""ET TROJAN Win32/RootTeam Stealer CnC Exfil M1""

SID: 2045867

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_05_25, deployment Perimeter, malware_family RootTeamStealer, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_07_12

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/api/report"

  • Value: "User-Agent|3a 20|Go-http-client"

  • Value: "|7b 22|" Depth: 2

  • Value: "cookies"

  • Value: "discord"

  • Value: "minecraft"

  • Value: "name"

  • Value: "nickname"

  • Value: "passwords"

  • Value: "steam"

  • Value: "telegram"

  • Value: "|22|uploader|22 3a 22 7b 5c 22|access_key|5c 22 3a 5c 22|"

  • Value: "delete_key"

  • Value: "direct_url"

  • Value: "expiry"

  • Value: "filename"

  • Value: "|5c 22|mimetype|5c 22 3a 5c 22|application/zip|5c 22|"

  • Value: "original_name"

  • Value: "sha256sum"

  • Value: "size"

  • Value: "url"

  • Value: "wallets"

  • Value: "gzip"

  • Value: "application/json"

Within:

PCRE: "/^Content-Type\x3a\x20[^\r\n]+application\//json/Hmi"

Special Options:

  • http_method

  • http_uri

  • http_header

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

  • http_header

source