Snort mailing list archives
Re: Remcos RAT 2.0.4 Pro sig
From: Marcos Rodriguez <mrodriguez () sourcefire com>
Date: Tue, 3 Jul 2018 12:00:07 -0400
On Fri, Jun 29, 2018 at 8:44 PM, James Lay via Snort-sigs < snort-sigs () lists snort org> wrote:
Meh: alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ETPRO TROJAN Remcos RAT Checkin 22"; flow:established,to_server; dsize:<500; content:"|57 40 cb 6d e6 5f 6d 51 4e e7 62|"; depth:11; fast_pattern; content:"|dd ec|"; distance:2; within:2; threshold:type limit, seconds 30, count 1, track by_src; metadata: former_category TROJAN; reference:md5, 3aa4743d13b7de4437e52a5fbda2e799; classtype:trojan-activity; sid:XXXXXXXXX; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag RAT, signature_severity Major, created_at 2018_06_29, malware_family Remcos, performance_impact Low, updated_at 2018_06_29;) 265173fbff235330fd50e1d41fb6c2efc2ef523eeacc774ce618b247ee97b140 on HA
Hiya James, Thanks for submitting this rule. We will review and test the rule and get back to you when it's finished. Sincerely, -- Marcos Rodriguez Cisco Talos
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Re: Remcos RAT 2.0.4 Pro sig Marcos Rodriguez (Jul 03)