ET RETIRED BlackshadesRAT Reporting

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET RETIRED BlackshadesRAT Reporting";
    flow:established,to_server;
    http.method;
    content:"GET"; nocase;
    http.uri;
    content:"/alive.php?"; nocase;
    content:"key="; nocase;
    content:"pcuser="; nocase;
    content:"pcname="; nocase;
    content:"hwid="; nocase;
    content:"country="; nocase;
    reference:md5,85a9f25c9b6614a8ad16dd7f3363a247;
    classtype:trojan-activity;
    sid:2012587; rev:7;
    metadata:tls_state plaintext, created_at 2011_03_28, former_category MALWARE, confidence High, signature_severity Major, updated_at 2024_12_05;
    target:src_ip;
)