################################################################
# ThreatFox IOCs: Suricata rules                               #
# Last updated: 2024-10-07 16:04:19 UTC                        #
#                                                              #
# Terms Of Use: https://threatfox.abuse.ch/faq/#tos            #
# For questions please contact threatfox [at] abuse.ch         #
################################################################
#
alert tcp $HOME_NET any -> [62.122.184.145] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334476/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334476; rev:1;)
alert tcp $HOME_NET any -> [62.113.200.103] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334475/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334475; rev:1;)
alert tcp $HOME_NET any -> [3.111.63.221] 443  (msg:"ThreatFox PoshC2 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334474/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334474; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.191] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334473/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334473; rev:1;)
alert tcp $HOME_NET any -> [137.184.141.171] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334472/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334472; rev:1;)
alert tcp $HOME_NET any -> [202.95.213.49] 39685  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334471/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334471; rev:1;)
alert tcp $HOME_NET any -> [202.95.213.49] 7397  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334470/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334470; rev:1;)
alert tcp $HOME_NET any -> [46.246.84.10] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334469/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334469; rev:1;)
alert tcp $HOME_NET any -> [23.94.2.159] 56788  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334468/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334468; rev:1;)
alert tcp $HOME_NET any -> [3.71.225.231] 17846  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334467/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334467; rev:1;)
alert tcp $HOME_NET any -> [180.64.110.203] 6522  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334466/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334466; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"dl07.ru"; depth:7; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334465/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_07; classtype:trojan-activity; sid:91334465; rev:1;)
alert tcp $HOME_NET any -> [18.153.198.123] 17846  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334464/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334464; rev:1;)
alert tcp $HOME_NET any -> [3.74.27.83] 17846  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334463/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334463; rev:1;)
alert tcp $HOME_NET any -> [18.192.31.30] 17846  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334462/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334462; rev:1;)
alert tcp $HOME_NET any -> [52.57.120.10] 17846  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334461/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334461; rev:1;)
alert tcp $HOME_NET any -> [91.151.89.158] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334460/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/35a0cc935e7ac588.php"; depth:21; nocase; http.host; content:"185.219.81.41"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334459/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"souguru.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334453/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334453; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"souguru.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334454/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"souguru.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334455/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"souguru.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334456/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"souguru.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334457/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334457; rev:1;)
alert tcp $HOME_NET any -> [77.232.36.155] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334458/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334458; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"*.outfit.dianamercer.com"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334451/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334451; rev:1;)
alert tcp $HOME_NET any -> [198.98.48.223] 443  (msg:"ThreatFox FAKEUPDATES botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334452/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/x.htm"; depth:6; nocase; http.host; content:"kuechenundmehr.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334450/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334450; rev:1;)
alert tcp $HOME_NET any -> [47.53.191.242] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334449/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334449; rev:1;)
alert tcp $HOME_NET any -> [103.116.53.12] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334448/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334448; rev:1;)
alert tcp $HOME_NET any -> [62.122.184.144] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334447/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334447; rev:1;)
alert tcp $HOME_NET any -> [154.12.95.219] 606  (msg:"ThreatFox Kaiji botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334446/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334446; rev:1;)
alert tcp $HOME_NET any -> [81.43.25.202] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334445/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334445; rev:1;)
alert tcp $HOME_NET any -> [198.98.58.93] 4333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334444/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334444; rev:1;)
alert tcp $HOME_NET any -> [185.43.4.70] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334443/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334443; rev:1;)
alert tcp $HOME_NET any -> [101.99.92.100] 4899  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334442/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334442; rev:1;)
alert tcp $HOME_NET any -> [42.192.22.70] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334441/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334441; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.196] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334440/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334440; rev:1;)
alert tcp $HOME_NET any -> [139.224.33.120] 20000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334439/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334439; rev:1;)
alert tcp $HOME_NET any -> [107.173.101.38] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334438/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"robotprintmoney.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334427/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334427; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"robotprintmoney.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334428/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"robotprintmoney.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334429/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"robotprintmoney.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334430/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"robotprintmoney.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334431/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"tratoragricola.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334433/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334433; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ahmedyassin.ddns.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334432/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334432; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"tratoragricola.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334434/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"tratoragricola.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334435/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"tratoragricola.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334436/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"tratoragricola.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334437/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334437; rev:1;)
alert tcp $HOME_NET any -> [103.186.116.30] 1111  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334426/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334426; rev:1;)
alert tcp $HOME_NET any -> [45.88.88.45] 34221  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334425/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334425; rev:1;)
alert tcp $HOME_NET any -> [67.220.95.213] 666  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334423/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334423; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"srftjwrty6kew.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334424/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334424; rev:1;)
alert tcp $HOME_NET any -> [72.11.142.133] 4449  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334422/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334422; rev:1;)
alert tcp $HOME_NET any -> [185.237.207.107] 80  (msg:"ThreatFox Socks5 Systemz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334421/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334421; rev:1;)
alert tcp $HOME_NET any -> [193.109.85.245] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334420/; target:src_ip; metadata: confidence_level 60, first_seen 2024_10_07; classtype:trojan-activity; sid:91334420; rev:1;)
alert tcp $HOME_NET any -> [83.136.255.209] 8000  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334419/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334419; rev:1;)
alert tcp $HOME_NET any -> [154.216.17.167] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334418/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334418; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.170] 10337  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334417/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334417; rev:1;)
alert tcp $HOME_NET any -> [5.188.86.69] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334416/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334416; rev:1;)
alert tcp $HOME_NET any -> [47.76.214.226] 9443  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334415/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334415; rev:1;)
alert tcp $HOME_NET any -> [185.36.140.204] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334414/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334414; rev:1;)
alert tcp $HOME_NET any -> [89.23.101.69] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334413/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334413; rev:1;)
alert tcp $HOME_NET any -> [185.43.4.72] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334412/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334412; rev:1;)
alert tcp $HOME_NET any -> [116.203.9.188] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334411/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334411; rev:1;)
alert tcp $HOME_NET any -> [95.164.90.97] 80  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334410/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334410; rev:1;)
alert tcp $HOME_NET any -> [141.98.233.156] 80  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334408/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334408; rev:1;)
alert tcp $HOME_NET any -> [185.43.4.73] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334409/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334409; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"proxy.johnmccrea.com"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334407/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"116.203.9.188"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334405/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334405; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"lade.petperfectcare.com"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334406/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334406; rev:1;)
alert tcp $HOME_NET any -> [154.12.229.73] 1999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334404/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334404; rev:1;)
alert tcp $HOME_NET any -> [134.19.179.179] 19125  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334403/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"proxy.johnmccrea.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334402/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"lade.petperfectcare.com"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334401/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334401; rev:1;)
alert tcp $HOME_NET any -> [121.5.79.178] 443  (msg:"ThreatFox DarkComet botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334400/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334400; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.196] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334399/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334399; rev:1;)
alert tcp $HOME_NET any -> [204.48.21.45] 1312  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334394/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334394; rev:1;)
alert tcp $HOME_NET any -> [194.120.230.54] 118  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334390/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334390; rev:1;)
alert tcp $HOME_NET any -> [192.227.146.254] 302  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334391/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334391; rev:1;)
alert tcp $HOME_NET any -> [69.165.65.90] 118  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334392/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334392; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.45] 59962  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334393/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334393; rev:1;)
alert tcp $HOME_NET any -> [46.8.229.204] 9999  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334388/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334388; rev:1;)
alert tcp $HOME_NET any -> [194.120.230.54] 3778  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334389/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334389; rev:1;)
alert tcp $HOME_NET any -> [94.156.105.122] 2711  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334385/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334385; rev:1;)
alert tcp $HOME_NET any -> [87.120.114.147] 1999  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334386/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334386; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.119] 777  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334387/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334387; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"outfit.dianamercer.com"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334382/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334382; rev:1;)
alert tcp $HOME_NET any -> [152.89.170.31] 38241  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334397/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334397; rev:1;)
alert tcp $HOME_NET any -> [217.15.161.176] 73  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334395/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334395; rev:1;)
alert tcp $HOME_NET any -> [45.88.88.55] 9506  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334396/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334396; rev:1;)
alert tcp $HOME_NET any -> [103.87.10.151] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334398/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334398; rev:1;)
alert tcp $HOME_NET any -> [122.51.175.93] 89  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334384/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334384; rev:1;)
alert tcp $HOME_NET any -> [47.90.157.82] 5555  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334383/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334383; rev:1;)
alert tcp $HOME_NET any -> [101.34.247.145] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334381/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334381; rev:1;)
alert tcp $HOME_NET any -> [147.45.44.73] 33619  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334380/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334380; rev:1;)
alert tcp $HOME_NET any -> [154.83.83.66] 4444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334379/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334379; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"rumerog.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334378/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334378; rev:1;)
alert tcp $HOME_NET any -> [64.176.183.172] 5050  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334357/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334357; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"yi0key.heleh.com.vn"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334358/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"methodbojjewkl.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334377/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334377; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"balukart.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334376/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334376; rev:1;)
alert tcp $HOME_NET any -> [193.109.85.246] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334375/; target:src_ip; metadata: confidence_level 60, first_seen 2024_10_07; classtype:trojan-activity; sid:91334375; rev:1;)
alert tcp $HOME_NET any -> [157.90.150.143] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334374/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334374; rev:1;)
alert tcp $HOME_NET any -> [193.107.109.49] 9999  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334373/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334373; rev:1;)
alert tcp $HOME_NET any -> [77.245.2.142] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334372/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334372; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"vmtaq043.directiq.com"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334371/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334371; rev:1;)
alert tcp $HOME_NET any -> [185.203.67.26] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334370/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334370; rev:1;)
alert tcp $HOME_NET any -> [45.61.152.130] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334369/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334369; rev:1;)
alert tcp $HOME_NET any -> [209.250.252.99] 2255  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334368/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334368; rev:1;)
alert tcp $HOME_NET any -> [78.159.112.29] 1080  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334367/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334367; rev:1;)
alert tcp $HOME_NET any -> [149.88.69.12] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334366/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"meritdiveu.site"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334365/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_07; classtype:trojan-activity; sid:91334365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"cj46058.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334364/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334364; rev:1;)
alert tcp $HOME_NET any -> [217.15.161.176] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334363/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334363; rev:1;)
alert tcp $HOME_NET any -> [185.240.104.220] 8082  (msg:"ThreatFox ERMAC botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334362/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334362; rev:1;)
alert tcp $HOME_NET any -> [216.241.141.4] 8848  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334361/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334361; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.244] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334360/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334360; rev:1;)
alert tcp $HOME_NET any -> [152.67.149.246] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334359/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_07; classtype:trojan-activity; sid:91334359; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"electrum.rostamasadi.website"; depth:28; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334356/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334356; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"stream.rostamasadi.website"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334355/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334355; rev:1;)
alert tcp $HOME_NET any -> [5.42.81.134] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334354/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334354; rev:1;)
alert tcp $HOME_NET any -> [16.163.157.68] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334353/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334353; rev:1;)
alert tcp $HOME_NET any -> [45.11.182.147] 80  (msg:"ThreatFox Socks5 Systemz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334352/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334352; rev:1;)
alert tcp $HOME_NET any -> [85.239.54.36] 5603  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334351/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334351; rev:1;)
alert tcp $HOME_NET any -> [176.126.62.31] 9481  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334350/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334350; rev:1;)
alert tcp $HOME_NET any -> [185.203.67.26] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334349/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334349; rev:1;)
alert tcp $HOME_NET any -> [78.24.220.122] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334348/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334348; rev:1;)
alert tcp $HOME_NET any -> [192.210.229.11] 445  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334347/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334347; rev:1;)
alert tcp $HOME_NET any -> [101.43.125.25] 4567  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334346/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334346; rev:1;)
alert tcp $HOME_NET any -> [82.147.84.252] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334345/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334345; rev:1;)
alert tcp $HOME_NET any -> [47.113.219.193] 11335  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334344/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"bemuzzeki.sbs"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334335/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"epiloggati.sbs"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334336/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"exemplarou.sbs"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334337/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"frizzettei.sbs"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334339/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"exilepolsiy.sbs"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334338/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"invinjurhey.sbs"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334340/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"isoplethui.sbs"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334341/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"laddyirekyi.sbs"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334342/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"wickedneatr.sbs"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334343/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334343; rev:1;)
alert tcp $HOME_NET any -> [166.88.159.37] 443  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334334/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334334; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pacotdc20.duckdns.org"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334314/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"sergei-esenin.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334330/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_06; classtype:trojan-activity; sid:91334330; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"d21m87a.mom"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334333/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"creamtaretio.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334332/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"lameuotgiwo.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334331/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334331; rev:1;)
alert tcp $HOME_NET any -> [146.70.143.147] 18095  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334329/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334329; rev:1;)
alert tcp $HOME_NET any -> [157.90.150.143] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334328/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334328; rev:1;)
alert tcp $HOME_NET any -> [69.165.74.42] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334327/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334327; rev:1;)
alert tcp $HOME_NET any -> [181.161.21.41] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334326/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334326; rev:1;)
alert tcp $HOME_NET any -> [194.87.31.220] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334325/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334325; rev:1;)
alert tcp $HOME_NET any -> [34.92.11.148] 8443  (msg:"ThreatFox pupy botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334324/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334324; rev:1;)
alert tcp $HOME_NET any -> [36.50.233.24] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334323/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334323; rev:1;)
alert tcp $HOME_NET any -> [8.149.136.53] 8081  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334322/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334322; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.faint.sh"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334320/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334320; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.stealer.to"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334321/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334321; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"faint.sh"; depth:8; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334319/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334319; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"webhook.my"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334318/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334318; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"discord-stealer.de"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334315/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334315; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"minxy-is-a-bad-dev.win"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334316/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334316; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"skids.rip"; depth:9; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334317/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334317; rev:1;)
alert tcp $HOME_NET any -> [192.169.69.25] 4070  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334313/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334313; rev:1;)
alert tcp $HOME_NET any -> [185.43.4.80] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334312/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334312; rev:1;)
alert tcp $HOME_NET any -> [192.210.229.11] 443  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334311/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334311; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ailurophilestealer.design"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334310/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334310; rev:1;)
alert tcp $HOME_NET any -> [36.50.233.24] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334309/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334309; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"hduak.site"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334308/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334308; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"goelites.cc"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334307/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334307; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dump.hduak.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334306/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334306; rev:1;)
alert tcp $HOME_NET any -> [151.236.16.40] 10351  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334305/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334305; rev:1;)
alert tcp $HOME_NET any -> [206.189.155.231] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334304/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334304; rev:1;)
alert tcp $HOME_NET any -> [109.120.140.242] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334303/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334303; rev:1;)
alert tcp $HOME_NET any -> [45.141.149.186] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334302/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334302; rev:1;)
alert tcp $HOME_NET any -> [80.87.199.167] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334301/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334301; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.98] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334300/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334300; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.98] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334299/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334299; rev:1;)
alert tcp $HOME_NET any -> [178.215.224.62] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334298/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334298; rev:1;)
alert tcp $HOME_NET any -> [34.92.11.148] 443  (msg:"ThreatFox pupy botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334297/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334297; rev:1;)
alert tcp $HOME_NET any -> [47.95.179.246] 8089  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334296/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334296; rev:1;)
alert tcp $HOME_NET any -> [47.116.17.233] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334295/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334295; rev:1;)
alert tcp $HOME_NET any -> [114.108.126.227] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334286/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334286; rev:1;)
alert tcp $HOME_NET any -> [217.15.161.176] 43957  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334288/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334288; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sensatinwu.buzz"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334289/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"a1022792.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334290/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334290; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eihtvh18ht.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334287/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334287; rev:1;)
alert tcp $HOME_NET any -> [167.86.135.144] 443  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334285/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334285; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.194] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334284/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334284; rev:1;)
alert tcp $HOME_NET any -> [68.183.124.105] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334283/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334283; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.119] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334282/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334282; rev:1;)
alert tcp $HOME_NET any -> [62.109.30.217] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334281/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334281; rev:1;)
alert tcp $HOME_NET any -> [185.43.4.69] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334280/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334280; rev:1;)
alert tcp $HOME_NET any -> [191.96.166.66] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334279/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334279; rev:1;)
alert tcp $HOME_NET any -> [172.93.101.18] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334278/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334278; rev:1;)
alert tcp $HOME_NET any -> [185.130.47.210] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334277/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334277; rev:1;)
alert tcp $HOME_NET any -> [66.103.223.68] 8081  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334276/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334276; rev:1;)
alert tcp $HOME_NET any -> [192.144.232.209] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334275/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"guvenilirislemlershop.com.tr"; depth:28; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334253/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"guvenilirmarketingislemler.com.tr"; depth:33; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334254/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"guvenilirislemlermarketing.com.tr"; depth:33; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334255/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"shopguvenilirislemler.com.tr"; depth:28; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334256/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334256; rev:1;)
alert tcp $HOME_NET any -> [154.236.142.94] 5552  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334258/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"guvenilirshopislemler.com.tr"; depth:28; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334252/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ngnkntc3mjllztm1/"; depth:18; nocase; http.host; content:"guvenilirislemler.com.tr"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334251/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_06; classtype:trojan-activity; sid:91334251; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"eg-womens.gl.at.ply.gg"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334232/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334232; rev:1;)
alert tcp $HOME_NET any -> [87.120.115.35] 47822  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334246/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334246; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"contarraylean.store"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334230/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334230; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.23] 7999  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334231/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334231; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"professitonwqu.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334229/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334229; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"devilboydevilhere.strangled.net"; depth:31; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334259/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_06; classtype:trojan-activity; sid:91334259; rev:1;)
alert tcp $HOME_NET any -> [93.123.39.131] 1337  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334274/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334274; rev:1;)
alert tcp $HOME_NET any -> [45.94.31.169] 4449  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334273/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334273; rev:1;)
alert tcp $HOME_NET any -> [20.235.246.169] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334272/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334272; rev:1;)
alert tcp $HOME_NET any -> [13.71.115.243] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334271/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334271; rev:1;)
alert tcp $HOME_NET any -> [13.71.115.243] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334270/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334270; rev:1;)
alert tcp $HOME_NET any -> [188.120.254.229] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334269/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334269; rev:1;)
alert tcp $HOME_NET any -> [47.103.218.35] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334268/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334268; rev:1;)
alert tcp $HOME_NET any -> [47.90.157.82] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334267/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334267; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"vilodeqa.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334266/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_06; classtype:trojan-activity; sid:91334266; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"crestwaybunk.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334265/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334265; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.kapilapiii.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334264/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334264; rev:1;)
alert tcp $HOME_NET any -> [194.87.31.220] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334263/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334263; rev:1;)
alert tcp $HOME_NET any -> [45.88.186.68] 7077  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334262/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334262; rev:1;)
alert tcp $HOME_NET any -> [142.202.188.195] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334261/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334261; rev:1;)
alert tcp $HOME_NET any -> [82.67.60.21] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334260/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_06; classtype:trojan-activity; sid:91334260; rev:1;)
alert tcp $HOME_NET any -> [151.237.170.179] 5655  (msg:"ThreatFox RMS botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334257/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334257; rev:1;)
alert tcp $HOME_NET any -> [51.38.109.144] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334250/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91334250; rev:1;)
alert tcp $HOME_NET any -> [51.38.109.144] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334249/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91334249; rev:1;)
alert tcp $HOME_NET any -> [51.38.109.144] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334248/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334248; rev:1;)
alert tcp $HOME_NET any -> [91.222.173.91] 443  (msg:"ThreatFox WarmCookie botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334247/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_05; classtype:trojan-activity; sid:91334247; rev:1;)
alert tcp $HOME_NET any -> [62.60.211.206] 8080  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334245/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334245; rev:1;)
alert tcp $HOME_NET any -> [38.55.193.31] 8080  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334244/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334244; rev:1;)
alert tcp $HOME_NET any -> [134.209.40.17] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334243/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334243; rev:1;)
alert tcp $HOME_NET any -> [91.214.78.145] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334242/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334242; rev:1;)
alert tcp $HOME_NET any -> [92.187.191.119] 3085  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334241/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334241; rev:1;)
alert tcp $HOME_NET any -> [45.200.148.128] 9000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334240/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334240; rev:1;)
alert tcp $HOME_NET any -> [143.198.204.173] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334239/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334239; rev:1;)
alert tcp $HOME_NET any -> [191.96.166.66] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334238/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334238; rev:1;)
alert tcp $HOME_NET any -> [45.88.186.85] 7077  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334236/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334236; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.98] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334237/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334237; rev:1;)
alert tcp $HOME_NET any -> [8.134.212.158] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334235/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334235; rev:1;)
alert tcp $HOME_NET any -> [206.189.234.67] 37829  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334234/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334234; rev:1;)
alert tcp $HOME_NET any -> [47.243.10.218] 4443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334233/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334233; rev:1;)
alert tcp $HOME_NET any -> [172.98.22.147] 1145  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334228/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334228; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"macabredabor.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334221/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334221; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"exmptiondixv.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334219/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334219; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"feelystroll.buzz"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334220/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334220; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"crowddycrossqk.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334217/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334217; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ejectyflay.store"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334218/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334218; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"corushedk.store"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334216/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334216; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"accentypastedw.store"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334213/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334213; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cereeembalank.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334215/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334215; rev:1;)
alert tcp $HOME_NET any -> [141.98.7.28] 56744  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334202/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334202; rev:1;)
alert tcp $HOME_NET any -> [3.71.225.231] 18924  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334203/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91334203; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mixturehari.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334222/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334222; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"nonsensedjwqj.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334223/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334223; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"probablekl.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334224/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334224; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"selfishhri.store"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334225/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334225; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"worthsuwqp.shop"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1334226/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wordpress/to/providerpollgame/datalifetest/downloads/videovoiddb3/request6/1/cpuprocessgamedbtrackdlelocalprivatecentral.php"; depth:125; nocase; http.host; content:"194.33.43.197"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334227/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334227; rev:1;)
alert tcp $HOME_NET any -> [89.221.225.227] 8443  (msg:"ThreatFox DeimosC2 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334212/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334212; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.183] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334210/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334210; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.183] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334211/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334211; rev:1;)
alert tcp $HOME_NET any -> [78.141.228.83] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334209/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334209; rev:1;)
alert tcp $HOME_NET any -> [213.238.61.60] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334208/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334208; rev:1;)
alert tcp $HOME_NET any -> [102.165.46.145] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334207/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334207; rev:1;)
alert tcp $HOME_NET any -> [178.73.218.9] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334206/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334206; rev:1;)
alert tcp $HOME_NET any -> [120.79.64.164] 58234  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334205/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"ejectyflay.store"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334204/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91334204; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.21] 4140  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334201/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"180.94.33.253"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334200/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_05; classtype:trojan-activity; sid:91334200; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 7075  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333991/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333991; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"clearancek.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333983/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333983; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eaglepawnoy.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333985/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333985; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"licendfilteo.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333987/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333987; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"spirittunek.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333989/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333989; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"studennotediw.store"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333990/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333990; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dissapoiznw.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333984/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333984; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"firghtenj.online"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333986/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333986; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mobbipenju.store"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333988/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333988; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"bathdoomgaz.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333982/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333982; rev:1;)
alert tcp $HOME_NET any -> [199.115.114.193] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333979/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333979; rev:1;)
alert tcp $HOME_NET any -> [212.193.56.186] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333980/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333980; rev:1;)
alert tcp $HOME_NET any -> [64.131.73.13] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333977/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333977; rev:1;)
alert tcp $HOME_NET any -> [64.131.81.98] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333978/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333978; rev:1;)
alert tcp $HOME_NET any -> [207.58.188.113] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333975/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333975; rev:1;)
alert tcp $HOME_NET any -> [207.58.186.35] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333976/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333976; rev:1;)
alert tcp $HOME_NET any -> [207.58.188.114] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333972/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333972; rev:1;)
alert tcp $HOME_NET any -> [207.58.188.116] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333973/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333973; rev:1;)
alert tcp $HOME_NET any -> [207.58.188.115] 81  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333974/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333974; rev:1;)
alert tcp $HOME_NET any -> [180.210.203.65] 23  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333971/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333971; rev:1;)
alert tcp $HOME_NET any -> [180.210.203.64] 23  (msg:"ThreatFox Kaiten botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333970/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/account.aspx"; depth:13; nocase; http.host; content:"semurox.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1334191/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334191; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 3989  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334192/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91334192; rev:1;)
alert tcp $HOME_NET any -> [146.190.5.183] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334199/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334199; rev:1;)
alert tcp $HOME_NET any -> [198.23.227.175] 4655  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334198/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334198; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.8] 8080  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334197/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334197; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.27] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334196/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334196; rev:1;)
alert tcp $HOME_NET any -> [82.141.119.10] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334195/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334195; rev:1;)
alert tcp $HOME_NET any -> [111.231.63.16] 6000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334194/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334194; rev:1;)
alert tcp $HOME_NET any -> [121.40.24.201] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1334193/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91334193; rev:1;)
alert tcp $HOME_NET any -> [51.13.60.105] 48601  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333993/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333993; rev:1;)
alert tcp $HOME_NET any -> [185.177.125.198] 223  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333992/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tosecurelowprocessordefaultdatalifecentral.php"; depth:47; nocase; http.host; content:"492668cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333981/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333981; rev:1;)
alert tcp $HOME_NET any -> [185.76.79.207] 38378  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333969/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333969; rev:1;)
alert tcp $HOME_NET any -> [103.142.9.181] 9999  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333968/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333968; rev:1;)
alert tcp $HOME_NET any -> [103.142.9.183] 9999  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333967/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333967; rev:1;)
alert tcp $HOME_NET any -> [5.42.98.74] 80  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333965/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333965; rev:1;)
alert tcp $HOME_NET any -> [5.42.98.74] 443  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333966/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333966; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.171] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333964/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333964; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.63] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333963/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333963; rev:1;)
alert tcp $HOME_NET any -> [209.12.214.152] 5000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333962/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333962; rev:1;)
alert tcp $HOME_NET any -> [45.88.88.78] 50555  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333961/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333961; rev:1;)
alert tcp $HOME_NET any -> [144.76.68.248] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333960/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333960; rev:1;)
alert tcp $HOME_NET any -> [178.215.224.69] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333959/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333959; rev:1;)
alert tcp $HOME_NET any -> [45.11.181.44] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333957/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333957; rev:1;)
alert tcp $HOME_NET any -> [94.247.42.128] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333958/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333958; rev:1;)
alert tcp $HOME_NET any -> [175.178.44.219] 888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333956/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333956; rev:1;)
alert tcp $HOME_NET any -> [206.166.251.4] 8080  (msg:"ThreatFox WhiteSnake Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333955/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333955; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"witnesjwuka.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333783/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333783; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"throaatyinpak.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333782/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333782; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"sunhsinkujh.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333781/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333781; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"mountainywj.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333780/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333780; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"febnceokwi.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333778/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333778; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"jealouskfnn.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333779/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333779; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"assaultxnh.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333777/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333777; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.23] 5951  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333767/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333767; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"gbyvwcn.localto.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333811/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333811; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 7608  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333812/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333812; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"tlkkyhm.localto.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333813/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333813; rev:1;)
alert tcp $HOME_NET any -> [13.124.37.111] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333814/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333814; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.19] 17515  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333815/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333815; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"ground-heavily.gl.at.ply.gg"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333816/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333816; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 4683  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333817/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333817; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"txx8luo.localto.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333818/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333818; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 3198  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333819/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333819; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"drd8jxg.localto.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333820/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333820; rev:1;)
