ET MALWARE Snake rootkit usermode-centric encrypted command from server
Sourceet/open
CreatedMarch 11, 2014
UpdatedAugust 6, 2020
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Snake rootkit usermode-centric encrypted command from server"; flow:to_client,established; http.stat_code; content:"200"; file.data; content:"|01 00 00 00 00 00 00 00|1dM3uu4j7Fw4sjnb"; fast_pattern; reference:url,info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf; classtype:trojan-activity; sid:2018248; rev:4; metadata:created_at 2014_03_11, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_06;)
Metadata
created at2014_03_11
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2020_08_06
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!