-Match\x3a\x20[^\r\n]+Sec-Fetch-Dest\x3a\x20[^\r\n]+Sec-Fetch-Mode\x3a\x20[^\r\n]+Sec-Fetch-User\x3a\x20/Hmi"

Special Options:

  • http_method

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_header

  • http_header

  • fast_pattern

source