""ET TROJAN Win32/Lilith Stealer getFile Command""

SID: 2038496

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_and_Server, created_at 2022_08_11, deployment Perimeter, malware_family Lilith_Stealer, performance_impact Low, signature_severity Major, updated_at 2022_08_11

Reference:

  • md5

  • 0ebe8de305581c9eca37e53a46d033c8

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "GET /gate/" Depth: 10

  • Value: "/getFile?name="

  • Value: "User-Agent|3a 20|Lilith-Bot/"

Within:

PCRE: "/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}/R"

Special Options:

  • fast_pattern

source