[Emerging-Sigs] 2 SIGS: W32/Dexter & W32/Stabuniq

Darren Spruell phatbuckett at gmail.com
Fri Dec 28 07:51:34 HAST 2012


> content:"/rssnews.php"; http_uri;

Beware that the URI path is variable; e.g. also seen:

yolanda911[.]com/rss.php

http://webcache.googleusercontent.com/search?q=cache:SjlDF9YN0UwJ:www.threatexpert.com/report.aspx%3Fmd5%3Deb392255167979b2f147ec101357f6dd+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a

-- 
Darren Spruell
phatbuckett at gmail.com


More information about the Emerging-sigs mailing list