""ET TROJAN Win32/LeftHook Stealer CnC Command - get_socket (POST)""

SID: 2045003

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_04_18, updated_at 2023_04_18

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "Connection|3a 20|keep-alive|0d 0a|"

  • Value: "Content-Length|3a 20|49|0d 0a|"

  • Value: "Origin: chrome-extension://"

  • Value: "action=get_socket&botID=" Depth: 24

Within:

PCRE: "/^[a-zA-Z0-9]{25}$/R"

Special Options:

  • http_method

  • http_header

  • http_header

  • http_header

  • file_data

  • fast_pattern

source