Versions (6)
Version DetailsCurrent
Rev: 8 • Dec 23, 2014, 12:00 PMET MALWARE Win32/Spy.Agent.OHT - AnunakAPT HTTP Checkin 1
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Spy.Agent.OHT - AnunakAPT HTTP Checkin 1"; flow:established,to_server; urilen:>100; flowbits:set,ET.Anunanak.HTTP.1; content:"Accept|3a 20 2a 2f 2a 0d 0a 0d 0a|"; fast_pattern; http.user_agent; pcre:"/(?: MSIE |rv\x3a11)/"; http.method; content:"GET"; http.uri; pcre:"/^[a-zA-Z0-9=/&?\x2e-]+$/"; http.host; content:!".imodules.com"; http.header_names; content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a|Accept|0d 0a 0d 0a|"; depth:30; endswith; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; classtype:targeted-activity; sid:2020027; rev:8; metadata:created_at 2014_12_23, deprecation_reason Performance, malware_family Win32_Spy_Agent_OHT, performance_impact Significant, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_08;)
Dec 23, 2014, 12:00 PM
Apr 8, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 13, 2025, 9:34 PM
rules/emerging-malware.rules