ET MALWARE ZeroTrace CnC Server Settings Inbound

alert tcp $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE ZeroTrace CnC Server Settings Inbound";
    flow:established,to_client;
    content:"|50 4b 03 04|";
    content:"ip.txt";
    content:"inj.txt";
    content:"uac.txt";
    content:"downloadexecute.txt"; fast_pattern;
    content:"port.txt";
    reference:md5,ab3ecc662732ece57ff6d35440061c1a;
    classtype:command-and-control;
    sid:2066801; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state plaintext, created_at 2026_01_16, deployment Perimeter, malware_family ZeroTrace, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_16, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1095, mitre_technique_name Non_Application_Layer_Protocol;
    target:dest_ip;
)