[Emerging-Sigs] kazakaza.php trojan communications

waldo kitty wkitty42 at windstream.net
Wed Oct 6 17:12:25 EDT 2010


On 10/6/2010 14:00, evilghost at packetmail.net wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> On 10/06/2010 12:58 PM, waldo kitty wrote:
>> why limit it to three character extensions? shirley they can bypass that by
>> going for zero, one, two, or more than three characters? they are given the
>> opportunity to name the config file anything they want IIRC what the kit does ;)
>>
>
> Short answer; because they don't...  All I've seen are three extension.

wonder how long it will be before they start? they likely do monitor this and 
other related lists... especially when they are(??) changing their modus 
operandi almost as soon as eoin posts his rules for what that are currently doing :P


More information about the Emerging-sigs mailing list