alert tcp $HOME_NET any -> [185.141.35.22] 1206  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333821/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333821; rev:1;)
alert tcp $HOME_NET any -> [5.161.22.78] 6969  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333825/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333825; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"yaseraljazeera.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333939/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333939; rev:1;)
alert tcp $HOME_NET any -> [209.126.80.197] 3906  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333810/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_05; classtype:trojan-activity; sid:91333810; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"ams82.mom"; depth:9; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333784/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/14119ced.php"; depth:13; nocase; http.host; content:"cj37718.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333954/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333954; rev:1;)
alert tcp $HOME_NET any -> [181.235.10.77] 2017  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333953/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333953; rev:1;)
alert tcp $HOME_NET any -> [194.59.31.31] 3013  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333952/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333952; rev:1;)
alert tcp $HOME_NET any -> [194.59.31.31] 8019  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333951/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"root.darkproducts.ru"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333950/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333950; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"smtracking.ridvansakaa.swp23.com"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333949/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333949; rev:1;)
alert tcp $HOME_NET any -> [82.147.84.175] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333948/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333948; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.174] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333946/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333946; rev:1;)
alert tcp $HOME_NET any -> [95.217.92.42] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333947/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333947; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"idc-91-120-212-116.hkt.cc"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333945/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333945; rev:1;)
alert tcp $HOME_NET any -> [87.120.126.140] 3232  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333944/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333944; rev:1;)
alert tcp $HOME_NET any -> [3.82.219.218] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333943/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333943; rev:1;)
alert tcp $HOME_NET any -> [45.126.209.238] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333942/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333942; rev:1;)
alert tcp $HOME_NET any -> [181.131.216.100] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333941/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333941; rev:1;)
alert tcp $HOME_NET any -> [80.76.51.75] 8361  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333940/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/5f1cf390.php"; depth:13; nocase; http.host; content:"cz44917.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333938/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333938; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"imap.surfmail.cloud"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333832/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333832; rev:1;)
alert tcp $HOME_NET any -> [185.246.223.69] 8080  (msg:"ThreatFox ERMAC botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333831/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333831; rev:1;)
alert tcp $HOME_NET any -> [94.232.247.68] 443  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333830/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333830; rev:1;)
alert tcp $HOME_NET any -> [157.20.182.169] 4449  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333829/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333829; rev:1;)
alert tcp $HOME_NET any -> [157.245.195.246] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333828/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333828; rev:1;)
alert tcp $HOME_NET any -> [165.154.219.160] 7397  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333827/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333827; rev:1;)
alert tcp $HOME_NET any -> [47.95.179.246] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333826/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_05; classtype:trojan-activity; sid:91333826; rev:1;)
alert tcp $HOME_NET any -> [186.169.83.212] 1213  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333824/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333824; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sost2024ene.duckdns.org"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333823/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333823; rev:1;)
alert tcp $HOME_NET any -> [85.113.101.120] 1177  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333822/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333822; rev:1;)
alert tcp $HOME_NET any -> [103.107.105.81] 443  (msg:"ThreatFox PlugX botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333809/; target:src_ip; metadata: confidence_level 60, first_seen 2024_10_04; classtype:trojan-activity; sid:91333809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/best.msi"; depth:9; nocase; http.host; content:"95.164.17.212"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333808/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333808; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"ekcdn.top"; depth:9; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333807/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333807; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"obobobo.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333804/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333804; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pobegskichi.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333805/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333805; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sosachwaffen.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333806/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/goku.php"; depth:9; nocase; http.host; content:"sosachwaffen.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333803/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/boku.php"; depth:9; nocase; http.host; content:"pobegskichi.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333802/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/boku.php"; depth:9; nocase; http.host; content:"obobobo.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333801/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333801; rev:1;)
alert tcp $HOME_NET any -> [134.209.32.140] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333800/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333800; rev:1;)
alert tcp $HOME_NET any -> [193.233.112.17] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333799/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333799; rev:1;)
alert tcp $HOME_NET any -> [31.13.224.32] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333798/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333798; rev:1;)
alert tcp $HOME_NET any -> [45.200.148.197] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333796/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333796; rev:1;)
alert tcp $HOME_NET any -> [223.155.16.3] 23333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333797/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333797; rev:1;)
alert tcp $HOME_NET any -> [223.155.16.42] 23333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333794/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333794; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cortanava.duckdns.org"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333795/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333795; rev:1;)
alert tcp $HOME_NET any -> [176.96.137.133] 4242  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333793/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333793; rev:1;)
alert tcp $HOME_NET any -> [45.43.86.230] 4190  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333792/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333792; rev:1;)
alert tcp $HOME_NET any -> [117.72.47.106] 4441  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333791/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333791; rev:1;)
alert tcp $HOME_NET any -> [124.222.72.51] 5088  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333790/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333790; rev:1;)
alert tcp $HOME_NET any -> [122.51.181.175] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333789/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333789; rev:1;)
alert tcp $HOME_NET any -> [216.238.100.68] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333788/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333788; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"hit-check.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333787/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/test_gate0117.php"; depth:18; nocase; http.host; content:"hit-check.com"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333786/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333786; rev:1;)
alert tcp $HOME_NET any -> [65.21.18.51] 24164  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333785/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333785; rev:1;)
alert tcp $HOME_NET any -> [62.234.81.85] 7421  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333776/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333776; rev:1;)
alert tcp $HOME_NET any -> [95.164.33.192] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333775/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333775; rev:1;)
alert tcp $HOME_NET any -> [179.100.49.94] 5000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333774/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333774; rev:1;)
alert tcp $HOME_NET any -> [192.210.229.8] 9090  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333773/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333773; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.252] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333772/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333772; rev:1;)
alert tcp $HOME_NET any -> [66.228.48.33] 8888  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333771/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333771; rev:1;)
alert tcp $HOME_NET any -> [2.57.122.74] 9090  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333770/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333770; rev:1;)
alert tcp $HOME_NET any -> [113.17.34.255] 9999  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333769/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333769; rev:1;)
alert tcp $HOME_NET any -> [121.36.77.90] 4444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333768/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333768; rev:1;)
alert tcp $HOME_NET any -> [141.98.7.86] 12345  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333766/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333766; rev:1;)
alert tcp $HOME_NET any -> [93.123.85.138] 3778  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333765/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333765; rev:1;)
alert tcp $HOME_NET any -> [91.222.173.223] 80  (msg:"ThreatFox DarkGate botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333764/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333764; rev:1;)
alert tcp $HOME_NET any -> [191.101.130.49] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333762/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333762; rev:1;)
alert tcp $HOME_NET any -> [193.233.255.34] 7777  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333763/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333763; rev:1;)
alert tcp $HOME_NET any -> [94.141.120.3] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333760/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333760; rev:1;)
alert tcp $HOME_NET any -> [188.134.71.71] 4448  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333761/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333761; rev:1;)
alert tcp $HOME_NET any -> [65.52.240.233] 5555  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333757/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333757; rev:1;)
alert tcp $HOME_NET any -> [80.85.152.13] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333758/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333758; rev:1;)
alert tcp $HOME_NET any -> [84.46.250.60] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333759/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333759; rev:1;)
alert tcp $HOME_NET any -> [5.252.53.134] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333756/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333756; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"winddows.duckdns.org"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333755/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/providerpollpacketdefaultdbasynctrafficdatalifedle.php"; depth:55; nocase; http.host; content:"703648cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333754/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333754; rev:1;)
alert tcp $HOME_NET any -> [84.46.250.60] 4449  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333753/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333753; rev:1;)
alert tcp $HOME_NET any -> [8.140.196.172] 42606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333752/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"exmptiondixv.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333751/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333751; rev:1;)
alert tcp $HOME_NET any -> [147.45.44.116] 33619  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333750/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333750; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"babygift-abbe.wp1.site"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333749/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"assaultxnh.site"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333748/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"spirittunek.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333746/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"studennotediw.store"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333747/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"mobbipenju.store"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333745/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"eaglepawnoy.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333744/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"dissapoiznw.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333743/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"clearancek.site"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333742/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"bathdoomgaz.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333741/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333741; rev:1;)
alert tcp $HOME_NET any -> [185.112.249.20] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333740/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333740; rev:1;)
alert tcp $HOME_NET any -> [194.87.29.74] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333739/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333739; rev:1;)
alert tcp $HOME_NET any -> [157.20.182.73] 4449  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333738/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333738; rev:1;)
alert tcp $HOME_NET any -> [157.20.182.230] 4449  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333737/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333737; rev:1;)
alert tcp $HOME_NET any -> [87.120.112.35] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333736/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333736; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.171] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333735/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333735; rev:1;)
alert tcp $HOME_NET any -> [193.109.85.27] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333734/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333734; rev:1;)
alert tcp $HOME_NET any -> [49.232.217.86] 8000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333732/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333732; rev:1;)
alert tcp $HOME_NET any -> [49.232.217.86] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333733/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333733; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.162] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333731/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333731; rev:1;)
alert tcp $HOME_NET any -> [34.38.102.206] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333729/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333729; rev:1;)
alert tcp $HOME_NET any -> [101.43.68.65] 10010  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333730/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333730; rev:1;)
alert tcp $HOME_NET any -> [35.233.91.245] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333728/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333728; rev:1;)
alert tcp $HOME_NET any -> [47.245.134.137] 10000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333727/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333727; rev:1;)
alert tcp $HOME_NET any -> [167.99.30.11] 80  (msg:"ThreatFox SharkBot botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333726/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/72ddb977.php"; depth:13; nocase; http.host; content:"a1036503.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333725/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333725; rev:1;)
alert tcp $HOME_NET any -> [45.149.241.168] 80  (msg:"ThreatFox Loki Password Stealer (PWS) botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333722/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333722; rev:1;)
alert tcp $HOME_NET any -> [185.236.228.12] 16741  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333723/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"a1035834.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333724/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333724; rev:1;)
alert tcp $HOME_NET any -> [185.222.58.239] 1781  (msg:"ThreatFox STRRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333721/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333721; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ansss2608.duckdns.org"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333719/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ndifygidj/five/fre.php"; depth:23; nocase; http.host; content:"freighteightonecam.sytes.net"; depth:28; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333720/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333720; rev:1;)
alert tcp $HOME_NET any -> [193.233.112.44] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333718/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333718; rev:1;)
alert tcp $HOME_NET any -> [43.138.225.212] 8888  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333717/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333717; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.142] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333716/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333716; rev:1;)
alert tcp $HOME_NET any -> [3.27.251.211] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333715/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333715; rev:1;)
alert tcp $HOME_NET any -> [45.147.200.140] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333714/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333714; rev:1;)
alert tcp $HOME_NET any -> [8.210.46.6] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333713/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333713; rev:1;)
alert tcp $HOME_NET any -> [113.17.34.255] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333712/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333712; rev:1;)
alert tcp $HOME_NET any -> [45.144.136.86] 2222  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333711/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333711; rev:1;)
alert tcp $HOME_NET any -> [124.221.174.136] 8787  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333710/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333710; rev:1;)
alert tcp $HOME_NET any -> [47.113.150.19] 50000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333709/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333709; rev:1;)
alert tcp $HOME_NET any -> [45.88.106.149] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333708/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333708; rev:1;)
alert tcp $HOME_NET any -> [139.59.198.47] 3566  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333707/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nmfkztc4ywm3ztk2/"; depth:18; nocase; http.host; content:"heloh634gerts.site"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333478/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_04; classtype:trojan-activity; sid:91333478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nmfkztc4ywm3ztk2/"; depth:18; nocase; http.host; content:"gtreh64oles.online"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333479/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_04; classtype:trojan-activity; sid:91333479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nmfkztc4ywm3ztk2/"; depth:18; nocase; http.host; content:"strongmilesfantas.online"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333476/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_04; classtype:trojan-activity; sid:91333476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/m2eyotm2m2fly2my/"; depth:18; nocase; http.host; content:"dejunggvbvqq.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333475/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_04; classtype:trojan-activity; sid:91333475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nmfkztc4ywm3ztk2/"; depth:18; nocase; http.host; content:"verymeger4u.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333477/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_04; classtype:trojan-activity; sid:91333477; rev:1;)
alert tcp $HOME_NET any -> [92.249.48.53] 1337  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333454/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333454; rev:1;)
alert tcp $HOME_NET any -> [92.249.48.69] 1338  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333473/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333473; rev:1;)
alert tcp $HOME_NET any -> [92.249.48.69] 5000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333474/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333474; rev:1;)
alert tcp $HOME_NET any -> [157.245.139.216] 2222  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333453/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333453; rev:1;)
alert tcp $HOME_NET any -> [205.185.117.147] 6969  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333480/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333480; rev:1;)
alert tcp $HOME_NET any -> [2.57.122.11] 33342  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333481/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333481; rev:1;)
alert tcp $HOME_NET any -> [167.0.201.5] 9001  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333487/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333487; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"02oct.duckdns.org"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333488/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"yaseraljazeera.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333629/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"yaseraljazeera.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333634/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"yaseraljazeera.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333631/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"yaseraljazeera.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333635/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333635; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"randomized.sytes.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333693/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_04; classtype:trojan-activity; sid:91333693; rev:1;)
alert tcp $HOME_NET any -> [116.203.0.21] 80  (msg:"ThreatFox XehookStealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333706/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/getloader.php"; depth:14; nocase; http.host; content:"116.203.0.21"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333705/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/getjson.php"; depth:12; nocase; http.host; content:"116.203.0.21"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333704/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/xh.php"; depth:7; nocase; http.host; content:"116.203.0.21"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333703/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333703; rev:1;)
alert tcp $HOME_NET any -> [5.89.184.89] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333701/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333701; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pc-star.fi"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333702/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333702; rev:1;)
alert tcp $HOME_NET any -> [5.206.227.225] 4444  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333700/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333700; rev:1;)
alert tcp $HOME_NET any -> [188.28.21.112] 4444  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333699/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333699; rev:1;)
alert tcp $HOME_NET any -> [5.83.218.191] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333698/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333698; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.142] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333697/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333697; rev:1;)
alert tcp $HOME_NET any -> [46.246.12.13] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333696/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333696; rev:1;)
alert tcp $HOME_NET any -> [162.33.179.247] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333695/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/8001ffab.php"; depth:13; nocase; http.host; content:"a1038038.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333694/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333694; rev:1;)
alert tcp $HOME_NET any -> [13.60.28.43] 9600  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333692/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333692; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.mozg55.com"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333498/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333498; rev:1;)
alert tcp $HOME_NET any -> [223.155.16.86] 23333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333497/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333497; rev:1;)
alert tcp $HOME_NET any -> [213.252.246.168] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333495/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333495; rev:1;)
alert tcp $HOME_NET any -> [51.250.27.34] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333496/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333496; rev:1;)
alert tcp $HOME_NET any -> [104.194.134.165] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333494/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333494; rev:1;)
alert tcp $HOME_NET any -> [88.119.175.153] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333493/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333493; rev:1;)
alert tcp $HOME_NET any -> [193.109.85.31] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333491/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333491; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"semurox.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333492/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333492; rev:1;)
alert tcp $HOME_NET any -> [113.17.34.255] 2083  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333490/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333490; rev:1;)
alert tcp $HOME_NET any -> [124.222.51.98] 65443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333489/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_04; classtype:trojan-activity; sid:91333489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/5559d41f.php"; depth:13; nocase; http.host; content:"a1036589.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333486/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/0a616124ff2f2b69.php"; depth:21; nocase; http.host; content:"45.200.148.115"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333485/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/f6c05fe452e5af24.php"; depth:21; nocase; http.host; content:"185.196.10.147"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333484/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"beearvagueo.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333483/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/383ccd496f3c5eee.php"; depth:21; nocase; http.host; content:"193.233.112.44"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333482/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333482; rev:1;)
alert tcp $HOME_NET any -> [46.246.4.22] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333472/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333472; rev:1;)
alert tcp $HOME_NET any -> [38.255.33.227] 22  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333471/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333471; rev:1;)
alert tcp $HOME_NET any -> [64.227.157.239] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333470/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333470; rev:1;)
alert tcp $HOME_NET any -> [164.92.225.122] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333469/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333469; rev:1;)
alert tcp $HOME_NET any -> [5.83.218.191] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333467/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333467; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.31] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333468/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333468; rev:1;)
alert tcp $HOME_NET any -> [5.83.218.191] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333466/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333466; rev:1;)
alert tcp $HOME_NET any -> [147.45.50.109] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333465/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333465; rev:1;)
alert tcp $HOME_NET any -> [44.201.155.166] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333464/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333464; rev:1;)
alert tcp $HOME_NET any -> [144.126.141.126] 2000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333462/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333462; rev:1;)
alert tcp $HOME_NET any -> [45.135.232.38] 52350  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333463/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333463; rev:1;)
alert tcp $HOME_NET any -> [47.98.254.233] 43664  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333461/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333461; rev:1;)
alert tcp $HOME_NET any -> [213.238.61.58] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333460/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333460; rev:1;)
alert tcp $HOME_NET any -> [93.123.39.108] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333459/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333459; rev:1;)
alert tcp $HOME_NET any -> [209.250.252.99] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333458/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333458; rev:1;)
alert tcp $HOME_NET any -> [149.88.90.176] 53  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333457/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333457; rev:1;)
alert tcp $HOME_NET any -> [45.83.140.96] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333456/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333456; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.161] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333455/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333455; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"opewolumeras.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333452/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/test/"; depth:6; nocase; http.host; content:"opewolumeras.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333451/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/admin.php"; depth:10; nocase; http.host; content:"82.115.223.39"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333450/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/bazar.php"; depth:10; nocase; http.host; content:"82.115.223.39"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333449/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333449; rev:1;)
alert tcp $HOME_NET any -> [82.115.223.39] 8041  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333448/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/admin.php"; depth:10; nocase; http.host; content:"greshunka.com"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333447/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333447; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dlink.cfd"; depth:9; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333446/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333446; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"frank.dlink.cfd"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333445/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333445; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"check-key.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333444/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/licenseuser.php"; depth:16; nocase; http.host; content:"check-key.com"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333443/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333443; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"consumptiy.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333436/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333436; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"highawaretemptersudwu.xyz"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333432/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333432; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pittyshishre.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333433/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333433; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pierryfurow.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333434/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333434; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fallydisablek.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333435/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333435; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"certainykww.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333437/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333437; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"abundanttyj.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333438/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333438; rev:1;)
alert tcp $HOME_NET any -> [93.185.156.125] 1912  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333442/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/phpcpuupdateauthbigloaddefaultlinuxwindowsasyncdatalife.php"; depth:60; nocase; http.host; content:"37.46.132.110"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333441/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/84b7b6f977dd1c65.php"; depth:21; nocase; http.host; content:"95.182.97.58"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333440/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333440; rev:1;)
alert tcp $HOME_NET any -> [45.67.228.7] 5200  (msg:"ThreatFox Ave Maria botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333439/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333439; rev:1;)
alert tcp $HOME_NET any -> [143.198.123.32] 8443  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333431/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333431; rev:1;)
alert tcp $HOME_NET any -> [93.123.39.47] 5000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333430/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333430; rev:1;)
alert tcp $HOME_NET any -> [104.41.34.16] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333429/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333429; rev:1;)
alert tcp $HOME_NET any -> [213.252.246.168] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333428/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333428; rev:1;)
alert tcp $HOME_NET any -> [88.119.175.153] 4444  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333427/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333427; rev:1;)
alert tcp $HOME_NET any -> [45.141.215.5] 8081  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333426/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333426; rev:1;)
alert tcp $HOME_NET any -> [149.88.90.176] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333425/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333425; rev:1;)
alert tcp $HOME_NET any -> [124.222.182.175] 40046  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333424/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333424; rev:1;)
alert tcp $HOME_NET any -> [8.220.192.59] 10808  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333423/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333423; rev:1;)
alert tcp $HOME_NET any -> [110.42.101.72] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333422/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/29087f1d398f0eec.php"; depth:21; nocase; http.host; content:"5.188.87.43"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333421/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"abundanttyj.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333420/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"jerescarla.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333415/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333415; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"jerescarla.com"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333416/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333416; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pullride.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333412/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"jerescarla.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333417/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"jerescarla.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333418/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"jerescarla.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333419/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/26f625bc.php"; depth:13; nocase; http.host; content:"ch68434.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333414/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"comatagcom.temp.swtest.ru"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333413/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/endpoint"; depth:9; nocase; http.host; content:"md928zs.shop"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333409/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"skiiin.club"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333410/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333410; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"skiiin.club"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333411/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/9cpu8traffic/defaultdatalife/trafficmariadb/protectpoll1/7/8/asyncprovider/low/bigload3/protonjavascript/centralwordpress1/bigloadcentral/jsapi/externallinerequestgeocpuprocessorlinuxtempuploads.php"; depth:199; nocase; http.host; content:"147.45.77.108"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333408/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"advocachark.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333407/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"shaoriffandco.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333402/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333402; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"shaoriffandco.com"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333403/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"shaoriffandco.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333404/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"shaoriffandco.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333405/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"shaoriffandco.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333406/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333406; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.132] 7000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333401/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333401; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"chorusarorp.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333377/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333377; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"soldiefieop.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333378/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333378; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mysterisop.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333379/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333379; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"absorptioniw.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333380/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333380; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"abnomalrkmu.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333381/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333381; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"treatynreit.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333382/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333382; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"snarlypagowo.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333383/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333383; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"questionsmw.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333384/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333384; rev:1;)
alert tcp $HOME_NET any -> [37.27.201.226] 27677  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333400/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333400; rev:1;)
alert tcp $HOME_NET any -> [23.237.174.3] 7979  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333399/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333399; rev:1;)
alert tcp $HOME_NET any -> [1.53.19.147] 4444  (msg:"ThreatFox Orcus RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333398/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333398; rev:1;)
alert tcp $HOME_NET any -> [159.65.6.251] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333397/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333397; rev:1;)
alert tcp $HOME_NET any -> [172.191.133.229] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333396/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333396; rev:1;)
alert tcp $HOME_NET any -> [5.42.92.214] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333395/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333395; rev:1;)
alert tcp $HOME_NET any -> [185.128.104.64] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333394/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333394; rev:1;)
alert tcp $HOME_NET any -> [170.64.225.181] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333393/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333393; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 7777  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333392/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333392; rev:1;)
alert tcp $HOME_NET any -> [154.216.17.231] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333391/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333391; rev:1;)
alert tcp $HOME_NET any -> [192.210.229.8] 8080  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333390/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333390; rev:1;)
alert tcp $HOME_NET any -> [101.32.218.184] 59969  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333389/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333389; rev:1;)
alert tcp $HOME_NET any -> [43.129.28.136] 9080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333388/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333388; rev:1;)
alert tcp $HOME_NET any -> [154.23.181.196] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333387/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333387; rev:1;)
alert tcp $HOME_NET any -> [175.178.124.71] 888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333386/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333386; rev:1;)
alert tcp $HOME_NET any -> [159.75.148.143] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333385/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333385; rev:1;)
alert tcp $HOME_NET any -> [64.49.14.120] 80  (msg:"ThreatFox Bashlite payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333376/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333376; rev:1;)
alert tcp $HOME_NET any -> [64.49.14.120] 12345  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333375/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/0e14acf91a669df4.php"; depth:21; nocase; http.host; content:"185.250.207.143"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333374/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333374; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"4k59ij2ujeu.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333367/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333367; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"y0zvqpi42no.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333368/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333368; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"zdf5ki8x9r0.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333369/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333369; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8mgj12azbyd.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333370/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333370; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"l6syolvczan.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333371/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333371; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mk7plk9c6i2.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333372/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333372; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"hudrx8fn980.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333373/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333373; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"y7pzxau0717.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333347/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333347; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"bev8ymaajb7.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333348/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333348; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"glux8x5b8d6.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333349/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333349; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ge0lpqif3ar.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333350/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333350; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ar7xakeve0o.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333351/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333351; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eb4l6wisq9z.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333352/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333352; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"1grovn87c8s.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333353/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333353; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wdga570b8pz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333354/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333354; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"nzs8vi9w5o8.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333355/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333355; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"exueqqmz3ia.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333356/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333356; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"65r8nx12fqr.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333357/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333357; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"vauy5ah65sx.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333358/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333358; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8hjv8mbhrlj.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333359/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333359; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eeqwg3mzq07.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333360/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333360; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"b1h0uaabzyz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333361/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333361; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8qvt5iabz5n.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333362/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333362; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8ru044xed25.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333363/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333363; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"w8ligr695sd.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333364/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333364; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"3e6rrifr5fn.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333365/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333365; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"9f6p9g7x13s.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333366/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333366; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dxyob8x456a.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333328/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333328; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"lrugnff8fkc.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333329/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333329; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"38i6lh0rpze.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333330/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333330; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mjb3r6mcs1f.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333331/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333331; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"vl41cymzzfq.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333332/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333332; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"qc4mwjiop45.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333333/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333333; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"z3z4fq0420z.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333334/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333334; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"0tab35o0swu.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333335/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333335; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"4izk0gc9is6.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333336/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333336; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"6brdh3p893b.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333337/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333337; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"drmk5rdefb5.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333338/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333338; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"1v0xhie4os8.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333339/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333339; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"khxcp22s3dz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333340/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333340; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8z9m8hndrhp.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333341/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333341; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"xeoz1f1vjs0.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333342/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333342; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"lobavyclh8e.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333343/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333343; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"in4pzu7t2pv.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333344/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333344; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"j280b59doxz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333345/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333345; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"6q894zusd4k.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333346/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333346; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"du19ek78tjw.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333308/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333308; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"234ct3lkozp.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333309/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333309; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"he8fq4k8d3w.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333310/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333310; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"7ewh8ltr7il.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333311/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333311; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dw34kmgfl7t.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333312/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333312; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"f2j20ayqh8y.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333313/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333313; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"331k2rdkmmb.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333314/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333314; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"37z6li6l9y2.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333315/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333315; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dpgs2lt1sbz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333316/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333316; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"plll0xq4y82.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333317/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333317; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"bzc9sq2pz53.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333318/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333318; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"7r8ln1wswth.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333319/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333319; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"y9neib92f2m.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333320/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333320; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"m5iukps17y7.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333321/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333321; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"xo8be64ejh2.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333322/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333322; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"widn8soih8u.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333323/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333323; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"08mkuqnx6gv.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333324/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333324; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"lzeqr3apopn.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333325/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333325; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"o4m5a5no7e8.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333326/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333326; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"2u8znzsbrto.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333327/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333327; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tvx1ovdepj8.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333288/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333288; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"acgr6r8zdot.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333289/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333289; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ilofx941igp.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333290/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333290; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"8x2apo5m7ri.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333291/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333291; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"x9yrzer0ndt.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333292/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333292; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"93j4v4jopzd.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333293/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333293; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"nyy41uibsv5.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333294/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333294; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ru4jvijdytq.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333295/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333295; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"l9t6r0y6cvi.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333296/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333296; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"f4vb9n3tdvh.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333297/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333297; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"9do3mcejztt.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333298/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333298; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pxu1ajsdhqr.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333299/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333299; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"7exy2b231n2.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333300/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333300; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"vu5b47m18jn.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333301/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333301; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"6mnudp7zj73.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333302/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333302; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"p5047yjrb8q.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333303/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333303; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"d0xtxp89bb9.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333304/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333304; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fig3gj0v6qe.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333305/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333305; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"txgogs9p8a1.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333306/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333306; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"2z1ls31az7s.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333307/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333307; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"q7dfpyyhe08.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333274/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333274; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"38f5wvwwn7o.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333275/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333275; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fsr2hskx44p.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333276/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333276; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"spd22scperm.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333277/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333277; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ameagxzo2f7.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333278/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333278; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ibcm5at6qrz.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333279/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333279; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"0cc2z8zrnhf.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333280/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333280; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"nhdeapyfg7e.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333281/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333281; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"736d0mvetjw.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333282/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333282; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"9qiliikd3sp.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333283/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333283; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"07zxfo0kere.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333284/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333284; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"yan95akxgqt.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333285/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333285; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"uyn0icgx1kv.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333286/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333286; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ygo9u1fkwux.life"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333287/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333287; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"diiiveowmnj.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333272/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333272; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"carddytrailko.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333273/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"carddytrailko.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333271/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"diiiveowmnj.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333270/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333270; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.23] 1213  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333201/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333201; rev:1;)
