diff options
| author | Julien (jvoisin) Voisin | 2016-05-16 09:58:12 +0200 |
|---|---|---|
| committer | Julien (jvoisin) Voisin | 2016-05-16 09:58:32 +0200 |
| commit | 16389c3f2163d15c7d3d0e0c9566a6311ecc8f5f (patch) | |
| tree | eb14d33b456f55617df0969baccdea9d2752e124 | |
| parent | 0689a9a422ad6a0e02f97118588bcaedb2ae6265 (diff) | |
Add USER_AGENT in b64
| -rw-r--r-- | php-malware-finder/common.yar | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/php-malware-finder/common.yar b/php-malware-finder/common.yar index 3c4bd64..2add775 100644 --- a/php-malware-finder/common.yar +++ b/php-malware-finder/common.yar | |||
| @@ -17,6 +17,7 @@ private rule IRC | |||
| 17 | private rule base64 | 17 | private rule base64 |
| 18 | { | 18 | { |
| 19 | strings: | 19 | strings: |
| 20 | $user_agent = "SFRUUF9VU0VSX0FHRU5UCg" | ||
| 20 | $eval = "ZXZhbCg" | 21 | $eval = "ZXZhbCg" |
| 21 | $system = "c3lzdGVt" | 22 | $system = "c3lzdGVt" |
| 22 | $preg_replace = "cHJlZ19yZXBsYWNl" | 23 | $preg_replace = "cHJlZ19yZXBsYWNl" |