""ET TROJAN [PTsecurity] QRat.Java.RAT (state_alive)""

SID: 2025391

Revision: 2

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_02_26, deployment Perimeter, malware_family QRat, signature_severity Major, tag Qrat, updated_at 2018_02_26

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: !$HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "|00 11 7b 22 73 74 61 74 65 22 3a 22 61 6c 69 76 65 22 7d|" Depth: 19

Within:

PCRE:

Special Options:

source