ET MALWARE GhostPenguin C2 Beacon Observed

alert udp $HOME_NET any -> any 53 (
    msg:"ET MALWARE GhostPenguin C2 Beacon Observed";
    dsize:34;
    content:"|22 00|FFFFFFFFFFFFFFFF|04|"; startswith;
    reference:url,www.trendmicro.com/en_us/research/25/l/ghostpenguin.html;
    reference:md5,7d3bd0d04d3625322459dd9f11cc2ea3;
    classtype:trojan-activity;
    sid:2066686; rev:1;
    metadata:affected_product Linux, attack_target Client_and_Server, created_at 2026_01_12, deployment Perimeter, deployment Internal, malware_family GhostPenguin, performance_impact Low, confidence High, signature_severity Major, updated_at 2026_01_12, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;
)