Reglas YARA con la etiqueta WHEELEDASH

Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines.

Detects JScript code using in skimming credit card details.

CPP loader for the Backwash malware.

Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell.

Variant of the BACKWASH malware family with IIS worm functionality.