[Community-sigs] Win.Trojan.Ransom

Tue Jul 26 13:08:02 EDT 2016

Win.Trojan.Ransom:1:4848:C745CC04000000C745C400000000C745C800000000C745FC00100000C745F8000000008B45D4D1E08945D48B4D08894DC48B55D4D1E28955D4FF75D4BBFD3B0000B95806000081C1A80900005153B9000000008B5DC4516AFFFFD38945F8C745D4C9000000

signature looks for specific block of code

detections:
004346527b3e15893f69e5b791e533c0
10f7b384c0300e48969379ecacbe0456
187b821e1c2207acf058401497b54520
1d1f7dab118c901cc2c0979ff0ec8a50
1e1895797adfc21600821d75f2a940f0
23aa838c4169f10d19d180d29bb7d990
257e7038285dcbea7e2ecc3597900600
2bddbfc1a6d05d1bbd92b4891bea4db0
2c4141455a8db0af0e3db725d8c532d0
30b9a1ad764e291f72537cb1a2a4a8b7
3231e354d275ec4f1f33d97626eb9db0
3856631441d08aa5cc02f9d318ab8ba0
394af62fa87c31f3eef7834f30c6cee0
3c85298fa40b662b3a25d47e2a6e6160
3e72ba394c2c6753c59be7cf46041427
46e4e10316d27507dc5b6327e9cde6a0
4889509c90d2e76da308e6172c6765e0
56166c5c789aa2621fe3550bc158ffa0
597f736c285b82e09bb68c6a0e1e4ce0
61259a712f20c4ffe32211512207e7d0
64b5893306cd9c500727122b685185e0
65de6e3ca3a466cd1b493daddea461cd
66c4983b1720f89a12cb5a348a8bd0f0
67d3c3752fb62c33346e2c0b1c97d9d0
7627ae45a476aa5c61a3aff9f78f5f40
77e78c034e7a83fbbba3259ab3b9cc50
7d8fa77c1ae767767d2be901ec16f72f
817e52bc67cb82b9bb4af9fdb4eee7ad
83d252fb9924e89b24f2fb861591c85f
937cc8a31f9af1d100fb365bf8b35040
96fe33caa7c173b729a353fc4a10c4b0
9e722a7ac94cdd8515ba379e8f1f8f48
9fc996d947cb2a7b11d2164b785373a0
a4ede28a2a1bf13e397931ff44e68e70
a5f2e9e3a5a815f1687be1ab11243711
b27a6b4ecb676ca5655daefa6345cd90
b7f35a9587a591e0207ccb9ab7997e40
bfd1a7026b6d87796ab1d43a265408b0
c26c4f9182ab275917f807e3a95c8b02
ca6eba3b8a8c9fcd0a885b1b2caa49e0
ce042e88ae703f186d3c649b00803240
d145a5aa2709bf6e2fc15fd82205e4f0
d30e7351fa4ce8c60a756c330e33fd5a
e1509a5ab2c4b998ae06f2df97e499b0
e2d1db5d6fb95620d5afb399461aa0b0
ee2272af249d12a0bb5e5de6cdc971f0
eece88b6294ab2c927c59ff381f93518
f4286e3e334f973e6bb3d64454273cc0
f4aaba587f0c67d6f763a4db66c45170
fa9bff3c571774b3a61f8f0326d94bd0
ff672ceca79b3dc9ea47309569eb2d00