Bot of the day: Ramnit/Ninmul - Revision history

Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

2015-07-31T10:51:14Z

Text replacement - "/ www." to "/ |Site=www."

← Older revision		Revision as of 10:51, 31 July 2015
Line 4:		Line 4:
	\|Legend=		\|Legend=
	\|Document=		\|Document=
	\|Link=http://www.emergingthreatspro.com/bot-of-the-day/bot-of-the-day-ramnitninmul/ www.emergingthreatspro.com		\|Link=http://www.emergingthreatspro.com/bot-of-the-day/bot-of-the-day-ramnitninmul/
			\|Site=www.emergingthreatspro.com
	\|Author=Matthew Jonkman,		\|Author=Matthew Jonkman,
	\|NomRevue=Emerging Threats Pro. LLC		\|NomRevue=Emerging Threats Pro. LLC

Eric.freyssinet: 1 revision imported

2015-02-07T14:22:19Z

1 revision imported

← Older revision		Revision as of 14:22, 7 February 2015
(No difference)

Eric.freyssinet at 18:01, 15 January 2012

2012-01-15T18:01:04Z

New page

{{Publication
|Titre=
|Image=
|Legend=
|Document=
|Link=http://www.emergingthreatspro.com/bot-of-the-day/bot-of-the-day-ramnitninmul/ www.emergingthreatspro.com
|Author=Matthew Jonkman,
|NomRevue=Emerging Threats Pro. LLC
|Date=18 juillet 2011
|Editor=
|Year=2011
|Page=
|Abstract=Ramnit is interesting because it tries to slide a command and control channel in on port 443 (SSL). Why port 443, a few reasons I might choose to do that:
# Many sites disable app processing on port 443 to save load on their IDS engine.
# Some old content filters used to just look at IP and nothing else for what they assumed was SSL.
# Port 443 is usually left wide open on firewalls that can’t proxy.
|Botnet=,
|Malware=Ramnit, Ninmul,
}}