Rule History

SID: 10012001 • Source: ptrules/open

Versions (7)

Version DetailsCurrent

Rev: 2 • Oct 9, 2025, 2:49 PM

Message:

LOADER [PTsecurity] AllaKore

Rule:

alert tcp any any -> any any (msg:"LOADER [PTsecurity] AllaKore"; flow:established, to_server; dsize:100<>200; stream_size:server, <, 3; stream_size:client, <, 201; base64_decode:bytes 100; base64_data; content:"pyCodeV16"; depth:9; content:"*NEW"; distance:0; content:"|20 7c 20|"; distance:0; content:"|20 7c 20|"; distance:0; reference:url, https://tria.ge/240918-mvh45swfkf/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012001; rev:2;)

Created:

Oct 9, 2025, 2:49 PM

Updated:

Oct 9, 2025, 2:49 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-malware.rules