ET MALWARE Rhadamanthys Stealer - Payload Download Request

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Rhadamanthys Stealer - Payload Download Request";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.header_names;
    content:"|0d 0a|X-CSRF-TOKEN|0d 0a|Cookie|0d 0a 0d 0a|"; endswith;
    http.cookie;
    content:"CSRF-TOKEN="; startswith;
    content:"==|3b 20|LANG=en-US"; distance:86; within:15; endswith;
    http.header.raw;
    pcre:"/X-CSRF-TOKEN\x3a\x20(?P<string>[a-zA-Z0-9\+\/]{86}\x3d\x3d)[\r\n]+Cookie\x3a\x20CSRF-TOKEN\x3d(?P=string)\x3b\x20LANG\x3den-US[\r\n]+$/D";
    reference:url,threatmon.io/rhadamanthys-stealer-analysis-threatmon/;
    reference:md5,6c7f6d2ac093abd0edcd16e29de79dd5;
    classtype:command-and-control;
    sid:2043202; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2023_01_04, deployment Perimeter, malware_family Rhadamanthys, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_04;
)