Signature Base unknown stable yara

Wordpress_Config_Webshell_Preprend [yara]

Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it

View Source

Detection Logic

uint32(0) == 0x68703f3c and filesize < 400KB and
      $x1 and
      all of ($s*) and
      not $x1 in (0..1000) and
      not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...