""ET TROJAN CHAOS RAT/AlfaC2 CnC Server Status Check""

SID: 2046873

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_and_Server, created_at 2023_07_20, deployment Perimeter, malware_family CHAOS, performance_impact Low, confidence Medium, signature_severity Critical, tag RemoteAccessTool, updated_at 2023_11_27

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: ".eyJhdXRob3JpemVkIj"

  • Value: "/health"

  • Value: "User-Agent|3a 20|Go-http-client/"

  • Value: "jwt=" Depth: 4

  • Value: ".eyJhdXRob3JpemVkIj"

  • Value: !"|3b|"

  • Value: "Content-Type|3a 20|application/json|0d 0a|"

Within:

PCRE:

Special Options:

  • http_uri

  • http_header

  • http_cookie

  • http_cookie

  • http_cookie

  • http_header

source