Versions (2)
Version DetailsCurrent
Rev: 1 • Jul 20, 2023, 12:00 PMET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check"; flow:established,to_server; http.uri; bsize:7; content:"/health"; http.user_agent; content:"Go-http-client/"; startswith; http.content_type; bsize:16; content:"application/json"; http.cookie; content:"jwt="; startswith; content:".eyJhdXRob3JpemVkIj"; fast_pattern; distance:0; content:!"|3b|"; distance:0; reference:md5,d0ea84204096109f18a2201fae1c4f30; reference:url,github.com/tiagorlampert/CHAOS; classtype:command-and-control; sid:2046873; rev:1; metadata:attack_target Client_and_Server, created_at 2023_07_20, deployment Perimeter, malware_family CHAOS, performance_impact Low, confidence Medium, signature_severity Critical, tag RemoteAccessTool, updated_at 2023_11_27; target:src_ip;)
Jul 20, 2023, 12:00 PM
Nov 27, 2023, 12:00 PM
Jul 21, 2023, 12:00 AM
May 31, 2024, 9:00 PM
rules/emerging-malware.rules