""ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M2""

SID: 2034872

Revision: 2

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_01_07, deployment Perimeter, malware_family PurpleFox, performance_impact Significant, signature_severity Major, updated_at 2022_01_10

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: !80

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "HTTP/1.1 200 OK|0d 0a|Content-Type|3a 20|application/octet-stream|0d 0a|" Depth: 57

  • Value: "|0d 0a|Server|3a 20|HFS|20|"

  • Value: "Set-Cookie|3a 20|HFS_SID_="

  • Value: "|0d 0a|Content|2d|Disposition|3a 20|attachment|3b 20|filename|2a 3d|UTF|2d|8|27 27|"

  • Value: "|2e|zip|3b 20|filename="

  • Value: "|2e|zip|0d 0a 0d 0a|PK|03 04|"

  • Value: ".exe"

Within: 150

PCRE:

Special Options:

  • fast_pattern

source