""ET TROJAN Pupy DNS Request without SPI M2""
SID: 2046963
Revision: 1
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2023_07_31, deployment Perimeter, deployment Internal, malware_family PupyRat, performance_impact Low, confidence High, signature_severity Critical, updated_at 2023_07_31
Reference:
Protocol: udp
Source Network: $HOME_NET
Source Port: any
Destination Network: any
Destination Port: 53
Flow:
Contents:
-
Value: "|01|" Depth: 1 Offset: 2
-
Value: "|00 01 00 00 00 00 00|"
-
Value: "9999"
-
Value: "9"
Within: 57
PCRE: "/^..\x01.\x00\x01\x00\x00\x00\x00\x00.\x20-\x35{3,7}[a-z0-8-]{4}9{4}\x08-\x35{1,7}(?:[a-z0-8-]{2}9{6}|[a-z0-8-]{4}9{4}|[a-z0-8-]{5}9{3}|[a-z0-8-]{7}9)?[^\x00]/"
Special Options:
- fast_pattern