Versions (6)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMLOADER [PTsecurity] SafeRAT FB set SafeRAT_loader
alert http any any -> any any (msg:"LOADER [PTsecurity] SafeRAT FB set SafeRAT_loader"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/"; startswith; pcre:"/^([a-zA-Z]{1,10}\.txt|payload\.bin)$/UR"; http.header_names; content:"|0d 0a|Connection|0d 0a|Host|0d 0a 0d 0a|"; content:!"Content"; content:!"Accept"; content:!"User-Agent"; content:!"Referer"; flowbits:set, SafeRAT_loader; flowbits:noalert; reference:url, https://www.virustotal.com/gui/file/859e09a10260c646d2864c1f718c551ea566e8612f47979e6de4076c480c8cbc/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011879; rev:1;)
Oct 9, 2025, 2:49 PM
Oct 9, 2025, 2:49 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-malware.rules