""ET TROJAN TA427 Outlook Stealer Loader""

SID: 2054223

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_07_02, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, updated_at 2024_07_02

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "CreateObject|28 22|Scripting|2e|FileSystemObject|22 29|"

  • Value: "CreateObject|28 22|WScript|2e|Shell|22 29|"

  • Value: "Function|20|Stream|5f|BinaryToString|28|Binary|29|"

  • Value: "Const|20|adTypeText|20 3d 20|2"

  • Value: "Set|20|BinaryStream|20 3d 20|CreateObject|28 22|ADODB|2e|Stream|22 29|"

  • Value: "|27|Specify|20|stream|20|type|20 2d 20|we|20|want|20|To|20|save|20|binary|20|data|2e|"

  • Value: "CreateObject|28 22|Msxml2|2e|DOMDocument|2e|3|2e|0|22 29|"

  • Value: "SpecialFolders|28 22|appdata|22 29|"

  • Value: "BinaryStream|2e|CharSet|20 3d 20 22|Windows|2d|1252|22|"

Within:

PCRE:

Special Options:

  • file_data

source