Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le septembre 09, 2013, 19:02:32

Titre: [MCAFEE]Cidox Trojan Spoofs HTTP Host Header to Avoid Detection
Posté par: igor51 le septembre 09, 2013, 19:02:32

Cidox Trojan Spoofs HTTP Host Header to Avoid Detection

Lately, we have seen a good number of samples generating some interesting network traffic through our automated framework. The HTTP network pattern generated contains a few interesting parameters, names like ?&av? (for antivirus?) and ?&vm=?(VMware?), The response received looked to be encrypted, which drew my attention. Also, all the network traffic contained the same host Read more...
Source: Cidox Trojan Spoofs HTTP Host Header to Avoid Detection (http://blogs.mcafee.com/mcafee-labs/cidox-trojan-spoofs-http-host-header-to-avoid-detection)