Sality Botnet - Payload URL Pack Retrieval
Detects HTTP requests to known Sality (SALTY SPIDER) payload-hosting domains distributed as "URL packs" to infected bots. Sality's P2P network tasks bots with URL packs pointing to compromised or operator-maintained web servers hosting malware payloads (such as the EggJagger clipjacker) disguised as innocuous image or document files (.gif, .png, .pdf) on free hosting providers.
YARA-L