alert tcp $HOME_NET any -> [45.149.241.169] 80  (msg:"ThreatFox Loki Password Stealer (PWS) botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333200/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333200; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"florida-institutions.gl.at.ply.gg"; depth:33; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333202/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333202; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"tecstify.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333254/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"tecstify.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333253/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"tecstify.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333255/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"tecstify.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333256/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"tecstify.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333257/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333257; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"newfutureapp.monster"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333262/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333262; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pureactiveapps.monster"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333263/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333263; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"purestarapp.monster"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333264/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333264; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"saveactiveapp.monster"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333265/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333265; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"savestarapp.monster"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333266/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333266; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"sendactiveapp.monster"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333267/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333267; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"webactiveapp.monster"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333268/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333268; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"webfutureapp.monster"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333269/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333269; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"bestactiveapps.monster"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333258/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333258; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cleanactiveapps.monster"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333259/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333259; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"elitestarapp.monster"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333260/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333260; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"grandactiveapp.monster"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333261/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333261; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.235] 443  (msg:"ThreatFox DanaBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333252/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333252; rev:1;)
alert tcp $HOME_NET any -> [185.150.162.32] 443  (msg:"ThreatFox DanaBot payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333251/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333251; rev:1;)
alert tcp $HOME_NET any -> [2.58.56.158] 443  (msg:"ThreatFox DanaBot payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333250/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333250; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cracksoftwaresdownload.com"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333241/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333241; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"desktopsofts.xyz"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333242/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333242; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"digitalassetkit.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333243/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333243; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"fbmypages.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333244/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333244; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pc-softs.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333245/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333245; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pc-software-free-crack.pro"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333246/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333246; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pc-software.xyz"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333247/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333247; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"playrankers.comcrep1x"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333248/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333248; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"software-download-free.xyz"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333249/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333249; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cracked-software-download-pc.xyz"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333237/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333237; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cracked-software-for-pc.xyz"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333238/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333238; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cracked-software.xyz"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333239/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333239; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cracked-sofware-for-pc.xyz"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333240/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333240; rev:1;)
alert tcp $HOME_NET any -> [185.222.58.253] 8681  (msg:"ThreatFox STRRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333214/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"cereeembalank.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333213/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"evoliutwoqm.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333212/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333212; rev:1;)
alert tcp $HOME_NET any -> [154.90.62.152] 56999  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333211/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333211; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.119] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333210/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333210; rev:1;)
alert tcp $HOME_NET any -> [176.124.204.213] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333208/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333208; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.31] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333209/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333209; rev:1;)
alert tcp $HOME_NET any -> [185.249.227.249] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333207/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333207; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.8] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333206/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333206; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.180] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333205/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333205; rev:1;)
alert tcp $HOME_NET any -> [103.56.93.5] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333203/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333203; rev:1;)
alert tcp $HOME_NET any -> [155.94.204.162] 5566  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333204/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"truthevideow.store"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333199/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/search/en-us"; depth:13; nocase; http.host; content:"chco.outlook-msdn.com"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333198/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mdifygidj/five/fre.php"; depth:23; nocase; http.host; content:"freighteighttwocam.ddns.net"; depth:27; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333197/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"weakkysemwmns.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333196/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"remembkreom.xyz"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333195/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"newresource.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333194/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"privilegedkoq.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333193/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"giffrooypwm.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333192/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333192; rev:1;)
alert tcp $HOME_NET any -> [186.169.63.46] 3737  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333190/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333190; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"sundsvall00020.duckdns.org"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333191/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"thighfeingjywk.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333189/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333189; rev:1;)
alert tcp $HOME_NET any -> [202.131.82.186] 8001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333188/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333188; rev:1;)
alert tcp $HOME_NET any -> [61.128.12.185] 8112  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333187/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333187; rev:1;)
alert tcp $HOME_NET any -> [154.37.212.42] 4444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333186/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333186; rev:1;)
alert tcp $HOME_NET any -> [134.0.160.221] 1165  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333009/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333009; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"toskaadmx.duckdns.org"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333182/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333182; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"fahad26smsm.duckdns.org"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333010/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_03; classtype:trojan-activity; sid:91333010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/89999999999999/acaaaaaaaaa/downloads/dsadsdsadsadsa.txt"; depth:56; nocase; http.host; content:"bitbucket.org"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333184/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/raw/v9y5q5vv"; depth:13; nocase; http.host; content:"pastebin.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333183/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v0/b/rodriakd-8413d.appspot.com/o/pe%2fp.txt"; depth:45; nocase; http.host; content:"firebasestorage.googleapis.com"; depth:30; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333185/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333185; rev:1;)
alert tcp $HOME_NET any -> [37.27.104.29] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333181/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333181; rev:1;)
alert tcp $HOME_NET any -> [179.95.163.195] 9990  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333180/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333180; rev:1;)
alert tcp $HOME_NET any -> [181.162.141.162] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333179/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333179; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"gitlabstand.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333178/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333178; rev:1;)
alert tcp $HOME_NET any -> [111.229.120.172] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333177/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/authgameapiserverlinuxtestcdndownloads.php"; depth:43; nocase; http.host; content:"024171cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333176/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/externalvmpythonrequestsecurepacketbigloadlocalprivatetemporary.php"; depth:68; nocase; http.host; content:"nazvanie.top"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333175/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333175; rev:1;)
alert tcp $HOME_NET any -> [49.232.20.75] 80  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333173/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333173; rev:1;)
alert tcp $HOME_NET any -> [49.232.20.75] 443  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333174/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333174; rev:1;)
alert tcp $HOME_NET any -> [110.42.103.18] 85  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333172/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333172; rev:1;)
alert tcp $HOME_NET any -> [161.97.175.164] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333171/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333171; rev:1;)
alert tcp $HOME_NET any -> [46.246.80.4] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333170/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333170; rev:1;)
alert tcp $HOME_NET any -> [172.235.60.145] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333169/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333169; rev:1;)
alert tcp $HOME_NET any -> [143.198.70.94] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333167/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333167; rev:1;)
alert tcp $HOME_NET any -> [192.236.209.198] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333168/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333168; rev:1;)
alert tcp $HOME_NET any -> [94.158.247.5] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333166/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333166; rev:1;)
alert tcp $HOME_NET any -> [43.230.161.37] 888  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333165/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333165; rev:1;)
alert tcp $HOME_NET any -> [78.141.208.27] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333164/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333164; rev:1;)
alert tcp $HOME_NET any -> [185.227.152.190] 50051  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333163/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333163; rev:1;)
alert tcp $HOME_NET any -> [120.55.241.243] 8082  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333162/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333162; rev:1;)
alert tcp $HOME_NET any -> [143.198.123.32] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333161/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333161; rev:1;)
alert tcp $HOME_NET any -> [159.75.148.143] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333160/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/16f0dab394a3d6f7.php"; depth:21; nocase; http.host; content:"45.88.105.102"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333159/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_03; classtype:trojan-activity; sid:91333159; rev:1;)
alert tcp $HOME_NET any -> [20.82.98.38] 1606  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333158/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333158; rev:1;)
alert tcp $HOME_NET any -> [107.155.56.4] 443  (msg:"ThreatFox PlugX botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333028/; target:src_ip; metadata: confidence_level 60, first_seen 2024_10_02; classtype:trojan-activity; sid:91333028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nyashsupport.php"; depth:17; nocase; http.host; content:"409728cm.nyashkoon.top"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333027/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/videolowcpugamebigloadprotectuniversalcentraldownloads.php"; depth:59; nocase; http.host; content:"267991cm.n9shka.top"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333026/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333026; rev:1;)
alert tcp $HOME_NET any -> [94.156.105.122] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333025/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333025; rev:1;)
alert tcp $HOME_NET any -> [54.248.167.251] 80  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333024/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333024; rev:1;)
alert tcp $HOME_NET any -> [46.246.86.17] 9000  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333023/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333023; rev:1;)
alert tcp $HOME_NET any -> [87.120.117.119] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333022/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333022; rev:1;)
alert tcp $HOME_NET any -> [104.243.47.56] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333021/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333021; rev:1;)
alert tcp $HOME_NET any -> [104.255.175.7] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333019/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333019; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tzten257.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333020/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333020; rev:1;)
alert tcp $HOME_NET any -> [178.215.224.78] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333018/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333018; rev:1;)
alert tcp $HOME_NET any -> [45.32.129.178] 5555  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333017/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333017; rev:1;)
alert tcp $HOME_NET any -> [89.110.87.87] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333016/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333016; rev:1;)
alert tcp $HOME_NET any -> [45.207.211.210] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333015/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333015; rev:1;)
alert tcp $HOME_NET any -> [198.23.137.164] 50001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333013/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333013; rev:1;)
alert tcp $HOME_NET any -> [47.121.31.202] 8889  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333014/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333014; rev:1;)
alert tcp $HOME_NET any -> [149.104.31.17] 5003  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333012/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333012; rev:1;)
alert tcp $HOME_NET any -> [173.249.52.98] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1333011/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/48cefc2d.php"; depth:13; nocase; http.host; content:"cw95073.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333008/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/imagepipejshttpcpugametraffictestwordpress.php"; depth:47; nocase; http.host; content:"890959cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1333007/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333007; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"corretoralago.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332994/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332994; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"musicasdownload.online"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332995/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332995; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"mottaconstrutora.site"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332996/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332996; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"tigoveiculos.online"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332997/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332997; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"aguiarsolucoesenergy.shop"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332998/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332998; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pixelatedsinfactory.com"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332999/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332999; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"pharmachemstore.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333000/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333000; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"luzocomerciais.site"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333001/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333001; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"cargoacessoria.online"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333002/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333002; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"duartecomercio.online"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333003/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333003; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"uniaosistemasrj.online"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333004/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333004; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"rochaservicos.online"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333005/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333005; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"lagunrepresentacoes.online"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1333006/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91333006; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"editoraramos.online"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332989/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332989; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"admequipamentos.online"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332990/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332990; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"financasguaru.online"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332991/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332991; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"projetoretha.online"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332992/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332992; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"nobreengenharia.online"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332993/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/~agroinovate/foreducational/panel/five/fre.php"; depth:47; nocase; http.host; content:"185.148.146.193"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332959/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gata/fre.php"; depth:13; nocase; http.host; content:"enormousslips.tk"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332960/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/michelle/fre.php"; depth:17; nocase; http.host; content:"ogaces.ru"; depth:9; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332961/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/~lahtipr1/lenzman/fre.php"; depth:26; nocase; http.host; content:"31.220.40.22"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332962/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ml/vrs/pt6/lok/panel/fre.php"; depth:29; nocase; http.host; content:"capty.nut.cc"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332963/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/lertyuiop/letryuiop/fre.php"; depth:28; nocase; http.host; content:"kasongogold.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332964/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/five/fre.php"; depth:13; nocase; http.host; content:"en.mg-trade.ir"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332965/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kelvin/panel/five/fre.php"; depth:26; nocase; http.host; content:"nirmalhoslakar.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332966/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/lordwap/panel/five/fre.php"; depth:27; nocase; http.host; content:"phiheatings.ir"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332967/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/user/five/fre.php"; depth:27; nocase; http.host; content:"deloilte.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332968/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/aioy/five/fre.php"; depth:18; nocase; http.host; content:"91.92.252.146"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332969/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ken/panel/five/fre.php"; depth:23; nocase; http.host; content:"ace.alasrglobal.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332970/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/purelogs/fre.php"; depth:17; nocase; http.host; content:"185.246.220.212"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332971/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/oss/fre.php"; depth:12; nocase; http.host; content:"141.105.71.126"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332972/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ftp/five/fre.php"; depth:17; nocase; http.host; content:"nextwaveconsulting.com.au"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332973/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/pws/fre.php"; depth:12; nocase; http.host; content:"dsbr.cam"; depth:8; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332974/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tafari/fre.php"; depth:15; nocase; http.host; content:"www.sarele.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332975/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/edu/fre.php"; depth:12; nocase; http.host; content:"sariraatjgaye.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332976/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eddy/fred.php"; depth:14; nocase; http.host; content:"augtosyt.ru"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332977/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/~zadmin/lmark/jojo/link.php"; depth:28; nocase; http.host; content:"backbaymall.ga"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332978/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/~t/i.html/rvxhi7ntm83h7"; depth:24; nocase; http.host; content:"65.21.223.84"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332979/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-admin/js/five/fre.php"; depth:25; nocase; http.host; content:"wonderbooth.com.my"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332980/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jazzy/fre.php"; depth:14; nocase; http.host; content:"annamadums.ml"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332981/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/five/fre.php"; depth:13; nocase; http.host; content:"tonov.wfdblinds.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332982/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/five/fre.php"; depth:13; nocase; http.host; content:"jasleenoverseas.tech"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332983/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/~zadmin/ema/cache.php"; depth:22; nocase; http.host; content:"185.82.200.16"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332984/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/kedu/fre.php"; depth:13; nocase; http.host; content:"sssteell-com.pro"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332985/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/intel/babanu/fre.php"; depth:21; nocase; http.host; content:"193.29.187.201"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332986/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/h1/hcode/fre.php"; depth:17; nocase; http.host; content:"aixc.ga"; depth:7; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332987/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/css/style/five/fre.php"; depth:23; nocase; http.host; content:"paadasala.com.au"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332988/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332988; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332955/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332955; rev:1;)
alert tcp $HOME_NET any -> [185.117.73.73] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332956/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332956; rev:1;)
alert tcp $HOME_NET any -> [185.183.98.241] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332957/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332957; rev:1;)
alert tcp $HOME_NET any -> [209.38.250.200] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332958/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332958; rev:1;)
alert tcp $HOME_NET any -> [167.172.52.2] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332949/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332949; rev:1;)
alert tcp $HOME_NET any -> [170.64.156.94] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332950/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332950; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332951/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332951; rev:1;)
alert tcp $HOME_NET any -> [185.45.194.44] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332952/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332952; rev:1;)
alert tcp $HOME_NET any -> [185.45.194.48] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332953/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332953; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332954/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332954; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332943/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332943; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332944/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332944; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332945/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332945; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332946/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332946; rev:1;)
alert tcp $HOME_NET any -> [159.65.185.228] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332947/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332947; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332948/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332948; rev:1;)
alert tcp $HOME_NET any -> [64.227.66.208] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332936/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332936; rev:1;)
alert tcp $HOME_NET any -> [64.227.88.113] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332937/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332937; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332938/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332938; rev:1;)
alert tcp $HOME_NET any -> [134.122.40.184] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332939/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332939; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332940/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332940; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332941/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332941; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332942/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332942; rev:1;)
alert tcp $HOME_NET any -> [46.23.108.109] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332933/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332933; rev:1;)
alert tcp $HOME_NET any -> [46.23.108.110] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332934/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332934; rev:1;)
alert tcp $HOME_NET any -> [46.23.108.111] 4444  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332935/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332935; rev:1;)
alert tcp $HOME_NET any -> [165.140.85.87] 20481  (msg:"ThreatFox Crimson RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332932/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332932; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"static.241.115.12.49.clients.your-server.de"; depth:43; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332931/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332931; rev:1;)
alert tcp $HOME_NET any -> [94.156.104.75] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332930/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332930; rev:1;)
alert tcp $HOME_NET any -> [60.182.87.13] 10001  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332929/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332929; rev:1;)
alert tcp $HOME_NET any -> [68.183.195.95] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332928/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332928; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 6666  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332927/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332927; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 5555  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332926/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332926; rev:1;)
alert tcp $HOME_NET any -> [198.23.197.108] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332925/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332925; rev:1;)
alert tcp $HOME_NET any -> [198.23.197.108] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332924/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332924; rev:1;)
alert tcp $HOME_NET any -> [185.92.221.89] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332923/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332923; rev:1;)
alert tcp $HOME_NET any -> [46.246.86.13] 8884  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332922/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332922; rev:1;)
alert tcp $HOME_NET any -> [93.123.39.21] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332921/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332921; rev:1;)
alert tcp $HOME_NET any -> [45.88.88.83] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332920/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332920; rev:1;)
alert tcp $HOME_NET any -> [79.23.76.107] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332919/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332919; rev:1;)
alert tcp $HOME_NET any -> [87.120.115.36] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332918/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332918; rev:1;)
alert tcp $HOME_NET any -> [185.208.159.133] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332917/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332917; rev:1;)
alert tcp $HOME_NET any -> [43.154.142.195] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332915/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332915; rev:1;)
alert tcp $HOME_NET any -> [124.223.71.19] 5000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332916/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332916; rev:1;)
alert tcp $HOME_NET any -> [206.189.234.67] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332914/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332914; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332912/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332912; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332913/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332913; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332903/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332903; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332904/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332904; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332905/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332905; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332906/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332906; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332907/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332907; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332908/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332908; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332909/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332909; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332910/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332910; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332911/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332911; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332894/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332894; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332895/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332895; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332896/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332896; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332897/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332897; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332898/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332898; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332899/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332899; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332900/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332900; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332901/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332901; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332902/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332902; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332882/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332882; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332883/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332883; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332884/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332884; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332885/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332885; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332886/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332886; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332887/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332887; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332888/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332888; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332889/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332889; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332890/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332890; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332891/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332891; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332892/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332892; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332893/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332893; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332873/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332873; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332874/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332874; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332875/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332875; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332876/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332876; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332877/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332877; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332878/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332878; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332879/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332879; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332880/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332880; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332881/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332881; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332863/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332863; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332864/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332864; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332865/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332865; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332866/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332866; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332867/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332867; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332868/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332868; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332869/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332869; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332870/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332870; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332871/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332871; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332872/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332872; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332854/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332854; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332855/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332855; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332856/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332856; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332857/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332857; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332858/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332858; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332859/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332859; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332860/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332860; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332861/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332861; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332862/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332862; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332846/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332846; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332847/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332847; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332848/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332848; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332849/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332849; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332850/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332850; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332851/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332851; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332852/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332852; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332853/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332853; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332836/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332836; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332837/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332837; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332838/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332838; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332839/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332839; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332840/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332840; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332841/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332841; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332842/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332842; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332843/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332843; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332844/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332844; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332845/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332845; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332826/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332826; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332827/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332827; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332828/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332828; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332829/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332829; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332830/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332830; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332831/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332831; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332832/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332832; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332833/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332833; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332834/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332834; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332835/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332835; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332818/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332818; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332819/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332819; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332820/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332820; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332821/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332821; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332822/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332822; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332823/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332823; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332824/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332824; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332825/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332825; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332808/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332808; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332809/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332809; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332810/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332810; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332811/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332811; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332812/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332812; rev:1;)
alert tcp $HOME_NET any -> [138.197.141.146] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332813/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332813; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332814/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332814; rev:1;)
alert tcp $HOME_NET any -> [165.22.62.189] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332815/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332815; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332816/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332816; rev:1;)
alert tcp $HOME_NET any -> [157.245.110.224] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332817/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332817; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332800/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332800; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332801/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332801; rev:1;)
alert tcp $HOME_NET any -> [138.197.155.229] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332802/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332802; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332803/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332803; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332804/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332804; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 17569  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332805/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332805; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332806/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332806; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332807/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332807; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332789/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332789; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332790/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332790; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332791/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332791; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.140] 11450  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332792/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332792; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332793/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332793; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332794/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332794; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 11991  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332795/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332795; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332796/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332796; rev:1;)
