search

cuckoosandbox / community

Repository of modules and signatures contributed by the community
323 stars 175 forks source link

P2PCnC uses a class-level "servers" variable, persisting across jobs #445

Closed srpape closed 5 years ago

srpape commented 5 years ago

The code in question is here:

class P2PCnC(Signature):
    name = "p2p_cnc"
    description = "Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol"
    severity = 2
    categories = ["p2p", "cnc"]
    authors = ["Kevin Ross"]
    minimum = "2.0"

    filter_analysistypes = set(["file"])

    servers = []

The servers variable is class level. Once I see a report with the P2P description added, all following job reports have it as well, until I restart Cuckoo.