search

mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
531 stars 160 forks source link

Add detection rule for hp-socket linking #848

Closed Still34 closed 9 months ago

Still34 commented 11 months ago

Summary

hp-socket is an open-source Chinese-origin networking library and has been spotted in various proprietary RAT such as SprySocks

mr-tz commented 9 months ago

I wasn't able to find a sample that matches AND is quick to analyze for testing. Can we move this to the nursery for now?

Still34 commented 9 months ago

Is that something you'd like me to do? Move the file to the nursery section?

mr-tz commented 9 months ago

Yes, please, if you can.

mr-tz commented 9 months ago

thank you!