Rule History

SID: 2049873 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 1 • Jan 2, 2024, 12:00 PM

Message:

ET MALWARE Kimsuky APT Related Win32/RftRAT Activity

Rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Kimsuky APT Related Win32/RftRAT Activity"; flow:established,to_server; dsize:580; content:"|ef a7 3d 96|"; startswith; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; endswith; reference:md5,093608a2d6eb098eb7ea917cc22e9998; reference:md5,a2b3fbd4da7a46e1b77da04b858ed7af; reference:md5,c55da826e50e2615903607e61968778f; classtype:trojan-activity; sid:2049873; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_01_02, deployment Perimeter, malware_family Win32_RftRAT, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_02; target:src_ip;)

Created:

Jan 2, 2024, 12:00 PM

Updated:

Jan 2, 2024, 12:00 PM

DB Created:

Jan 2, 2024, 10:00 PM

DB Updated:

Aug 15, 2025, 8:34 PM

Filename:

rules/emerging-malware.rules