Versions (2)
Version DetailsCurrent
Rev: 2 • Aug 8, 2024, 12:00 PM🐾 - 🚨 Suspicious Windows 11 🪟 TLSv1 connection to reallyfreegeoip.org service - Possible public IP address gathering 👀 - T1590.005 - Seen in 🐍 SnakeKeylogger ⌨ attack
alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"🐾 - 🚨 Suspicious Windows 11 🪟 TLSv1 connection to reallyfreegeoip.org service - Possible public IP address gathering 👀 - T1590.005 - Seen in 🐍 SnakeKeylogger ⌨ attack"; flow:to_server, stateless; ja3.hash; content:"8fffe46776bf62f45716b436b6dbc131"; fast_pattern; ssl_version:tls1.0; tls_sni; content:"reallyfreegeoip.org"; nocase; reference:url,https://attack.mitre.org/techniques/T1590/005/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger; reference:url,https://samples.vx-underground.org/Papers/Malware%20Defense/Malware%20Analysis/2024/2024-06-30%20-%20Deep%20Analysis%20of%20Snake%20(404%20keylogger).pdf; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0043, mitre_tactic_name Reconnaissance, mitre_technique_id T1590_05, mitre_technique_name Gather_Victim_Network_Information_IP_Addresses, created_at 2024_08_08, updated_at 2024_08_14; sid:3321325; rev:2; classtype:external-ip-check;)
Aug 8, 2024, 12:00 PM
Aug 14, 2024, 12:00 PM
Aug 8, 2024, 10:00 PM
May 29, 2025, 11:12 PM
rules/PAW-PATRULES_MALWARES.rules