Versions (6)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMWORM [PTsecurity] Expiro
alert tcp any any -> $EXTERNAL_NET any (msg:"WORM [PTsecurity] Expiro"; flow:established, to_server; stream_size:client, <, 80; stream_size:client, >, 50; stream_size:server, <, 3; content:"|17 00 00 00 af b0 f3 aa f1 98 b0 ff|"; depth:12; reference:url, https://tria.ge/240229-lbqt7scg95/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011031; rev:1;)
Oct 9, 2025, 2:49 PM
Oct 9, 2025, 2:49 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-malware.rules