[Community-sigs] Win.Trojan.Agent

[Christopher Marczewski]

Askar,

Thank you for your submission. Your signature has been queued for FP
testing.

On Wed, Aug 10, 2016 at 1:51 PM, Askar Dyussekeyev <dyussekeyev at yandex.kz>
wrote:

> Win.Trojan.Agent:1:5449:470FBE0709C0740583F82275F3803F
> 007406897DF447EB2D897DF4EB28803F00742189FBEB01470FBE0709C074
> 0583F82075F3803F007406897DF447EB07897DF4EB0231F68B45F88B55FC
> 39107506837D0800750E09F67403FF45FC31DB803F00758B837D08007505
> 8B45FCEB1F09DB74138B45088B55F429DA89108B45F8FF0089D8EB088B45
> 0883200089F85F5E5BC9C20400
>
> signature looks for specific block of code
>
> detections (68):
> 089b61f6b06ae23b0c73450856e4dcd1
> 093bb6db492643dce894c229010b65a3
> 0c7fc6fc7d4045006da5d2c4a1d7843e
> 1079b2e34aa5a983bbccd600fded66e9
> 10a807778512cd6fdf915be1b5e52162
> 11b0bd140ee891d29a227157e628b5a1
> 13b308241b099bad464bfff0b67c7871
> 143bf8db6c24bb34331a07fc659650ab
> 147b7b1ba14eefffb0789409f515e20e
> 19e8a1ad489d95182a2fe97d1f797237
> 253afd917555f77e4a9590ec1fb2f4a5
> 28522f8afb7aad8cd5846129ee91e4b1
> 2ea91ae77e75543ae6eef8a3966998f2
> 2efaa665952b7d6301897e8c3f18b796
> 3ae0a656ce4d48d004f2d972727303e0
> 417a63a62a62141190a3ecb79881b650
> 44493a917cc58b73a83334e3aec21a7b
> 4777c545679b5c04c98ca1584ea99556
> 47d5888e83808a5a5665150d6afd81a5
> 4862514e7272f608afab9e7967d2554d
> 4cf8761eb4151430edd3253480a5cc6c
> 4d010e7edb8bd736e0afc8e4ff36d070
> 4ea97c3fd0f18093f318f219ebef424a
> 54060fe923f5e00b092270176d10facc
> 5753f63d06b097b11359972e9076e3b4
> 5afd48ff19e21d416ccb23467da7739b
> 5b0afca46118050a7dac9ccf8dbd4a95
> 5e4a85333ffb426707c4c60458f65295
> 624e4b1a255bbd768df6768b1db19e1f
> 6694482b7b27ead883c7b631cfef99d7
> 671c4dedd0f914cc26b71f81295fb835
> 71131a80406152c52c0a01e710d420f0
> 7177c3f7cedab3af6c301cc23b3871f6
> 75b356d361972a67292aa95e47a4ea95
> 7aa183a5c39753e82314def2237a0018
> 8718a9c4fc0a1ed3ec288d060b56b16f
> 914e4b4b4fa7b8f374c4eb746e0077ce
> 98bb95ceb93c7ee9f92529defb8da44a
> 9b76177193a995913e3ca50399b1f985
> 9d4cdc4fc6d8ebf711a3710fc8e3a1dc
> a5441defe381f2575158cef788223d57
> a8f1cee1c7b6ebb3b7e25249ff76e0f5
> a9361c0078994a8e381cb8352320376b
> ab6b4da97f1e00325b9ce23683a7f711
> aeb2534fc447764da7d61f06788d23b3
> af094564305055c7173be3fc9b5271c2
> af2e92c333362b5b1caf12589b40972a
> b0961a165dff150551eefd4241e73165
> b16a7cd372ae7a902a5672f15f9b4ae7
> b517b6f2cd60332fcd8790ae9970a542
> b6c7c45c5576091930f95f88bd2db0ab
> b9abaffafa4e4bbffe15c8259821037c
> bb3f24ff12f7819907235588d4142269
> bb6b85c79818b8ebe4f6ac067d9dc4bd
> be97444ce8d1510c45e995d161c60ed9
> be9d114222b0378daf63173f292ba39b
> cf04a5dc1e853c29d0d8e05a86159b23
> d6ffa95928d5bc01d524fadd8467ab3f
> dbfa86a767d53d3fc780d632462457b0
> de5e21fa27349b57512810c9f619c17c
> e028e747c5c058da5ebcf67bc139c21d
> e875e6574dd0203733417311596e30b8
> ebc2e39499080d1bcfe0025c590bcc83
> efc164d2bfe35d55d95e5bffdc2712a4
> f872e82151bf91c92ff1b99a1e70f2bf
> f8aa249a1468d1c1a24c7161d72eda33
> f8f54e94162ffc457f39269036ce01cd
> fb65cf483418810fb661793140484420
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>



-- 
Christopher Marczewski
Research Engineer
Talos Group
cmarczewski at sourcefire.com
Phone: 443.430.7118