SparroWocky PortmapReverseServer TCP proxy initial packet

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•5

Detects network traffic containing a specific 4-byte sequence ('13 12 11 09') identified as the initial handshake packet for the SparroWocky malware's reverse port-mapping server component.