""ET TROJAN NanoCore RAT Keepalive Response 2""
SID: 2046910
Revision: 10
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2015_03_27, deployment Perimeter, malware_family NanoCore, performance_impact Significant, signature_severity Major, updated_at 2023_07_26, former_sid 2810291
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: [!9000,!9001,!9002,!9003,!9004,!2032,1024:]
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "|21 00 00 00|" Depth: 4
-
Value: !"|00 00 00 00|"
-
Value: !"|0d 00|"
Within: 2
PCRE:
Special Options: