Versions (3)
Version DetailsCurrent
Rev: 1 • Apr 3, 2024, 12:00 PMET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity
alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity"; flow:established,to_server; dsize:26; content:"|00 00 00 00 15 00 7b 22 54 79 70 65 22 3a 22 41 66 6b 53 79 73 74 65 6d 22 7d|"; fast_pattern; reference:md5,befd0a5f55e4b7ee61490100f71db919; reference:md5,c14742d3e34478e71f9a701392d97967; reference:md5,befd0a5f55e4b7ee61490100f71db919; reference:md5,e366af3563aaa5cb7d8f61b028bb6905; classtype:trojan-activity; sid:2051910; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2024_04_03, deployment Perimeter, performance_impact Low, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_03; target:src_ip;)
Apr 3, 2024, 12:00 PM
Apr 3, 2024, 12:00 PM
Apr 10, 2024, 9:04 PM
Aug 12, 2025, 9:34 PM
rules/emerging-malware.rules