""ET TROJAN Win32/MSIL.Heracles Checkin""

SID: 2037799

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_07_20, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2022_07_20, reviewed_at 2024_08_19

Reference:

• md5

• 4263294773ac7b794c8f7205967db4b0

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

• Value: "GET|20|/pages/onlineserial.aspx?TYPE=GetRegSerial&machinCode="

• Value: "&soft="

• Value: "&computerName="

• Value: "&userName="

Within:

PCRE: "/Host\x3a\x20[^\r\n]+[\r\n]+/"

Special Options:

source