alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN eCh0raix/QNAPCrypt Successful Server Response"; flow:established,from_server; flowbits:isset,ET.QNAPCrypt.DetailReq; content:"HTTP/1.1 200 OK|0d 0a|"; depth:17; content:"Content-Type|3a 20|application/json"; distance:0; content:"|7b 22|RsaPublicKey|22 3a 22|-----BEGIN RSA PUBLIC KEY"; content:"|22 7d 2c 7b 22|BtcPublicKey|22 3a 22|"; fast_pattern; content:"|22 7d 2c 7b 22|Readme|22 3a 22|"; metadata: former_category TROJAN; reference:url,; classtype:trojan-activity; sid:2027705; rev:1; metadata:attack_target IoT?, deployment Perimeter, signature_severity Major, created_at 2019_07_11, performance_impact Low, updated_at 2019_07_11;)

Added 2019-07-11 18:37:22 UTC

Topic revision: r1 - 2019-07-11 - TWikiGuest
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats