[Community-sigs] Win.Trojan.Fosniw

Wed Aug 3 18:43:39 EDT 2016

Askar,

Thank you for your submission. Your signature is queued for FP testing.

On Tue, Aug 2, 2016 at 12:45 PM, Askar Dyussekeyev <dyussekeyev at yandex.kz>
wrote:

>
> Win.Trojan.Fosniw:1:1198:558BEC5151568B750856E8????????8365F8005985C07E6D53578D7E018D70FFD1EE460FBE47FF50E8????????8AD80FBE0750E8????????8845FF0FB6C350E8????????83C40C85C0740580C3A9EB0380C3D00FB645FF50E8????????5985C074068045FFA9EB048045FFD08B4DF88B450CC0E3040A5DFFFF45F847474E881C0175A05F5B8B45F85EC9C3
>
> signature looks for specific block of code.
>
> detections (89):
> 02b48828a41a4a8693138fb805d70cf8
> 0d179bd3b4ea942e2c3c9f65a105d9e3
> 0ed2513e07785d1f1eadb6016bba70ee
> 10a6daab38c0c741a2132f5795f0f46b
> 14164a9f0ed40be47457135ec0088974
> 17f7de068c821d4c7753d87a771b8584
> 1b6b2b703c2c5353945571fbde81c211
> 1dcd375935d425bf4a679b109f5c4520
> ................................
> f502edd5a47974e5718019645616519a
> f77af56bba982d31cba5ce3756f1c4aa
> f908100293f36f826dbf3c28f86f1bbb
> f9933118c1e82b6c734c3417ce31c4d0
> f9d456fa9b07e475dc1d5882b2147a95
> fb58014706e439b6a1b0dd41b8814bd7
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>

-- 
Christopher Marczewski
Research Engineer
Talos Group
cmarczewski at sourcefire.com
Phone: 443.430.7118