reglas/iii-botnets.yar · yara-python 4.5.4 · muestras únicas escaneadas: 47941
HP_Handshakebins_Bot: 14
   07c0a0af63dde8dc2e36dc58b630dcad6563263e992877aaa704530afb8a5656
   30e0cb05a8c207c4084adaeb2906cbb8119b3d638999a73d4635e333e09cc0f6
   387d6d1bc5b00c60c64528c6b0ceb34fa7c4a83f6b8cf95f0526adb5cc57389d
   488cd4b95923b20587debbd1a747d9e04b85b3ff2b274e36660401e194576626
   4c463687adab59995dc46225c0df38a12da6ffd828b1a46a162e75ba604897ad
   718ef7418c3114a560c8d7a6c09691ead65ce59ac28bf80708f440311564807d
   732e796d24da151af2e4ad54d5706248aefe86686f83e5033c7ca8dd19e97954
   73695282607747038a31f516e3f8310a67ae6f2f9e4a0b90b55a40f77272e559
   941efe52eb858311653bf2c1e855555cf735896d500f11ea90aaf7e93d1faa3f
   945afece38f108d7c1c5c71e785fbf452f7de803ca1f207e6eae1f9dd3d5ae80
   b992e0488abed5c19f215626dee38cc4b7b92b918ab194e276924a462aa97c3f
   bcfbd1d0c98844ddd4795a6df4e6431a494a0320c72413f188b50140cd30f506
   cd9655a77201f73e69953ec5b53f898de41983c1b4dcedd0c431955b9c20b241
   dcac02c71bd67e7ce708e2fad709059b817ebdde9796542ef16855de5c7b9a41
HP_Handshakebins_Dropper: 3
   0fad00ddec16b67f3131aa4efffbe32d78fca178407895920b7549667d7bbfbf
   586960df8bf559ffbba600f11917a99baed4a875cb7faa5eabc060bcde67277b
   7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8
HP_Iran_Mirai_Variant: 8
   553855b485206d2cbe0756235116ce329b5185c4a40092bb1707ffdc9da26d5a
   64690dd19373b5df539d66e64e39dbbd51b2734e35143d53c223a19bfea74f50
   84b352b314d71d6887ef94b8094bbb4c6cbcb409e52ee748dca7583b8f75002a
   9e4cbff8e55bcd3dd88b9df12f3c4333dfc08c5ceaa174e2f40bb163d4783cb6
   a038aad92c5375a1b7dcf2a4f0e6a4cadc05cfa552f42157f4a53baf588f4392
   a0e7e5b25346340da9e58ac4fe8691409f8dbc99d1e2aa3f496c3f9b10016d8c
   b5c517046323ddc8baaeec0a67cd1f3fc2b84bb3ea4b1db74bb55c382fa93a01
   d1f0d6f767c5385b7129e9bf95bf9a769b8066e8709b0be045411e1bc895ebfb
coincidencias fuera de la familia esperada: 0 (revisado a mano contra muestras/manifest.csv)

── reglas/iv-mineros-docker.yar · yara-python 4.5.4 · archivos únicos escaneados: 48095 ──
(muestras/ + downloads de Cowrie + captures web; dedup por sha256)
HP_RedTail_Installer: 2
   31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e  (setup.sh)
   1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d  (setup.sh, variante)
HP_XMRig_SupportXMR_Config: 1   (exige la wallet 4ALMv7Z7…; supportxmr:5555 aparece en 51 mineros con wallets distintas → no se usa la rama de pools)
   fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d
HP_Linux_Processhider_Preload: 1
   fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d
HP_Docker_API_Host_Escape: 532   (cuerpos POST /containers/create con bind del raíz + Privileged + chroot/release_agent/base64)
coincidencias fuera de la familia esperada: 0 (cada regla toca solo su familia; revisado contra muestras/manifest.csv)
