""ET TROJAN nspx30 Orchestrator CnC Checkin""

SID: 2050498

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, created_at 2024_01_25, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_01_25

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "/id|3d|" Depth: 4

  • Value: "ad|3d|"

  • Value: "os|3d|"

  • Value: "t|3d|"

  • Value: "User-Agent|3a 20|Mozilla/4.0 |28|compatible|3b|MSIE 5.0|3b 20|Windows 98|29|"

  • Value: "Host|3a 20|www.baidu.com"

Within:

PCRE: "/t\x3d\d/U"

Special Options:

  • http_method

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_header

  • http_header

source