[Community-sigs] new sig: Win.Dropper.Agent

Shaun Hurley shahurle at sourcefire.com
Thu Dec 18 07:42:04 EST 2014


Andrei,

Win.Dropper.Agent-320 has passed FP testing and will be published.

Shaun

On Wed, Dec 17, 2014 at 10:18 AM, Shaun Hurley <shahurle at sourcefire.com>
wrote:
>
> Andrei,
>
> This signature has been submitted for FP testing.
>
> Thank you for your help.
>
> Shaun Hurley
>
> On Wed, Dec 17, 2014 at 9:58 AM, Alain Zidouemba <
> azidouemba at sourcefire.com> wrote:
>>
>> To Shaun.
>>
>> - Alain
>>
>> ---------- Forwarded message ----------
>> From: <andreisaygo at live.ie>
>> Date: Wed, Dec 17, 2014 at 6:30 AM
>> Subject: [Community-sigs] new sig: Win.Dropper.Agent
>> To: "community-sigs at lists.clamav.net" <community-sigs at lists.clamav.net>
>>
>> Sig:
>>
>> Win.Dropper.Agent;Target:1;(0|1|2|3|4|5)>3,3;66390174084066833C410075F8;FF15????????813E6366686475E0;4D69635F4E65745F43464724;5C737663686F7374642E657865;5C4E73686B5C7472756E6B5C436F64655C5261696E626F77;72756E004D006900630072006F0073006F00660074005C00410064006F00620065005C00740065006D0070
>>
>> Hashes:
>> MD5: 55945e22c0f49c788ba6d2d5cde9897a
>> SHA1: 65558148cdaea77b20b3b6eb506b626b819a8a47
>> SHA256: b6818ce4e928f5dff0b74c27d75628560ead5bf03be830ed73fbcd1641eab9b4
>>
>>
>> //Sig0
>> //get unicode string length
>> 663901                      cmp        word [ds:ecx], ax
>> 7408                          je         0x404008
>> 40                              inc        eax
>> 66833C4100             cmp        word [ds:ecx+eax*2], 0x0
>> 75F8                          jne        0x404000
>>
>>
>> //Sig1
>> FF1518D04000         call       dword [ds:imp_CloseHandle]
>> 813E63666864          cmp        dword [ds:esi], 'cfhd'
>> 75E0                          jne        0x402a02
>>
>> //Sig2: Mic_Net_CFG$
>> 4D69635F4E65745F43464724
>>
>> //Sig3: \svchostd.exe
>> 5C737663686F7374642E657865
>>
>> //Sig4: \Nshk\trunk\Code\Rainbow
>> 5C4E73686B5C7472756E6B5C436F64655C5261696E626F77
>>
>> //Sig5: runMicrosoft\Adobe\temp
>>
>> 72756E004D006900630072006F0073006F00660074005C00410064006F00620065005C00740065006D0070
>>
>> Regards,
>> Andrei Saygo
>>
>> _______________________________________________
>> Community-sigs mailing list
>> Community-sigs at lists.clamav.net
>> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>>
>> http://www.clamav.net/contact.html#ml
>>
>



More information about the Community-sigs mailing list