Versions (4)
Version DetailsCurrent
Rev: 1 • Mar 11, 2021, 12:00 PMET MALWARE ELF/RedXOR CnC Checkin
alert http [$HOME_NET,$HTTP_SERVERS] any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF/RedXOR CnC Checkin"; flow:established,to_server; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi"; http.method; content:"POST"; http.content_len; content:"00000"; startswith; http.header; content:"Total-Length|3a 20|00000"; fast_pattern; reference:url,www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/; classtype:command-and-control; sid:2031934; rev:1; metadata:affected_product Linux, attack_target Client_and_Server, created_at 2021_03_11, deployment Perimeter, malware_family RedXOR, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_11;)
Mar 11, 2021, 12:00 PM
Mar 11, 2021, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 15, 2025, 9:36 PM
rules/emerging-malware.rules