[Community-sigs] SPEEDTEST Shellbot

[Andrea Allievi]

Hi Jorg!
Thanks for your submission. We have really appreciated that!
We are working on your submitted sample.
We will let you know as soon as possible.

Thanks,
Andrea

On Wed, Aug 12, 2015 at 8:58 AM, Jörg Stephan <jost2208 at gmail.com> wrote:

> Good morning,
>
> my honeypot came across a shellbot injection
>
> Source: hxxp://194.60.242[.]251/minispeedtest/speedtest/.z/hb/plk03
> Zonealam: Backdoor.Perl.Shellbot.a
>
> I created the following signature to detect it
>
>
> SHELL.Shellbot.SPEEDTEST:0:*:2323230D0A2320537465616C7468205368656C6C626F7420
>
> It basically searches for the ## SHELLBOT  tag within the file.
> --
> Regards
>
> Joerg Stephan
> IDSBlog: http://sendmespamids.blogspot.nl/
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>



-- 
Andrea Allievi
aallievi at sourcefire.com
Security Research Engineer
TALOS Security Intelligence and Research Group
Cisco Systems Inc.