[Community-sigs] Win.Agent.Zbot
Askar Dyussekeyev
dyussekeyev at yandex.kz
Fri Jul 22 12:37:38 EDT 2016
Win.Agent.Zbot:1:EP+0:558BEC81EC2C010000535657C745F800000000C745F4????????892D????????C785E4FEFFFF????????C785D4FEFFFF????????C785E0FEFFFF????????6A006A00FF15????????68040100008D85E8FEFFFF50FF15????????8B8DE0FEFFFF518D95E8FEFFFF52FF15????????68????????68????????FF15????????50FF15????????8985DCFEFFFF6A0068800000006A036A006A036A018D85E8FEFFFF50FF95DCFEFFFF8985D8FEFFFF83BDD8FEFFFFFF740983BDD8FEFFFF00
signature looks for specific block of code at EP
detestions:
000a3ea381d7d70be8b6fe1ee51dca22
0146239b75060a85aad6fa8f41d5775f
1bc4c02c7129f8ffdbb4b3b9c8b5f7c0
42702f6b7f2483569de1c4cf80e84621
81def92207eb5591571379169f7bae90
8f3d169a8741338142924e600084ff30
9bca2a5b27cc90bddb1f3f9ebf09d696
9fd345bc63dda1943ff85627ab676c7c
c098b29e139056836b22c6ca30ed3d12
More information about the Community-sigs
mailing list