""ET TROJAN Possible Vidar Stealer C2 Config In Steam Profile""
SID: 2043334
Revision: 4
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2023_01_18, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, signature_severity Major, updated_at 2023_10_05, reviewed_at 2024_01_26
Reference:
-
md5
-
deb6e2ba0b5da298a176f135d0dbb902
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "|3c|title|3e|Steam|20|Community|20 3a 3a 20|"
-
Value: "http|3a 2f 2f|"
-
Value: "|7c 3c 2f|title|3e|"
Within: 20
PCRE: "/http(?:s)?\x3a\x2f\x2f(?:[0-9]{1,3}.){3}[0-9]{1,3}(?:\x3a[0-9]{1,5})?\x7c\x3c\x2ftitle\x3e/"
Special Options:
-
file_data
-
fast_pattern