Cidox Trojan Spoofs HTTP Host Header to Avoid DetectionLately, we have seen a good number of samples generating some interesting network traffic through our automated framework. The HTTP network pattern generated contains a few interesting parameters, names like ?&av? (for antivirus?) and ?&vm=?(VMware?), The response received looked to be encrypted, which drew my attention. Also, all the network traffic contained the same host
Read more...Source:
Cidox Trojan Spoofs HTTP Host Header to Avoid Detection
