""ET TROJAN W32/Emotet.v4 Checkin""

SID: 2035047

Revision: 5

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_07_24, deployment Perimeter, malware_family Emotet, performance_impact Moderate, signature_severity Major, updated_at 2017_09_18

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: [443,7080,8080,80]

Flow: established,to_server

Contents:

  • Value: "POST / HTTP/1.1|0d 0a|User-Agent|3a 20|" Depth: 29

  • Value: "|20|MSIE|20|"

  • Value: !"Accept"

  • Value: !"Referer|3a|"

  • Value: !"Content-Type|3a|"

  • Value: !"Cookie"

  • Value: !"TagId|3a 20|"

Within:

PCRE: "/\x0d\x0a\x0d\x0a[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/s"

Special Options:

source