[Community-sigs] Win.Trojan.Hicrazyk
Andrea Allievi
aallievi at sourcefire.com
Mon Jan 11 12:03:44 EST 2016
Hi Arnaud!
Thanks very much for your submission.
We are doing the standard False Positive tests for the signature you have
sent to us. If all goes fine, we will publish it soon.
We really appreciate your contribution.
Thanks again,
Andrea
On Thu, Jan 7, 2016 at 4:26 PM, Arnaud Jacques / SecuriteInfo.com <
webmaster at securiteinfo.com> wrote:
> Hello sigmakers,
>
>
> Win.Trojan.Hicrazyk:0:*:3436250034307500307834303030303030307c307831303030303030307c307830343030303030307c307830303031303030307c307830303030303030307c307830303030304330307c307830303030303030337c3078303030303230303000425554544f4e*53686f72744375740055524c0049434f55524c*646f776e6c6f61645f717569657400436d640022
>
> I named it "Win.Trojan.Hicrazyk" because Clamav have signatures from this
> name. But it is not a trojan, it is a downloader.
>
> Filte type is 0 because it is not an exe file. I suspect this is a part of
> installer.
>
> Number of samples detected by the signature : 4663
>
> MD5 of detected samples (just a few) :
>
> 0561894ce912afad635e6c1799b45cf2
> 1b7174a943a82aec52690602d17ed5a2
> 840696070e83141ec0ae19ae08e5e06f
> 1d311b2d10de7503443f0a13e9e13eef
> 8aa51c43c345715b8b66be1a6ccfd5fa
> 5f006611909b3b94c0bd79e30e70b283
> 53fd775cdfaddc38c8b75cd0f9500228
> aba52f6a4d0ea03d9ad42b80bc43820e
> e98a97fd7db74b4bf75c5c57d9c0c9f9
> 0ff926738e2071cd751e76aa299cfb1b
> 42a21cd561cfbb7498f4daaf6114f3e4
> 6a6f07f9dcfb74ffa2e07fd6d80cb2b6
> 7ef5828e3f7f4352953f17bb4dbae426
> 9eb2c179cd0bf863c3023401bf90a7fb
> c94114b10a4ae987389a0c4b4f45f826
> e5c2c1bcfa2a922a8d3240747c68e7b3
> 5a1e218420f269564967e3f11017c9f1
> 63c44080e67c71ee913a7d9bdf438054
> 2292c38908276c36876efcc4f8dcf760
> b839d6c7def3b2594767e559e31c5a27
> 0186cb6e240e674e1e7edb1e3aa499ee
> 8be7525c59dc3f364e28be23e4ae0cb5
> 1fe7d089a3c5fd02769087a85d720e0a
> 36a1aae250917d98d6c6764d1f0a787e
> a9dee0886e0abaf174adeb7c49318623
> 6f19355c5c0539e441b0bd64a84a1149
> b0d25107298b338ceb7dad89b8c02454
> 282143651d08af2b3b407818f6bb9be0
> 5e9f2ed077b75da0f4ea9aa11c4f6ac7
> bfbcec41439bf55b6b9fc631ea6ac79d
> 3c03aacadfb6ba260b9295be3969fdc4
> 70f28d849ab620ef0fda7c1f54c7fffb
> 10af9f47375d659bf56010812bbbf312
> 518f37f02a33f109b0a87caa181d16c0
> da30545e095666c9cef25ed7e1a1a486
> b49e8362413759264e44a281ac660259
> 5de0eae79b13fece19dbe8379c91ed1e
> 97683478fe091d56e7cca6cea0df8597
> d65d2b20948e12d1cf8e154f50728590
> 2e1cd740605b91fcd01c6326971bf92c
> 391c427f727bb188a666861fcad10304
> 706933ad2833f33552a43726bc1e4cfc
> 23fe9271feaf6da6ef21b12663a55b69
