Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL MaaS Toolkit PureRAT v4.1.9 Protocol Preamble Before TLS to Confirmed C2 Ports

SID: 1900062Rev: 1Enabled1 viewsHistory
Filehunters-ledger.rules
CreatedMarch 17, 2026
UpdatedMarch 17, 2026
Classificationtrojan-activity
alert tcp $HOME_NET any -> 185.49.126.140 [56001,56002,56003] (msg:"THL MaaS Toolkit PureRAT v4.1.9 Protocol Preamble Before TLS to Confirmed C2 Ports"; flow:established,to_server; content:"|04 00 00 00|"; depth:4; threshold:type limit,track by_src,count 1,seconds 300; classtype:trojan-activity; sid:1900062; rev:1; metadata:author "The Hunters Ledger", created_at 2026_03_17, malware_family PureRAT, confidence high, mitre_technique T1573.002;)

Metadata

author"The Hunters Ledger"
created at2026_03_17
malware familyPureRAT
confidencehigh
mitre techniqueT1573.002

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!