[Community-sigs] PUA.NetTool.Zona

Angel Villegas anvilleg at sourcefire.com
Mon Jul 13 12:23:25 EDT 2015


Thanks Arnaud for your submission! I've changed the name to conform to our
naming convention (PUA.Win.Tool.Zona), queued it for FP testing and will
publish it if it passes.

Unfortunately, the max-filesize is an optional setting each ClamAV user
would need to set, so the detection for this signature may not hit as often
as you've witnessed with that setting defined.

Thanks,
Angel M. Villegas

On Mon, Jul 13, 2015 at 3:19 AM, Arnaud Jacques / SecuriteInfo.com <
webmaster at securiteinfo.com> wrote:

> Hello,
>
>
> PUA.NetTool.Zona:1:*:5a004f004e0041005f005000410043004b*5a4f4e415f494e5354414c4c45445f414c52454144595f5449544c45
>
> Please use --max-filesize=450000000 to detect files
>
> Number of samples detected by the signature : 250
>
> MD5 of detected samples :
>
> 8dc36ff070b006bcec07372b4e8d629d
> cc730be1ded1d8c4d7270d4b8549a1c6
> 231924831d75c3adb2aa69331d0e849f
> 92fded0f841f267589b06b12f0bce377
> ef208623da9aa56118b1ba89c520aeaf
> e329a6a1933c113794282804ceb2357b
> b199438876efa0257d8e573ba2c70adc
> 3e96d53f513ea2ead807c1bb22414ab6
> 79f7a80ecc921a6dda9f58bebacac0b7
> 9d2ee09d069855b0a30fd3d51d6b784f
> 18d08bf78ccaa07bcfbb0d2f4e6b731e
> c83633d38e889f623620ad1b03a75e17
> 4fc761b2b85104a9b2bb8c25657a3560
> f46bd78fe24bcfc443d917fbca29cce0
> bc8f89e09dce658b58bca49e6a93890a
> a0a2c9c940aa64c5b7b270ff0dfd941e
> 6fe31a1ac91aaca7954ca9ed7ffeae78
> 3bdfb26014682bf62731fb23dcb9477a
> 040eda90e0e4cd1a96cf53071d031199
> 890ad2fd179e0c0899fb1fb01af4a4af
> 0409f895b94a3f1973e0b80b9cee2ba8
> 471302c238241c80fbf6f7ec5217e62f
> c5ce944dd367b77a317108a978121e66
> 739698e03c4aea22a096943139f08aa5
> 0c5e82e2aad31b0ad96fa9ab89f3d73d
> d2c6755ea9545d12bb4157da73f66dc6
> 944cba4e8ab24cc2aec8cac3b914bb6e
> e4d4e3e2cfe72f20e142e89fe1d275ff
> 35f2533222bff1611d7179ce176310b2
> b08a406b5e3fb888801ef2fffc46afe3
> 36bb6c9c3c9a407a296a71afc7957e06
> 393ecb142fe44adb76b7d8192c4c115a
> 89884a7fcd121ef0eff564755bfeac52
> 05af34b1351863e9fdf580203312b5ab
> 42bfecde12ce4bea8ca3fff899827eb3
> 3bb4eec4b81c2ec7957c9dc9048d5731
> a0123ce68b948ca0d964d3ed94744681
> 0edede54ed85b736a1a87258714bcd3d
> 9e8217d57247344114cde6ae84dceb0c
> 5f0e887bc91ed0bff0fe73d062f65766
> 4f40d2c965da69060e59c5514b38ebe3
> 9df414d0d279b897710a3c299e657832
> c8a640db5695c73af8cc4ac3ae554150
> c5afac100392da42006fce44011d77b5
> 107d33b48732b145da153a99d45fe3f4
> 37a6b62447be736fa774cf45260128c6
