""ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)""
SID: 2046056
Revision: 2
Class Type: trojan-activity
Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, created_at 2023_06_02, deployment Perimeter, malware_family Stealer, malware_family Redline, malware_family MetaStealer, confidence High, signature_severity Major, updated_at 2024_01_09, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system
Reference:
-
md5
-
022ffcaf0d05a9f02b4199f44c40d86a
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: 1024:
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "tempuri.org|2f|"
-
Value: "|25|userprofile|25|"
-
Value: "|2a 2e 74 78 74 2c 2a 2e 64 6f 63 2a 2c 2a 6b 65 79 2a 2c 2a 77 61 6c 6c 65 74 2a 2c 2a 73 65 65 64 2a|"
Within:
PCRE:
Special Options:
-
nocase
-
fast_pattern