""ET TROJAN Rhadamanthys Stealer - Payload Download Request""

SID: 2043202

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_01_04, deployment Perimeter, malware_family Rhadamanthys, performance_impact Low, signature_severity Major, updated_at 2023_01_04

Reference:

  • md5

  • 6c7f6d2ac093abd0edcd16e29de79dd5

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "X-CSRF-TOKEN|3a 20|"

  • Value: "Cookie|3a 20|"

  • Value: "CSRF-TOKEN=" Depth: 11

  • Value: "==|3b 20|LANG=en-US"

Within: 15

PCRE: "/X-CSRF-TOKEN\x3a\x20(?P[a-zA-Z0-9+\/]{86}\x3d\x3d)[\r\n]+Cookie\x3a\x20CSRF-TOKEN\x3d(?P=string)\x3b\x20LANG\x3den-US[\r\n]+$/D"

Special Options:

  • http_method

  • http_header

  • http_header

  • http_cookie

  • http_cookie

source