# StatusRecorder

**URL:** https://community.emergingthreats.net/t/statusrecorder/699
**Category:** Rule Signatures
**Created:** [June 27, 2023, 11:05am UTC](https://community.emergingthreats.net/t/statusrecorder/699 "2023-06-27T11:05:25Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)
#### Post date: [June 27, 2023, 11:05am UTC](https://community.emergingthreats.net/t/statusrecorder/699/1 "2023-06-27T11:05:25Z")

</div>

Hello! We thought for a while and discussed what we saw,

> <https://twitter.com/Jane_0sint/status/1673058053636202497?s=20>

and as a result I wrote the following rule:

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] StatusRecorder";flow: established, to_server; stream_size: server, =, 1; content: "$$$$$$WALLETS_START$$$$$$"; classtype: credential-theft; reference:md5,b0a77120cb81694bac9120cbeb337b89; reference:url,app.any.run/tasks/0d0744a8-c186-4fe7-95d9-bdd483e8e6ad; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family StatusRecorder, created_at 2023_06_24; sid: 1; rev: 1;)

```

We do not know how widespread this threat will be in the future, but we want to put up a barrier now.  
Best regards, Jane.

---

<div class="post-metadata">

### Author: ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)
#### Post date: [June 27, 2023, 1:24pm UTC](https://community.emergingthreats.net/t/statusrecorder/699/2 "2023-06-27T13:24:05Z")

</div>

Great work! We will take a look and get this in for today.

JT