Versions (4)
Version DetailsCurrent
Rev: 1 • Sep 29, 2020, 12:00 PMET MALWARE Vicious Panda CnC Activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vicious Panda CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/tel/1214"; startswith; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|Pragma|0d 0a|Accept|0d 0a 0d 0a|"; bsize:26; http.accept; content:"image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*"; bsize:56; reference:md5,3009db32ca8895a0f15f724ba12a6711; reference:url,research.checkpoint.com/2020/vicious-panda-the-covid-campaign/; reference:url,twitter.com/dewan202/status/1244595728175030272; classtype:command-and-control; sid:2030921; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_09_29, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_29;)
Sep 29, 2020, 12:00 PM
Sep 29, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 16, 2025, 8:36 PM
rules/emerging-malware.rules