virussign.com_3c21164bf280bcf80278c4137f437650.vir
Agent DCBC malware signature
Virus.Hijack Agent DCBC lockerSelf-copy into Windows system directory with Run key
SHA-256069363ac84ff83da0c260b4a6bd048546c8688d63889b7e268782faf2400c3e0
Evidence
⋯5 more rows
0xff000000000000000000000000000000000................
0x100097bd1e93bb7f2ebd7f2e1a63414141bd...........cAAA.
0x10108739c52242b63abd7f2e931a92414141.9."B.:......AAA
0x1020bd872ebd278f044541fefefefefefefe....'..EA.......
0x103097bd1e93bb7f2ebd7f2e1aac384141bd............8AA.
0x1040278f05fefefefefefefefefefefefefe'...............
0x105097bd1e93bb7f2ebd7f2e1a7a4a4141bd...........zJAA.
0x1060278f05fefefefefefefefefefefefefe'...............
0x107097bd1ebd8739921ac4454141c506458f.....9...EAA..E.
0x1080044541fefefefefefefefefefefefefe.EA.............
0x109097bd1e93bb7f2ebd7f2e1af3313131bd............111.
0x10a08739c52242b63abd7f2e931a02313131.9."B.:......111
0x10b0bd872ebd278f044541fefefefefefefe....'..EA.......
0x10d0bd7f2e1a60634141bd278f043941fefe....`cAA.'..9A..
0x10e097bd1e93bb7f2e9c42bd872ebd7a6293........B....zb.
0x10f031570a958441bd278f05fefefefefefe1W...A.'........
0x110097bd1e93bb7f2e9c41bd872ebd7a6293........A....zb.
0x111031570a958441bd278f05fefefefefefe1W...A.'........
0x112097bd1e93bb7f2ebd7f2e1ac2a64141bd.............AA.
0x1130278f044541fefefefefefefefefefefe'..EA...........
0x114097bd1e93bb7f2ebd873992bd7f2ebd93.........9......
0x11506294315716958441bd278f044541fefeb.1W...A.'..EA..
0x116097bd1e93bb7f2ebd875292bd7f3d93bd.........R...=..
0x1170973994bd872ebd7a45933157fe958441.9.....zE.1W...A
0x1180bd278f043d41fefefefefefefefefefe.'..=A..........
0x119097bd1ec51e39bb7f2ec5af2e41b73af9.....9......A.:.
0x11a0872a414141411d3abd872ebd7a45bb7f.*AAAA.:....zE..
0x11b02abd872abd278f05fefefefefefefefe*..*.'..........
0x11c097bd1e93bb7f2ebd875292bd7f3d93bd.........R...=..
0x11d0973994bd872ebd7a6293315706958441.9.....zb.1W...A
0x11e0bd278f043d41fefefefefefefefefefe.'..=A..........
0x11f097bd1e93bb7f2ebd872ebd7a62933157...........zb.1W
0x120002958441bd278f05fefefefefefefefe...A.'..........
0x121097bd1e93bb7f2ebd875292bd7f3d93bd.........R...=..
0x1220973994bd872ebd7a62933157aa958441.9.....zb.1W...A
0x1230bd278f043d41fefefefefefefefefefe.'..=A..........
0x124097bd1e93bb7f2ebd873992bd7f3d939a.........9...=..
0x1250c2414141bd972ebd8462923157069584.AAA.....b.1W...
0x126041bd278f043941fefefefefefefefefeA.'..9A.........
0x127097bd1e93bb7f2ebd875692bd7f5293bd.........V...R..
0x24f9000000000000000000000000000000000................
0x24fa000000000000000000000000000000000................
0x24fb000000000000000000000000000000000................
0x24fc000000000000000000000000000000000................
0x24fd000000000000000000000000000000000................
0x24fe000000000000000000000000000000000................
0x24ff000000000000000000000000000000000................
0x2500030ca020022ca020012ca020000ca02000..."...........
0x25010f0c90200dcc90200cec90200bcc90200................
0x25020aec90200000000000cc902001ec90200................
0x2503032c902003ec9020050c9020090c802002...>...P.......
0x25040f6c80200e2c80200ccc80200b8c80200................
0x25050a8c80200fcc70200ecc7020084c80200................
0x2506076c802006ac802005ac802004cc80200v...j...Z...L...
0x2507040c8020036c8020028c802001ac80200@...6...(.......
0x250800ac802009ec80200000000005cbe0200............\...
0x2509068be020078be020092be02009ebe0200h...x...........
0x250a0aabe0200babe0200c8be0200dabe0200................
0x250b0ecbe0200febe02000abf020018bf0200................
0x250c02abf020036bf02004abf020050be0200*...6...J...P...
0x250d084bf020098bf0200aabf0200babf0200................
0x250e0c8bf0200d6bf0200e4bf0200f2bf0200................
0x250f00cc0020024c002003ec0020058c00200....$...>...X...
0x2510072c002007cc002008cc002009ec00200r...|...........
0x25110aec00200bec00200cec00200e0c00200................
0x25120f2c0020002c1020018c102003ebe0200............>...
0x251302ebe02001abe020008be0200f0bd0200................
0x25140e6bd0200cebd0200bebd0200b0bd0200................
0x25150a4bd020088bd020078bd020068bd0200........x...h...
0x2516050bd020042bd02002abd02001cbd0200P...B...*.......
0x251700ebd0200fcbc0200f0bc0200e6bc0200................
0x25180d0bc0200bebc0200b2bc0200a2bc0200................
0x251908abc020074bc020064bc020052bc0200....t...d...R...
0x251a042bc020034bc020024bc020006bc0200B...4...$.......
0x251b0f2bb0200dcbb0200c4bb0200aabb0200................
