Predator the Thief C2 traffic

[recvfrom]

Overview
Write Snort rules for the command and control (C2) traffic used by Predator the Thief (commodity infostealer malware)

Proposal
Write Snort rules (likely two) for Predator the Thief C2 traffic. For more info, see:

• https://www.fortinet.com/blog/threat-research/predator-the-thief-recent-versions
• https://github.com/silence-is-best/c2db#predator-the-thief

Expected Difficulty
Beginner/Easy - The C2 protocol is very basic, write-ups exist that detail the purpose of the protocol data, etc.

Technical Info

predator-4c18b806dd10733f6e4d1376e769d94b.pcap.zip (password: infected)