Skip to content

R
rules
Commit ab08d19e by wesdawg Committed by GitHub
Options

Remove chickenkiller string 

chickenkiller is dynamic DNS, not WildNeutron specific.
parent eced3058
Showing with 0 additions and 1 deletions
malware/APT_WildNeutron.yar
...@@ -70,7 +70,6 @@ rule WildNeutron_Sample_3 ...@@ -70,7 +70,6 @@ rule WildNeutron_Sample_3
strings: strings:
$x1 = "178.162.197.9" fullword ascii /* score: '9.00' */ $x1 = "178.162.197.9" fullword ascii /* score: '9.00' */
$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */ $x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide /* PEStudio Blacklist: strings */ /* score: '33.00' */
$x3 = ".chickenkiller.com" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
$s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */ $s1 = "LiveUpdater.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '25.00' */
$s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */ $s2 = "id-at-postalAddress" fullword ascii /* PEStudio Blacklist: strings */ /* score: '18.00' */
$s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */ $s3 = "%d -> %d (default)" fullword wide /* PEStudio Blacklist: strings */ /* score: '17.00' */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment