ET MALWARE PyRation Variant - Configuration Request

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE PyRation Variant - Configuration Request";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri; bsize:14;
    content:"/client/config"; fast_pattern;
    http.user_agent;
    content:"python-requests/"; startswith;
    http.header_names;
    content:"|0d 0a|identity|0d 0a|";
    reference:url,www.stratosphereips.org/blog/2024/2/23/analysis-and-understanding-of-malware-of-the-pyration-family;
    reference:url,github.com/stratosphereips/Malware-CC-Recovery/blob/main/README.md;
    reference:md5,45038b5cb3575f4cc43abe758544bf23;
    classtype:command-and-control;
    sid:2051082; rev:1;
    metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2024_02_26, deployment Perimeter, malware_family PyRation, performance_impact Low, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_26;
    target:src_ip;
)