> 6902210a195f507cafa05c3c4880b3cd
> 6ca6890dad827169c990e23947237419
> c3fa27d197a517bf573e199f96e8dc07
> f586bff0e6e41afde556be1508ad8bee
> 4a3aeb15e82737d0aa8015486d08b0cd
> 46c93549e040980837f6d0c71b37eb76
> abf622b7cc72695418b55fe77e49fc8c
> 13e16455e10c226bbc2367c295d817f6
> 0dcc938610c46f55d6734c7e06c7d8a0
> 5fcc6f0128b468d88d396cf28080a353
> 6e5325b5fb6fc62cc7221a3614c108ba
> d7a946b90da2ab93f460754bcd32d923
> 352c79fe84299df28346ae2b65b5ca25
> 53af5a19472f1abae5197ae8754ccf13
> 432fb3ff710fca39021d4be065903439
> ae1e7abc49a15ec352f483e32bba0435
> 17b674885c1542337358fde1e2a22545
> c63ba009059957df48d9154475d1f22a
> 92973943eb97986eacfe1757c3c4a35a
> 8d1943b50c16fe575113540675c2cb70
> 1c75346da99165fabb8d17fc0bcd4dc9
> c634fa35030e07770df9ba2b416aa75a
> 576567615e100dc0edcd054bab927797
> 5b320b6766a626241e0c1b2d38581bd6
> 8608cfa87b4ef5c30d4688aaa374cf80
> f48dd2726fe90e0ec26af9e5155774bc
> 0971572c4a8e9ab5c951c0ef4ef4130b
> 1c963793954c5984d61b9edf67f6e579
> 97b888bdbeefb363a78bf9d5e60395bc
> 05a27a4e7b658fca4184db834bd00908
> f14a593077c424a777ca259949b9b82f
> 24f56c1465375c99ef1a96d7ab4f7082
> 1eca935266f58e81312b1bafabdb8217
> 753900cfc8959424ba84bdf028170cf4
> 67b03da00ef95910ff00f0cb949cc96f
> 6971c1aa18609c6d4db00d6e61aa484b
> 680a0c25c9c5419a0fc9a373aca3283e
> 0a41460c6e71541b7054a39ed78d9246
> 96167a0f905a8c23c8d871561e09f978
> 770a6e4f39192b5bc60cfc9b26d2bfb2
> dad24a24ea948f64edefa4b562a9bdde
> f983493c73af3733e55954b470ae6f84
> 2c42bf5b6c4017357161583763ed767c
> 2e208538653ce71f8c80865ffd42ce9d
> 093f1ca6aa10407ca8fe39bb2132b83b
> de5f7d60e1596dbb1936b2db868ed3f6
> 4b8e9d140ac7a84e1f3c76d23c2c2f1c
> ef0c7127f91d0bbd1064e0a025b7ce21
> 0ae250d680be7f9283a49e8cdc2d138a
> d3db0554bc8bae6df5944b73de2f58b3
> 4fb27f7555e0aee616b3cbdeb2fe4158
> a9f48d2547297aef8a9ca98f97cc04f7
> 1bfd3a4f99cbe6410f311a46aa697027
> 8a1b02de80984280c01efe16f3aef385
> 111dcf874c4b80b9efaa7b2412ce2de5
> f322b8250278fda86cccc57e03f52d7c
> 978e194439e07368acbe6b5e6f823fc5
> 1e559d8eb3a698579c94170ce6ab7c6b
> 440e5f5d55f84662fa6906b074c13418
> 31924e35905a1a549e8a841135f2c617
> 222f86e25a6813c6beb9600a2cfe5da9
> cd9297a586604fcbec14b879ef1f4819
> b3382e258b860fa38451358a8dc0ea2a
> 98c8a8595f9c7ada15d0fd95b71ba649
> fb4f47604963793aaf236b4b2d731248
> c9af76ad5f801df8024338ab951302c5
> 5464effa9716dfb865d2c1db26a90ea8
> 492ac1d62657d1036898701aa8d69eff
> 7dffe9f6d59e3bcd4e0d6610c1dd2fb5
> 9413b425ef3582788274072dfacd2e70
