Versions (8)
Version DetailsCurrent
Rev: 2 • Oct 9, 2025, 2:49 PMKEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram
alert http any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/sendMessage?chat_id="; content:"&text="; distance:0; content:"PC Name|3a|"; within:16; fast_pattern; content:"Country Name|3a|"; distance:0; content:"Clicked on the File"; distance:0; http.host; content:"api.telegram.org"; startswith; isdataat:!1, relative; threshold:type limit, track by_dst, count 1, seconds 120; reference:url, https://www.virustotal.com/gui/file/bcade8f76366bc86315e2775770083a82a5f1ca9344d03be5ef52616dcceaea8/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012139; rev:2;)
Oct 9, 2025, 2:49 PM
Feb 13, 2026, 3:29 PM
Oct 16, 2025, 10:34 AM
Mar 2, 2026, 1:34 PM
rules/ptopen-malware.rules