Versions (4)
Version DetailsCurrent
Rev: 2 • Nov 18, 2014, 12:00 PMET MALWARE AlienSpy RAT Checkin Set
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AlienSpy RAT Checkin Set"; flow:established,to_server; dsize:4; content:"|ac ed|"; depth:2; flowbits:set,ET.rat.alienspy; flowbits:noalert; reference:url,contagiodump.blogspot.com/2014/11/alienspy-java-rat-samples-and-traffic.html?m=1; classtype:command-and-control; sid:2019738; rev:2; metadata:created_at 2014_11_18, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Nov 18, 2014, 12:00 PM
Jul 26, 2019, 12:00 PM
Nov 18, 2014, 12:00 PM
Dec 16, 2025, 10:34 PM
rules/emerging-malware.rules