""ET TROJAN Win32/VictoryGate/Orchard Botnet CnC Checkin""

SID: 2038727

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2021_10_20, updated_at 2022_09_02

Reference:

  • md5

  • cb442cbff066dfef2e3ff0c56610148f

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: 1024:

Flow: established,to_server

Contents:

  • Value: "|00 7b 22|Active_Window|22 3a 22|" Depth: 50

  • Value: "|22 2c 22|Antivirus|22 3a|"

  • Value: "|2c 22|Authenticate_Type|22 3a|"

  • Value: "|2c 22|Camera|22 3a|"

Within:

PCRE:

Special Options:

  • fast_pattern

source