MALWARE [PTsecurity] Pegasus (Buhtrap/Ratopak) C2 connection

SID: 10003298Rev: 10 views
Sourceptresearch/attackdetection
CreatedDecember 13, 2021
UpdatedDecember 13, 2021
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"MALWARE [PTsecurity] Pegasus (Buhtrap/Ratopak) C2 connection"; flow:established, to_server; content:"POST"; http_method; content:".php"; http_uri; content:"Content-Type: multipart/form-data|3b| boundary="; http_header; pcre:"/^[0-9a-f]{12}\r\n/RH"; content:"Content-Type: application/octet-stream"; http_client_body; content:"Content-Disposition: form-data|3b| name=|22|"; http_client_body; pcre:"/^[a-z]{8,14}\x22\r\nContent-Type: application/octet-stream\r\n\r\n(.{192}){1,2}\r\n--[0-9a-z]{12}--/RPs"; pcre:"/[\x0e-\x19\x80-\xff]{4}/P"; classtype:trojan-activity; reference:url, github.com/ptresearch/AttackDetection; sid:10003298; rev:1;)

References

urlgithub.com/ptresearch/AttackDetection

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!