# Gh0stRat.Generic SweetSpecter variant

**URL:** <https://community.emergingthreats.net/t/gh0strat-generic-sweetspecter-variant/1720>\
**Category:** Rule Signatures\
**Created:** [June 13, 2024, 10:44am UTC](https://community.emergingthreats.net/t/gh0strat-generic-sweetspecter-variant/1720 "2024-06-13T10:44:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [June 13, 2024, 10:44am UTC](https://community.emergingthreats.net/t/gh0strat-generic-sweetspecter-variant/1720/1 "2024-06-13T10:44:11Z")

</div>

Hello, I’m glad it’s time to participate in the life of the community again! Have you read the article [Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia](https://unit42.paloaltonetworks.com/operation-diplomatic-specter/) ? There is a chance of detection, and write a signature to the server response [Analysis sweetspecter.zip (MD5: D3B13760394FCDC4ED391853E5F5FFA4) Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/d9dd4d5d-9bc1-4ffa-9a4f-804d0e95c108)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/2X/f/f4f7baf4f3a0bb4e79b5861f4140fe97028cd58d.png)

3, 4 → content: “|15 00 00 00 01 00 00 00|”;

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Gh0stRAT.Gen Server Response (SweetSpecter)"; 
flow: established, to_client;  
dsize: 21; 
content: !"|00 00 00 00|"; depth: 4; 
content: "|15000000 01000000|"; offset: 4; depth: 8; 

classtype: command-and-control; 
reference:md5,cfd26f1694178a0f6df3a92fa9b24644; 
reference:url,community.emergingthreats.net/t/gh0strat-generic-sweetspecter-variant/1720;
reference:url,unit42.paloaltonetworks.com/operation-diplomatic-specter;
metadata: malware_family Gh0stRat, created_at 2023_06_15; 
sid: 1; rev: 1;)

```

Best regards, Jane

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [June 13, 2024, 6:36pm UTC](https://community.emergingthreats.net/t/gh0strat-generic-sweetspecter-variant/1720/2 "2024-06-13T18:36:06Z")

</div>

Hey @Jane0sint ,

Good to hear from you again! I haven’t seen that post yet so I’ll take a look. We’ll get this sig in today’s release!

Isaac 😼