""ET TROJAN MacOS/Adload Proxy Node Response""
SID: 2047630
Revision: 2
Class Type: bad-unknown
Metadata: affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2023_08_11, deployment Perimeter, malware_family Adload, signature_severity Major, updated_at 2024_02_09
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: [7000:7002]
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "|7B 22|result|22 3A|" Depth: 10 Offset: 0
-
Value: "|22|error|22 3A 22|"
-
Value: "|22 2C 22|action|22 3A 22|result|22|"
-
Value: "|22|uuid4|22|"
-
Value: "|22|version|22|"
Within:
PCRE:
Special Options:
- fast_pattern