> 96fd661044dbb9b7f3df4a7cdfe766fe
> 6c6986e44f91d8f264047e9d68192e23
> c87baa42782c994062447751688147e9
> 9551a0659f302ad39d2672c31c144c01
> 207c98c35023c3e8040ab40bc37b4b1d
> 45b4b9dcff0b90229c1b63c71d085c26
> bdd0b0685c65ca4fd44793d50498df24
> 3450dd1c8705d9bbb6a296378d595cab
> b7320cb13b2a8b268fae813554143720
> 263ba98f4e33ca156e943c0fc8887392
> 81d3da9bf615ea4c81c1fb2fba10053d
> 8fad3a1123370add5e5a95ff94354376
> d03bb630d22518d28993237c9a856a93
> 46b78ed8e788e7a720cc585f336a06f4
> 8b9b7af3bbaea22603d4b5930aa499f4
> 4fe828373b33cbcfb18d8e45d74625ec
> 9bbf4272deb87e59c59bc0cfb5170797
> 3dbeb13617449804495de8162e9f0496
> d9d5c3e351dfe6f1e17ea06276d40d2e
> f6756c97cc144c89545ab62c10c953a1
> 3bc3b41298609258346d97bce69a88b9
> 83331ec8ab484cc05f80c44f40570982
> c5f4ccb0c9d49ec4f82871b462990fdd
> 91fe3a65db0c5ee973d6ab5eb9d19a9e
> 22e24c7ab6b56c05de950de138041790
> 2ced52a129f98965c15f684482001004
> c9e09ce29945fa62ec31316b28c46e05
> 1a564c39cddb1f481ab0d22805819912
> 8da7b43111ccfaba98d41a9e5d7ad0d5
> 7043daba3c9299fbca9f0bad8d64aef5
> 35a3c94bb9991763ca224fcef6414a1d
> 92cc653ca95ca40ebd7bd00574f8859c
> 23c5596ab538c860286cc4045a47d9cb
> 32abdbe1ba40a4a66fa46aff1db60aa2
> c7fcfdabd9d13e30c3281f7cfb39456d
> 80b7d1da19ba3c824d8d95c66c82ae4f
> 20147fed8b7567b113f51f0940220cc2
> 53b4a80c967b483803f1d06ba676dbfc
> a3bc8d2a281362cfb65b0ef5d19fe1dc
> 8b4f9d3a311a3fa8f84e4d5615b95889
> 3685dc6336eb3e3727069746ece921cd
> f620a59107f8cc45cc24746f7c4b8072
> a847636407fc22b9b8672327ede2274b
> 767c875c80590c725362f539aca7af72
> 76012bef3c77e371628db4bf4b1fa290
> c219afd77c194e07dd4a78120b6bd936
> d069d43e5461410075460f5d558d0e7b
> b1d6d3281ea8afebdc03ce2f4490f85b
> 2233ed005f976b183f09fc2aeb8c4c46
> 023f85de75b92cd5604ed7afacd3e5de
> 7612d83b206f00647c2fe65fac59e524
> a0b08cd5aa602fa80ed2d3ad5543cb55
> 5a450f3422fe8cff161af86a563eeae1
> 259c1ec0f331794d9dda75471dc27d3c
> 939c64efd1241ee8ea7da8d385de2b4e
> 6e7a52ed7b84f1b6d35eca045bd59a27
> 7cd25d8421a5983fa0ec0fd42499d747
> f37f09238d2662027626814c522e5188
> 2d51e0c55897e19c4f70b3017219f283
> 38cf1a3234d2ab3515329a660f7a6199
> 531e1155003408fb8bb4c4c7556f0fa7
> cf94830bb806ab3b047ef79889853c07
> c337fa798a6f17aaddc0995ab33f6a71
> a904789a462444a701e9c97bffdb93d6
> 43a269018ec6815ae6f4e17663d1165c
> 9b135e6c2c3e7e4db66081e178067b07
> a4a06b9294a882e075f47e762ee1ee00
> 7db38e63c94a99fe81f0a2e597032aea
> 1a33db1f834ec71bbf3e9d1ab78927d3
> 5c7b352ef3a67785254256b14aff9d4b
> 4dae073b38ad00f9b6118234b1c2f252
> b779a6836a4af6d211906fee355ceeb8
> d1e44016a542e038647dc1957809f3b2
> ea5035694fedeae7fdae888a803cd8cd
> 6c91fc6c28a33f3d69a616dfafdd614f
