Update malware.rules

abhinavbom · Nov 19, 2015 · 6f2e1a6 · 6f2e1a6
1 parent 7dfee21
commit 6f2e1a6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/malware.rules b/malware.rules
@@ -1,3 +1,9 @@
+*/Ghost RAT
+*/
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET 201 (msg:"Gh0stRAT malware v3.6 June 2015 check-in "; flow:to_server,established; 
+content:"|63 6c 61 72 6b 63 6c 61 72 31|"; depth:10; sid:1; rev:1;)
+
 */Submitted September 6 2015
 */
 alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN W32/Boaxxe.Downloader CnC Beacon"; flow:established,