""ET TROJAN Pupy DNS Request with SPI M1""
SID: 2046958
Revision: 1
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2023_07_31, deployment Perimeter, deployment Internal, malware_family PupyRat, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_07_31
Reference:
Protocol: udp
Source Network: $HOME_NET
Source Port: any
Destination Network: any
Destination Port: 53
Flow:
Contents:
-
Value: "|01|" Depth: 1 Offset: 2
-
Value: "|00 01 00 00 00 00 00|"
-
Value: "|08|"
-
Value: "9"
-
Value: "999999"
-
Value: "9"
Within: 57
PCRE: "/^..\x01.\x00\x01\x00\x00\x00\x00\x00.\x08[a-z0-8-]{7}9\x20-\x35{3,7}[a-z0-8-]{2}9{6}\x08-\x35{1,7}(?:[a-z0-8-]{2}9{6}|[a-z0-8-]{4}9{4}|[a-z0-8-]{5}9{3}|[a-z0-8-]{7}9)?[^\x00]/"
Special Options:
- fast_pattern