> 5d6a87b8140aa9bfc1acf723e25651bb
> 79a7242c83d963094075ab6397386995
> 357e5d6301eac65751ef9c8b1e14c1f1
> daae18e5d4550f2c9a985d3af37af32a
> d17166ca796667faa193f2d6a94dd5ca
> 1e31069f6b8c3f537fd26e3169243eb6
> 7cd02f57709951f41d5cdf9d664dea53
> 468123ad79283bda26eb1c6c0e7098f8
> 486e79d156a4224765c778f4a912e1a5
> 777084eed8b433dfc8c0f0078cfe4bfe
> 3e4085f6572d1d42018cd550ef8625fa
> a6b0478feb9ad278f35d733a0917e1c3
> 59fcaf9ac9f2fd33e48071dead5aca33
> 17f414b0b7c6cae1a53e7ce45e7bb0f1
> f1ab9602a7ea05f0160a569819bc628d
> 7dcae2298426b86148f50d0ea1bb9c6d
> 538b5d290026107279d18e3550d45e42
> 7335f6da7822f6bbd868e09e2173e62e
> 5991e9b7b508afacb9c32f96903cdce6
> 99b06356d710400dafa8ef92242a6a67
> 5e7244993733348b3e909c47834c21c0
> ebb79672d08a9c5812195bde410908bb
> 86d5a645a6192ea338ecd1c49da8052a
> 9bde6d9e1a7ff0ef0d35cb745d2a5d71
> 1d2a6b655a201e5775dd3834d08d5d1a
> 7adcaf6be3459f33c09ffebce0d7da1c
> 83b41b1184f7ffca21f02b0e52393445
> 01212d366647111dacbe20e634ec77d0
> 3b11135001f3c9f3924741fbf3a86888
> eb49037638c1c9cfc0aedb873cf4b554
> 40fb3a4e9d49c04c9085fb3ecd76b61a
> 6e4eab4ff8c0111f8c9b75a365868269
> 5a8edd6aa268d4c03408c1bd1ffcf4f2
> 069e3fff3cb6a2dd3da28435c0adcf60
> 0b3f53d3682f5967f0b223295b4a828d
> 0f53fa435f826cf33e9e8baacc4c65e3
> 778a26e93a5ff8fd0c2f48546009e54c
> 323e235ab746d62b0b01ac6549e230ec
> 19a78d070812c8d6c02fbae015d552de
> 504414d04c88b0824d13a25b8aa2fda3
> dd8d1ac5466c9f0b4d314bac2b4d7257
> 2be23c26989bd081ad332d9ade5864ee
> c2cfdef699fbf14b93530fda57f752aa
> f8ce16d104d8493ba86bd090b3ba4e21
> 03b0282ea788b15cbe44b814a8a624b2
> d4f1adeec40aca960ee526854267e208
> 8b2535d11bb35054f5adf41fa59eba4c
> 5474bd808e0a8caf58c59952461d7c74
> 97261074cd2c0a840b8fd87964ded4cf
> 6894f4087c0a09a1bee28e1d41fbbe95
> f357726ed23fe3be960bc3d65c176af9
> abf4e389bf3c9e1b79d561dcd5c7f7e3
> f88ff6943be75351ebeed4729d377bed
> 3c21d00260d934c92c0d6dbbbcea358e
> 47220ff914c8daaaba7a8c520c41fb0c
> ffedbeed629a7b602e2aa4f887f48397
> 27f6c9cfaeb72735736dbc50af8de062
> 3c399c42d2bb6a8b372016504a9b639d
> 9214b0d01fa7334ef4b835e5bdb7946a
> e32ae0ffbf108a50b051b33949e08f84
> 7e8d82c7db5f8c983fdc1e5c833accc6
> aadc902980d1357e37b5cc539d0b16da
> dba4f0377708d22321aaa2d1df490a07
> 82ffd7a471f399889c830d0b06fdd0a7
> 18582103f783d890f14d112e512f2ca1
> 83db3edd1c80da76fc9c5dafeed084c2
> 02a89e9f1f5336448fc242edffa8af6b
> 3d37909b1860d39dbf5877c155aefc1c
> d87c297db0a6995ed5872e7c0970517a
> 64c3cb145474112c29e9237890c17308
> 0f8788b1d97221eb91889e4dd243346a
> 13e7d192d68fd2b5b7b9caea9ccab955
> 2bd6652804ee78bf36692e01ed90d934
> b5a101d8607b5002f21652e9c97ab986
> 7c3623fbdaa6a625c77d83281527ee4b
> a01194364cd2cb5c9e1ce57c6944f9da
> ec7341a373c92ff20f5a5e52e0acce44
> b217c878a3e318d6bf7b1ac04bd70512
> 9f5f72682f1fbe51ebb3299753b3f664
> 042f895c62a93316c79799612f8cae01
> 102e229ccfb79bfb309ad88297283873
> 883361788e1d1fed0a07c6bf967de4b0
> 356c2a1eabdc31ffd0885ecaa9f71b76
> 6e8f3454bda1d1fdff2f359217150b6e
> eee70272562678e2add60ada5a17b9ce
> 9bf2b5c2584a8b1bc3f550384df65e88
> 15f68687e0d2519e47014b0a50e7100e
> 9c56c885b27d075839fb6b9b928f5569
> ba5c71fb82043f4c776d3af6132d6f49
> 43006bdc7721e8dea8ab3c8bc1fa63b8
> 127aa87b5abc753e91708fe1b528b750
> c20388fce4f2aed40f7c21ce75442d1d
> a5abd92b55ce5a6ec65e8451f15cd67e
> c50c62efc5e77598e10fb05454d214d7
> b902f71cac150d46b49ee13126a718cb
> c41ced20fed5bcdcaf2069ddc24470cc
> ea183079ade6835de8252a2103a39714
> 10167b72804537cc0aa1738ee0e458b5
> e7621e53111e89fff86e7c5cb4bfd726
> bd05ee1c2b901c11f7e061cbed8a5d17
> 7f375e8bfe2a9a156f3be019f841bdfb
> 6c0d7f40faed7cc607f11e7934916d7b
> 582e8eb2fe8b4fc23cef7d1f24697067
> e29adba1bdb23e497e8e02d3989594da
> ccfbc9b83963809fa89b97d76072893e
> 48106155b8a30cd1d83cda0663bba8b1
> dd55ace7152355a7c6116512010c7113
> 06062a76a1ece84bb4d1ef949961c962
> 4f2d8d04e4aa9d836b569c04bb1c9eb7
> 1799571a72649284235f34da26fe7754
> 1f674457687fad1c5afa5c22794537e8
> 234cbd30382ebeed4a39339960dff227
> 598fee18ae4030691050eccdabd2a602
> 59432d244cf59fa3847392430156f43a
> 49e4982006c1b167226b3909d790b655
> 71037db67a259ae44f37b069d7e35c7e
> 2d1600590775332d74aaf1c752dfb84b
> 76cf8d29515e29d210f829094ce0673b
> 859f8f339df336b729ac741d16481430
> 2c6a45bf0a893ecac0144ee0c7497d39
> d7db4012ebac8a06e7bd345d8507ef49
> d023691a4285cdab8983560f03c1bec1
> 199135c02a8692eced2d06b3aeb3f53c
> a3ed735179b76a2b4786c443679fdcb0
> 182a1b399ae83622a7d83111f95cafb4
> e098a792a8b6519dbaaf3cd13c4a8e32
> f2e79c0f752b41dc863a43be3ef06ed4
> 104ac40951b43f155711374d13bb67eb
> 1a53939ec81264d6a57e8e68d1374cde
> c499ad261aaeb97182ea7f31632076b9
> 64d7c19c02d44998ed5f6d9f53514933
> faeb166d05e5e56368265d88f3ebdb7f
> 21fa664d4e1a6ea8c8b01c6eb000b283
> 3b9187b18b13026cb44dc7c9c5ea8e06
> a36c21d5ad80e40a362f3b27a196f203
> 794f97bb505c1f2069b12a609599088e
> 69e12e75514bfc95c8a7059586e2e934
> 57c465d18e0cef2f3aa97cdd9b466cd8
> baed4798ae259135d9f939b4af87c92f
>
> --
> Best regards,
>
> Arnaud Jacques
> SecuriteInfo.com
>
> Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
> Twitter : @SecuriteInfoCom
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>
--
Andrea Allievi
aallievi at sourcefire.com
Security Research Engineer
TALOS Security Intelligence and Research Group
Cisco Systems Inc.
More information about the Community-sigs
mailing list