Signature Detail

SCAN: Canvas Helium Agent

This signature detects Helium, a python-based Trojan installed after a system is exploited by the Canvas Framework from Immunitysec. By default, Canvas uses port 31337, but an attacker can configure Canvas to use any port. Remote attackers can use the Helium Trojan to gain full access to the infected host, including loading programs such as port scanners, exploits, and distributed computing modules.

Extended Description

The Helium trojan allows an attacker to gain full access to an infected server, and to load programs.

References

• URL: http://www.immunitysec.com/products-hydrogen.shtml