Re: [Snort-sigs] More on RxBot and IRC traffic

James Riden <j.riden@massey.ac.nz> writes:

> Tom Fischer <Tom.Fischer@rus.uni-stuttgart.de> writes:
>
> > Hi,
> >
> > On Sat, Jan 15, 2005 at 02:23:01PM +1300, James Riden wrote:
> > > I found an interesting web page
> > > http://cert.uni-stuttgart.de/doc/netsec/bots.php which lists some
> > > signatures for IRC communications from Agobot/Phatbot/RxBot.
>
> Correction, sorry - according to LURHQ, phatbot actually uses a P2P
> system rather than IRC for communication -
> http://www.lurhq.com/phatbot.html - also gives some snort sigs for the
> P2P control and for phatbot infection.

Duh; the LURHQ ones are already included in bleeding-virus.rules. 

-- 
James Riden / j.riden@massey.ac.nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/




-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs