""ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M2""
SID: 2034872
Revision: 2
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2022_01_07, deployment Perimeter, malware_family PurpleFox, performance_impact Significant, signature_severity Major, updated_at 2022_01_10
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: !80
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "HTTP/1.1 200 OK|0d 0a|Content-Type|3a 20|application/octet-stream|0d 0a|" Depth: 57
-
Value: "|0d 0a|Server|3a 20|HFS|20|"
-
Value: "Set-Cookie|3a 20|HFS_SID_="
-
Value: "|0d 0a|Content|2d|Disposition|3a 20|attachment|3b 20|filename|2a 3d|UTF|2d|8|27 27|"
-
Value: "|2e|zip|3b 20|filename="
-
Value: "|2e|zip|0d 0a 0d 0a|PK|03 04|"
-
Value: ".exe"
Within: 150
PCRE:
Special Options:
- fast_pattern