Predator the Thief C2 traffic

[recvfrom]

Overview Write Snort rules for the command and control (C2) traffic used by Predator the Thief (commodity infostealer malware)

Proposal Write Snort rules (likely two) for Predator the Thief C2 traffic. For more info, see:

• https://www.fortinet.com/blog/threat-research/predator-the-thief-recent-versions
• https://github.com/silence-is-best/c2db#predator-the-thief

Expected Difficulty Beginner/Easy - The C2 protocol is very basic, write-ups exist that detail the purpose of the protocol data, etc.

Technical Info

predator-4c18b806dd10733f6e4d1376e769d94b.pcap.zip (password: infected)