alert tcp $HOME_NET any -> [138.197.7.36] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332797/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332797; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332798/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332798; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 22146  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332799/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332799; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 25265  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332782/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332782; rev:1;)
alert tcp $HOME_NET any -> [138.68.66.39] 21792  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332783/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332783; rev:1;)
alert tcp $HOME_NET any -> [139.59.247.93] 6559  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332784/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332784; rev:1;)
alert tcp $HOME_NET any -> [178.128.99.13] 9604  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332785/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332785; rev:1;)
alert tcp $HOME_NET any -> [128.199.113.0] 13554  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332786/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332786; rev:1;)
alert tcp $HOME_NET any -> [185.117.72.139] 18232  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332787/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332787; rev:1;)
alert tcp $HOME_NET any -> [139.59.59.19] 18137  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332788/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"tuhncjamujanams.info"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332760/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"juanjjaknclm.club"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332761/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"tuhncjamujanams.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332762/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"nuvuvtabke.info"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332763/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"liutexhutujuva.us"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332764/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"asceaecacscea.top"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332765/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"azmlakpqkmc.life"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332766/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"ewmkalomcasc.club"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332767/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"qnktnascoadcs.info"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332768/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zjuwytmzyjlizdzk/"; depth:18; nocase; http.host; content:"atiharbibuyukadamolcak.com"; depth:26; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332769/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zjuwytmzyjlizdzk/"; depth:18; nocase; http.host; content:"atiyepompaladm522.com"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332770/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zjuwytmzyjlizdzk/"; depth:18; nocase; http.host; content:"motiveyiziplattim23.com"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332771/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zjuwytmzyjlizdzk/"; depth:18; nocase; http.host; content:"igot5onit332.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332772/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zjuwytmzyjlizdzk/"; depth:18; nocase; http.host; content:"aliatabakt2t22.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332773/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"thehyperfocus.quest"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332758/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mtbiytaymtk0nzjj/"; depth:18; nocase; http.host; content:"kulijanovatovadownload.net"; depth:26; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332759/; target:src_ip; metadata: confidence_level 80, first_seen 2024_10_02; classtype:trojan-activity; sid:91332759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"thehyperfocus.quest"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332757/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"thehyperfocus.quest"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332756/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332756; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"thehyperfocus.quest"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332755/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332755; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"lgbtrestaurant.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332753/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"thehyperfocus.quest"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332754/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332754; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tselka.org"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332752/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332752; rev:1;)
alert tcp $HOME_NET any -> [154.197.69.155] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332651/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332651; rev:1;)
alert tcp $HOME_NET any -> [103.91.190.180] 1337  (msg:"ThreatFox DBatLoader botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332650/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332650; rev:1;)
alert tcp $HOME_NET any -> [87.120.114.147] 3778  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332781/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332781; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"novo.doxbin.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332780/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332780; rev:1;)
alert tcp $HOME_NET any -> [141.98.10.116] 48920  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332779/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332779; rev:1;)
alert tcp $HOME_NET any -> [107.189.4.201] 58431  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332778/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332778; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"byeux.com"; depth:9; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332777/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332777; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"update.byeux.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332776/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"ch67763.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332775/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"beautidrawk.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332774/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/317f94f0db7b7e68.php"; depth:21; nocase; http.host; content:"45.91.202.84"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332751/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/updatemultiasyncdownloads.php"; depth:30; nocase; http.host; content:"vsratost.top"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332750/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332750; rev:1;)
alert tcp $HOME_NET any -> [147.45.156.121] 8088  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332749/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332749; rev:1;)
alert tcp $HOME_NET any -> [165.22.185.225] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332748/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332748; rev:1;)
alert tcp $HOME_NET any -> [185.229.224.244] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332747/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332747; rev:1;)
alert tcp $HOME_NET any -> [64.49.14.13] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332746/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332746; rev:1;)
alert tcp $HOME_NET any -> [176.9.66.115] 15747  (msg:"ThreatFox SectopRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332745/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332745; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332744/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332744; rev:1;)
alert tcp $HOME_NET any -> [192.210.229.11] 9090  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332742/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332742; rev:1;)
alert tcp $HOME_NET any -> [109.199.104.52] 80  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332743/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332743; rev:1;)
alert tcp $HOME_NET any -> [136.244.110.179] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332741/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332741; rev:1;)
alert tcp $HOME_NET any -> [47.95.179.246] 888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332740/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332740; rev:1;)
alert tcp $HOME_NET any -> [143.198.123.32] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332739/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332739; rev:1;)
alert tcp $HOME_NET any -> [68.183.89.48] 6450  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332733/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332733; rev:1;)
alert tcp $HOME_NET any -> [38.180.74.228] 8976  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332734/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332734; rev:1;)
alert tcp $HOME_NET any -> [45.76.154.241] 4281  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332735/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332735; rev:1;)
alert tcp $HOME_NET any -> [78.141.218.239] 8717  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332736/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332736; rev:1;)
alert tcp $HOME_NET any -> [38.54.50.120] 7288  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332737/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332737; rev:1;)
alert tcp $HOME_NET any -> [38.54.85.244] 4986  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332738/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332738; rev:1;)
alert tcp $HOME_NET any -> [176.97.73.199] 7422  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332724/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332724; rev:1;)
alert tcp $HOME_NET any -> [104.238.176.171] 5468  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332725/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332725; rev:1;)
alert tcp $HOME_NET any -> [38.54.88.248] 2882  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332726/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332726; rev:1;)
alert tcp $HOME_NET any -> [64.176.49.89] 4524  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332727/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332727; rev:1;)
alert tcp $HOME_NET any -> [139.84.167.48] 6004  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332728/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332728; rev:1;)
alert tcp $HOME_NET any -> [139.59.80.77] 4538  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332729/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332729; rev:1;)
alert tcp $HOME_NET any -> [195.80.148.142] 2410  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332730/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332730; rev:1;)
alert tcp $HOME_NET any -> [154.205.128.194] 2621  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332731/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332731; rev:1;)
alert tcp $HOME_NET any -> [154.205.137.248] 7192  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332732/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332732; rev:1;)
alert tcp $HOME_NET any -> [91.196.70.165] 4572  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332715/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332715; rev:1;)
alert tcp $HOME_NET any -> [207.148.69.74] 8225  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332716/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332716; rev:1;)
alert tcp $HOME_NET any -> [139.180.212.224] 6771  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332717/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332717; rev:1;)
alert tcp $HOME_NET any -> [140.82.38.225] 3748  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332718/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332718; rev:1;)
alert tcp $HOME_NET any -> [139.84.227.52] 2474  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332719/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332719; rev:1;)
alert tcp $HOME_NET any -> [154.205.155.3] 7497  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332720/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332720; rev:1;)
alert tcp $HOME_NET any -> [38.180.74.236] 4818  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332721/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332721; rev:1;)
alert tcp $HOME_NET any -> [38.54.56.45] 7507  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332722/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332722; rev:1;)
alert tcp $HOME_NET any -> [38.180.74.180] 7462  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332723/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332723; rev:1;)
alert tcp $HOME_NET any -> [139.180.200.78] 3499  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332705/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332705; rev:1;)
alert tcp $HOME_NET any -> [154.90.63.215] 2280  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332706/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332706; rev:1;)
alert tcp $HOME_NET any -> [38.60.212.13] 5049  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332707/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332707; rev:1;)
alert tcp $HOME_NET any -> [207.148.125.75] 5893  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332708/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332708; rev:1;)
alert tcp $HOME_NET any -> [108.61.127.186] 4001  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332709/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332709; rev:1;)
alert tcp $HOME_NET any -> [38.180.9.2] 5226  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332710/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332710; rev:1;)
alert tcp $HOME_NET any -> [141.164.47.248] 2251  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332711/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332711; rev:1;)
alert tcp $HOME_NET any -> [154.223.21.16] 6259  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332712/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332712; rev:1;)
alert tcp $HOME_NET any -> [66.42.34.87] 8262  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332713/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332713; rev:1;)
alert tcp $HOME_NET any -> [154.205.136.160] 5366  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332714/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332714; rev:1;)
alert tcp $HOME_NET any -> [64.176.47.133] 7216  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332696/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332696; rev:1;)
alert tcp $HOME_NET any -> [38.60.196.86] 8784  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332697/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332697; rev:1;)
alert tcp $HOME_NET any -> [139.84.174.102] 8835  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332698/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332698; rev:1;)
alert tcp $HOME_NET any -> [64.227.130.48] 6088  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332699/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332699; rev:1;)
alert tcp $HOME_NET any -> [38.180.189.108] 5984  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332700/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332700; rev:1;)
alert tcp $HOME_NET any -> [38.180.106.12] 2572  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332701/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332701; rev:1;)
alert tcp $HOME_NET any -> [67.219.101.151] 5989  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332702/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332702; rev:1;)
alert tcp $HOME_NET any -> [158.247.223.125] 2109  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332703/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332703; rev:1;)
alert tcp $HOME_NET any -> [38.60.203.61] 4516  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332704/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332704; rev:1;)
alert tcp $HOME_NET any -> [139.59.43.67] 3242  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332687/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332687; rev:1;)
alert tcp $HOME_NET any -> [154.90.62.247] 3472  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332688/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332688; rev:1;)
alert tcp $HOME_NET any -> [154.223.21.80] 2694  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332689/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332689; rev:1;)
alert tcp $HOME_NET any -> [38.180.106.179] 6648  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332690/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332690; rev:1;)
alert tcp $HOME_NET any -> [154.90.62.201] 5914  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332691/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332691; rev:1;)
alert tcp $HOME_NET any -> [188.116.22.59] 3632  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332692/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332692; rev:1;)
alert tcp $HOME_NET any -> [154.223.21.181] 4873  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332693/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332693; rev:1;)
alert tcp $HOME_NET any -> [38.60.206.78] 3314  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332694/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332694; rev:1;)
alert tcp $HOME_NET any -> [154.223.20.215] 8640  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332695/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332695; rev:1;)
alert tcp $HOME_NET any -> [154.223.21.160] 5972  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332677/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332677; rev:1;)
alert tcp $HOME_NET any -> [5.34.178.144] 3652  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332678/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332678; rev:1;)
alert tcp $HOME_NET any -> [38.60.203.83] 7121  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332679/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332679; rev:1;)
alert tcp $HOME_NET any -> [176.97.73.215] 6894  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332680/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332680; rev:1;)
alert tcp $HOME_NET any -> [38.54.50.253] 4805  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332681/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332681; rev:1;)
alert tcp $HOME_NET any -> [38.180.29.5] 6214  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332682/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332682; rev:1;)
alert tcp $HOME_NET any -> [38.180.188.92] 6733  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332683/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332683; rev:1;)
alert tcp $HOME_NET any -> [154.90.63.156] 8080  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332684/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332684; rev:1;)
alert tcp $HOME_NET any -> [64.176.228.78] 2119  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332685/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332685; rev:1;)
alert tcp $HOME_NET any -> [45.76.177.40] 3053  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332686/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332686; rev:1;)
alert tcp $HOME_NET any -> [38.180.74.14] 7144  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332668/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332668; rev:1;)
alert tcp $HOME_NET any -> [45.77.34.148] 8158  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332669/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332669; rev:1;)
alert tcp $HOME_NET any -> [38.54.50.163] 3296  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332670/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332670; rev:1;)
alert tcp $HOME_NET any -> [139.84.170.90] 7170  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332671/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332671; rev:1;)
alert tcp $HOME_NET any -> [154.205.128.210] 3591  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332672/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332672; rev:1;)
alert tcp $HOME_NET any -> [139.180.139.12] 5118  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332673/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332673; rev:1;)
alert tcp $HOME_NET any -> [38.60.212.167] 8764  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332674/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332674; rev:1;)
alert tcp $HOME_NET any -> [5.34.176.150] 2666  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332675/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332675; rev:1;)
alert tcp $HOME_NET any -> [38.180.106.167] 3973  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332676/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332676; rev:1;)
alert tcp $HOME_NET any -> [139.84.230.198] 7335  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332659/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332659; rev:1;)
alert tcp $HOME_NET any -> [38.180.74.173] 6114  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332660/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332660; rev:1;)
alert tcp $HOME_NET any -> [45.32.33.92] 3558  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332661/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332661; rev:1;)
alert tcp $HOME_NET any -> [139.84.147.229] 7860  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332662/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332662; rev:1;)
alert tcp $HOME_NET any -> [64.176.56.252] 8927  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332663/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332663; rev:1;)
alert tcp $HOME_NET any -> [139.84.177.244] 6542  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332664/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332664; rev:1;)
alert tcp $HOME_NET any -> [139.84.163.73] 2225  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332665/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332665; rev:1;)
alert tcp $HOME_NET any -> [38.180.191.118] 2814  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332666/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332666; rev:1;)
alert tcp $HOME_NET any -> [38.60.212.233] 7038  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332667/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332667; rev:1;)
alert tcp $HOME_NET any -> [38.180.29.229] 8245  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332656/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332656; rev:1;)
alert tcp $HOME_NET any -> [38.180.128.52] 7598  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332657/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332657; rev:1;)
alert tcp $HOME_NET any -> [38.60.223.208] 4557  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332658/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332658; rev:1;)
alert tcp $HOME_NET any -> [185.180.199.205] 443  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332655/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332655; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eyh.ocry.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332654/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332654; rev:1;)
alert tcp $HOME_NET any -> [38.60.221.211] 8080  (msg:"ThreatFox GobRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332653/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332653; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"nbt201.dynamic-dns.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332652/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332652; rev:1;)
alert tcp $HOME_NET any -> [143.198.123.84] 42078  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332649/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332649; rev:1;)
alert tcp $HOME_NET any -> [188.34.178.0] 5552  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332648/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/b719f5f6.php"; depth:13; nocase; http.host; content:"a1035960.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332647/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"nurserrsjwuwq.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332646/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"dividenntykw.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332645/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/e37816e5.php"; depth:13; nocase; http.host; content:"a1036037.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332644/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/edumall-child/ethec4.php"; depth:43; nocase; http.host; content:"indiaaidfoundation.org"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332642/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/twentytwentytwo/vqra4w.php"; depth:45; nocase; http.host; content:"jalandharagroexport.com"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332643/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/twentytwenty/io3ryx.php"; depth:42; nocase; http.host; content:"lionsclub-issoire.org"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332641/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/twentytwentyone/bthdfl.php"; depth:45; nocase; http.host; content:"velintra.org"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332639/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/twentytwentytwo/8rw0ar.php"; depth:45; nocase; http.host; content:"hablainglesfacil.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332640/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/modules/mod_feed/tmpl/e3ycof.php"; depth:33; nocase; http.host; content:"iconic-tec.de"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332638/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/modules/dashgoals/t2apqe.php"; depth:29; nocase; http.host; content:"auditoresdezaragoza.es"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332637/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/themes/twentytwentytwo/cb2v5p.php"; depth:45; nocase; http.host; content:"sdtruckinglogistics.net"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332636/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/download.php"; depth:13; nocase; http.host; content:"downloadglobalproject.info"; depth:26; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332635/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/redirect.php"; depth:24; nocase; http.host; content:"globalvpnproject.info"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332634/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"globalvpnproject.info"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332633/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332633; rev:1;)
alert tcp $HOME_NET any -> [46.101.120.37] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332632/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332632; rev:1;)
alert tcp $HOME_NET any -> [47.113.193.147] 8443  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332631/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332631; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.241] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332630/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332630; rev:1;)
alert tcp $HOME_NET any -> [156.195.154.23] 2003  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332629/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332629; rev:1;)
alert tcp $HOME_NET any -> [182.180.49.15] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332628/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332628; rev:1;)
alert tcp $HOME_NET any -> [185.174.101.156] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332627/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332627; rev:1;)
alert tcp $HOME_NET any -> [8.130.115.187] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332626/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332626; rev:1;)
alert tcp $HOME_NET any -> [139.155.77.34] 10086  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332625/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332625; rev:1;)
alert tcp $HOME_NET any -> [154.221.17.44] 2888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332624/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332624; rev:1;)
alert tcp $HOME_NET any -> [166.1.190.154] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332623/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332623; rev:1;)
alert tcp $HOME_NET any -> [154.37.222.102] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332622/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332622; rev:1;)
alert tcp $HOME_NET any -> [124.71.223.58] 5001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332621/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332621; rev:1;)
alert tcp $HOME_NET any -> [8.134.212.158] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332620/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332620; rev:1;)
alert tcp $HOME_NET any -> [8.219.159.73] 801  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332619/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332619; rev:1;)
alert tcp $HOME_NET any -> [199.195.253.96] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332618/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/281e4696f6bc0de6.php"; depth:21; nocase; http.host; content:"45.200.149.53"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332558/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_02; classtype:trojan-activity; sid:91332558; rev:1;)
alert tcp $HOME_NET any -> [82.202.167.226] 25563  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332560/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332560; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.21] 59424  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332561/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332561; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"language-sublime.gl.at.ply.gg"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332562/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332562; rev:1;)
alert tcp $HOME_NET any -> [137.184.83.183] 4000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332617/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332617; rev:1;)
alert tcp $HOME_NET any -> [103.77.209.61] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332616/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332616; rev:1;)
alert tcp $HOME_NET any -> [185.215.113.28] 7766  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332615/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332615; rev:1;)
alert tcp $HOME_NET any -> [45.149.241.43] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332613/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332613; rev:1;)
alert tcp $HOME_NET any -> [94.156.105.72] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332614/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332614; rev:1;)
alert tcp $HOME_NET any -> [87.120.115.5] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332612/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332612; rev:1;)
alert tcp $HOME_NET any -> [64.176.38.230] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332611/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332611; rev:1;)
alert tcp $HOME_NET any -> [198.255.103.64] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332610/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332610; rev:1;)
alert tcp $HOME_NET any -> [185.16.43.72] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332609/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332609; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.177] 443  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332608/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332608; rev:1;)
alert tcp $HOME_NET any -> [206.119.171.243] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332607/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332607; rev:1;)
alert tcp $HOME_NET any -> [59.110.6.123] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332606/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332606; rev:1;)
alert tcp $HOME_NET any -> [95.174.93.130] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332605/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332605; rev:1;)
alert tcp $HOME_NET any -> [45.12.90.123] 50051  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332604/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332604; rev:1;)
alert tcp $HOME_NET any -> [31.135.19.237] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332603/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/providerpythonjsbigloadflowertemp.php"; depth:38; nocase; http.host; content:"cb62343.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332602/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332602; rev:1;)
alert tcp $HOME_NET any -> [167.0.201.5] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332601/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332601; rev:1;)
alert tcp $HOME_NET any -> [148.113.165.11] 3236  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332600/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_02; classtype:trojan-activity; sid:91332600; rev:1;)
alert tcp $HOME_NET any -> [47.93.240.197] 444  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332599/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332599; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"anoive.top"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332598/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332598; rev:1;)
alert tcp $HOME_NET any -> [23.237.174.2] 7979  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332597/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332597; rev:1;)
alert tcp $HOME_NET any -> [3.86.191.252] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332596/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332596; rev:1;)
alert tcp $HOME_NET any -> [177.144.166.190] 5000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332595/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332595; rev:1;)
alert tcp $HOME_NET any -> [45.88.88.78] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332594/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332594; rev:1;)
alert tcp $HOME_NET any -> [94.156.166.105] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332593/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332593; rev:1;)
alert tcp $HOME_NET any -> [167.99.6.167] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332592/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332592; rev:1;)
alert tcp $HOME_NET any -> [139.162.212.131] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332591/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332591; rev:1;)
alert tcp $HOME_NET any -> [95.216.94.138] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332589/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332589; rev:1;)
alert tcp $HOME_NET any -> [193.42.11.31] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332590/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332590; rev:1;)
alert tcp $HOME_NET any -> [46.246.82.4] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332588/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332588; rev:1;)
alert tcp $HOME_NET any -> [172.94.127.3] 7920  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332587/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332587; rev:1;)
alert tcp $HOME_NET any -> [45.207.211.210] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332586/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332586; rev:1;)
alert tcp $HOME_NET any -> [101.133.238.18] 4444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332585/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_02; classtype:trojan-activity; sid:91332585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/d9355d18f49536e4.php"; depth:21; nocase; http.host; content:"194.26.232.100"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332584/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"markyclaktwi.store"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332583/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//2.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332581/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//7.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332582/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//1.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332580/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//5.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332579/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//4.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332578/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//3.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332577/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/www//6.jpg"; depth:11; nocase; http.host; content:"l3monrat.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332576/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ae39cca0.php"; depth:13; nocase; http.host; content:"a1016854.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332575/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"a1035638.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332574/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332574; rev:1;)
alert tcp $HOME_NET any -> [176.124.205.162] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332573/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332573; rev:1;)
alert tcp $HOME_NET any -> [93.123.85.216] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332572/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332572; rev:1;)
alert tcp $HOME_NET any -> [172.211.39.141] 80  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332571/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332571; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.235] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332570/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332570; rev:1;)
alert tcp $HOME_NET any -> [104.238.57.79] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332569/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332569; rev:1;)
alert tcp $HOME_NET any -> [94.156.166.34] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332568/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332568; rev:1;)
alert tcp $HOME_NET any -> [47.76.61.197] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332567/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332567; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332566/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332566; rev:1;)
alert tcp $HOME_NET any -> [95.34.8.91] 8080  (msg:"ThreatFox DarkComet botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332565/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332565; rev:1;)
alert tcp $HOME_NET any -> [60.204.152.14] 8011  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332564/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332564; rev:1;)
alert tcp $HOME_NET any -> [47.121.133.136] 40404  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332563/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"125.47.62.230"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332559/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332559; rev:1;)
alert tcp $HOME_NET any -> [5.42.92.116] 48893  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332362/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332362; rev:1;)
alert tcp $HOME_NET any -> [18.158.58.205] 14355  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332361/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332361; rev:1;)
alert tcp $HOME_NET any -> [3.67.62.142] 14355  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332360/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332360; rev:1;)
alert tcp $HOME_NET any -> [3.67.161.133] 14355  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332359/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"treatynreit.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332357/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"soldiefieop.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332356/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"snarlypagowo.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332355/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"questionsmw.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332354/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"mysterisop.site"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332353/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"gravvitywio.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332352/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"absorptioniw.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332350/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"chorusarorp.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332351/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"abnomalrkmu.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332349/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332349; rev:1;)
alert tcp $HOME_NET any -> [51.250.44.190] 8443  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332348/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332348; rev:1;)
alert tcp $HOME_NET any -> [20.117.118.95] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332346/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332346; rev:1;)
alert tcp $HOME_NET any -> [45.150.108.3] 8080  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332347/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332347; rev:1;)
alert tcp $HOME_NET any -> [49.51.49.133] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332345/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332345; rev:1;)
alert tcp $HOME_NET any -> [93.123.85.190] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332344/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332344; rev:1;)
alert tcp $HOME_NET any -> [89.117.72.231] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332343/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332343; rev:1;)
alert tcp $HOME_NET any -> [85.209.11.15] 4444  (msg:"ThreatFox BitRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332342/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332342; rev:1;)
alert tcp $HOME_NET any -> [18.133.253.38] 443  (msg:"ThreatFox PoshC2 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332341/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332341; rev:1;)
alert tcp $HOME_NET any -> [139.144.31.55] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332339/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332339; rev:1;)
alert tcp $HOME_NET any -> [45.55.96.141] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332340/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332340; rev:1;)
alert tcp $HOME_NET any -> [47.253.151.200] 80  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332337/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332337; rev:1;)
alert tcp $HOME_NET any -> [167.71.175.190] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332338/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332338; rev:1;)
alert tcp $HOME_NET any -> [45.56.75.204] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332336/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332336; rev:1;)
alert tcp $HOME_NET any -> [81.165.145.181] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332335/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332335; rev:1;)
alert tcp $HOME_NET any -> [52.140.16.178] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332333/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332333; rev:1;)
alert tcp $HOME_NET any -> [52.140.16.178] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332334/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332334; rev:1;)
alert tcp $HOME_NET any -> [45.89.247.153] 50555  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332332/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332332; rev:1;)
alert tcp $HOME_NET any -> [91.92.253.85] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332331/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332331; rev:1;)
alert tcp $HOME_NET any -> [163.172.171.199] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332329/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332329; rev:1;)
alert tcp $HOME_NET any -> [47.76.51.11] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332330/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332330; rev:1;)
alert tcp $HOME_NET any -> [195.100.198.220] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332328/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332328; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.176] 6666  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332327/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332327; rev:1;)
alert tcp $HOME_NET any -> [46.246.86.13] 2000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332326/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332326; rev:1;)
alert tcp $HOME_NET any -> [39.107.85.83] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332325/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332325; rev:1;)
alert tcp $HOME_NET any -> [8.218.193.197] 80  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332324/; target:src_ip; metadata: confidence_level 90, first_seen 2024_10_01; classtype:trojan-activity; sid:91332324; rev:1;)
alert tcp $HOME_NET any -> [192.248.165.125] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332323/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332323; rev:1;)
alert tcp $HOME_NET any -> [107.175.130.20] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332322/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332322; rev:1;)
alert tcp $HOME_NET any -> [103.186.117.214] 9373  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332320/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332320; rev:1;)
alert tcp $HOME_NET any -> [103.186.117.97] 9373  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332321/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332321; rev:1;)
alert tcp $HOME_NET any -> [103.186.117.143] 9373  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332319/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332319; rev:1;)
alert tcp $HOME_NET any -> [124.220.59.220] 57841  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332318/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332318; rev:1;)
alert tcp $HOME_NET any -> [159.75.241.157] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332317/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332317; rev:1;)
alert tcp $HOME_NET any -> [80.66.85.112] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332316/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"writekdmsnu.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332311/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"delaylacedmn.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332312/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"trenndylicensei.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332313/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"agentyanlark.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332310/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"commandejorsk.site"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332308/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"bellykmrebk.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332309/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"virationli.site"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332306/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"famikyjdiag.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332307/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332307; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"trenndylicensei.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332304/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332304; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"virationli.site"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332305/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332305; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"worldresource.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332298/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332298; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"025sep.duckdns.org"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332301/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332301; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"winsrr14.duckdns.org"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332302/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332302; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"indoprimitiveart.com"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332300/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332300; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"boarderryowk.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332314/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332314; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"voilantaiowm.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332315/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332315; rev:1;)
alert tcp $HOME_NET any -> [172.94.108.143] 7784  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332303/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/77e2e60e0ac03638.php"; depth:21; nocase; http.host; content:"185.244.219.199"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332299/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332299; rev:1;)
alert tcp $HOME_NET any -> [94.232.40.36] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332297/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332297; rev:1;)
alert tcp $HOME_NET any -> [167.71.234.132] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332296/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332296; rev:1;)
alert tcp $HOME_NET any -> [173.231.247.84] 64114  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332295/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332295; rev:1;)
alert tcp $HOME_NET any -> [94.156.64.12] 447  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332294/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eternaljslocaltemporary.php"; depth:28; nocase; http.host; content:"479548cm.nyashka.top"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332293/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332293; rev:1;)
alert tcp $HOME_NET any -> [154.197.69.165] 443  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332292/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332292; rev:1;)
alert tcp $HOME_NET any -> [103.252.89.37] 80  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332290/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332290; rev:1;)
alert tcp $HOME_NET any -> [154.197.69.165] 80  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332291/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332291; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.242] 80  (msg:"ThreatFox Loki Password Stealer (PWS) botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332170/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332170; rev:1;)
alert tcp $HOME_NET any -> [170.75.167.85] 443  (msg:"ThreatFox FAKEUPDATES botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332171/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332171; rev:1;)
alert tcp $HOME_NET any -> [110.164.203.191] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332287/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332287; rev:1;)
