Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M3"; flow:established,to_server; content:"|16 03 01 00 ee 01 00 00 ea 03 03|"; offset:3; depth:11; fast_pattern; content:"|20|"; distance:32; within:1; content:"|00 26|"; distance:32; within:2; content:"|c0|"; distance:4; within:1; content:"|c0|"; distance:1; within:1; content:"|c0 09 c0 13 c0 0a c0 14 00 9c 00 9d 00 2f 00 35 c0 12 00 0a 13|"; distance:5; within:21; content:"|13|"; distance:1; within:1; content:"|13|"; distance:1; within:1; content:"|01 00 00 7b 00 05 00 05 01 00 00 00 00 00 0a 00 0a 00 08 00 1d 00 17 00 18 00 19 00 0b 00 02 01 00 00 0d 00 1a 00 18 08 04 04 03 08 07 08 05 08 06 04 01 05 01 06 01 05 03 06 03 02 01 02 03 ff 01 00 01 00 00 12 00 00 00 2b 00 09 08 03 04 03 03 03 02 03 01 00 33 00 26 00 24 00 1d 00 20|"; distance:1; within:95; content:"|14 03 03 00 01 01 17 03 03 00 35|"; distance:32; within:11; content:"|17 03 03 00|"; distance:53; within:4; threshold:type limit,track by_dst,seconds 1300, count 1; reference:md5,f0f69284967de298d89cad5585dafd15; reference:url,app.any.run/tasks/b3ef48ea-2f47-49bb-9eff-70fcae8bf366; classtype:command-and-control; sid:2046950; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_07_27, deployment Perimeter, malware_family hydrochasma, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_31;)