[Snort-inline-users] writing virus signatures

[Siddhartha J. <si...@ne...>]

Hi,

I am trying to write a signature for the mytob virus. I have the ClamAV
signature for the virus but clam extracts the .exe from the .zip file
and then does a match so the clam signature seems useless.

How do I identify the base64 string in the mytob zip file that uniquely
identifies the virus?

- Siddhartha