alert tcp $HOME_NET any -> [154.197.69.165] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332288/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332288; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"millysioitwl.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332286/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332286; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"positionorbiteo.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332279/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332279; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"perforatedmwqn.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332280/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332280; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"makedupperkjs.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332281/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332281; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wallkedsleeoi.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332282/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332282; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"usseorganizedw.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332283/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332283; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"spiderrista.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332284/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332284; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"moduledfahhhiov.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332285/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332285; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"brammdysocitrey.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332269/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332269; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"famillmeasurd.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332270/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332270; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"gemmyfaithkw.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332271/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332271; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"agreedmeanynj.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332272/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332272; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"oriennnationiw.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332273/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332273; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"appendparttenw.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332274/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332274; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"officemythsjw.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332275/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332275; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"annthostiledm.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332276/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332276; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sufferinggeryjs.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332277/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332277; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"platformreisio.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332278/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"racedsuitreow.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332268/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"performenj.shop"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332267/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"moduledfahhhiov.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332266/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"reinforcenh.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332265/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"millysioitwl.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332264/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"literacyhangwk.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332263/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"ptramidermsnqj.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332262/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"reliabledmwqj.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332261/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"articultattkwm.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332260/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"drawzhotdog.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332259/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"stogeneratmns.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332258/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"ghostreedmnu.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332257/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"vozmeatillu.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332256/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"spiderrista.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332254/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"fragnantbui.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332255/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"wallkedsleeoi.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332253/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"riderratttinow.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332252/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"spiderrista.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332251/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"usseorganizedw.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332250/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"raciimoppero.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332249/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"makedupperkjs.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332248/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"defenddsouneuw.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332247/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"branchtriviawlek.shop"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332246/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"perforatedmwqn.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332245/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"positionorbiteo.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332244/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"gutterydhowi.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332243/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"platformreisio.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332242/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"sufferinggeryjs.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332240/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"platformreisio.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332241/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"annthostiledm.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332239/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"officemythsjw.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332238/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"appendparttenw.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332237/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"oriennnationiw.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332236/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"gemmyfaithkw.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332235/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"gemmyfaithkw.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332234/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"famillmeasurd.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332233/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"brammdysocitrey.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332232/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"brammdysocitrey.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332231/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332231; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sixvx16pn.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332224/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332224; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvh20pt.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332225/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332225; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvx20vs.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332226/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332226; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetvx19pn.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332227/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332227; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eihtvf18sr.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332228/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332228; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetvh19ht.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332229/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332229; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvh20ht.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332230/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332230; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvx20pn.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332214/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332214; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eihtvh18pt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332215/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332215; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fiftvh15pt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332216/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332216; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fiftvx15pn.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332217/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332217; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetvh19pt.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332218/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332218; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetvx19vs.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332219/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332219; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevtvh17pt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332220/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332220; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevtvx17pn.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332221/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332221; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevtvx17vs.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332222/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332222; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sixvh16pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332223/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332223; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fivevf5pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332208/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332208; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"forcf4pt.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332209/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332209; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivf6pt.top"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332210/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332210; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"threvf3pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332211/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332211; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"twovdf2pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332212/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332212; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvf7pt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332213/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332213; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tenvh10sr.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332199/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332199; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"threvf3sr.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332200/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332200; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"elevenvh11vt.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332201/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332201; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"neinvh9vt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332202/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332202; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetgh19sb.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332203/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332203; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvh7vt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332204/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332204; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivh6vt.top"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332205/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332205; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"twelvevf12vt.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332206/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332206; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fivevh5vt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332207/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332207; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvh7ht.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332189/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332189; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"elevenvh11ht.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332190/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332190; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"elevenvh11sr.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332191/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332191; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fivevh5ht.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332192/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332192; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fivevh5sr.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332193/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332193; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"neinvh9ht.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332194/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332194; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"neinvh9sr.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332195/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332195; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivh6hs.top"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332196/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332196; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivh6sr.top"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332197/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332197; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tenvh10ht.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332198/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332198; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvx7vs.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332179/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332179; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivhs6pn.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332180/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332180; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivhs6pt.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332181/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332181; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sivhs6vs.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332182/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332182; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tendv10vs.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332183/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332183; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"threvh3pn.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332184/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332184; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"threvh3pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332185/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332185; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"twelvevx12vs.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332186/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332186; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"twovh2pn.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332187/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332187; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"twovh2pt.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332188/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332188; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvx7pn.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332172/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332172; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eightxp8sb.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332173/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332173; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fivevh5pt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332174/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332174; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"neinvx9vs.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332175/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332175; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"onevh1pn.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332176/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332176; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"onevh1pt.top"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332177/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332177; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvh7pt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332178/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"indoprimitiveart.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332162/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"indoprimitiveart.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332163/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"indoprimitiveart.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332164/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"indoprimitiveart.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332165/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332165; rev:1;)
alert tcp $HOME_NET any -> [60.205.56.181] 7777  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332169/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332169; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"solutviewmen.viewdns.net"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332168/; target:src_ip; metadata: confidence_level 50, first_seen 2024_10_01; classtype:trojan-activity; sid:91332168; rev:1;)
alert tcp $HOME_NET any -> [172.234.120.150] 2469  (msg:"ThreatFox Meterpreter botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332167/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/bdifygidj/five/fre.php"; depth:23; nocase; http.host; content:"solutviewmen.viewdns.net"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332166/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332166; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.portalvpn.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332160/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332160; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwvpnssl.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332161/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332161; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.141] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332158/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332158; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwsecure.ethergases.org"; depth:28; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332159/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332159; rev:1;)
alert tcp $HOME_NET any -> [20.174.169.119] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332157/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332157; rev:1;)
alert tcp $HOME_NET any -> [128.90.102.94] 5155  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332156/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332156; rev:1;)
alert tcp $HOME_NET any -> [46.246.86.13] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332155/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332155; rev:1;)
alert tcp $HOME_NET any -> [185.38.142.127] 80  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332153/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332153; rev:1;)
alert tcp $HOME_NET any -> [185.196.8.98] 2105  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332154/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332154; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ghd-34kaspod.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332152/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mdm/"; depth:5; nocase; http.host; content:"ghd-34kaspod.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332151/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332151; rev:1;)
alert tcp $HOME_NET any -> [147.45.113.135] 443  (msg:"ThreatFox EugenLoader payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332150/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332150; rev:1;)
alert tcp $HOME_NET any -> [80.66.81.199] 443  (msg:"ThreatFox EugenLoader payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332149/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332149; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"sufsharkos.com"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332141/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332141; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"vpnspia.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332142/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332142; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"privatevpnos.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332143/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332143; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"nrdvpn.pro"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332144/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332144; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"piavpn.pro"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332145/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332145; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"privatvpn.pro"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332146/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332146; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"surfshrkvpn.pro"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332147/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332147; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"vpnexprss.pro"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332148/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332148; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"nordvpnos.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332139/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332139; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"expressovvpn.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332140/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"gunnylaumienphi2017.com"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332138/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/2yme"; depth:5; nocase; http.host; content:"8.130.42.227"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332137/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332137; rev:1;)
alert tcp $HOME_NET any -> [5.75.211.100] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332136/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"5.75.211.100"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332135/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332135; rev:1;)
alert tcp $HOME_NET any -> [83.229.123.102] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332134/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/index.php/check.php"; depth:20; nocase; http.host; content:"137.184.191.215"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332133/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/index.php/check.php"; depth:20; nocase; http.host; content:"137.184.191.215"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332132/; target:src_ip; metadata: confidence_level 75, first_seen 2024_10_01; classtype:trojan-activity; sid:91332132; rev:1;)
alert tcp $HOME_NET any -> [103.164.62.56] 800  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332131/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/0a616124ff2f2b69.php"; depth:21; nocase; http.host; content:"45.200.148.113"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332130/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332130; rev:1;)
alert tcp $HOME_NET any -> [39.102.36.209] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332129/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332129; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"paveldurov.sbs"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332104/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332104; rev:1;)
alert tcp $HOME_NET any -> [68.35.241.183] 5982  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332118/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332118; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tag224.ddns.net"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332119/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332119; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sam.mr"; depth:6; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332128/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332128; rev:1;)
alert tcp $HOME_NET any -> [128.65.199.135] 8888  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332127/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332127; rev:1;)
alert tcp $HOME_NET any -> [167.179.109.53] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332126/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332126; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"68-183-110-121.ipv4.staticdns3.io"; depth:33; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332125/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332125; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.gateway.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332124/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332124; rev:1;)
alert tcp $HOME_NET any -> [45.88.186.202] 7077  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332123/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332123; rev:1;)
alert tcp $HOME_NET any -> [5.189.175.225] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332122/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332122; rev:1;)
alert tcp $HOME_NET any -> [45.207.211.210] 8088  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332121/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/videojavascriptauthdefaultsqllinuxwindowsprivatetempuploads.php"; depth:64; nocase; http.host; content:"664930cm.n9shka.top"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332120/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/externaleternalapidefaultwindowsuniversaldownloads.php"; depth:55; nocase; http.host; content:"779601cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332117/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332117; rev:1;)
alert tcp $HOME_NET any -> [50.114.5.24] 8000  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332116/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332116; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwdemo.ethergases.org"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332114/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332114; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"analyze.ethergases.org"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332115/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332115; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwadmin.ethergases.org"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332113/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332113; rev:1;)
alert tcp $HOME_NET any -> [142.202.242.182] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332112/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332112; rev:1;)
alert tcp $HOME_NET any -> [85.209.11.113] 5001  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332111/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332111; rev:1;)
alert tcp $HOME_NET any -> [103.186.116.99] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332110/; target:src_ip; metadata: confidence_level 100, first_seen 2024_10_01; classtype:trojan-activity; sid:91332110; rev:1;)
alert tcp $HOME_NET any -> [103.198.26.87] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332109/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/push"; depth:5; nocase; http.host; content:"156.224.21.148"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332108/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91332108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/gclg"; depth:5; nocase; http.host; content:"156.224.21.148"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332107/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91332107; rev:1;)
alert tcp $HOME_NET any -> [156.224.21.148] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332106/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332106; rev:1;)
alert tcp $HOME_NET any -> [89.169.12.17] 6180  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332105/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/7db38bfff9324bbe.php"; depth:21; nocase; http.host; content:"77.105.164.86"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332103/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332103; rev:1;)
alert tcp $HOME_NET any -> [203.55.176.207] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332102/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_30; classtype:trojan-activity; sid:91332102; rev:1;)
alert tcp $HOME_NET any -> [143.198.204.173] 8000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332101/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332101; rev:1;)
alert tcp $HOME_NET any -> [5.89.181.113] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332099/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332099; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"canvas.pet"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332100/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332100; rev:1;)
alert tcp $HOME_NET any -> [46.246.84.15] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332097/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332097; rev:1;)
alert tcp $HOME_NET any -> [46.246.80.12] 6060  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332098/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332098; rev:1;)
alert tcp $HOME_NET any -> [46.246.6.14] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332096/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332096; rev:1;)
alert tcp $HOME_NET any -> [80.78.28.83] 1337  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332095/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332095; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwssl.ethergases.app"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332094/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332094; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwmail.ethergases.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332092/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332092; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwstaging.ethergases.app"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332093/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332093; rev:1;)
alert tcp $HOME_NET any -> [94.232.40.36] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332091/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332091; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.112] 5555  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332090/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332090; rev:1;)
alert tcp $HOME_NET any -> [66.179.188.124] 888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332089/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332089; rev:1;)
alert tcp $HOME_NET any -> [46.246.86.13] 8888  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1332088/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/79056de7.php"; depth:13; nocase; http.host; content:"co28270.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1332087/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332087; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"torressociedade.site"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332081/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332081; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"camburiengenharia.site"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332082/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332082; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"rochaacessoria.site"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332083/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332083; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"carvalhoengenharia.site"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332084/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332084; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"maximosolucoes.online"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332085/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332085; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"bandeirantelogistica.online"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1332086/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91332086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"paperbearsweets.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331944/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331944; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"paperbearsweets.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331945/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"paperbearsweets.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331946/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331946; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"commandejorsk.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331955/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331955; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"underlinemdsj.site"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331954/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331954; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"flouredbiteowo.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331956/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331956; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"bellykmrebk.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331957/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331957; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"writekdmsnu.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331958/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331958; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"delaylacedmn.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331959/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331959; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"agentyanlark.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331960/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331960; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"offeviablwke.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331964/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331964; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dczas.duckdns.org"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331986/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331986; rev:1;)
alert tcp $HOME_NET any -> [103.252.89.37] 7000  (msg:"ThreatFox XWorm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331985/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331985; rev:1;)
alert tcp $HOME_NET any -> [185.33.84.157] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331967/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331967; rev:1;)
alert tcp $HOME_NET any -> [173.255.204.62] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331968/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"paperbearsweets.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331947/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"paperbearsweets.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331948/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"reputationb.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331926/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331926; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"reputationb.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331927/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"reputationb.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331928/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"reputationb.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331929/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"reputationb.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331930/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331930; rev:1;)
alert tcp $HOME_NET any -> [172.81.182.179] 443  (msg:"ThreatFox FAKEUPDATES botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331942/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331942; rev:1;)
alert tcp $HOME_NET any -> [88.119.175.180] 443  (msg:"ThreatFox FAKEUPDATES botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331941/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331941; rev:1;)
alert tcp $HOME_NET any -> [216.189.145.234] 443  (msg:"ThreatFox FAKEUPDATES botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331943/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331943; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"artbykathrynmorin.com"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331993/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331993; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 90%)"; dns_query; content:"transfer-server.store"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331992/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_30; classtype:trojan-activity; sid:91331992; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"limacamposadv.online"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331991/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"tiddymarktwo.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331990/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"offeviablwke.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331989/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"explorationmsn.store"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331988/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331988; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"camposacessoria.online"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331987/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331987; rev:1;)
alert tcp $HOME_NET any -> [81.16.6.166] 53  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331984/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331984; rev:1;)
alert tcp $HOME_NET any -> [62.84.102.226] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331983/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331983; rev:1;)
alert tcp $HOME_NET any -> [143.244.201.89] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331981/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331981; rev:1;)
alert tcp $HOME_NET any -> [137.184.67.163] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331982/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331982; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 5001  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331980/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331980; rev:1;)
alert tcp $HOME_NET any -> [177.172.52.150] 5000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331979/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331979; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.233] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331978/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331978; rev:1;)
alert tcp $HOME_NET any -> [185.200.221.18] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331977/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331977; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.191] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331975/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331975; rev:1;)
alert tcp $HOME_NET any -> [104.243.242.233] 1692  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331976/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331976; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.229] 443  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331974/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331974; rev:1;)
alert tcp $HOME_NET any -> [45.95.169.124] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331973/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331973; rev:1;)
alert tcp $HOME_NET any -> [95.168.174.42] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331972/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331972; rev:1;)
alert tcp $HOME_NET any -> [79.132.130.211] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331971/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331971; rev:1;)
alert tcp $HOME_NET any -> [139.9.86.216] 8000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331970/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eternalrequestgeoapiprotecttraffictestlocal.php"; depth:48; nocase; http.host; content:"684841cm.newnyash.top"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331969/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/_longpollflowertest.php"; depth:24; nocase; http.host; content:"cryptoaboba.top"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331966/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dfa6021ea4b3871c.php"; depth:21; nocase; http.host; content:"185.250.207.28"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331965/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mi341/index.php"; depth:16; nocase; http.host; content:"d4hk.shop"; depth:9; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331953/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331953; rev:1;)
alert tcp $HOME_NET any -> [5.42.101.62] 80  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331952/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331952; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"urusvisa.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331951/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"urusvisa.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331950/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jamsemlg"; depth:9; nocase; http.host; content:"t.me"; depth:4; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331949/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331949; rev:1;)
alert tcp $HOME_NET any -> [161.35.11.78] 4000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331940/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331940; rev:1;)
alert tcp $HOME_NET any -> [45.153.242.178] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331939/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331939; rev:1;)
alert tcp $HOME_NET any -> [191.82.199.12] 2000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331938/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331938; rev:1;)
alert tcp $HOME_NET any -> [109.207.172.142] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331936/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331936; rev:1;)
alert tcp $HOME_NET any -> [5.83.152.9] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331937/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331937; rev:1;)
alert tcp $HOME_NET any -> [185.246.223.69] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331935/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331935; rev:1;)
alert tcp $HOME_NET any -> [159.89.1.205] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331934/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331934; rev:1;)
alert tcp $HOME_NET any -> [20.189.117.246] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331933/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331933; rev:1;)
alert tcp $HOME_NET any -> [91.149.240.153] 443  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331932/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_30; classtype:trojan-activity; sid:91331932; rev:1;)
alert tcp $HOME_NET any -> [47.120.33.101] 8088  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331931/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331931; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"softbyms.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331924/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331924; rev:1;)
alert tcp $HOME_NET any -> [45.182.189.109] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331925/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/js/support.js"; depth:14; nocase; http.host; content:"beonlineboo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331920/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331920; rev:1;)
alert tcp $HOME_NET any -> [179.60.150.123] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331921/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331921; rev:1;)
alert tcp $HOME_NET any -> [147.78.47.88] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331922/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331922; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"beef.softbyms.com"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331923/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331923; rev:1;)
alert tcp $HOME_NET any -> [103.186.116.93] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331919/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331919; rev:1;)
alert tcp $HOME_NET any -> [45.89.247.199] 3608  (msg:"ThreatFox STRRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331918/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331918; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cpcontacts.purefusionos.com"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331917/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331917; rev:1;)
alert tcp $HOME_NET any -> [115.91.26.76] 6000  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331916/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331916; rev:1;)
alert tcp $HOME_NET any -> [54.79.166.152] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331915/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331915; rev:1;)
alert tcp $HOME_NET any -> [181.162.179.165] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331914/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331914; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"portalvpn.pythr.net"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331913/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331913; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwportal.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331911/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331911; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwconnect.pythr.net"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331912/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331912; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwwwwwebmail.pythr.net"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331908/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331908; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwrds1.pythr.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331909/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331909; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwwwwgatewayvpn.pythr.net"; depth:33; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331910/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331910; rev:1;)
alert tcp $HOME_NET any -> [170.106.168.85] 50555  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331907/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331907; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwconnect.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331905/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331905; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwconnect.pythr.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331906/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331906; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.backend.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331903/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331903; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"us-ps-cp.life"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331904/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331904; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tthvlgatewaycitrix.pythr.net"; depth:28; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331902/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331902; rev:1;)
alert tcp $HOME_NET any -> [66.179.188.124] 8000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331901/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331901; rev:1;)
alert tcp $HOME_NET any -> [122.51.10.219] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331900/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331900; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"shades.whatisaweekend.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331899/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eternallinepythonphpauthdbflowergenerator.php"; depth:46; nocase; http.host; content:"185.106.92.23"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331898/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331898; rev:1;)
alert tcp $HOME_NET any -> [207.246.113.185] 46836  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331897/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/lrk4"; depth:5; nocase; http.host; content:"47.120.3.3"; depth:10; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331896/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331896; rev:1;)
alert tcp $HOME_NET any -> [47.120.3.3] 8044  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331895/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331895; rev:1;)
alert tcp $HOME_NET any -> [49.12.106.214] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331894/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331894; rev:1;)
alert tcp $HOME_NET any -> [49.12.197.9] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331893/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"49.12.106.214"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331892/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"49.12.197.9"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331891/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"103.15.254.80"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331890/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_30; classtype:trojan-activity; sid:91331890; rev:1;)
alert tcp $HOME_NET any -> [107.173.229.59] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331817/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331817; rev:1;)
alert tcp $HOME_NET any -> [107.173.141.207] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331816/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_30; classtype:trojan-activity; sid:91331816; rev:1;)
alert tcp $HOME_NET any -> [157.20.182.63] 4449  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331812/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331812; rev:1;)
alert tcp $HOME_NET any -> [107.172.60.88] 5003  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331813/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331813; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"innerglowjourney.com"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331860/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"innerglowjourney.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331861/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"innerglowjourney.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331862/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331862; rev:1;)
alert tcp $HOME_NET any -> [94.156.69.121] 31337  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331858/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_30; classtype:trojan-activity; sid:91331858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"innerglowjourney.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331859/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"innerglowjourney.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331863/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331863; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"encrypted7745.hopto.org"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331865/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331865; rev:1;)
alert tcp $HOME_NET any -> [43.128.112.182] 4444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331889/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331889; rev:1;)
alert tcp $HOME_NET any -> [198.98.49.171] 800  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331888/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331888; rev:1;)
alert tcp $HOME_NET any -> [52.64.79.95] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331887/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331887; rev:1;)
alert tcp $HOME_NET any -> [154.213.65.88] 7777  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331886/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331886; rev:1;)
alert tcp $HOME_NET any -> [154.12.20.247] 801  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331885/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331885; rev:1;)
alert tcp $HOME_NET any -> [47.121.200.173] 5555  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331884/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331884; rev:1;)
alert tcp $HOME_NET any -> [47.117.3.107] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331883/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331883; rev:1;)
alert tcp $HOME_NET any -> [66.63.168.142] 4782  (msg:"ThreatFox XenoRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331882/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"underlinemdsj.site"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331881/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"possiwreeste.site"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331880/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_30; classtype:trojan-activity; sid:91331880; rev:1;)
alert tcp $HOME_NET any -> [192.3.101.137] 5980  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331879/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331879; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mail.purefusionos.com"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331876/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331876; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cpanel.purefusionos.com"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331877/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331877; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"login.kane-com.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331878/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331878; rev:1;)
alert tcp $HOME_NET any -> [157.10.45.143] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331875/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331875; rev:1;)
alert tcp $HOME_NET any -> [144.126.245.91] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331874/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331874; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.53] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331872/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331872; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"uspsgc.life"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331873/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331873; rev:1;)
alert tcp $HOME_NET any -> [5.83.152.9] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331871/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331871; rev:1;)
alert tcp $HOME_NET any -> [139.84.163.210] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331870/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331870; rev:1;)
alert tcp $HOME_NET any -> [47.236.98.169] 8801  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331869/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331869; rev:1;)
alert tcp $HOME_NET any -> [103.27.109.72] 443  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331868/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_30; classtype:trojan-activity; sid:91331868; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www2.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331867/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331867; rev:1;)
alert tcp $HOME_NET any -> [8.149.141.189] 2222  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331866/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331866; rev:1;)
alert tcp $HOME_NET any -> [103.186.116.220] 6565  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331864/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331864; rev:1;)
alert tcp $HOME_NET any -> [38.45.65.60] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331857/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331857; rev:1;)
alert tcp $HOME_NET any -> [94.156.177.119] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331856/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331856; rev:1;)
alert tcp $HOME_NET any -> [101.99.92.203] 3232  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331855/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331855; rev:1;)
alert tcp $HOME_NET any -> [5.161.251.122] 7000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331854/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331854; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.qtvzudev.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331852/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331852; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.intelligence.ethergases.app"; depth:31; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331853/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331853; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"m.ethergases.app"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331851/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331851; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwapi.pythr.net"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331849/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331849; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwwp.ethergases.app"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331850/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331850; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"xwdvawwwwwwwebmail.ethergases.app"; depth:33; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331847/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331847; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwcloudapp.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331848/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331848; rev:1;)
alert tcp $HOME_NET any -> [49.113.79.116] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331846/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331846; rev:1;)
alert tcp $HOME_NET any -> [45.74.50.102] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331845/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331845; rev:1;)
alert tcp $HOME_NET any -> [134.175.119.217] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331844/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_30; classtype:trojan-activity; sid:91331844; rev:1;)
alert tcp $HOME_NET any -> [158.140.77.165] 1177  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331843/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/5ae9a21e.php"; depth:13; nocase; http.host; content:"a1034996.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331842/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/windowsdblongpoll/processsql/uploadswppacketlocal/protectcdn/publictrackjavascriptprovider/sql/generator/longpoll4wpimage/dump7/vmproton/js_apibigloadtrafficpublictemp.php"; depth:172; nocase; http.host; content:"80.66.81.77"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331841/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331841; rev:1;)
alert tcp $HOME_NET any -> [78.80.190.195] 9998  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331840/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331840; rev:1;)
alert tcp $HOME_NET any -> [103.28.35.146] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331839/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331839; rev:1;)
alert tcp $HOME_NET any -> [149.88.69.17] 5000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331838/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331838; rev:1;)
alert tcp $HOME_NET any -> [120.26.97.135] 23333  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331837/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331837; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"badion.top"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331836/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331836; rev:1;)
alert tcp $HOME_NET any -> [5.34.176.172] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331835/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331835; rev:1;)
alert tcp $HOME_NET any -> [103.200.124.236] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331834/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331834; rev:1;)
alert tcp $HOME_NET any -> [79.250.140.211] 9215  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331832/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331832; rev:1;)
alert tcp $HOME_NET any -> [103.200.124.237] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331833/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331833; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwstaging.ethergases.org"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331831/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331831; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"remote.pythr.net"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331829/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331829; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"points-crystaldash.co"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331830/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331830; rev:1;)
alert tcp $HOME_NET any -> [109.207.172.142] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331827/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331827; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.intelligence.pythr.net"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331828/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331828; rev:1;)
alert tcp $HOME_NET any -> [217.28.130.27] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331826/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331826; rev:1;)
