ET MALWARE Win32/WinDealer CnC Activity (Checkin)

Query · suricata

dsize:<200;
content:"|06 81 da 91 ce c7 9f 43|"; startswith; fast_pattern;
content:"|14 00|"; distance:4; within:4;
Raw source ET MALWARE Win32/WinDealer CnC Activity (Checkin) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (
    msg:"ET MALWARE Win32/WinDealer CnC Activity (Checkin)";
    dsize:<200;
    content:"|06 81 da 91 ce c7 9f 43|"; startswith; fast_pattern;
    content:"|14 00|"; distance:4; within:4;
    reference:url,blogs.jpcert.or.jp/en/2021/10/windealer.html;
    reference:md5,5a7a90ceb6e7137c753d8de226fc7947;
    classtype:trojan-activity;
    sid:2034254; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2021_10_26, deployment Perimeter, malware_family Win32_WinDealer, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.