Versions (3)
Version DetailsCurrent
Rev: 8 • Oct 23, 2012, 12:00 PMET MALWARE Smoke Loader C2 Response
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Smoke Loader C2 Response"; flow:established,to_client; http.content_len; bsize:1; content:"4"; file.data; content:"Smk"; startswith; fast_pattern; pcre:"/^\d+[\r\n]*?$/Rs"; classtype:command-and-control; sid:2015835; rev:8; metadata:created_at 2012_10_23, signature_severity Major, updated_at 2024_02_23;)
Oct 23, 2012, 12:00 PM
Feb 23, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules