Versions (5)
Version DetailsCurrent
Rev: 5 • Mar 14, 2014, 12:00 PMET MALWARE Possible Netwire RAT Client HeartBeat S1 (no alert)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Netwire RAT Client HeartBeat S1 (no alert)"; flow:established,from_server; dsize:5; content:"|01 00 00 00 01|"; flowbits:isset,ET.Netwire.HB; flowbits:isnotset,ET.Netwire.HB.2; flowbits:unset,ET.Netwire.HB; flowbits:set,ET.Netwire.HB.2; flowbits:noalert; reference:md5,154a2366cd3e39e8625f5f737f9da8f1; reference:md5,9475f91a426ac45d1f074373034cbea6; classtype:trojan-activity; sid:2018282; rev:5; metadata:created_at 2014_03_14, confidence Medium, signature_severity Major, updated_at 2024_04_26;)
Mar 14, 2014, 12:00 PM
Apr 26, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules