""ET TROJAN HermeticWizard - WMI Spreader - File Copy via SMB1 (NT Create AndX Request)""

SID: 2035423

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_10, deployment Internal, deployment Datacenter, malware_family HermeticWizard, signature_severity Major, updated_at 2022_03_10

Reference:

  • md5

  • 517d2b385b846d6ea13b75b8adceb061

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: 445

Flow: established,to_server

Contents:

  • Value: "SMB" Depth: 8

  • Value: "|a2|"

  • Value: "|27 00 00 5c 00 63 00|"

  • Value: "|2e 00|d|00|l|00|l|00|"

Within: 8

PCRE: "/^(?:[A-F0-9]\x00){12}/R"

Special Options:

  • fast_pattern

source