[Snort-sigs] gamarue infection

Joel Esler jesler at ...435...
Fri Dec 7 09:24:34 EST 2012


On Fri, Dec 07, 2012 at 11:35:55AM +0000, Aisling Brennan wrote:
> Hi,
> 
> is there a rule for W32 gamarue infection


That's a very open question, there are many variants of the "gamarue" trojan, and not all of them act the same.  Yes, we have coverage for some variants of it.

Is there a particular sample you want us to cover with Snort?  Most of them are covered with ClamAV.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire 




More information about the Snort-sigs mailing list