[Community-sigs] Win.Agent.Zbot

Tue Jul 26 15:39:27 EDT 2016

Thanks again Askar,
I'll queue up these new sigs for testing. Your previous signatures for
Dorkbot and Zbot passed FP testing and should be published soon.

On Tue, Jul 26, 2016 at 1:52 PM, Askar Dyussekeyev <dyussekeyev at yandex.kz>
wrote:

>
> Win.Agent.Zbot:1:EP+0:558BEC8BC98BC98BCD8BC98BC9890D5CC44000E8080000005DC3CCCCCCCCCCCC558BEC83EC60535657C745FC00000000C745A404000000C745BC00000080C745A819000200A1181040008945C8C745E46A000000C745D08B000000C745E8FF000000C745CC5500000060C745F400000000C745FC00000000C745DC00000000C745B064000000C745EC180000008B0D00104000894DD48D55D8526A016A00680CC040006800000080FF55D485C0740733C0E9D7010000
>
> signature looks for specific block of code
>
> detections:
> 045f83c00825692e39844ee71287b2b9
> 04d05222c71b603741d873df35fb1a21
> 0ab09d5967a485818d5cc9a83c76b478
> 0be0456ab9620a31c6da20641347d0e4
> 32058681610f4f746607e1be3beefc59
> 4017188db6eb103761307b5bc02280e6
> 697c0ae745664225721055a340ce4024
> 6edd3d598000a5036c45c2e039d8f316
> 97c35cb766bbb3d454b3e6251792e840
> b0cf0f9e3750c764f1b9e8946a91d793
> be49417d1059290d9ddafca3b337ba90
> ced1693d7c9e8fd200792f517b69eb81
> d12be3fc97890560111b772ad58f0675
> ef87d939624e10c9dc7786d04d7b22d9
> fdbd6865e6ea15d31001bbc05fd0d7ef
> fe2484c26edcc2f16ab1344d23e7d490
> ff90961ccc4029d3bd381731a576ef80
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>