> 4085727c142931bb22830815e7b59d66
> cd493e7d695ff2f278c275ac48f24435
> 385b07f0f74eda83d817a499982e30b3
> 408efd29853493a7518c1d37f96e4aac
> aaeb2952c0ab21cf2b92ed602cc91593
> 325603897248bd8724fc55441016d106
> 70340c97f8a6c58f63db9deb80c101b8
> e0c5341c0670fa28e6249593def049b7
> 4df1e56697ed7f8ebc23f1089af85f8f
> 854caf65ff8ae0778a40c7f3dc978700
> 888bda378e2c5d414c78b10aaef13396
> eeaf85473e4bdec2627ba3e4ca90967d
> 6cda401bc4eb61493afac45dbd9c3ae9
> 5c57d3a53568c3062b4bdec12c167494
> c53001531706e4427f64754a961b7711
> 5bb9f7b1685e42524a5e214c9d097053
> 9c3abfe8e8691b238232489af127e862
> db756574184235369fba6a66dfe77eb1
> 400838b147dc1e1a7b14c0d1c5fad916
> 09d0ff95ab782f5f04645e65a722dc66
> 65b1ea091cced48f74d12c1f4626f517
> bb9e7d16f670ca3f2ad2be3f4cee3866
> e96c7a156b7499749370630dea788e22
> 6e84285e9d804f9924254769525176de
> 59b49b5d4fbb4ad635527fc19e1928ed
> 10822abe4bd3f81a95827d19503cb931
> 2b124335014679c08c436677020034aa
> 8507d25b23dc50ea382f5c9b221390ab
> fd50cb15b1a8101024fd4c9f7ada9077
> 5d331c992233273a270a4b7647cf8bb6
> 043f7bdf2721337fee2ab90b0f274188
> c92a40b100437497f9fa8513fbeb5ed6
> 20ada0d71a466f78463539ecbdf96d95
> c994eb2bbdcd092ba855dbe904f7f2db
> 0c7298b9535d42a8a8fd545bc637fbcc
> b93de45a3949b82ce45d7ad027499ce7
> cdb574d7dedbc5bf80863cc966ab9d07
> 9ce9bf63bd44ced509f4cba2f444cdcf
> 0ab164498eaf4784e9556f60a4704e8e
> e97b621ebbdc755c393076caf4494f45
> 49b2466a26518f900fc29fd1892500b1
> c0b645bfd5aa43a52d2a13c17de73a2c
> 3258bb9f35903cb6ea6b747449af7fa0
> 77a4289de19eaa145d647be8eabbda40
> 5204b01a499a3e536ecd835279c20563
> 3f88848428ad2f7942b60e3b6454a211
> a7d41d1d9a44cb9096f986a81d9c173b
> 479ab54ef9c2d3d59608954b5affa623
> 67d0c3b28d580ac9d3698a4c131c8d2b
> 906c8970cf3ab13d9adbdb7f3592da24
> 7b26b0c8bd7f6345454491d490130768
> ef6d710c68bc692400dd707fe08a5277
> 94e0a73eca0e03ee44ee93983718bf39
> 4900547da40042a0ded06112db987b0e
> 924d3d1a37f51b71738312b6d57d5086
> e5135125fe72f8afa90a8b4380d61cd8
> 2dd31679dde65443c62783c52384d9bb
> 7b9963617e81084d31049664da2a6f61
> 7e48a55c1625d4721dfa30ab5403f198
> d6b58326f7345300d99a7c6c2e433e86
> 686ae8fbac01aa539fdeaeaf0bd19299
> dbfa7cbe038e1057cc7b535c4efb2882
> ef7305f53cd14753b626561691ea93eb
> 381f185c54e60f9734e0b644d598acb4
> 598295598b8b19677f82dd59ff7efeb3
> 8400571df706ec75fd855e0059b3257c
> 3d31bf367cc5aaca8ccefa0c5ff414a7
> 6934b846b2ef1e1f67244037dc83543c
> 85fd7e16d62b94d698c6c726b3049c49
> a1857093f31faa416dccfc70b4065753
> e6cde9d92f008fc9a05248534d7b92f7
