# PortStarter Backdoor Sigs

**URL:** <https://community.emergingthreats.net/t/portstarter-backdoor-sigs/2042>\
**Category:** Rule Signatures\
**Created:** [October 10, 2024, 11:39am UTC](https://community.emergingthreats.net/t/portstarter-backdoor-sigs/2042 "2024-10-10T11:39:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [October 10, 2024, 11:39am UTC](https://community.emergingthreats.net/t/portstarter-backdoor-sigs/2042/1 "2024-10-10T11:39:34Z")

</div>

Used by ViceSociety/Rhysidia ransomware. More info here [Advanced Cyber Threat Intelligence | Recorded Future](https://go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf) (page 14). Additional Samples [VirusTotal](https://www.virustotal.com/gui/file/bcddca962a619baaee36eb2e3dbf41eeb00f0e375888d2bba6a06584d2ba7edc/behavior), [VirusTotal](https://www.virustotal.com/gui/file/78b42d4d051cb1f1c4e1f47e8390810c23ba0e24f8dc689b99b40996945abc87/behavior)

I have noticed even though when I edit it the escaped dots in the IP segment of the PCRE are escaped when viewed normally they are just shown as a dot with no backslash so this may need sorted if this remains the case.

# This rule needs SSL decryption. It is focused on the anomalous Hostname header that is part of this tool.

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“MALWARE-CNC PortStarter Backdoor Request”; flow:established,to\_server; content:“GET”; http\_method; urilen:1; content:“/”; http\_uri; content:“Hostname|3A| “; http\_header; content:!“User-Agent|3A|”; http\_header; pcre:”/Hostname:\ \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}|/H”; classtype:trojan-activity; reference:url,[Advanced Cyber Threat Intelligence | Recorded Future](http://go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf); sid:198001; rev:1;)

# Checked in traffic and this JA3 does not seem to appear in about a week of large network traffic with mix of OS.

alert tls $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET JA3 PortStarter Backdoor TLS Fingerprint”; flow:established,to\_server; ja3.hash; content:“19e29534fd49dd27d09234e639c4057e”; classtype:trojan-activity; reference:url,[Advanced Cyber Threat Intelligence | Recorded Future](http://go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf); sid:198002; rev:1;)

---

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [October 10, 2024, 12:02pm UTC](https://community.emergingthreats.net/t/portstarter-backdoor-sigs/2042/2 "2024-10-10T12:02:47Z")

</div>

Also found another sample [VirusTotal](https://www.virustotal.com/gui/file/9f66708cb440a2c849457da724ae745263b94e9a30170568ed1a7004f0d405d6/behavior). On behaviour tab under HTTP traffic (though it is HTTPS) there is the first request above but also another to ping 404

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“MALWARE-CNC PortStarter Backdoor Request M2”; flow:established,to\_server; content:“GET”; http\_method; content:“/ping 404”; http\_uri; fast\_pattern:only; content:“Hostname|3A| “; http\_header; content:!“User-Agent|3A|”; http\_header; pcre:”/Hostname:\ \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}|/H”; classtype:trojan-activity; reference:url,[go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf](http://go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf); sid:198003; rev:1;)