alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KimJongRAT cnc exe pull"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"subject="; nocase; depth:8; content:"&data="; nocase; pcre:"/^subject=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_(?:(?:list|que)_done|ini(?:_done)?)&data/"; reference:url,malware.lu/Pro/RAP003_KimJongRAT-Stealer_Analysis.1.0.pdf; classtype:command-and-control; sid:2017009; rev:6; metadata:created_at 2013_06_13, signature_severity Major, updated_at 2020_04_24;)