""ET TROJAN [ANY.RUN] PlanetStealer CnC Checkin""

SID: 2051490

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, tls_state plaintext, created_at 2024_03_05, deployment Perimeter, malware_family PlanetStealer, performance_impact Low, confidence High, signature_severity Major, tag InfoStealer, tag PlanetStealer, updated_at 2024_03_05

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/submit/info"

  • Value: "User-Agent|3a 20|Go-http-client/"

  • Value: "|22|owner_id|22 3a 22|"

  • Value: "|22|bot_id|22 3a 22|"

  • Value: "|22|build_id|22 3a 22|"

  • Value: "|22|statistics|22 3a 7b 22|total_passwords|22 3a|"

  • Value: "|22|total_cookies|22 3a|"

  • Value: "|22|total_cards|22 3a|"

  • Value: "|22|total_autofills|22 3a|"

  • Value: "|22|total_wallets|22 3a|"

  • Value: "|22|total_bookmarks|22 3a|"

  • Value: "|22|computer|22 3a 7b 22|username|22 3a 22|"

  • Value: "|22|hostname|22 3a 22|"

  • Value: "|22|hwid|22 3a 22|"

  • Value: "|22|cpu|22 3a 22|"

  • Value: "|22|gpu|22 3a 22|"

  • Value: "|22|windows_version|22 3a 22|Windows"

  • Value: "|22|country|22 3a 22|"

  • Value: "|22|ip|22 3a 22|"

  • Value: "|22|wallets|22 3a|"

  • Value: "|22|credentials|22 3a|"

  • Value: "|22|software|22 3a|"

  • Value: "|22|file|22 3a|"

  • Value: !"Referer|3a 20|"

Within:

PCRE: "/\x22hwid\x22\x3a\x22[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\x22/P"

Special Options:

  • http_method

  • http_uri

  • http_header

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

source