> a76f998d47cd94080d5a8e16a893e36b
> 8040040cfa9e91dc8ea8ecdc1ce47d23
> f9a8b3d4a4aba17d4077b9876a83359b
> fdf8347ac35b0d8dd17c63738a2483f2
> 8ac2d6afc03cfaa5ffeeef49f352c1cc
> 8fc315fd47c4aa9f3e88ee0bb018eaaf
> 2ac72ccbeb57273177c460ff97d6d172
> d07da2b1eda69dc1e3178cf6f2686c97
> 3084fdf37600441606c6139c907b61a7
> 10fea4f75ae424939c33399430c981b1
> 02170850758799fcbdcc11ddca7f0731
> 2f85bc0e9d72e393d32025ff6f5cda41
> 81ca4baa02632e9cee9b3515f71f88f9
> 590cc43dbc733528c51de9135f2120f5
> 3b68bca3c1cac5f2f2fb7e0a6f44b9a7
> 37148f6efad17127ebdc2680a4301443
> d1830d4ccb49606d63561ce2a2b4ab1c
> ed72edddab6324cc54af438bd7948a5a
> 5ec2f4635b01130c64dc7c385e125337
> 879293df61718d98ad618a8f20616578
> 9d398deb318064fe761fd0e49b7350fd
> b7bb398b7b67d3e69664c6a55fd94703
> eb28c9c2a46f9de6051b1277db751e04
> 4668584990a481b2aeb852264c67648d
> 013a3856020941651bfb75a4cda56acd
> 82336c9ae8022d9af8e68a457e4358d1
> a61f2e065374acb029e3ee4a7f3c63bc
> 62f758973c826bb78479a43d95903814
> 10ac07d0c706e28af43cbe0475c783f4
> feb0c1ae4741475e7fa373dd0a920167
> 48f7c8fc0aefde85e182d52341a941ca
> 25c2181d5df206b824f0b88197917ca8
> 0dd2ff9c2fb8b39222e9381cb407c10d
> 345e633300836f0c3b1ca2b8eaa68e3a
> 2de03d7ef3da4fcac166c60867b75964
> 0eafeeef51ade60ccb73d9d6abf4d515
> b8c0a38bee7e528900508d1ad7cd7f07
> eccaea499b807bae185e8a4224e5c7fc
> d601ed0f5752329d0e987aa1590201e5
> a4c67b14eb54dfe95e63258c031d4f9c
> bfe5c072d0bafe6a58a58b26f5f8e5c7
> 41bf5df837e46e721c7adc433f30dacd
> 2b9bf45489705f6a7c7c1228b7267f6e
> 053c087b00987f55a2774d93fdf52c96
> 5dfedbef4297070b5bd4af74cd7f0f79
> af11f3e8468319c205945242e0f847ae
> 4c9ac0d0ae25c4031f00421989e5b236
> 3663ceca467ede5077b8a8d6062fdb31
> 1637901228947bb47fcbe3fa196e00a0
> f73f8557e6464ca39efbab11cd8add92
> f543a88869423dae3f99c6a681b3bb78
> 0a047ef439ea3dd082ee9a4efa71c3d2
> 8afb478bd25cc215e3129d57d3624d0b
> f5c8db73cfa4a4c2d8afffd39a0950ce
> 419fa940b998651fd465167bdc7fe0d4
> 41fdca6a3d93958fde9f544333c2c4f2
> b18026f2102aeee9cefe87e1c780a7fc
> a6dcee5b259d353abfbde3844eda7da8
> 25dde43d3b09dcb6effda1e08d9f3d9f
> e5d2ef32721a41d1a2c41ecda46f523e
> 81c835bde907564f1e37a62f7c890893
> ab1cc2e0bd1601f103ea3c1c22c031fe
> 308e50da1fcd9537ec91f52cfc84f9f0
>
> --
> Best regards,
>
> Arnaud Jacques
> SecuriteInfo.com
>
> Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
> Twitter : https://twitter.com/SecuriteInfoCom
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>



More information about the Community-sigs mailing list