#by Mat Jonkman, from sandnet analysis
# some kind of c&c, needs more research, but these sigs are reliable
alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Trojan.Win32.Qhost C&C Traffic Outbound (case1)”; flow:established; dsize:>1000; content:”|00 00 00 28 0a 00 00 02 0f|Service Pack 1|00|”; classtype:trojan-activity; reference:url,/www.viruslist.com/en/viruses/encyclopedia?virusid=142254; sid:2007578; rev:1;)
alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Trojan.Win32.Qhost C&C Traffic Outbound (case2)”; flow:established; dsize:>1000; content:”|00 00 00 28 0a 00 00 02 0f|Service Pack 2|00|”; classtype:trojan-activity; reference:url,/www.viruslist.com/en/viruses/encyclopedia?virusid=142254; sid:2007579; rev:1;)
alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Trojan.Win32.Qhost C&C Traffic Inbound (case1)”; flow:established; dsize:>1000; content:”|00 00 00 28 0a 00 00 02 0f|Service Pack 1|00|”; classtype:trojan-activity; reference:url,/www.viruslist.com/en/viruses/encyclopedia?virusid=142254; sid:2007580; rev:1;)
alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:”BLEEDING-EDGE TROJAN Trojan.Win32.Qhost C&C Traffic Inbound (case2)”; flow:established; dsize:>1000; content:”|00 00 00 28 0a 00 00 02 0f|Service Pack 2|00|”; classtype:trojan-activity; reference:url,/www.viruslist.com/en/viruses/encyclopedia?virusid=142254; sid:2007581; rev:1;)

The C&C channel is interesting, please report any hits, or let me know if you notice something else unique in samples.

Matt

This entry was posted on Monday, August 27th, 2007 at 5:03 am and is filed under General, New Rules. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.