ET MALWARE Golang/Linux Kaiji Variant Activity

Query · suricata

flow:established,to_server;
dsize:200<>260;
content:"|5e 57 26 61 37 72 25 38 67 50 33 71 38 49 6e 6d 70 42 52 63 25 73 67 43 64 6f 7a 54 74 32 34 72 66 69 32 58 35 45 38 54 6b 75 48 23 5a 30 4d 35 57 45|"; startswith; fast_pattern;
target:src_ip;
Raw source ET MALWARE Golang/Linux Kaiji Variant Activity · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET 1024: (
    msg:"ET MALWARE Golang/Linux Kaiji Variant Activity";
    flow:established,to_server;
    dsize:200<>260;
    content:"|5e 57 26 61 37 72 25 38 67 50 33 71 38 49 6e 6d 70 42 52 63 25 73 67 43 64 6f 7a 54 74 32 34 72 66 69 32 58 35 45 38 54 6b 75 48 23 5a 30 4d 35 57 45|"; startswith; fast_pattern;
    reference:md5,69eb788e6982a765472eb77c5c697688;
    reference:md5,630a21057c70a10fcf1162846d05e245;
    reference:md5,416e1a8b5b998a8290abe090a5e5ece8;
    reference:url,twitter.com/suyog41/status/1636329384947720196;
    classtype:trojan-activity;
    sid:2044667; rev:1;
    metadata:attack_target Linux_Unix, created_at 2023_03_17, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_17;
    target:src_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.