Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- h/t @0xE9FBFFFFFF for the intel on botnet ID
- alert tcp any any -> any 443 (msg:"Danabot x86 Checkin"; flow:established,to_server; dsize:<240; content:"|FF FF FF FF 54 04 00 00|"; rawbytes; depth:57; content:"|00 00 00 01 00 00 00|"; rawbytes; offset:1; content:"|00 00 00 20 00 00 00|"; offset:5; classtype:trojan-activity; sid:20166258; rev:2; metadata:created_at 2018_09_20;)
- alert tcp any any -> any 443 (msg:"Danabot x64 Checkin"; flow:established,to_server; dsize:<240; content:"|FF FF FF FF 54 04 00 00|"; rawbytes; depth:57; content:"|00 00 00 01 00 00 00|"; rawbytes; offset:1; content:"|00 00 00 40 00 00 00|"; offset:5; classtype:trojan-activity; sid:20166259; rev:2; metadata:created_at 2018_09_20;)
Advertisement
Add Comment
Please, Sign In to add comment
