diff --git a/network/c2/remcospro-rat-trojan.yaml b/network/c2/remcospro-rat-trojan.yaml deleted file mode 100644 index d025b4b5db..0000000000 --- a/network/c2/remcospro-rat-trojan.yaml +++ /dev/null @@ -1,29 +0,0 @@ -id: remcospro-rat-trojan - -info: - name: Remcos Pro RAT Trojan - Detect - author: pussycat0x - severity: info - description: | - DarkTrack is a malicious program classified as a Remote Access Trojan (RAT). This type of malware enables remote access and control over an infected device. The level of control these programs have varies, however, some can allow user-level manipulation of the affected machine. - reference: - - https://github.com/montysecurity/C2-Tracker/blob/main/tracker.py - metadata: - max-request: 1 - shodan-query: product:'Remcos Pro RAT Trojan' - tags: network,c2,ir,osint,cti,remcos,rat - -tcp: - - inputs: - - data: 2E - type: hex - - host: - - "{{Hostname}}" - port: 1604 - read-size: 1024 - - matchers: - - type: word - words: - - "BF7CAB464EFB" \ No newline at end of file