jlimbo Fri, 04/13/2007 - 17:27
User Badges:

Here are the custom signature details for the NUWAR virus:


NUWAR.AOP

Engine: String.TCP

Service Port: 25

Regex String :

\x39\x6f\x68\x53\x73\x6a\x4e\x4c\x51\x42\x78\x46\x77\x52\x6c\x73\x66\x67\x6b\x2f\x33\x57\x73\x69\x68\x76\x50\x51\x53\x75\x45\x33


NUWAR.AOO

Engine: String.TCP

Service Port: 25

Regex String :

\x49\x47\x65\x67\x39\x65\x4b\x63\x57\x50\x65\x68\x55\x57\x34\x4b\x67\x72\x34\x35\x61\x4d\x6a\x30\x68\x33\x48\x77\x7a\x59\x47\x77


NUWAR.AOP

Engine: String.TCP

Service Port: 25

Regex String :

\x73\x4c\x32\x54\x34\x44\x57\x64\x52\x37\x5a\x77\x2b\x32\x73\x62\x6b\x46\x4d\x4d\x51\x53\x71\x66\x49\x41\x75\x68\x76\x73\x57\x68


Hope that helps,

Jonathan



Actions

This Discussion