""ET TROJAN Suspected Smokeloader Activity (POST)""

SID: 2039103

Revision: 2

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_10_06, deployment Perimeter, former_category MALWARE, performance_impact Significant, signature_severity Major, updated_at 2022_10_28, reviewed_at 2023_09_01

Reference:

• md5

• d58078226c4066f05926c70be7cf64a7

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Referer|3a 20|"

• Value: "User-Agent|3a 20|Mozilla|2f|4|2e|0|20 28|compatible|3b 20|MSIE|20|8|2e|0|3b 20|Windows|20|NT|20|6|2e|1|3b 20|Win64|3b 20|x64|3b 20|Trident|2f|4|2e|0|3b 20 2e|NET|20|CLR|20|2|2e|0|2e|50727|3b 20|SLCC2|3b 20 2e|NET|20|CLR|20|3|2e|5|2e|30729|3b 20 2e|NET|20|CLR|20|3|2e|0|2e|30729|3b 20|Media|20|Center|20|PC|20|6|2e|0|3b|"

Within:

PCRE: "/^Referer\x3a\x20http|3a 2f 2f|[a-z]{5,10}.(com|org|net|de)\/$/Hm"

Special Options:

• http_method

• http_header

• http_header

source