Gost Tunnel Renamed Svchost Config Dll

Arnold Chan@slaz

•updated yesterday•0•0•1

Detects the GOST tunnel binary deployed as svchost.exe from a staging directory, identified by its known hash, or by an unsigned PE importing config.dll with a matching MZ header and embedded config.dll reference (reduces FPs from legitimately signed software that imports a DLL of the same name)