alert tcp $HOME_NET any -> [45.83.31.47] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331824/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331824; rev:1;)
alert tcp $HOME_NET any -> [45.83.31.47] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331825/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331825; rev:1;)
alert tcp $HOME_NET any -> [45.83.31.47] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331823/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331823; rev:1;)
alert tcp $HOME_NET any -> [103.186.117.126] 9373  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331822/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331822; rev:1;)
alert tcp $HOME_NET any -> [95.216.94.138] 2222  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331821/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331821; rev:1;)
alert tcp $HOME_NET any -> [198.37.105.222] 27000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331819/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331819; rev:1;)
alert tcp $HOME_NET any -> [178.33.182.74] 334  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331820/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331820; rev:1;)
alert tcp $HOME_NET any -> [101.201.227.94] 9999  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331818/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331818; rev:1;)
alert tcp $HOME_NET any -> [206.119.171.39] 2012  (msg:"ThreatFox Ghost RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331736/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/t9wy"; depth:5; nocase; http.host; content:"122.51.22.201"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331638/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331638; rev:1;)
alert tcp $HOME_NET any -> [122.51.22.201] 5369  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331637/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331637; rev:1;)
alert tcp $HOME_NET any -> [147.45.44.87] 19062  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331633/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331633; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.204] 51511  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331632/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331632; rev:1;)
alert tcp $HOME_NET any -> [103.200.124.235] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331631/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331631; rev:1;)
alert tcp $HOME_NET any -> [193.183.217.16] 443  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331630/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331630; rev:1;)
alert tcp $HOME_NET any -> [103.200.124.238] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331628/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331628; rev:1;)
alert tcp $HOME_NET any -> [103.200.124.234] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331629/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331629; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.9] 6666  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331627/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331627; rev:1;)
alert tcp $HOME_NET any -> [83.229.125.53] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331626/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331626; rev:1;)
alert tcp $HOME_NET any -> [181.214.223.155] 6000  (msg:"ThreatFox DarkComet botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331625/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331625; rev:1;)
alert tcp $HOME_NET any -> [123.115.205.99] 6443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331624/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331624; rev:1;)
alert tcp $HOME_NET any -> [45.157.11.106] 1912  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331623/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331623; rev:1;)
alert tcp $HOME_NET any -> [107.174.92.148] 10000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331610/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331610; rev:1;)
alert tcp $HOME_NET any -> [154.51.39.219] 20028  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331611/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"chaptermusu.store"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331613/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331613; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"branchtriviawlek.shop"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331614/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"branchtriviawlek.shop"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331612/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331612; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"chaptermusu.store"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331615/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/v1/upload.php"; depth:14; nocase; http.host; content:"elevenvx11vs.top"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331616/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331616; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"elevenvx11vs.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331617/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331617; rev:1;)
alert tcp $HOME_NET any -> [18.156.13.209] 10394  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331595/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331595; rev:1;)
alert tcp $HOME_NET any -> [18.197.239.5] 10394  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331596/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331596; rev:1;)
alert tcp $HOME_NET any -> [3.127.138.57] 10394  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331597/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331597; rev:1;)
alert tcp $HOME_NET any -> [18.157.68.73] 10394  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331598/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331598; rev:1;)
alert tcp $HOME_NET any -> [18.192.93.86] 10394  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331599/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331599; rev:1;)
alert tcp $HOME_NET any -> [3.126.37.18] 10394  (msg:"ThreatFox Nanocore RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331600/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331600; rev:1;)
alert tcp $HOME_NET any -> [31.220.98.29] 8080  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331609/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331609; rev:1;)
alert tcp $HOME_NET any -> [77.3.186.75] 10000  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331608/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331608; rev:1;)
alert tcp $HOME_NET any -> [160.124.255.58] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331607/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331607; rev:1;)
alert tcp $HOME_NET any -> [155.138.139.243] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331606/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331606; rev:1;)
alert tcp $HOME_NET any -> [45.76.191.59] 443  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331605/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_29; classtype:trojan-activity; sid:91331605; rev:1;)
alert tcp $HOME_NET any -> [8.210.221.119] 80  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331604/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_29; classtype:trojan-activity; sid:91331604; rev:1;)
alert tcp $HOME_NET any -> [47.236.228.126] 8082  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331603/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331603; rev:1;)
alert tcp $HOME_NET any -> [47.236.228.126] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331602/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331602; rev:1;)
alert tcp $HOME_NET any -> [113.45.220.201] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331601/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331601; rev:1;)
alert tcp $HOME_NET any -> [45.137.22.123] 55615  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331594/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/blueoceansite/templates/"; depth:25; nocase; http.host; content:"motorans.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331593/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331593; rev:1;)
alert tcp $HOME_NET any -> [85.119.82.36] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331592/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331592; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mx01.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331590/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331590; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cs.pqpw.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331591/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331591; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"spam.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331588/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331588; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ns.pqpw.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331589/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331589; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mail.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331585/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331585; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"rj.pqpw.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331586/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331586; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"seed.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331587/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331587; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"willibleu.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331583/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331583; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"gw.pqpw.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331584/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331584; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"imap.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331580/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331580; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"post.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331581/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331581; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www1.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331582/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331582; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"auth.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331577/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331577; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mx.pqpw.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331578/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331578; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"host.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331579/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331579; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wiki.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331575/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331575; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"smtp.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331576/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331576; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"metromich.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331573/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331573; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"send.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331574/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331574; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dddd.pqpw.com"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331572/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331572; rev:1;)
alert tcp $HOME_NET any -> [47.117.3.107] 9999  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331571/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331571; rev:1;)
alert tcp $HOME_NET any -> [198.98.49.171] 81  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331570/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331570; rev:1;)
alert tcp $HOME_NET any -> [47.108.176.117] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331569/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331569; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"iholdtelnet.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331568/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331568; rev:1;)
alert tcp $HOME_NET any -> [157.245.202.88] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331566/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331566; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.76] 5000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331567/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331567; rev:1;)
alert tcp $HOME_NET any -> [156.224.26.180] 5555  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331565/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331565; rev:1;)
alert tcp $HOME_NET any -> [45.76.234.154] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331564/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331564; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.187] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331563/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331563; rev:1;)
alert tcp $HOME_NET any -> [207.174.3.213] 33333  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331562/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331562; rev:1;)
alert tcp $HOME_NET any -> [45.141.215.70] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331561/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331561; rev:1;)
alert tcp $HOME_NET any -> [185.196.8.98] 4728  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331560/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331560; rev:1;)
alert tcp $HOME_NET any -> [47.76.62.136] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331559/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331559; rev:1;)
alert tcp $HOME_NET any -> [47.108.176.117] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331558/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331558; rev:1;)
alert tcp $HOME_NET any -> [156.238.236.33] 8011  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331557/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331557; rev:1;)
alert tcp $HOME_NET any -> [47.113.218.136] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331556/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331556; rev:1;)
alert tcp $HOME_NET any -> [52.77.174.185] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331555/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331555; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 49%)"; dns_query; content:"cr87986.tw1.ru"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331554/; target:src_ip; metadata: confidence_level 49, first_seen 2024_09_29; classtype:trojan-activity; sid:91331554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"103.197.115.80"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331553/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331553; rev:1;)
alert tcp $HOME_NET any -> [121.40.101.179] 8088  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331551/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331551; rev:1;)
alert tcp $HOME_NET any -> [101.43.125.25] 5555  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331552/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331552; rev:1;)
alert tcp $HOME_NET any -> [47.95.179.246] 89  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331550/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331550; rev:1;)
alert tcp $HOME_NET any -> [43.139.161.196] 4000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331549/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331549; rev:1;)
alert tcp $HOME_NET any -> [45.12.52.60] 7788  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331548/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331548; rev:1;)
alert tcp $HOME_NET any -> [177.101.101.171] 5020  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331543/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_29; classtype:trojan-activity; sid:91331543; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"lootebarrkeyn.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331526/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331526; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"famikyjdiag.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331527/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331527; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"possiwreeste.site"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331528/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_29; classtype:trojan-activity; sid:91331528; rev:1;)
alert tcp $HOME_NET any -> [185.125.230.40] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331547/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331547; rev:1;)
alert tcp $HOME_NET any -> [45.89.247.153] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331546/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331546; rev:1;)
alert tcp $HOME_NET any -> [207.32.217.187] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331545/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331545; rev:1;)
alert tcp $HOME_NET any -> [45.87.246.32] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331544/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331544; rev:1;)
alert tcp $HOME_NET any -> [112.124.60.149] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331542/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331542; rev:1;)
alert tcp $HOME_NET any -> [5.89.242.75] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331541/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331541; rev:1;)
alert tcp $HOME_NET any -> [91.103.140.83] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331539/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331539; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mozg55.com"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331540/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331540; rev:1;)
alert tcp $HOME_NET any -> [110.41.53.51] 8082  (msg:"ThreatFox Vshell botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331538/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331538; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"speak-easy-school.com"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331537/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331537; rev:1;)
alert tcp $HOME_NET any -> [144.126.149.221] 7777  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331536/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331536; rev:1;)
alert tcp $HOME_NET any -> [41.43.63.40] 2003  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331535/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331535; rev:1;)
alert tcp $HOME_NET any -> [8.210.74.92] 80  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331534/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_29; classtype:trojan-activity; sid:91331534; rev:1;)
alert tcp $HOME_NET any -> [23.94.250.124] 8511  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331533/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331533; rev:1;)
alert tcp $HOME_NET any -> [47.98.185.98] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331532/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331532; rev:1;)
alert tcp $HOME_NET any -> [1.14.194.206] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331531/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331531; rev:1;)
alert tcp $HOME_NET any -> [95.174.93.130] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331530/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331530; rev:1;)
alert tcp $HOME_NET any -> [38.60.162.58] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331529/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_29; classtype:trojan-activity; sid:91331529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/9e5aafa1.php"; depth:13; nocase; http.host; content:"nezik.ru.swtest.ru"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331525/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331525; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"tipinfodownload-soft1.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331520/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331520; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"resourcedownloadslatin3.com"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331521/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331521; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"resourcedownloadslatin2.com"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331522/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331522; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"innovupdates3.com"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331523/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331523; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"innovupdates2.com"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331524/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331524; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"tipinfodownload-soft3.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331518/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331518; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"tipinfodownload-soft2.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331519/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/hkdf"; depth:5; nocase; http.host; content:"106.14.141.209"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331517/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331517; rev:1;)
alert tcp $HOME_NET any -> [157.66.27.105] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331318/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331318; rev:1;)
alert tcp $HOME_NET any -> [91.92.254.114] 3030  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331317/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331317; rev:1;)
alert tcp $HOME_NET any -> [159.100.30.69] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331316/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331316; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cloudapp.pythr.net"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331314/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331314; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"research.pythr.net"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331315/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331315; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwsowgoowa.ethergases.app"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331311/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331311; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.secure.pythr.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331312/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331312; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"metis-launchpads.app"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331313/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331313; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"clientesvpn.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331308/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331308; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwwwwrds.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331309/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331309; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwfqwvcwwwsslvpn.pythr.net"; depth:31; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331310/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331310; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"intel.ethergases.org"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331306/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331306; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwportal.pythr.net"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331307/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331307; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.api.ethergases.app"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331303/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331303; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwgatewayvpn.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331304/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331304; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.bigdata.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331305/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331305; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"2024.pythr.net"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331299/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331299; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sandbox-superset.ethergases.app"; depth:31; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331300/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331300; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwadmin.ethergases.app"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331301/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331301; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwofficevpn.pythr.net"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331302/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331302; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.metric.ethergases.app"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331297/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331297; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwsupersets.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331298/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331298; rev:1;)
alert tcp $HOME_NET any -> [45.126.209.19] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331296/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331296; rev:1;)
alert tcp $HOME_NET any -> [45.126.209.19] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331295/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331295; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.223] 9090  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331294/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331294; rev:1;)
alert tcp $HOME_NET any -> [185.174.101.192] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331292/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331292; rev:1;)
alert tcp $HOME_NET any -> [192.3.101.137] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331293/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331293; rev:1;)
alert tcp $HOME_NET any -> [198.46.235.203] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331291/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331291; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.39] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331290/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331290; rev:1;)
alert tcp $HOME_NET any -> [47.109.26.55] 8005  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331289/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331289; rev:1;)
alert tcp $HOME_NET any -> [83.229.120.164] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331288/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331288; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"naver-info.store"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331287/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331287; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 90%)"; dns_query; content:"taipeilivecenter.online"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331286/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_28; classtype:trojan-activity; sid:91331286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/5javascript/20/process/0testtestprocessor/0/9secureuniversal/174cdn/lineeternaldump/baseserver/longpollmariadbauth/lowvm/testprotect/lowprocessserverwordpressprivate.php"; depth:170; nocase; http.host; content:"45.43.89.176"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331285/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331285; rev:1;)
alert tcp $HOME_NET any -> [43.198.93.208] 443  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331284/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331284; rev:1;)
alert tcp $HOME_NET any -> [62.109.28.31] 80  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331282/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331282; rev:1;)
alert tcp $HOME_NET any -> [5.149.255.67] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331283/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331283; rev:1;)
alert tcp $HOME_NET any -> [115.91.26.76] 6005  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331281/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331281; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.152] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331280/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331280; rev:1;)
alert tcp $HOME_NET any -> [45.126.209.19] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331279/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331279; rev:1;)
alert tcp $HOME_NET any -> [101.99.92.100] 21  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331277/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331277; rev:1;)
alert tcp $HOME_NET any -> [1.239.98.205] 80  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331278/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331278; rev:1;)
alert tcp $HOME_NET any -> [167.172.58.134] 8888  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331276/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331276; rev:1;)
alert tcp $HOME_NET any -> [185.225.17.41] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331275/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331275; rev:1;)
alert tcp $HOME_NET any -> [110.42.45.224] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331274/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331274; rev:1;)
alert tcp $HOME_NET any -> [45.84.199.218] 1604  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331273/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/updates.rss"; depth:12; nocase; http.host; content:"47.239.242.141"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331272/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/s9bo"; depth:5; nocase; http.host; content:"47.239.242.141"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331271/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"112.248.80.166"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331270/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331270; rev:1;)
alert tcp $HOME_NET any -> [89.23.115.35] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331269/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331269; rev:1;)
alert tcp $HOME_NET any -> [147.139.198.60] 50555  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331268/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331268; rev:1;)
alert tcp $HOME_NET any -> [136.175.8.59] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331267/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331267; rev:1;)
alert tcp $HOME_NET any -> [46.246.82.16] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331265/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331265; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.223] 4040  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331266/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331266; rev:1;)
alert tcp $HOME_NET any -> [116.205.224.187] 28080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331264/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331264; rev:1;)
alert tcp $HOME_NET any -> [39.106.153.195] 7443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331262/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331262; rev:1;)
alert tcp $HOME_NET any -> [62.234.205.28] 8000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331263/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331263; rev:1;)
alert tcp $HOME_NET any -> [39.106.153.195] 9876  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331261/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331261; rev:1;)
alert tcp $HOME_NET any -> [47.92.124.145] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331260/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331260; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"www.venitex.nut.cc"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331256/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331256; rev:1;)
alert tcp $HOME_NET any -> [192.169.69.25] 4444  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331249/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331249; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"socket.infinyx.us"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331252/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/requestlongpolllinuxtrafficlocalpublicuploads.php"; depth:50; nocase; http.host; content:"zelensky.top"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331251/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"admissionfaccen.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331250/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331250; rev:1;)
alert tcp $HOME_NET any -> [185.82.202.195] 4444  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331248/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331248; rev:1;)
alert tcp $HOME_NET any -> [188.127.249.150] 4443  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331247/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331247; rev:1;)
alert tcp $HOME_NET any -> [172.233.1.11] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331246/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331246; rev:1;)
alert tcp $HOME_NET any -> [142.93.159.214] 3333  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331245/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331245; rev:1;)
alert tcp $HOME_NET any -> [103.238.234.112] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331243/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331243; rev:1;)
alert tcp $HOME_NET any -> [45.85.146.39] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331244/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331244; rev:1;)
alert tcp $HOME_NET any -> [149.28.160.145] 7443  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331242/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331242; rev:1;)
alert tcp $HOME_NET any -> [50.18.43.35] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331241/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331241; rev:1;)
alert tcp $HOME_NET any -> [139.84.195.78] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331240/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331240; rev:1;)
alert tcp $HOME_NET any -> [198.58.98.151] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331239/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331239; rev:1;)
alert tcp $HOME_NET any -> [136.175.8.59] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331238/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331238; rev:1;)
alert tcp $HOME_NET any -> [205.185.127.244] 23  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331237/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331237; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.tablebusiness.us"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331235/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331235; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.barsukenotikejik.com"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331236/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331236; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.enotikkrolikzayac.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331233/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331233; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tablebusiness.us"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331234/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331234; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"barsukenotikejik.com"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331232/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331232; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"serviceupdate32.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331231/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331231; rev:1;)
alert tcp $HOME_NET any -> [212.52.1.56] 443  (msg:"ThreatFox NetSupportManager RAT payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331230/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331230; rev:1;)
alert tcp $HOME_NET any -> [212.52.1.56] 80  (msg:"ThreatFox NetSupportManager RAT payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331229/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331229; rev:1;)
alert tcp $HOME_NET any -> [212.52.1.56] 80  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331227/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331227; rev:1;)
alert tcp $HOME_NET any -> [212.52.1.56] 443  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331228/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info3.php"; depth:10; nocase; http.host; content:"serviceupdate32.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331225/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info2.php"; depth:10; nocase; http.host; content:"serviceupdate32.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331226/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info2.php"; depth:10; nocase; http.host; content:"212.52.1.56"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331224/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info3.php"; depth:10; nocase; http.host; content:"212.52.1.56"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331223/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info2.php"; depth:10; nocase; http.host; content:"212.52.1.56"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331222/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info3.php"; depth:10; nocase; http.host; content:"212.52.1.56"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331221/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331221; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"serviceupdate32.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331220/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info2.php"; depth:10; nocase; http.host; content:"serviceupdate32.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331219/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/info3.php"; depth:10; nocase; http.host; content:"serviceupdate32.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331218/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"agreedmeanynj.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331217/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331217; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mizzerablekmo.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331216/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331216; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"patternucapri.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331213/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331213; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ballotnwu.site"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331214/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331214; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"teenylogicod.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331215/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331215; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"raciimoppero.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331212/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331212; rev:1;)
alert tcp $HOME_NET any -> [109.107.181.162] 15666  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330889/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91330889; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"admissionfaccen.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330921/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91330921; rev:1;)
alert tcp $HOME_NET any -> [136.244.88.135] 17615  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331076/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/bins/bin.armv7l"; depth:16; nocase; http.host; content:"62.204.41.39"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331196/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/useraccount.aspx"; depth:26; nocase; http.host; content:"baruopas.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331197/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331197; rev:1;)
alert tcp $HOME_NET any -> [147.45.45.75] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331211/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331211; rev:1;)
alert tcp $HOME_NET any -> [185.216.119.38] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331210/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331210; rev:1;)
alert tcp $HOME_NET any -> [84.201.150.223] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331209/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331209; rev:1;)
alert tcp $HOME_NET any -> [114.132.226.247] 8082  (msg:"ThreatFox Vshell botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331208/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331208; rev:1;)
alert tcp $HOME_NET any -> [54.178.8.63] 80  (msg:"ThreatFox Brute Ratel C4 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331207/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331207; rev:1;)
alert tcp $HOME_NET any -> [3.101.103.197] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331206/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331206; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"pools-eth.org"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331205/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331205; rev:1;)
alert tcp $HOME_NET any -> [159.100.30.69] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331203/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331203; rev:1;)
alert tcp $HOME_NET any -> [159.100.30.69] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331204/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331204; rev:1;)
alert tcp $HOME_NET any -> [89.23.115.35] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331202/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331202; rev:1;)
alert tcp $HOME_NET any -> [149.248.56.154] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331201/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331201; rev:1;)
alert tcp $HOME_NET any -> [52.128.230.45] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331200/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331200; rev:1;)
alert tcp $HOME_NET any -> [85.206.172.156] 333  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331199/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331199; rev:1;)
alert tcp $HOME_NET any -> [173.208.241.155] 8888  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331198/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploadsvoiddbauth/processorcpueternalwindows/0/videoeternal9/vmvideo/public/6eternal/cpuimagewindows/eternalmariadbwindows/0/requestproviderdownloads/provider/dleasync/js/5packet/5/cdn/line/4trackmariadb/vmjsprocessorgamedbasynctestwp.php"; depth:239; nocase; http.host; content:"62.109.31.158"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331195/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331195; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"mazurax.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331187/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331187; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"sumerda.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331188/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331188; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"www.mazurax.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331189/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331189; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"www.sumerda.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331190/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331190; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"baruopas.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331191/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331191; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"sumonare.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331192/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331192; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"www.baruopas.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331193/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331193; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"www.sumonare.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331194/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331194; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.baruopas.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331185/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331185; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.sumonare.com"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331186/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331186; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.mazurax.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331183/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331183; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.sumerda.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331184/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.baruopas.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331181/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumonare.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331182/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumonare.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331180/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumerda.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331178/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"baruopas.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331179/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumerda.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331176/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.mazurax.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331177/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"mazurax.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331175/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.baruopas.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331173/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumonare.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331174/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"baruopas.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331171/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumonare.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331172/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.mazurax.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331169/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumerda.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331170/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumerda.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331168/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumonare.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331166/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"mazurax.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331167/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.baruopas.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331165/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumonare.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331164/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"baruopas.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331163/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.sumerda.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331162/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"www.mazurax.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331161/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"sumerda.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331160/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"mazurax.com"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331159/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331159; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331151/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331151; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331152/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331152; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331153/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331153; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331154/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331154; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331155/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331155; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331156/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331156; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331157/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331157; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331158/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331158; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331147/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331147; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331148/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331148; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331149/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331149; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 80  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331150/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331150; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331144/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331144; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331145/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331145; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331146/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331146; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331141/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331141; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331142/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331142; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331143/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331143; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331137/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331137; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331138/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331138; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331139/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331139; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 443  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331140/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331140; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331129/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331129; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331130/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331130; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331131/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331131; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331132/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331132; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331133/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331133; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331134/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331134; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331135/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331135; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 4433  (msg:"ThreatFox Matanbuchus payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331136/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331136; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331123/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331123; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331124/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331124; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331125/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331125; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331126/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331126; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331127/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331127; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331128/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331128; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331119/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331119; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331120/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331120; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331121/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331121; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 80  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331122/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331122; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331118/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331118; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331112/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331112; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331113/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331113; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331114/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331114; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331115/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331115; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331116/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331116; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331117/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.19"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331111/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.18"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331110/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.16"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331108/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.17"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331109/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.15"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331107/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.13"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331105/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.14"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331106/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.12"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331104/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.11"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331103/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.19"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331101/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.10"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331102/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.18"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331100/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.17"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331099/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.15"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331097/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.16"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331098/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.14"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331096/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.13"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331095/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.12"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331094/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.10"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331092/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.11"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331093/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.19"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331091/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.18"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331090/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.17"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331089/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.16"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331088/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.15"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331087/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.14"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331086/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.13"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331085/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.12"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331084/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.11"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331083/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/projects/cloud-solutions/"; depth:26; nocase; http.host; content:"194.67.193.10"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331082/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331082; rev:1;)
