File:Yara Signature of PAS TOOL PHP WEB KIT.png
Jump to navigation
Jump to search
Yara_Signature_of_PAS_TOOL_PHP_WEB_KIT.png (499 × 499 pixels, file size: 48 KB, MIME type: image/png)
Yara Signature of PAS_TOOL_PHP_WEB_KIT also known as Grizzly Steppe according to U.S. Department of Homeland Security
- Yara Signature
- rule PAS_TOOL_PHP_WEB_KIT
- {
- meta:
- description = "PAS TOOL PHP WEB KIT FOUND"
- strings:
- $php = "<?php"
- $base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
- $strreplace = "(str_replace("
- $md5 = ".substr(md5(strrev("
- $gzinflate = "gzinflate"
- $cookie = "_COOKIE"
- $isset = "isset"
- condition:
- (filesize > 20KB and filesize < 22KB) and
- #cookie == 2 and
- #isset == 3 and
- all of them
- }
- Source
- GRIZZLY STEPPE – Russian Malicious Cyber Activity - US-CERT, December 29, 2016
- JAR_16-20296A_GRIZZLY STEPPE-2016-1229.pdf - Report as PDF file
File history
Click on a date/time to view the file as it appeared at that time.
Date/Time | Thumbnail | Dimensions | User | Comment | |
---|---|---|---|---|---|
current | 09:53, 3 January 2017 | 499 × 499 (48 KB) | Petri Krohn (talk | contribs) | Yara Signature of PAS_TOOL_PHP_WEB_KIT also known as ''Grizzly Steppe'' according to U.S. Department of Homeland Security :'''''Yara Signature :rule PAS_TOOL_PHP_WEB_KIT :{ :meta: :description = "PAS TOOL PHP WEB KIT FOUND" :strings: :$php = "<?php" :... |
You cannot overwrite this file.
File usage
The following page uses this file: