[Community-sigs] Win.Trojan.Hicrazyk
Arnaud Jacques / SecuriteInfo.com
webmaster at securiteinfo.com
Thu Jan 7 10:26:14 EST 2016
Hello sigmakers,
Win.Trojan.Hicrazyk:0:*:3436250034307500307834303030303030307c307831303030303030307c307830343030303030307c307830303031303030307c307830303030303030307c307830303030304330307c307830303030303030337c3078303030303230303000425554544f4e*53686f72744375740055524c0049434f55524c*646f776e6c6f61645f717569657400436d640022
I named it "Win.Trojan.Hicrazyk" because Clamav have signatures from this
name. But it is not a trojan, it is a downloader.
Filte type is 0 because it is not an exe file. I suspect this is a part of
installer.
Number of samples detected by the signature : 4663
MD5 of detected samples (just a few) :
0561894ce912afad635e6c1799b45cf2
1b7174a943a82aec52690602d17ed5a2
840696070e83141ec0ae19ae08e5e06f
1d311b2d10de7503443f0a13e9e13eef
8aa51c43c345715b8b66be1a6ccfd5fa
5f006611909b3b94c0bd79e30e70b283
53fd775cdfaddc38c8b75cd0f9500228
aba52f6a4d0ea03d9ad42b80bc43820e
e98a97fd7db74b4bf75c5c57d9c0c9f9
0ff926738e2071cd751e76aa299cfb1b
42a21cd561cfbb7498f4daaf6114f3e4
6a6f07f9dcfb74ffa2e07fd6d80cb2b6
7ef5828e3f7f4352953f17bb4dbae426
9eb2c179cd0bf863c3023401bf90a7fb
c94114b10a4ae987389a0c4b4f45f826
e5c2c1bcfa2a922a8d3240747c68e7b3
5a1e218420f269564967e3f11017c9f1
63c44080e67c71ee913a7d9bdf438054
2292c38908276c36876efcc4f8dcf760
b839d6c7def3b2594767e559e31c5a27
0186cb6e240e674e1e7edb1e3aa499ee
8be7525c59dc3f364e28be23e4ae0cb5
1fe7d089a3c5fd02769087a85d720e0a
36a1aae250917d98d6c6764d1f0a787e
a9dee0886e0abaf174adeb7c49318623
6f19355c5c0539e441b0bd64a84a1149
b0d25107298b338ceb7dad89b8c02454
282143651d08af2b3b407818f6bb9be0
5e9f2ed077b75da0f4ea9aa11c4f6ac7
bfbcec41439bf55b6b9fc631ea6ac79d
3c03aacadfb6ba260b9295be3969fdc4
70f28d849ab620ef0fda7c1f54c7fffb
10af9f47375d659bf56010812bbbf312
518f37f02a33f109b0a87caa181d16c0
da30545e095666c9cef25ed7e1a1a486
b49e8362413759264e44a281ac660259
5de0eae79b13fece19dbe8379c91ed1e
97683478fe091d56e7cca6cea0df8597
d65d2b20948e12d1cf8e154f50728590
2e1cd740605b91fcd01c6326971bf92c
391c427f727bb188a666861fcad10304
706933ad2833f33552a43726bc1e4cfc
23fe9271feaf6da6ef21b12663a55b69
96fd661044dbb9b7f3df4a7cdfe766fe
6c6986e44f91d8f264047e9d68192e23
c87baa42782c994062447751688147e9
9551a0659f302ad39d2672c31c144c01
207c98c35023c3e8040ab40bc37b4b1d
45b4b9dcff0b90229c1b63c71d085c26
bdd0b0685c65ca4fd44793d50498df24
3450dd1c8705d9bbb6a296378d595cab
b7320cb13b2a8b268fae813554143720
263ba98f4e33ca156e943c0fc8887392
81d3da9bf615ea4c81c1fb2fba10053d
8fad3a1123370add5e5a95ff94354376
d03bb630d22518d28993237c9a856a93
46b78ed8e788e7a720cc585f336a06f4
8b9b7af3bbaea22603d4b5930aa499f4
4fe828373b33cbcfb18d8e45d74625ec
9bbf4272deb87e59c59bc0cfb5170797
3dbeb13617449804495de8162e9f0496
d9d5c3e351dfe6f1e17ea06276d40d2e
f6756c97cc144c89545ab62c10c953a1
3bc3b41298609258346d97bce69a88b9
83331ec8ab484cc05f80c44f40570982
c5f4ccb0c9d49ec4f82871b462990fdd
91fe3a65db0c5ee973d6ab5eb9d19a9e
22e24c7ab6b56c05de950de138041790
2ced52a129f98965c15f684482001004
c9e09ce29945fa62ec31316b28c46e05
1a564c39cddb1f481ab0d22805819912
8da7b43111ccfaba98d41a9e5d7ad0d5
7043daba3c9299fbca9f0bad8d64aef5
35a3c94bb9991763ca224fcef6414a1d
92cc653ca95ca40ebd7bd00574f8859c
23c5596ab538c860286cc4045a47d9cb
32abdbe1ba40a4a66fa46aff1db60aa2
c7fcfdabd9d13e30c3281f7cfb39456d
80b7d1da19ba3c824d8d95c66c82ae4f
20147fed8b7567b113f51f0940220cc2
53b4a80c967b483803f1d06ba676dbfc
a3bc8d2a281362cfb65b0ef5d19fe1dc
8b4f9d3a311a3fa8f84e4d5615b95889
3685dc6336eb3e3727069746ece921cd
f620a59107f8cc45cc24746f7c4b8072
a847636407fc22b9b8672327ede2274b
767c875c80590c725362f539aca7af72
76012bef3c77e371628db4bf4b1fa290
c219afd77c194e07dd4a78120b6bd936
d069d43e5461410075460f5d558d0e7b
b1d6d3281ea8afebdc03ce2f4490f85b
2233ed005f976b183f09fc2aeb8c4c46
023f85de75b92cd5604ed7afacd3e5de
7612d83b206f00647c2fe65fac59e524
a0b08cd5aa602fa80ed2d3ad5543cb55
5a450f3422fe8cff161af86a563eeae1
259c1ec0f331794d9dda75471dc27d3c
939c64efd1241ee8ea7da8d385de2b4e
6e7a52ed7b84f1b6d35eca045bd59a27
7cd25d8421a5983fa0ec0fd42499d747
f37f09238d2662027626814c522e5188
2d51e0c55897e19c4f70b3017219f283
38cf1a3234d2ab3515329a660f7a6199
531e1155003408fb8bb4c4c7556f0fa7
cf94830bb806ab3b047ef79889853c07
c337fa798a6f17aaddc0995ab33f6a71
a904789a462444a701e9c97bffdb93d6
43a269018ec6815ae6f4e17663d1165c
9b135e6c2c3e7e4db66081e178067b07
a4a06b9294a882e075f47e762ee1ee00
7db38e63c94a99fe81f0a2e597032aea
1a33db1f834ec71bbf3e9d1ab78927d3
5c7b352ef3a67785254256b14aff9d4b
4dae073b38ad00f9b6118234b1c2f252
b779a6836a4af6d211906fee355ceeb8
d1e44016a542e038647dc1957809f3b2
ea5035694fedeae7fdae888a803cd8cd
6c91fc6c28a33f3d69a616dfafdd614f
5d6a87b8140aa9bfc1acf723e25651bb
79a7242c83d963094075ab6397386995
357e5d6301eac65751ef9c8b1e14c1f1
daae18e5d4550f2c9a985d3af37af32a
d17166ca796667faa193f2d6a94dd5ca
1e31069f6b8c3f537fd26e3169243eb6
7cd02f57709951f41d5cdf9d664dea53
468123ad79283bda26eb1c6c0e7098f8
486e79d156a4224765c778f4a912e1a5
777084eed8b433dfc8c0f0078cfe4bfe
3e4085f6572d1d42018cd550ef8625fa
a6b0478feb9ad278f35d733a0917e1c3
59fcaf9ac9f2fd33e48071dead5aca33
17f414b0b7c6cae1a53e7ce45e7bb0f1
f1ab9602a7ea05f0160a569819bc628d
7dcae2298426b86148f50d0ea1bb9c6d
538b5d290026107279d18e3550d45e42
7335f6da7822f6bbd868e09e2173e62e
5991e9b7b508afacb9c32f96903cdce6
99b06356d710400dafa8ef92242a6a67
5e7244993733348b3e909c47834c21c0
ebb79672d08a9c5812195bde410908bb
86d5a645a6192ea338ecd1c49da8052a
9bde6d9e1a7ff0ef0d35cb745d2a5d71
1d2a6b655a201e5775dd3834d08d5d1a
7adcaf6be3459f33c09ffebce0d7da1c
83b41b1184f7ffca21f02b0e52393445
01212d366647111dacbe20e634ec77d0
3b11135001f3c9f3924741fbf3a86888
eb49037638c1c9cfc0aedb873cf4b554
40fb3a4e9d49c04c9085fb3ecd76b61a
6e4eab4ff8c0111f8c9b75a365868269
5a8edd6aa268d4c03408c1bd1ffcf4f2
069e3fff3cb6a2dd3da28435c0adcf60
0b3f53d3682f5967f0b223295b4a828d
0f53fa435f826cf33e9e8baacc4c65e3
778a26e93a5ff8fd0c2f48546009e54c
323e235ab746d62b0b01ac6549e230ec
19a78d070812c8d6c02fbae015d552de
504414d04c88b0824d13a25b8aa2fda3
dd8d1ac5466c9f0b4d314bac2b4d7257
2be23c26989bd081ad332d9ade5864ee
c2cfdef699fbf14b93530fda57f752aa
f8ce16d104d8493ba86bd090b3ba4e21
03b0282ea788b15cbe44b814a8a624b2
d4f1adeec40aca960ee526854267e208
8b2535d11bb35054f5adf41fa59eba4c
5474bd808e0a8caf58c59952461d7c74
97261074cd2c0a840b8fd87964ded4cf
6894f4087c0a09a1bee28e1d41fbbe95
f357726ed23fe3be960bc3d65c176af9
abf4e389bf3c9e1b79d561dcd5c7f7e3
f88ff6943be75351ebeed4729d377bed
3c21d00260d934c92c0d6dbbbcea358e
47220ff914c8daaaba7a8c520c41fb0c
ffedbeed629a7b602e2aa4f887f48397
27f6c9cfaeb72735736dbc50af8de062
3c399c42d2bb6a8b372016504a9b639d
9214b0d01fa7334ef4b835e5bdb7946a
e32ae0ffbf108a50b051b33949e08f84
7e8d82c7db5f8c983fdc1e5c833accc6
aadc902980d1357e37b5cc539d0b16da
dba4f0377708d22321aaa2d1df490a07
82ffd7a471f399889c830d0b06fdd0a7
18582103f783d890f14d112e512f2ca1
83db3edd1c80da76fc9c5dafeed084c2
02a89e9f1f5336448fc242edffa8af6b
3d37909b1860d39dbf5877c155aefc1c
d87c297db0a6995ed5872e7c0970517a
64c3cb145474112c29e9237890c17308
0f8788b1d97221eb91889e4dd243346a
13e7d192d68fd2b5b7b9caea9ccab955
2bd6652804ee78bf36692e01ed90d934
b5a101d8607b5002f21652e9c97ab986
7c3623fbdaa6a625c77d83281527ee4b
a01194364cd2cb5c9e1ce57c6944f9da
ec7341a373c92ff20f5a5e52e0acce44
b217c878a3e318d6bf7b1ac04bd70512
9f5f72682f1fbe51ebb3299753b3f664
042f895c62a93316c79799612f8cae01
102e229ccfb79bfb309ad88297283873
883361788e1d1fed0a07c6bf967de4b0
356c2a1eabdc31ffd0885ecaa9f71b76
6e8f3454bda1d1fdff2f359217150b6e
eee70272562678e2add60ada5a17b9ce
9bf2b5c2584a8b1bc3f550384df65e88
15f68687e0d2519e47014b0a50e7100e
9c56c885b27d075839fb6b9b928f5569
ba5c71fb82043f4c776d3af6132d6f49
43006bdc7721e8dea8ab3c8bc1fa63b8
127aa87b5abc753e91708fe1b528b750
c20388fce4f2aed40f7c21ce75442d1d
a5abd92b55ce5a6ec65e8451f15cd67e
c50c62efc5e77598e10fb05454d214d7
b902f71cac150d46b49ee13126a718cb
c41ced20fed5bcdcaf2069ddc24470cc
ea183079ade6835de8252a2103a39714
10167b72804537cc0aa1738ee0e458b5
e7621e53111e89fff86e7c5cb4bfd726
bd05ee1c2b901c11f7e061cbed8a5d17
7f375e8bfe2a9a156f3be019f841bdfb
6c0d7f40faed7cc607f11e7934916d7b
582e8eb2fe8b4fc23cef7d1f24697067
e29adba1bdb23e497e8e02d3989594da
ccfbc9b83963809fa89b97d76072893e
48106155b8a30cd1d83cda0663bba8b1
dd55ace7152355a7c6116512010c7113
06062a76a1ece84bb4d1ef949961c962
4f2d8d04e4aa9d836b569c04bb1c9eb7
1799571a72649284235f34da26fe7754
1f674457687fad1c5afa5c22794537e8
234cbd30382ebeed4a39339960dff227
598fee18ae4030691050eccdabd2a602
59432d244cf59fa3847392430156f43a
49e4982006c1b167226b3909d790b655
71037db67a259ae44f37b069d7e35c7e
2d1600590775332d74aaf1c752dfb84b
76cf8d29515e29d210f829094ce0673b
859f8f339df336b729ac741d16481430
2c6a45bf0a893ecac0144ee0c7497d39
d7db4012ebac8a06e7bd345d8507ef49
d023691a4285cdab8983560f03c1bec1
199135c02a8692eced2d06b3aeb3f53c
a3ed735179b76a2b4786c443679fdcb0
182a1b399ae83622a7d83111f95cafb4
e098a792a8b6519dbaaf3cd13c4a8e32
f2e79c0f752b41dc863a43be3ef06ed4
104ac40951b43f155711374d13bb67eb
1a53939ec81264d6a57e8e68d1374cde
c499ad261aaeb97182ea7f31632076b9
64d7c19c02d44998ed5f6d9f53514933
faeb166d05e5e56368265d88f3ebdb7f
21fa664d4e1a6ea8c8b01c6eb000b283
3b9187b18b13026cb44dc7c9c5ea8e06
a36c21d5ad80e40a362f3b27a196f203
794f97bb505c1f2069b12a609599088e
69e12e75514bfc95c8a7059586e2e934
57c465d18e0cef2f3aa97cdd9b466cd8
baed4798ae259135d9f939b4af87c92f
--
Best regards,
Arnaud Jacques
SecuriteInfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom
More information about the Community-sigs
mailing list