Ran into an interesting use of Bandook, so put the time into some sigs for the last two versions of it, 1.2 and 1.35.

They’re available here:

http://doc.bleedingthreats.net/bin/view/Main/WebSearch?search=bandook

And an overview page for the set:

http://doc.bleedingthreats.net/bin/view/Main/TrojanBandook

As always, please let me know about any false positives.

Matt

This entry was posted on Thursday, April 12th, 2007 at 3:42 pm and is filed under General, New Rules. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.