""ET TROJAN [ANY.RUN] RadX RAT Keep-Alive Activity (POST)""

SID: 2050420

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2024_01_24, deployment Perimeter, confidence High, signature_severity Critical, updated_at 2024_01_24

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: 1024:

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "|20|/check/-"

• Value: "Content-Length|3a 20|0|0d 0a|"

Within:

PCRE: "/\r\nHost[^\r\n]+\r\nContent-Length[^\r\n]+\r\n\r\n/"

Special Options:

• fast_pattern

source