SID: 2036945

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2022_06_09, malware_family APT_Q_37, updated_at 2022_06_09

Reference:

  • md5

  • 71e1cfb5e5a515cea2c3537b78325abf

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: 1024:

Flow: established,to_server

Contents:

  • Value: "|2a 00|" Depth: 12

  • Value: "|2a 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00|"

  • Value: !"User-Agent"

  • Value: !"Referer"

  • Value: !"Host"

Within: 30

PCRE:

Special Options:

  • fast_pattern

source