""ET TROJAN X-Files Stealer CnC Exfil Activity M2""

SID: 2037743

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2022_07_12, updated_at 2022_07_12

Reference:

  • md5

  • c128193024853118bd07d4a4e89200bf

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: ".php?Chatid="

  • Value: "Content-Type|3a 20|multipart/form-data|3b 20|boundary=|22|"

  • Value: "|2d|"

  • Value: "|2d|4"

  • Value: "|2d|"

  • Value: "|2d|"

  • Value: "|22 0d 0a|"

  • Value: !"User-Agent|3a 20|"

  • Value: !"Referer|3a 20|"

  • Value: "|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d|file|3b 20|filename|3d|q|3b 20|filename|2a 3d|utf|2d|8|27 27|q|0d 0a 0d 0a|PK|03 04|"

Within: 3

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_header

  • http_header

  • http_header

  • http_header

  • http_header

  • http_header

  • http_header

  • http_header

  • http_client_body

source