alert tcp $HOME_NET any -> [47.238.55.14] 4449  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331081/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_28; classtype:trojan-activity; sid:91331081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/vmto_authdbbasetesttrackdatalifedownloads.php"; depth:46; nocase; http.host; content:"115583cm.n9shteam2.top"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331080/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331080; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331078/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331078; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331079/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331079; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 4433  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331077/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331077; rev:1;)
alert tcp $HOME_NET any -> [23.106.127.109] 5432  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331075/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331075; rev:1;)
alert tcp $HOME_NET any -> [45.142.104.70] 8713  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331074/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331074; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"sumerda.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331072/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331072; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"sumonare.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331073/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331073; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"baruopas.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1331071/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_28; classtype:trojan-activity; sid:91331071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/e3d6bf56.php"; depth:13; nocase; http.host; content:"a1035266.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331070/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331070; rev:1;)
alert tcp $HOME_NET any -> [84.247.146.58] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331069/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331069; rev:1;)
alert tcp $HOME_NET any -> [149.88.69.17] 3000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331068/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331068; rev:1;)
alert tcp $HOME_NET any -> [46.246.12.11] 5000  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331067/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331067; rev:1;)
alert tcp $HOME_NET any -> [183.146.226.37] 10001  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331066/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331066; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.226] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331065/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331065; rev:1;)
alert tcp $HOME_NET any -> [185.169.180.163] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331064/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331064; rev:1;)
alert tcp $HOME_NET any -> [139.84.149.212] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331063/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331063; rev:1;)
alert tcp $HOME_NET any -> [38.165.46.63] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331062/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331062; rev:1;)
alert tcp $HOME_NET any -> [8.218.56.204] 80  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331061/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_28; classtype:trojan-activity; sid:91331061; rev:1;)
alert tcp $HOME_NET any -> [185.10.68.86] 37486  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331060/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331060; rev:1;)
alert tcp $HOME_NET any -> [194.87.85.114] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331059/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331059; rev:1;)
alert tcp $HOME_NET any -> [146.70.41.191] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331058/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331058; rev:1;)
alert tcp $HOME_NET any -> [147.124.212.210] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331057/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331057; rev:1;)
alert tcp $HOME_NET any -> [188.190.10.197] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331056/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331056; rev:1;)
alert tcp $HOME_NET any -> [116.196.95.100] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331055/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331055; rev:1;)
alert tcp $HOME_NET any -> [159.65.123.203] 1337  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331054/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331054; rev:1;)
alert tcp $HOME_NET any -> [172.86.75.211] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331053/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_28; classtype:trojan-activity; sid:91331053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/6f9307efa625dd18.php"; depth:21; nocase; http.host; content:"194.87.29.53"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1331052/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91331052; rev:1;)
alert tcp $HOME_NET any -> [188.120.242.78] 8817  (msg:"ThreatFox WhiteSnake Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1331051/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91331051; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"static-100-1-226-154.nwrknj.fios.verizon.net"; depth:44; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330916/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330916; rev:1;)
alert tcp $HOME_NET any -> [213.199.51.167] 8000  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330917/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330917; rev:1;)
alert tcp $HOME_NET any -> [151.236.8.150] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330915/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330915; rev:1;)
alert tcp $HOME_NET any -> [190.231.88.140] 5609  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330914/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330914; rev:1;)
alert tcp $HOME_NET any -> [46.246.12.18] 9090  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330913/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330913; rev:1;)
alert tcp $HOME_NET any -> [8.222.226.141] 50056  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330912/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330912; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.kqivbwwwanyconnect.pythr.net"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330911/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330911; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwrds1.pythr.net"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330909/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330909; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwstaging.ethergases.org"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330910/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330910; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwapp.pythr.net"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330906/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330906; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.dev.ethergases.org"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330907/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330907; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwsitemap.ethergases.app"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330908/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330908; rev:1;)
alert tcp $HOME_NET any -> [154.216.19.53] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330903/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330903; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"backend.ethergases.org"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330904/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330904; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sitemap.ethergases.app"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330905/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330905; rev:1;)
alert tcp $HOME_NET any -> [52.128.230.42] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330902/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330902; rev:1;)
alert tcp $HOME_NET any -> [52.128.230.44] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330901/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330901; rev:1;)
alert tcp $HOME_NET any -> [194.26.192.222] 111  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330900/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330900; rev:1;)
alert tcp $HOME_NET any -> [207.32.218.46] 6666  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330899/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330899; rev:1;)
alert tcp $HOME_NET any -> [45.83.31.47] 4444  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330898/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330898; rev:1;)
alert tcp $HOME_NET any -> [120.26.43.184] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330897/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330897; rev:1;)
alert tcp $HOME_NET any -> [104.250.169.103] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330896/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330896; rev:1;)
alert tcp $HOME_NET any -> [157.20.182.169] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330895/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330895; rev:1;)
alert tcp $HOME_NET any -> [185.174.101.182] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330893/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330893; rev:1;)
alert tcp $HOME_NET any -> [94.156.69.146] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330894/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330894; rev:1;)
alert tcp $HOME_NET any -> [81.69.30.92] 8081  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330892/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330892; rev:1;)
alert tcp $HOME_NET any -> [171.25.157.186] 7081  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330891/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330891; rev:1;)
alert tcp $HOME_NET any -> [110.42.212.130] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330890/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"ch94205.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330888/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330888; rev:1;)
alert tcp $HOME_NET any -> [82.64.210.112] 25565  (msg:"ThreatFox XenoRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330887/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"raciimoppero.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330886/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330886; rev:1;)
alert tcp $HOME_NET any -> [173.249.57.136] 8080  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330885/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330885; rev:1;)
alert tcp $HOME_NET any -> [81.95.8.174] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330884/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330884; rev:1;)
alert tcp $HOME_NET any -> [207.244.199.87] 80  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330883/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330883; rev:1;)
alert tcp $HOME_NET any -> [101.109.165.137] 7443  (msg:"ThreatFox NetSupportManager RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330882/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330882; rev:1;)
alert tcp $HOME_NET any -> [171.113.130.94] 6079  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330881/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330881; rev:1;)
alert tcp $HOME_NET any -> [45.74.34.32] 1995  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330880/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330880; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 6001  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330878/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330878; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 9999  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330879/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330879; rev:1;)
alert tcp $HOME_NET any -> [134.209.85.138] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330877/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330877; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwapi.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330875/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330875; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"chart.ethergases.org"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330876/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330876; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"metrics.pythr.net"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330873/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330873; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"backend.pythr.net"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330874/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330874; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"report.ethergases.app"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330872/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330872; rev:1;)
alert tcp $HOME_NET any -> [170.64.234.99] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330871/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330871; rev:1;)
alert tcp $HOME_NET any -> [77.221.143.57] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330869/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330869; rev:1;)
alert tcp $HOME_NET any -> [43.157.250.79] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330870/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330870; rev:1;)
alert tcp $HOME_NET any -> [45.32.117.209] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330868/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330868; rev:1;)
alert tcp $HOME_NET any -> [51.195.27.76] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330866/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330866; rev:1;)
alert tcp $HOME_NET any -> [190.211.254.79] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330867/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330867; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.223] 8090  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330865/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330865; rev:1;)
alert tcp $HOME_NET any -> [87.98.186.183] 2405  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330864/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330864; rev:1;)
alert tcp $HOME_NET any -> [103.161.133.16] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330862/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330862; rev:1;)
alert tcp $HOME_NET any -> [46.246.4.18] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330863/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330863; rev:1;)
alert tcp $HOME_NET any -> [45.66.231.49] 443  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330861/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330861; rev:1;)
alert tcp $HOME_NET any -> [116.62.193.113] 111  (msg:"ThreatFox Ghost RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330860/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330860; rev:1;)
alert tcp $HOME_NET any -> [170.130.165.18] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330859/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330859; rev:1;)
alert tcp $HOME_NET any -> [8.130.42.227] 10001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330858/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330858; rev:1;)
alert tcp $HOME_NET any -> [109.176.19.156] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330857/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330857; rev:1;)
alert tcp $HOME_NET any -> [43.133.87.227] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330856/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330856; rev:1;)
alert tcp $HOME_NET any -> [69.161.221.124] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330855/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330855; rev:1;)
alert tcp $HOME_NET any -> [176.124.204.206] 15666  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330854/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330854; rev:1;)
alert tcp $HOME_NET any -> [102.165.14.28] 28000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330853/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330853; rev:1;)
alert tcp $HOME_NET any -> [102.165.14.28] 27000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330852/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330852; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mysteryedjw.site"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330850/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330850; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"filetip.shop"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330851/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330851; rev:1;)
alert tcp $HOME_NET any -> [154.216.17.207] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330849/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330849; rev:1;)
alert tcp $HOME_NET any -> [154.216.17.207] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330848/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330848; rev:1;)
alert tcp $HOME_NET any -> [154.216.17.207] 1188  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330847/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"a1033894.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330846/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330846; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"oldenlumm.fun"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330844/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330844; rev:1;)
alert tcp $HOME_NET any -> [38.180.91.117] 443  (msg:"ThreatFox WarmCookie botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330845/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330845; rev:1;)
alert tcp $HOME_NET any -> [91.92.250.207] 8808  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330843/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330843; rev:1;)
alert tcp $HOME_NET any -> [91.92.250.207] 6606  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330842/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330842; rev:1;)
alert tcp $HOME_NET any -> [194.71.107.41] 443  (msg:"ThreatFox WarmCookie botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330841/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330841; rev:1;)
alert tcp $HOME_NET any -> [178.209.52.166] 443  (msg:"ThreatFox WarmCookie botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330839/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330839; rev:1;)
alert tcp $HOME_NET any -> [185.49.68.139] 443  (msg:"ThreatFox WarmCookie botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330840/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330840; rev:1;)
alert tcp $HOME_NET any -> [91.92.250.207] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330838/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/di.php"; depth:13; nocase; http.host; content:"internationalcricketboard.com"; depth:29; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330834/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"internationalcricketboard.com"; depth:29; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330830/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330830; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"internationalcricketboard.com"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330831/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"internationalcricketboard.com"; depth:29; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330832/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"internationalcricketboard.com"; depth:29; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330833/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330833; rev:1;)
alert tcp $HOME_NET any -> [34.145.18.233] 5050  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330829/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"mysteryedjw.site"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330828/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_27; classtype:trojan-activity; sid:91330828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/jspacketwindows.php"; depth:20; nocase; http.host; content:"918938cm.n9shteam2.top"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330827/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330827; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"steam.buy-nitro.ru"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330826/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330826; rev:1;)
alert tcp $HOME_NET any -> [210.2.169.231] 80  (msg:"ThreatFox Nimplant botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330825/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330825; rev:1;)
alert tcp $HOME_NET any -> [185.119.196.166] 5810  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330824/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330824; rev:1;)
alert tcp $HOME_NET any -> [105.154.15.219] 8000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330823/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330823; rev:1;)
alert tcp $HOME_NET any -> [136.244.119.156] 443  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330822/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_27; classtype:trojan-activity; sid:91330822; rev:1;)
alert tcp $HOME_NET any -> [46.246.98.47] 8080  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330821/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_27; classtype:trojan-activity; sid:91330821; rev:1;)
alert tcp $HOME_NET any -> [103.176.145.220] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330820/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330820; rev:1;)
alert tcp $HOME_NET any -> [124.220.104.101] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330819/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330819; rev:1;)
alert tcp $HOME_NET any -> [103.107.52.80] 445  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330818/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330818; rev:1;)
alert tcp $HOME_NET any -> [104.249.156.197] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330817/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330817; rev:1;)
alert tcp $HOME_NET any -> [66.150.198.142] 28000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330816/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330816; rev:1;)
alert tcp $HOME_NET any -> [66.150.198.142] 27000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330815/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330815; rev:1;)
alert tcp $HOME_NET any -> [66.150.198.142] 2700  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330814/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330814; rev:1;)
alert tcp $HOME_NET any -> [66.150.198.142] 26000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330813/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330813; rev:1;)
alert tcp $HOME_NET any -> [176.109.107.2] 5555  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330812/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330812; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"literacyhangwk.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330811/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330811; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"riderratttinow.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330810/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"literacyhangwk.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330809/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"riderratttinow.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330808/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330808; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"for4hs.top"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330807/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330807; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"graficaminervaa.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330806/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330806; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"ribeirotransportes.online"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330805/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/tohttppacketcpubigloadprotectdbgeneratorlocal.php"; depth:50; nocase; http.host; content:"288583cm.n9shteam2.top"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330804/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"193.187.174.250"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330803/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/7c157dfb.php"; depth:13; nocase; http.host; content:"a1033964.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330802/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330802; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"customer.thewayofmoney.us"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330772/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330772; rev:1;)
alert tcp $HOME_NET any -> [198.74.56.166] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330773/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330773; rev:1;)
alert tcp $HOME_NET any -> [77.73.67.162] 8080  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330800/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330800; rev:1;)
alert tcp $HOME_NET any -> [143.198.179.167] 5060  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330801/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330801; rev:1;)
alert tcp $HOME_NET any -> [141.98.115.226] 80  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330799/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330799; rev:1;)
alert tcp $HOME_NET any -> [146.190.241.166] 443  (msg:"ThreatFox Nimplant botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330798/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330798; rev:1;)
alert tcp $HOME_NET any -> [91.92.254.46] 3030  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330797/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330797; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 6000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330796/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330796; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 8000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330794/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330794; rev:1;)
alert tcp $HOME_NET any -> [171.250.186.108] 5000  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330795/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330795; rev:1;)
alert tcp $HOME_NET any -> [138.201.163.183] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330793/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330793; rev:1;)
alert tcp $HOME_NET any -> [191.82.232.202] 2000  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330791/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330791; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.205] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330792/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330792; rev:1;)
alert tcp $HOME_NET any -> [76.71.94.235] 443  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330790/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330790; rev:1;)
alert tcp $HOME_NET any -> [185.14.45.140] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330789/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330789; rev:1;)
alert tcp $HOME_NET any -> [108.61.96.197] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330788/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330788; rev:1;)
alert tcp $HOME_NET any -> [52.128.230.46] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330786/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330786; rev:1;)
alert tcp $HOME_NET any -> [52.128.230.43] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330787/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330787; rev:1;)
alert tcp $HOME_NET any -> [209.126.1.139] 80  (msg:"ThreatFox Poseidon Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330785/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330785; rev:1;)
alert tcp $HOME_NET any -> [209.145.50.29] 7777  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330784/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330784; rev:1;)
alert tcp $HOME_NET any -> [106.54.207.88] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330782/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330782; rev:1;)
alert tcp $HOME_NET any -> [146.56.200.231] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330783/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330783; rev:1;)
alert tcp $HOME_NET any -> [34.219.79.26] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330781/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330781; rev:1;)
alert tcp $HOME_NET any -> [165.232.139.76] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330779/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330779; rev:1;)
alert tcp $HOME_NET any -> [185.245.43.181] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330780/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330780; rev:1;)
alert tcp $HOME_NET any -> [43.136.69.151] 50001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330778/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330778; rev:1;)
alert tcp $HOME_NET any -> [47.103.109.70] 88  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330776/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330776; rev:1;)
alert tcp $HOME_NET any -> [47.103.109.70] 222  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330777/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330777; rev:1;)
alert tcp $HOME_NET any -> [103.143.81.59] 5555  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330775/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330775; rev:1;)
alert tcp $HOME_NET any -> [5.230.33.206] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330774/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/d2e9d328.php"; depth:13; nocase; http.host; content:"a1025223.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330430/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330430; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 90%)"; dns_query; content:"info-tel.online"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330429/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_27; classtype:trojan-activity; sid:91330429; rev:1;)
alert tcp $HOME_NET any -> [213.255.246.19] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330428/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330428; rev:1;)
alert tcp $HOME_NET any -> [122.51.150.62] 9999  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330427/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330427; rev:1;)
alert tcp $HOME_NET any -> [194.233.82.123] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330426/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330426; rev:1;)
alert tcp $HOME_NET any -> [101.43.65.230] 5001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330425/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330425; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"socket.squadware.dev"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330390/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330390; rev:1;)
alert tcp $HOME_NET any -> [167.88.167.117] 9999  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330391/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330391; rev:1;)
alert tcp $HOME_NET any -> [138.118.150.205] 5020  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330393/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330393; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"windowssistem.duckdns.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330394/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_27; classtype:trojan-activity; sid:91330394; rev:1;)
alert tcp $HOME_NET any -> [93.185.156.124] 1912  (msg:"ThreatFox STRRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330424/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330424; rev:1;)
alert tcp $HOME_NET any -> [8.140.230.234] 443  (msg:"ThreatFox SquidLoader botnet C2 traffic (ip:port - confidence level: 50%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330423/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_27; classtype:trojan-activity; sid:91330423; rev:1;)
alert tcp $HOME_NET any -> [143.198.179.167] 1433  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330422/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330422; rev:1;)
alert tcp $HOME_NET any -> [75.119.147.136] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330421/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330421; rev:1;)
alert tcp $HOME_NET any -> [5.59.249.232] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330420/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330420; rev:1;)
alert tcp $HOME_NET any -> [193.233.48.86] 80  (msg:"ThreatFox Stealc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330419/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330419; rev:1;)
alert tcp $HOME_NET any -> [185.196.8.189] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330418/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330418; rev:1;)
alert tcp $HOME_NET any -> [73.213.108.128] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330417/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330417; rev:1;)
alert tcp $HOME_NET any -> [44.204.40.122] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330416/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330416; rev:1;)
alert tcp $HOME_NET any -> [45.89.53.172] 57580  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330415/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330415; rev:1;)
alert tcp $HOME_NET any -> [47.239.242.141] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330414/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330414; rev:1;)
alert tcp $HOME_NET any -> [47.238.103.180] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330413/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330413; rev:1;)
alert tcp $HOME_NET any -> [192.227.146.254] 505  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330412/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330412; rev:1;)
alert tcp $HOME_NET any -> [106.15.224.147] 36500  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330411/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330411; rev:1;)
alert tcp $HOME_NET any -> [31.41.244.13] 13739  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330410/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330410; rev:1;)
alert tcp $HOME_NET any -> [92.243.64.200] 7258  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330409/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330409; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"172-104-139-26.ip.linodeusercontent.com"; depth:39; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330407/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330407; rev:1;)
alert tcp $HOME_NET any -> [75.119.147.136] 443  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330406/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330406; rev:1;)
alert tcp $HOME_NET any -> [20.2.211.79] 40056  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330405/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330405; rev:1;)
alert tcp $HOME_NET any -> [52.172.15.158] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330404/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330404; rev:1;)
alert tcp $HOME_NET any -> [91.92.244.164] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330403/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330403; rev:1;)
alert tcp $HOME_NET any -> [185.196.8.189] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330402/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330402; rev:1;)
alert tcp $HOME_NET any -> [62.231.109.225] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330401/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330401; rev:1;)
alert tcp $HOME_NET any -> [193.26.115.159] 50  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330400/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330400; rev:1;)
alert tcp $HOME_NET any -> [45.83.31.53] 8080  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330399/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330399; rev:1;)
alert tcp $HOME_NET any -> [111.92.242.136] 9999  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330398/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330398; rev:1;)
alert tcp $HOME_NET any -> [1.94.175.252] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330397/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330397; rev:1;)
alert tcp $HOME_NET any -> [141.98.197.31] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330396/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_27; classtype:trojan-activity; sid:91330396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"ca09284.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330395/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"wallkedsleeoi.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330392/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91330392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/2/to_betterserver/multilinelow8/pipe/updatelinux.php"; depth:53; nocase; http.host; content:"95.163.229.169"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330389/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/generatortest.php"; depth:18; nocase; http.host; content:"homker11.uebki.one"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330388/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330388; rev:1;)
alert tcp $HOME_NET any -> [185.203.216.41] 8000  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330387/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330387; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tx.s.officefilechecks.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330386/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330386; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"s.officefilechecks.com"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330383/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330383; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"cdn.c.officefilechecks.com"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330384/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330384; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"banking.s.officefilechecks.com"; depth:30; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330385/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330385; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"my.c.officefilechecks.com"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330382/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330382; rev:1;)
alert tcp $HOME_NET any -> [46.246.82.4] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330381/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330381; rev:1;)
alert tcp $HOME_NET any -> [196.244.72.27] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330380/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330380; rev:1;)
alert tcp $HOME_NET any -> [196.244.72.29] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330378/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330378; rev:1;)
alert tcp $HOME_NET any -> [196.244.72.30] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330379/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330379; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwcloudapp.pythr.net"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330375/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330375; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.metric.ethergases.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330376/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330376; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wkfhgwwwwebmail.pythr.net"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330377/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330377; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwww1.ethergases.org"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330372/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330372; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwp.ethergases.app"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330373/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330373; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"app.ethergases.org"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330374/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330374; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwwwwwebmail.pythr.net"; depth:30; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330369/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330369; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.metrics.pythr.net"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330370/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330370; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwchart.ethergases.app"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330371/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330371; rev:1;)
alert tcp $HOME_NET any -> [91.92.245.165] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330367/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330367; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fqwvcwwwsslvpn.pythr.net"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330368/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330368; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwwwapp.ethergases.org"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330364/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330364; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"chronopostx.lat"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330365/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330365; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.owa.pythr.net"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330366/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330366; rev:1;)
alert tcp $HOME_NET any -> [20.92.252.75] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330363/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330363; rev:1;)
alert tcp $HOME_NET any -> [178.73.192.16] 2000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330362/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330362; rev:1;)
alert tcp $HOME_NET any -> [106.14.127.122] 8888  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330361/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330361; rev:1;)
alert tcp $HOME_NET any -> [101.99.93.120] 5000  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330360/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330360; rev:1;)
alert tcp $HOME_NET any -> [120.79.64.164] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330359/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330359; rev:1;)
alert tcp $HOME_NET any -> [122.51.212.130] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330358/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330358; rev:1;)
alert tcp $HOME_NET any -> [5.255.125.247] 4089  (msg:"ThreatFox Mirai botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330357/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/eternalasync.php"; depth:17; nocase; http.host; content:"272450cm.n9shteam2.top"; depth:22; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330164/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/imagesecurelowlongpollapisqllocal.php"; depth:38; nocase; http.host; content:"seroi.top"; depth:9; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1330163/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330163; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"trustterwowqm.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330162/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330162; rev:1;)
alert tcp $HOME_NET any -> [86.107.101.47] 24553  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330161/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330161; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"c.officefilechecks.com"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330160/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330160; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"my.officefilechecks.com"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330159/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330159; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"_.mariona.duckdns.org"; depth:21; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330158/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330158; rev:1;)
alert tcp $HOME_NET any -> [196.244.72.26] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330157/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330157; rev:1;)
alert tcp $HOME_NET any -> [196.244.72.28] 443  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330156/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330156; rev:1;)
alert tcp $HOME_NET any -> [68.183.123.72] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330155/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330155; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.cloudapp.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330153/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330153; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwwwacceso.pythr.net"; depth:26; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330154/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330154; rev:1;)
alert tcp $HOME_NET any -> [52.172.15.158] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330150/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330150; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.dashboards.pythr.net"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330151/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330151; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.fauowwwwwwwwww1.pythr.net"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1330152/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330152; rev:1;)
alert tcp $HOME_NET any -> [45.32.113.133] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330149/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330149; rev:1;)
alert tcp $HOME_NET any -> [149.248.4.114] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330148/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330148; rev:1;)
alert tcp $HOME_NET any -> [101.99.92.100] 80  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330147/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330147; rev:1;)
alert tcp $HOME_NET any -> [45.32.163.234] 8000  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330145/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330145; rev:1;)
alert tcp $HOME_NET any -> [128.90.122.7] 9999  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330146/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330146; rev:1;)
alert tcp $HOME_NET any -> [192.3.220.19] 2080  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330144/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330144; rev:1;)
alert tcp $HOME_NET any -> [172.111.163.227] 9583  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330142/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330142; rev:1;)
alert tcp $HOME_NET any -> [188.190.10.175] 2405  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330143/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330143; rev:1;)
alert tcp $HOME_NET any -> [45.32.125.172] 6886  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330141/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330141; rev:1;)
alert tcp $HOME_NET any -> [135.125.27.227] 8100  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330139/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330139; rev:1;)
alert tcp $HOME_NET any -> [45.95.169.113] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330140/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330140; rev:1;)
alert tcp $HOME_NET any -> [101.99.93.120] 80  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330138/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330138; rev:1;)
alert tcp $HOME_NET any -> [37.120.210.219] 25723  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330137/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330137; rev:1;)
alert tcp $HOME_NET any -> [8.222.128.44] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330136/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330136; rev:1;)
alert tcp $HOME_NET any -> [47.103.143.60] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330135/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330135; rev:1;)
alert tcp $HOME_NET any -> [178.236.44.84] 8085  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330134/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330134; rev:1;)
alert tcp $HOME_NET any -> [118.89.124.211] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330133/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91330133; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.15] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1330132/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_26; classtype:trojan-activity; sid:91330132; rev:1;)
alert tcp $HOME_NET any -> [197.207.192.227] 555  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329594/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"teenylogicod.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329593/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329593; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"coinnyfrownwejr.shop"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329589/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329589; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"reliabledmwqj.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329590/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329590; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"chlakkymagazi.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329591/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329591; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ptramidermsnqj.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329592/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"coinnyfrownwejr.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329588/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"reliabledmwqj.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329587/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"chlakkymagazi.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329586/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"ptramidermsnqj.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329585/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329585; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"majorbrdide.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329583/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329583; rev:1;)
alert tcp $HOME_NET any -> [147.45.47.98] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329584/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"restbycalm.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329575/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329575; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"restbycalm.com"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329576/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"restbycalm.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329577/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"restbycalm.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329578/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/da.php"; depth:13; nocase; http.host; content:"restbycalm.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329579/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329579; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"circle.innovativecsportal.com"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329581/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329581; rev:1;)
alert tcp $HOME_NET any -> [217.144.191.125] 443  (msg:"ThreatFox FAKEUPDATES payload delivery (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329582/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"ballotnwu.site"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329580/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329580; rev:1;)
alert tcp $HOME_NET any -> [43.157.65.53] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329574/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329574; rev:1;)
alert tcp $HOME_NET any -> [91.92.241.154] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329573/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329573; rev:1;)
alert tcp $HOME_NET any -> [62.231.109.225] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329572/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329572; rev:1;)
alert tcp $HOME_NET any -> [212.227.243.51] 8443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329571/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329571; rev:1;)
alert tcp $HOME_NET any -> [185.225.226.197] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329570/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329570; rev:1;)
alert tcp $HOME_NET any -> [121.37.186.152] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329569/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329569; rev:1;)
alert tcp $HOME_NET any -> [111.230.244.189] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329568/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329568; rev:1;)
alert tcp $HOME_NET any -> [47.103.109.70] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329566/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329566; rev:1;)
alert tcp $HOME_NET any -> [47.103.109.70] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329567/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329567; rev:1;)
alert tcp $HOME_NET any -> [121.36.93.103] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329565/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ywfim2vkmmfmnwfh/"; depth:18; nocase; http.host; content:"abaciscus.org"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329552/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ywfim2vkmmfmnwfh/"; depth:18; nocase; http.host; content:"leonhost32.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329553/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ywfim2vkmmfmnwfh/"; depth:18; nocase; http.host; content:"portalpoo21.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329554/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ywfim2vkmmfmnwfh/"; depth:18; nocase; http.host; content:"speedtest23.org"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329555/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ywfim2vkmmfmnwfh/"; depth:18; nocase; http.host; content:"speedfresh22.net"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329556/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzq1yzk1zgq4ody3/"; depth:18; nocase; http.host; content:"mutesksek3421.com"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329557/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzq1yzk1zgq4ody3/"; depth:18; nocase; http.host; content:"adyesksockcem3421.com"; depth:21; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329558/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzq1yzk1zgq4ody3/"; depth:18; nocase; http.host; content:"adnndlga23cm.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329559/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzq1yzk1zgq4ody3/"; depth:18; nocase; http.host; content:"ad23cmxd.com"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329560/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzq1yzk1zgq4ody3/"; depth:18; nocase; http.host; content:"adbniskseekske2.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329561/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/m2eyotm2m2fly2my/"; depth:18; nocase; http.host; content:"bestjunggvbvqq.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329563/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/m2eyotm2m2fly2my/"; depth:18; nocase; http.host; content:"junggvbvqqtech.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329562/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/m2eyotm2m2fly2my/"; depth:18; nocase; http.host; content:"jungjungju.com"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329564/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329564; rev:1;)
alert tcp $HOME_NET any -> [185.222.58.70] 1782  (msg:"ThreatFox STRRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329551/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329551; rev:1;)
