""ET TROJAN Maldoc Sending Windows System Information (POST)""

SID: 2048318

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_08_30, deployment Perimeter, malware_family AtlasCross, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_09_29, reviewed_at 2023_08_30, former_sid 2855191

Reference:

  • md5

  • 7195d7e4926a0a85fbe81e40ab7c0ca4

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "User-Agent|3a 20|Mozilla/5.0 (Windows NT 6.1|3b 20|WOW64|3b 20|Trident/7.0|3b 20|rv|3a|11.0) like Gecko|0d 0a|"

  • Value: "&session=" Depth: 30

  • Value: "|35 33 37 39 37 33 37 34 36 35 36 64 32 30 34 39 36 34 36 63 36 35 32 30 35 30 37 32 36 66 36 33 36 35 37 33 37 33 30 64 30 61|"

  • Value: !"|2e|"

  • Value: !"Referer"

Within: 200

PCRE: "/^\x26(?:(id|token))\x3d/P"

Special Options:

  • http_method

  • http_header

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_uri

  • http_header

source