[Emerging-Sigs] kazakaza.php trojan communications

evilghost@packetmail.net evilghost at packetmail.net
Wed Oct 6 14:00:59 EDT 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 10/06/2010 12:58 PM, waldo kitty wrote:
> why limit it to three character extensions? shirley they can bypass that by 
> going for zero, one, two, or more than three characters? they are given the 
> opportunity to name the config file anything they want IIRC what the kit does ;)
> 

Short answer; because they don't...  All I've seen are three extension.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJMrLlbAAoJENgimYXu6xOHsS0P/1+9K2iykIFOyVQSBMDATZF4
qAY8rqqfTenVtjSCKXu4V0OlzfcdsZgFgzmS7E6Re55HTegYUuaJ8uUr7LBdVLlg
GK8aCC/dSHaPJ/yVd8jkJXIBzaIWrm/KBG6tqt6kDjN9HZq9C8vXUh+YZakL0ucg
IZaOMGQpsj6pmDDiRtkV+jqqX4cuFuqGOxfAn5ROdQhMEyeiE94rXDoy8YgvEI0i
6Xc/sCnl+VprrDZ9EpjMWafFeCkfnexFI7ixOCspUWSIjpT2r64A1wVl50h/bHz1
4D9XB1ibz301RbvrxKAYOATw902wmQD0KVUp7WW3zI4IEhtmquDh1vnkcXEQWDbQ
dJMZZ9IUW3HqK97ZH6k8JRKpbZZOkJpz0e+grpEQTYxuuNjrNy0KDp+n4xoorO2s
m+kdqSP/Xm+dxllTWL+uYAkHUXFZrew0d9DoPMG+60N1A1ZrHLX1O3gpJjL/7zvw
Hh1SCDJCDom2Crt3871sneOh4/TmA9mpwF3bCUzA24O7KOaLmXRzYhpPI8+3Ae2W
NB8UIFEIAIsdGFe52ipy4+ONWJTWoCDG3fe8ulBBvY1Xd471TGd5jWs0Wx7zUd/a
HpG+DNvo3PWuUyjA71O4McWsBwyrdkLTofEeQQWhewkBmxfc6jncyVowzf+a2AR5
aEaImSYTaaFiV6VBRLCO
=9hkz
-----END PGP SIGNATURE-----


More information about the Emerging-sigs mailing list