[Community-sigs] Win.Agent.Zbot
Askar Dyussekeyev
dyussekeyev at yandex.kz
Tue Jul 26 13:52:29 EDT 2016
Win.Agent.Zbot:1:EP+0:558BEC8BC98BC98BCD8BC98BC9890D5CC44000E8080000005DC3CCCCCCCCCCCC558BEC83EC60535657C745FC00000000C745A404000000C745BC00000080C745A819000200A1181040008945C8C745E46A000000C745D08B000000C745E8FF000000C745CC5500000060C745F400000000C745FC00000000C745DC00000000C745B064000000C745EC180000008B0D00104000894DD48D55D8526A016A00680CC040006800000080FF55D485C0740733C0E9D7010000
signature looks for specific block of code
detections:
045f83c00825692e39844ee71287b2b9
04d05222c71b603741d873df35fb1a21
0ab09d5967a485818d5cc9a83c76b478
0be0456ab9620a31c6da20641347d0e4
32058681610f4f746607e1be3beefc59
4017188db6eb103761307b5bc02280e6
697c0ae745664225721055a340ce4024
6edd3d598000a5036c45c2e039d8f316
97c35cb766bbb3d454b3e6251792e840
b0cf0f9e3750c764f1b9e8946a91d793
be49417d1059290d9ddafca3b337ba90
ced1693d7c9e8fd200792f517b69eb81
d12be3fc97890560111b772ad58f0675
ef87d939624e10c9dc7786d04d7b22d9
fdbd6865e6ea15d31001bbc05fd0d7ef
fe2484c26edcc2f16ab1344d23e7d490
ff90961ccc4029d3bd381731a576ef80
More information about the Community-sigs
mailing list