alert tcp $HOME_NET any -> [91.92.243.170] 2025  (msg:"ThreatFox Vjw0rm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329550/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/is-ready"; depth:9; nocase; http.host; content:"rolla.wikaba.com"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329549/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk1.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329492/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk2.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329493/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk3.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329494/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk111.zip"; depth:19; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329495/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk222.zip"; depth:19; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329496/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/pnk333.zip"; depth:19; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329497/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tera3.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329498/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tera9.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329499/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tera10.zip"; depth:19; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329500/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tera14.zip"; depth:19; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329501/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tera111.zip"; depth:20; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329502/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr2.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329503/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr3.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329504/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr4.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329505/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr9.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329506/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr10.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329507/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr14.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329508/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr15.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329509/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr17.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329510/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il333.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329490/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il444.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329491/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il111.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329488/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il222.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329489/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il3.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329486/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il4.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329487/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il2.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329485/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/giga.zip"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329483/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/il1.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329484/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/"; depth:9; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329481/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/gig.txt"; depth:16; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329482/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329482; rev:1;)
alert tcp $HOME_NET any -> [50.87.119.38] 80  (msg:"ThreatFox Loki Password Stealer (PWS) botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329457/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329457; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"mabident.com"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329458/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr18.txt"; depth:17; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329511/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr111.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329512/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr222.zip"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329513/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uploads/tr222.txt"; depth:18; nocase; http.host; content:"finalstepgo.com"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329514/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329514; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"finalstepgo.com"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329515/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329515; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"comandoespecial2023.duckdns.org"; depth:31; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329516/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329516; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"dcmxz.duckdns.org"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329517/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329517; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"23spt.duckdns.org"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329518/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/wp-content/uploads/2024/09/dllskyfal.txt"; depth:41; nocase; http.host; content:"www.informacionoportuna.com"; depth:27; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329519/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/24/items/detah-note-v/detahnotev.txt"; depth:37; nocase; http.host; content:"ia600100.us.archive.org"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329520/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329520; rev:1;)
alert tcp $HOME_NET any -> [91.211.248.215] 24327  (msg:"ThreatFox RedLine Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329531/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329531; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"articultattkwm.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329522/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329522; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"md928zs.shop"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329521/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329521; rev:1;)
alert tcp $HOME_NET any -> [176.145.117.173] 8010  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329548/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329548; rev:1;)
alert tcp $HOME_NET any -> [101.42.158.190] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329546/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329546; rev:1;)
alert tcp $HOME_NET any -> [120.25.163.165] 8080  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329545/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329545; rev:1;)
alert tcp $HOME_NET any -> [182.153.48.169] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329543/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329543; rev:1;)
alert tcp $HOME_NET any -> [108.143.124.130] 8000  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329544/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329544; rev:1;)
alert tcp $HOME_NET any -> [5.42.84.155] 8080  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329542/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329542; rev:1;)
alert tcp $HOME_NET any -> [100.1.226.154] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329540/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329540; rev:1;)
alert tcp $HOME_NET any -> [39.98.204.142] 81  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329541/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329541; rev:1;)
alert tcp $HOME_NET any -> [89.197.154.116] 80  (msg:"ThreatFox MimiKatz botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329539/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329539; rev:1;)
alert tcp $HOME_NET any -> [94.102.49.16] 443  (msg:"ThreatFox Nimplant botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329538/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329538; rev:1;)
alert tcp $HOME_NET any -> [1.92.154.210] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329537/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329537; rev:1;)
alert tcp $HOME_NET any -> [51.79.73.224] 5555  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329536/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329536; rev:1;)
alert tcp $HOME_NET any -> [185.196.8.189] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329535/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329535; rev:1;)
alert tcp $HOME_NET any -> [103.146.179.112] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329533/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329533; rev:1;)
alert tcp $HOME_NET any -> [8.217.31.179] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329534/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329534; rev:1;)
alert tcp $HOME_NET any -> [34.226.209.111] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329532/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329532; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"eihtvf18vt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329523/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329523; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvf20vt.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329524/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329524; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetgh19sr.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329525/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329525; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ninetgh19vt.top"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329526/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329526; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevenvh7sr.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329527/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329527; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sevtvf17vt.top"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329528/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329528; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"sixvf16vt.top"; depth:13; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329529/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329529; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"tventyvf20sr.top"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329530/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329530; rev:1;)
alert tcp $HOME_NET any -> [143.198.179.167] 443  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329480/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329480; rev:1;)
alert tcp $HOME_NET any -> [51.250.27.83] 443  (msg:"ThreatFox BianLian botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329479/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329479; rev:1;)
alert tcp $HOME_NET any -> [209.141.58.104] 808  (msg:"ThreatFox Kaiji botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329478/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329478; rev:1;)
alert tcp $HOME_NET any -> [104.168.132.88] 8082  (msg:"ThreatFox ERMAC botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329477/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329477; rev:1;)
alert tcp $HOME_NET any -> [13.51.193.253] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329476/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329476; rev:1;)
alert tcp $HOME_NET any -> [223.155.16.63] 23333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329475/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329475; rev:1;)
alert tcp $HOME_NET any -> [195.10.205.190] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329474/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329474; rev:1;)
alert tcp $HOME_NET any -> [170.106.168.85] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329473/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329473; rev:1;)
alert tcp $HOME_NET any -> [178.156.8.15] 5001  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329472/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329472; rev:1;)
alert tcp $HOME_NET any -> [154.12.242.122] 7707  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329471/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329471; rev:1;)
alert tcp $HOME_NET any -> [47.106.205.194] 28888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329470/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329470; rev:1;)
alert tcp $HOME_NET any -> [49.113.77.4] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329469/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329469; rev:1;)
alert tcp $HOME_NET any -> [38.55.193.31] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329468/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329468; rev:1;)
alert tcp $HOME_NET any -> [45.88.91.63] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329466/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329466; rev:1;)
alert tcp $HOME_NET any -> [185.157.162.126] 557  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329467/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329467; rev:1;)
alert tcp $HOME_NET any -> [154.9.253.10] 8090  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329465/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329465; rev:1;)
alert tcp $HOME_NET any -> [117.50.220.31] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329464/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329464; rev:1;)
alert tcp $HOME_NET any -> [117.50.220.31] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329463/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329463; rev:1;)
alert tcp $HOME_NET any -> [45.207.49.26] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329462/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329462; rev:1;)
alert tcp $HOME_NET any -> [124.220.180.112] 2087  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329460/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329460; rev:1;)
alert tcp $HOME_NET any -> [104.168.142.114] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329461/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329461; rev:1;)
alert tcp $HOME_NET any -> [47.99.138.26] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329459/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329459; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"vozmeatillu.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329448/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329448; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"gutterydhowi.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329449/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329449; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ghostreedmnu.shop"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329450/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329450; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"offensivedzvju.shop"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329451/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329451; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"drawzhotdog.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329452/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329452; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"fragnantbui.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329453/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329453; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"stogeneratmns.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329454/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329454; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"reinforcenh.shop"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329455/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329455; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"performenj.shop"; depth:15; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329456/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"reinforcenh.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329447/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"fragnantbui.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329446/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"offensivedzvju.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329445/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"gutterydhowi.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329444/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"vozmeatillu.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329443/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329443; rev:1;)
alert tcp $HOME_NET any -> [154.37.219.142] 7777  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329442/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329442; rev:1;)
alert tcp $HOME_NET any -> [98.142.139.225] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329441/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329441; rev:1;)
alert tcp $HOME_NET any -> [47.120.46.195] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329440/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329440; rev:1;)
alert tcp $HOME_NET any -> [47.106.190.13] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329439/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329439; rev:1;)
alert tcp $HOME_NET any -> [152.136.47.20] 4434  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329438/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329438; rev:1;)
alert tcp $HOME_NET any -> [1.14.168.46] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329437/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329437; rev:1;)
alert tcp $HOME_NET any -> [124.71.224.84] 8088  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329436/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329436; rev:1;)
alert tcp $HOME_NET any -> [110.41.47.38] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329435/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329435; rev:1;)
alert tcp $HOME_NET any -> [1.94.190.242] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329434/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329434; rev:1;)
alert tcp $HOME_NET any -> [59.110.9.127] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329433/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329433; rev:1;)
alert tcp $HOME_NET any -> [1.14.67.242] 9999  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329432/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329432; rev:1;)
alert tcp $HOME_NET any -> [38.45.72.89] 7777  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329431/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329431; rev:1;)
alert tcp $HOME_NET any -> [162.14.78.121] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329430/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329430; rev:1;)
alert tcp $HOME_NET any -> [5.75.211.162] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329428/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329428; rev:1;)
alert tcp $HOME_NET any -> [116.202.1.77] 443  (msg:"ThreatFox Vidar botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329429/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"116.202.1.77"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329427/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/"; depth:1; nocase; http.host; content:"5.75.211.162"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329426/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"42.178.170.21"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329425/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_26; classtype:trojan-activity; sid:91329425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"cu34302.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329424/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329424; rev:1;)
alert tcp $HOME_NET any -> [185.91.69.119] 56001  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329423/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"marketingshops62.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329392/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"75biribizidurdursun536.pro"; depth:26; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329393/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"marketingshops3.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329389/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"marketingshops4.com"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329390/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"marketingshops52.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329391/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"marketingshops32.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329388/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zgzmnzzhnzq1m2iz/"; depth:18; nocase; http.host; content:"94.141.120.47"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329387/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/y2mzztdizgrizjg0/"; depth:18; nocase; http.host; content:"94.156.67.47"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329386/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"3biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329395/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"5biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329397/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329397; rev:1;)
alert tcp $HOME_NET any -> [89.117.23.69] 23  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329422/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_26; classtype:trojan-activity; sid:91329422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"4biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329396/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"biribizidurdursun36.xyz"; depth:23; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329394/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"5biribizidurdursun361.net"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329398/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/zwjiyjzmyjnmntc2/"; depth:18; nocase; http.host; content:"5biribizidurdursun536.com"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329399/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_26; classtype:trojan-activity; sid:91329399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/28cc5c41.php"; depth:13; nocase; http.host; content:"ct43953.tw1.ru"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329421/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329421; rev:1;)
alert tcp $HOME_NET any -> [74.208.249.109] 8084  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329420/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329420; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"v120527.hosted-by-vdsina.com"; depth:28; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329419/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329419; rev:1;)
alert tcp $HOME_NET any -> [195.230.23.91] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329418/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329418; rev:1;)
alert tcp $HOME_NET any -> [5.189.178.220] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329417/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329417; rev:1;)
alert tcp $HOME_NET any -> [185.196.9.145] 3394  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329416/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329416; rev:1;)
alert tcp $HOME_NET any -> [47.108.238.222] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329415/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329415; rev:1;)
alert tcp $HOME_NET any -> [156.238.236.33] 4433  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329414/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 50%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mozi.m"; depth:7; nocase; http.host; content:"123.190.101.115"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329412/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_26; classtype:trojan-activity; sid:91329412; rev:1;)
alert tcp $HOME_NET any -> [161.35.4.145] 4000  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329411/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329411; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.inforig.ru"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329410/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329410; rev:1;)
alert tcp $HOME_NET any -> [34.27.109.111] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329409/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329409; rev:1;)
alert tcp $HOME_NET any -> [4.234.97.238] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329408/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329408; rev:1;)
alert tcp $HOME_NET any -> [147.139.198.60] 8089  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329407/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329407; rev:1;)
alert tcp $HOME_NET any -> [209.145.50.29] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329406/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329406; rev:1;)
alert tcp $HOME_NET any -> [207.32.218.46] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329405/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329405; rev:1;)
alert tcp $HOME_NET any -> [45.32.117.209] 443  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329404/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329404; rev:1;)
alert tcp $HOME_NET any -> [46.246.82.21] 8888  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329403/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329403; rev:1;)
alert tcp $HOME_NET any -> [154.216.18.125] 44122  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329402/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329402; rev:1;)
alert tcp $HOME_NET any -> [67.203.7.212] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329401/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329401; rev:1;)
alert tcp $HOME_NET any -> [98.142.139.225] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329400/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_26; classtype:trojan-activity; sid:91329400; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"103.230.121.12.sslip.io"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329385/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329385; rev:1;)
alert tcp $HOME_NET any -> [199.192.23.197] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329384/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329384; rev:1;)
alert tcp $HOME_NET any -> [51.83.133.9] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329383/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329383; rev:1;)
alert tcp $HOME_NET any -> [46.246.82.8] 8080  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329382/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329382; rev:1;)
alert tcp $HOME_NET any -> [193.149.187.135] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329381/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329381; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.portal.pythr.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329380/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329380; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.visual.pythr.net"; depth:20; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329378/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329378; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.analytic.pythr.net"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329379/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329379; rev:1;)
alert tcp $HOME_NET any -> [4.210.154.233] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329377/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329377; rev:1;)
alert tcp $HOME_NET any -> [20.115.73.1] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329376/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329376; rev:1;)
alert tcp $HOME_NET any -> [207.32.218.100] 8888  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329375/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329375; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"xspeed.freemyip.com"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329374/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329374; rev:1;)
alert tcp $HOME_NET any -> [8.218.17.11] 80  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329373/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_25; classtype:trojan-activity; sid:91329373; rev:1;)
alert tcp $HOME_NET any -> [121.41.47.190] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329372/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329372; rev:1;)
alert tcp $HOME_NET any -> [124.71.224.84] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329370/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329370; rev:1;)
alert tcp $HOME_NET any -> [206.189.234.67] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329371/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329371; rev:1;)
alert tcp $HOME_NET any -> [5.78.80.119] 2083  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329369/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329369; rev:1;)
alert tcp $HOME_NET any -> [103.97.200.115] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329368/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329368; rev:1;)
alert tcp $HOME_NET any -> [43.143.151.132] 4431  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329367/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329367; rev:1;)
alert tcp $HOME_NET any -> [185.216.68.161] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329366/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329366; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 90%)"; dns_query; content:"oca.pics"; depth:8; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329365/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_25; classtype:trojan-activity; sid:91329365; rev:1;)
alert tcp $HOME_NET any -> [43.239.249.243] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329364/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_25; classtype:trojan-activity; sid:91329364; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.12] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329362/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329362; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.73] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329363/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329363; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.11] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329360/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329360; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.10] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329361/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329361; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.13] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329358/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329358; rev:1;)
alert tcp $HOME_NET any -> [193.109.85.43] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329359/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329359; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.17] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329356/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329356; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.18] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329357/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329357; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.16] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329354/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329354; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.74] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329355/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329355; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.14] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329352/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329352; rev:1;)
alert tcp $HOME_NET any -> [194.67.193.19] 443  (msg:"ThreatFox Matanbuchus botnet C2 traffic (ip:port - confidence level: 60%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329353/; target:src_ip; metadata: confidence_level 60, first_seen 2024_09_25; classtype:trojan-activity; sid:91329353; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"mazurax.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329351/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329351; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"nor-reg.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329134/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_25; classtype:trojan-activity; sid:91329134; rev:1;)
alert tcp $HOME_NET any -> [88.253.254.6] 80  (msg:"ThreatFox N-W0rm botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329133/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329133; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"m.outlook.adminstream.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329132/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329132; rev:1;)
alert tcp $HOME_NET any -> [94.102.49.16] 80  (msg:"ThreatFox Nimplant botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329131/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329131; rev:1;)
alert tcp $HOME_NET any -> [139.59.238.238] 8443  (msg:"ThreatFox DeimosC2 botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329130/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329130; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"staging.ethergases.app"; depth:22; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329129/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329129; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.tthvlgatewaycitrix.pythr.net"; depth:32; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329127/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329127; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwremoto.pythr.net"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329128/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329128; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwebmail.ethergases.app"; depth:29; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329126/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329126; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.wwwwp.ethergases.org"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329124/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329124; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.secure.ethergases.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329125/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329125; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.virtualapps.pythr.net"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329122/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329122; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"metis-launchpad.org"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329123/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329123; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.sitemaps.ethergases.org"; depth:27; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329121/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329121; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"www.admin.ethergases.org"; depth:24; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329119/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329119; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"wwwwww.pythr.net"; depth:16; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329120/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329120; rev:1;)
alert tcp $HOME_NET any -> [8.215.19.219] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329118/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329118; rev:1;)
alert tcp $HOME_NET any -> [4.234.97.238] 80  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329117/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329117; rev:1;)
alert tcp $HOME_NET any -> [149.28.83.179] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329116/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329116; rev:1;)
alert tcp $HOME_NET any -> [74.208.164.130] 444  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329115/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329115; rev:1;)
alert tcp $HOME_NET any -> [121.43.148.27] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329114/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"drawzhotdog.shop"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329113/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329113; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"newlumm.fun"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329112/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_25; classtype:trojan-activity; sid:91329112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"articultattkwm.shop"; depth:19; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329111/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"swipedbakkwo.shop"; depth:17; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329110/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/6d687e53250c2111.php"; depth:21; nocase; http.host; content:"193.233.113.184"; depth:15; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329109/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329109; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"younngpresseo.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329108/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329108; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"candleduseiwo.shop"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329107/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"younngpresseo.shop"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329106/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/original.js"; depth:18; nocase; http.host; content:"roadrunnersell.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329100/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329100; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"roadrunnersell.com"; depth:18; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329101/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/index.php"; depth:16; nocase; http.host; content:"roadrunnersell.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329102/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/fix.php"; depth:14; nocase; http.host; content:"roadrunnersell.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329103/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/trade/d.php"; depth:12; nocase; http.host; content:"roadrunnersell.com"; depth:18; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329104/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/api"; depth:4; nocase; http.host; content:"moduledfahhhiov.shop"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329105/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329105; rev:1;)
alert tcp $HOME_NET any -> [139.180.202.227] 4782  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329099/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329099; rev:1;)
alert tcp $HOME_NET any -> [185.196.10.235] 4449  (msg:"ThreatFox AsyncRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329098/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329098; rev:1;)
alert tcp $HOME_NET any -> [172.104.139.26] 443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329097/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329097; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"kapilapiii.com"; depth:14; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329096/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329096; rev:1;)
alert tcp $HOME_NET any -> [104.244.73.3] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329095/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329095; rev:1;)
alert tcp $HOME_NET any -> [94.156.68.181] 80  (msg:"ThreatFox MooBot botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329094/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329094; rev:1;)
alert tcp $HOME_NET any -> [37.60.242.208] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329093/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329093; rev:1;)
alert tcp $HOME_NET any -> [188.166.40.224] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329092/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329092; rev:1;)
alert tcp $HOME_NET any -> [198.167.199.223] 19132  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329090/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329090; rev:1;)
alert tcp $HOME_NET any -> [223.155.16.33] 23333  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329091/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329091; rev:1;)
alert tcp $HOME_NET any -> [181.162.144.84] 8080  (msg:"ThreatFox Quasar RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329089/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329089; rev:1;)
alert tcp $HOME_NET any -> [106.14.57.252] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329088/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329088; rev:1;)
alert tcp $HOME_NET any -> [143.92.39.11] 8888  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329087/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329087; rev:1;)
alert tcp $HOME_NET any -> [198.13.39.189] 443  (msg:"ThreatFox ShadowPad botnet C2 traffic (ip:port - confidence level: 90%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329086/; target:src_ip; metadata: confidence_level 90, first_seen 2024_09_25; classtype:trojan-activity; sid:91329086; rev:1;)
alert tcp $HOME_NET any -> [172.111.213.81] 2404  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329085/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329085; rev:1;)
alert tcp $HOME_NET any -> [1.117.62.81] 8081  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329084/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329084; rev:1;)
alert tcp $HOME_NET any -> [211.149.159.163] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329083/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329083; rev:1;)
alert tcp $HOME_NET any -> [47.108.87.138] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329082/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329082; rev:1;)
alert tcp $HOME_NET any -> [123.115.205.99] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329081/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329081; rev:1;)
alert tcp $HOME_NET any -> [139.159.148.68] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329080/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329080; rev:1;)
alert tcp $HOME_NET any -> [47.97.58.249] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329078/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329078; rev:1;)
alert tcp $HOME_NET any -> [139.159.148.68] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329079/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329079; rev:1;)
alert tcp $HOME_NET any -> [101.34.53.44] 81  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329077/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329077; rev:1;)
alert tcp $HOME_NET any -> [112.124.39.205] 8013  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329076/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329076; rev:1;)
alert tcp $HOME_NET any -> [62.234.81.85] 4430  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329075/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329075; rev:1;)
alert tcp $HOME_NET any -> [47.113.150.19] 50001  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329073/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329073; rev:1;)
alert tcp $HOME_NET any -> [49.235.151.58] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329074/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329074; rev:1;)
alert tcp $HOME_NET any -> [170.106.195.29] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329072/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329072; rev:1;)
alert tcp $HOME_NET any -> [43.154.114.222] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329071/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329071; rev:1;)
alert tcp $HOME_NET any -> [139.196.237.171] 12345  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329070/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329070; rev:1;)
alert tcp $HOME_NET any -> [178.131.30.112] 8000  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329069/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329069; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 50%)"; dns_query; content:"lumnew.fun"; depth:10; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329068/; target:src_ip; metadata: confidence_level 50, first_seen 2024_09_25; classtype:trojan-activity; sid:91329068; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"meet.google.us-join.com"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329062/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329062; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"meet.googie.com-join.us"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329063/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329063; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"meet.google.com-join.us"; depth:23; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329064/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329064; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"googiedrivers.com"; depth:17; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329065/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329065; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"us-join.com"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329066/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329066; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"com-join.us"; depth:11; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329067/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329067; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox payload delivery (domain - confidence level: 100%)"; dns_query; content:"dcratff.duckdns.org"; depth:19; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329061/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/processgameapiprivatecentral.php"; depth:33; nocase; http.host; content:"nazaruser8.temp.swtest.ru"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329060/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329060; rev:1;)
alert tcp $HOME_NET any -> [85.237.211.247] 23  (msg:"ThreatFox Bashlite botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329059/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329059; rev:1;)
alert tcp $HOME_NET any -> [172.104.139.26] 80  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329058/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329058; rev:1;)
alert tcp $HOME_NET any -> [209.200.246.16] 443  (msg:"ThreatFox Latrodectus botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329057/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329057; rev:1;)
alert tcp $HOME_NET any -> [154.44.10.197] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329056/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329056; rev:1;)
alert tcp $HOME_NET any -> [165.140.85.87] 4567  (msg:"ThreatFox Crimson RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329055/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329055; rev:1;)
alert tcp $HOME_NET any -> [49.12.115.241] 443  (msg:"ThreatFox XehookStealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329054/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329054; rev:1;)
alert tcp $HOME_NET any -> [82.156.127.143] 443  (msg:"ThreatFox Havoc botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329053/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329053; rev:1;)
alert tcp $HOME_NET any -> [91.92.251.205] 8082  (msg:"ThreatFox Hook botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329052/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329052; rev:1;)
alert tcp $HOME_NET any -> [216.128.129.3] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329051/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329051; rev:1;)
alert tcp $HOME_NET any -> [172.104.181.84] 443  (msg:"ThreatFox pupy botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329050/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329050; rev:1;)
alert tcp $HOME_NET any -> [154.216.20.219] 443  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329049/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329049; rev:1;)
alert tcp $HOME_NET any -> [185.157.162.103] 557  (msg:"ThreatFox Remcos botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329048/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329048; rev:1;)
alert tcp $HOME_NET any -> [111.230.103.200] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329047/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329047; rev:1;)
alert tcp $HOME_NET any -> [91.238.203.15] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329046/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329046; rev:1;)
alert tcp $HOME_NET any -> [178.236.44.84] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329045/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329045; rev:1;)
alert tcp $HOME_NET any -> [8.147.234.137] 8011  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329043/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329043; rev:1;)
alert tcp $HOME_NET any -> [8.217.31.179] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329044/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329044; rev:1;)
alert tcp $HOME_NET any -> [118.25.148.25] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329042/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329042; rev:1;)
alert tcp $HOME_NET any -> [101.43.83.10] 1122  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329040/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329040; rev:1;)
alert tcp $HOME_NET any -> [124.221.14.65] 6666  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329041/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329041; rev:1;)
alert tcp $HOME_NET any -> [51.20.188.228] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329039/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329039; rev:1;)
alert tcp $HOME_NET any -> [123.58.220.204] 8090  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329038/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/index.php/check"; depth:16; nocase; http.host; content:"168.100.10.152"; depth:14; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329037/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mine/pws/fre.php"; depth:17; nocase; http.host; content:"dddotx.shop"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329036/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329036; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"remcos2024fin.duckdns.org"; depth:25; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329035/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329035; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 100%)"; dns_query; content:"ms-edge.link"; depth:12; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1329034/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/contkra/serv.php"; depth:17; nocase; http.host; content:"ms-edge.link"; depth:12; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329033/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ml341/index.php"; depth:16; nocase; http.host; content:"mg5n.shop"; depth:9; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329032/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/uo341/index.php"; depth:16; nocase; http.host; content:"l0h5.shop"; depth:9; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329031/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 75%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/ku341/index.php"; depth:16; nocase; http.host; content:"chr1zx.shop"; depth:11; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329030/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91329030; rev:1;)
alert tcp $HOME_NET any -> [47.238.103.180] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329029/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329029; rev:1;)
alert tcp $HOME_NET any -> [49.232.24.115] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329028/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329028; rev:1;)
alert tcp $HOME_NET any -> [95.169.180.39] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329027/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329027; rev:1;)
alert tcp $HOME_NET any -> [121.37.67.93] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329026/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329026; rev:1;)
alert tcp $HOME_NET any -> [1.14.67.242] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329025/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329025; rev:1;)
alert tcp $HOME_NET any -> [101.200.208.94] 80  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329024/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329024; rev:1;)
alert tcp $HOME_NET any -> [198.98.49.171] 8080  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329023/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329023; rev:1;)
alert tcp $HOME_NET any -> [47.120.58.5] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329022/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329022; rev:1;)
alert tcp $HOME_NET any -> [91.92.246.252] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329021/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329021; rev:1;)
alert tcp $HOME_NET any -> [47.238.103.180] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329020/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329020; rev:1;)
alert tcp $HOME_NET any -> [175.178.158.27] 806  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329019/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329019; rev:1;)
alert tcp $HOME_NET any -> [156.238.233.75] 1337  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329018/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329018; rev:1;)
alert tcp $HOME_NET any -> [154.36.194.176] 444  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329017/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329017; rev:1;)
alert tcp $HOME_NET any -> [121.40.146.254] 8443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329016/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329016; rev:1;)
alert tcp $HOME_NET any -> [120.26.64.126] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329015/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329015; rev:1;)
alert tcp $HOME_NET any -> [106.75.61.100] 8099  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329014/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329014; rev:1;)
alert tcp $HOME_NET any -> [192.227.221.123] 443  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329013/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329013; rev:1;)
alert tcp $HOME_NET any -> [195.62.32.75] 8888  (msg:"ThreatFox Cobalt Strike botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329012/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mzm2zdq0ntuzyju3/"; depth:18; nocase; http.host; content:"94.141.120.47"; depth:13; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328927/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/mmm4njczntuyyjay/"; depth:18; nocase; http.host; content:"primesecundagate.com"; depth:20; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328928/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nzy1mmjhm2flyzhj/"; depth:18; nocase; http.host; content:"3biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328929/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nzy1mmjhm2flyzhj/"; depth:18; nocase; http.host; content:"5biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328931/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nzy1mmjhm2flyzhj/"; depth:18; nocase; http.host; content:"4biribizidurdursun36.xyz"; depth:24; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328930/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nzy1mmjhm2flyzhj/"; depth:18; nocase; http.host; content:"5biribizidurdursun361.net"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328932/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328932; rev:1;)
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (domain - confidence level: 75%)"; dns_query; content:"notificadoresrma.duckdns.org"; depth:28; fast_pattern; isdataat:!1,relative; nocase; reference:url, threatfox.abuse.ch/ioc/1328969/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91328969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 80%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/nzy1mmjhm2flyzhj/"; depth:18; nocase; http.host; content:"5biribizidurdursun536.com"; depth:25; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1328933/; target:src_ip; metadata: confidence_level 80, first_seen 2024_09_25; classtype:trojan-activity; sid:91328933; rev:1;)
alert tcp $HOME_NET any -> [147.185.221.19] 42443  (msg:"ThreatFox NjRAT botnet C2 traffic (ip:port - confidence level: 75%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1328965/; target:src_ip; metadata: confidence_level 75, first_seen 2024_09_25; classtype:trojan-activity; sid:91328965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ThreatFox botnet C2 traffic (url - confidence level: 100%)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/l1nc0in.php"; depth:12; nocase; http.host; content:"a1031179.xsph.ru"; depth:16; isdataat:!1,relative; reference:url, threatfox.abuse.ch/ioc/1329011/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329011; rev:1;)
alert tcp $HOME_NET any -> [172.247.194.227] 23812  (msg:"ThreatFox Kaiji botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329010/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329010; rev:1;)
alert tcp $HOME_NET any -> [109.120.177.224] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329008/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329008; rev:1;)
alert tcp $HOME_NET any -> [89.208.96.148] 80  (msg:"ThreatFox Meduza Stealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329009/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329009; rev:1;)
alert tcp $HOME_NET any -> [49.12.115.241] 80  (msg:"ThreatFox XehookStealer botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329007/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329007; rev:1;)
alert tcp $HOME_NET any -> [4.233.217.245] 1024  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329006/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329006; rev:1;)
alert tcp $HOME_NET any -> [43.134.142.176] 8082  (msg:"ThreatFox DCRat botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329005/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329005; rev:1;)
alert tcp $HOME_NET any -> [2.59.134.243] 2222  (msg:"ThreatFox Venom RAT botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329004/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329004; rev:1;)
alert tcp $HOME_NET any -> [64.176.214.38] 7443  (msg:"ThreatFox Unknown malware botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329003/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329003; rev:1;)
alert tcp $HOME_NET any -> [31.172.87.52] 31337  (msg:"ThreatFox Sliver botnet C2 traffic (ip:port - confidence level: 100%)"; threshold: type limit, track by_src, seconds 60, count 1; reference:url, threatfox.abuse.ch/ioc/1329002/; target:src_ip; metadata: confidence_level 100, first_seen 2024_09_25; classtype:trojan-activity; sid:91329002; rev:1;)
alert tcp $HOME_NET any -> [198.20.161.194] 8080  (msg:"Thre