""ET TROJAN Generic Stealer Config from Server""

SID: 2036883

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2022_06_06, updated_at 2022_06_06

Reference:

• md5

• 0a7b32e75a01764ef5389a1d9e72ed63

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "200"

• Value: "wallets|3b 2a 3b 2d|"

• Value: "|3b|Local|20|Extension|20|Settings"

• Value: "azne|2e|exe|7c 25|TEMP|25 5c 7c|exe"

• Value: "pm|2e|exe|7c 25|TEMP|25 5c 7c|exe"

• Value: "cc|2e|exe|7c 25|TEMP|25 5c 7c|exe"

• Value: "rc|2e|exe|7c 25|TEMP|25 5c 7c|exe"

Within:

PCRE:

Special Options:

• http_stat_code

• file_data

• fast_pattern

source