[Snort-sigs] Remcos RAT 2.0.4 Pro sig

James Lay jlay at slave-tothe-box.net
Fri Jun 29 20:44:48 EDT 2018


Meh:
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ETPRO TROJAN Remcos
RAT Checkin 22"; flow:established,to_server; dsize:<500; content:"|57
40 cb 6d e6 5f 6d 51 4e e7 62|"; depth:11; fast_pattern; content:"|dd
ec|"; distance:2; within:2; threshold:type limit, seconds 30, count 1,
track by_src; metadata: former_category TROJAN;
reference:md5,3aa4743d13b7de4437e52a5fbda2e799; classtype:trojan-
activity; sid:XXXXXXXXX; rev:1; metadata:affected_product
Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target
Client_Endpoint, deployment Perimeter, tag RAT, signature_severity
Major, created_at 2018_06_29, malware_family Remcos, performance_impact
Low, updated_at 2018_06_29;)
265173fbff235330fd50e1d41fb6c2efc2ef523eeacc774ce618b247ee97b140 on HA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20180629/2186bcc9/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot from 2018-06-29 18-43-51.png
Type: image/png
Size: 64898 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20180629/2186bcc9/attachment-0001.png>


More information about the Snort-sigs mailing list