Resolved! netsky.p signature
According to the signature 3136.3, The regular expression that looks for netsky.p is \x68\x43\x7a\x65\x31\x57\x6c\x66\x57\x77\x69\x55\x33\x55\x43\x58\x59\x7a\x72\x79\x50\x6e\x4a\x45\x68\x38\x6f\x72\x0d\x0a\x4f\x31When this translated to ASCII it ishC...