0x251c098bb020088bb020078bb020068bb0200........x...h...
0x251d058bb020046bb020038bb02002cbb0200X...F...8...,...
0x251e01ebb020010bb0200fcba0200eeba0200................
0x251f0dcba0200ccba0200b6ba0200a0ba0200................
0x252008aba02007eba020076ba020062ba0200....~...v...b...
0x2521050ba020044ba020036ba020020ba0200P...D...6... ...
0x252200cba020004ba0200eeb90200e0b90200................
0x25230d4b90200c6b90200bab90200acb90200................
0x25240a0b902008eb902007eb9020066bf0200........~...f...
0x2525000000000090000800c00008008000080................
0x25260000000005eb9020046b9020030b90200....^...F...0...
0x2527020b902000000000060ca020050ca0200 .......`...P...
0x252800000000096ca020080ca020000000000................
⋯7 more rows
0x287004461746554696d655370616e00000000DateTimeSpan....
0x28710433a5c77696e646f77735c2573000000C:\windows\%s...
0x28720433a5c77696e646f77735c7379737465C:\windows\syste
0x287306d33325c25730000433a5c77696e646fm32\%s..C:\windo
0x2874077735c73797374656d5c257300000000ws\system\%s....
0x287507762000073746172742025730a000000wb..start %s....
⋯6 more rows
0x287c0206d6f74686572206675636b65722021 mother fucker !
0x287d0000000005c2573005c2573004e745265....\%s.\%s.NtRe
0x287e073756d6550726f63657373006e74646csumeProcess.ntdl
0x287f06c2e646c6c000000633a5c73746f702dl.dll...c:\stop-
0x288006164772e7478740025780000534f4654adw.txt.%x..SOFT
0x28810574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28820696e646f77735c43757272656e745665indows\CurrentVe
0x288307273696f6e5c52756e5c0000534f4654rsion\Run\..SOFT
0x28840574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28850696e646f77735c43757272656e745665indows\CurrentVe
0x288607273696f6e5c52756e5c000063616c63rsion\Run\..calc
0x288702e657865000000006f70656e00000000.exe....open....
0x288806e6f74657061642e657865006f70656enotepad.exe.open
0x28890000000006d737061696e742e65786500....mspaint.exe.
0x288a06f70656e0000000077726974652e6578open....write.ex
0x288b0650000006f70656e00000000596f7520e...open....You
0x288c07375636b00000000596f75207265616csuck....You real
0x288d079207468696e6b20796f752063616e20y think you can
0x288e0657363617065206d650000004d657373escape me...Mess
0x288f02077697468207468652062657374202c with the best ,
0x2890020646965206c696b6520746865207265 die like the re
0x28910737400004920616d20746865206f6e65st..I am the one
0x2892020616e64206f6e6c7900000048412048 and only...HA H
0x289304120484100000000436f6d606f6e202cA HA....Com`on ,
0x2894020746861746073207468652062657374 that`s the best
0x2895020796f752063616e20646f0049606d20 you can do.I`m
0x2896076657279206469737361706f696e7465very dissapointe
0x2897064207769746820796f75722070657266d with your perf
0x289806f726d61636500004e6f626164792063ormace..Nobady c
⋯7 more rows
0x2c9a057494e53504f4f4c2e4452560000eb01WINSPOOL.DRV....
0x2c9b05265674f70656e4b6579410004025265RegOpenKeyA...Re
0x2c9c06753657456616c75654578410000cb01gSetValueExA....
0x2c9d0526567436c6f73654b657900f7015265RegCloseKey...Re
0x2c9e067517565727956616c75654578410000gQueryValueExA..
0x2c9f0ec015265674f70656e4b657945784100..RegOpenKeyExA.
0x2ca00d1015265674372656174654b65794578..RegCreateKeyEx
0x2ca104100d40152656744656c6574654b6579A...RegDeleteKey
0x2ca204100dd01526567456e756d4b65794100A...RegEnumKeyA.
0x2ca30f601526567517565727956616c756541..RegQueryValueA
0x2ca40000041445641504933322e646c6c0000..ADVAPI32.dll..
0x2ca5007015368656c6c457865637574654100..ShellExecuteA.
0x2ca60af005348476574466f6c646572506174..SHGetFolderPat
⋯3 more rows
0x2caa046696c654e616d65410053484c574150FileNameA.SHLWAP
0x2cab0492e646c6c004f4c4541555433322e64I.dll.OLEAUT32.d
0x2cac06c6c0000000000000000000000000000ll..............
0x2cad000000000000000000000000000000000................
⋯7 more rows
⋯5 more rows
0x335ae01001800a80c00000100300334000000..........0.4...
0x335be560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x335ce4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x3363e300034003000390030003400650034000.4.0.9.0.4.e.4.
0x3364e00004a001500010043006f006d007000..J.....C.o.m.p.
0x3365e61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x3366e000054004f0044004f003a0020003c00..T.O.D.O.:. .<.
0x3367e43006f006d00700061006e0079002000C.o.m.p.a.n.y. .
0x3368e6e0061006d0065003e00000000005a00n.a.m.e.>.....Z.
0x3369e19000100460069006c00650044006500....F.i.l.e.D.e.
0x336ae73006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x336be6e000000000054004f0044004f003a00n.....T.O.D.O.:.
0x336ce20003c00460069006c00650020006400 .<.F.i.l.e. .d.
0x336de65007300630072006900700074006900e.s.c.r.i.p.t.i.
0x336ee6f006e003e0000000000300008000100o.n.>.....0.....
0x336fe460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x3370e69006f006e000000000031002e003000i.o.n.....1...0.
0x3371e2e0030002e003100000038000c000100..0...1...8.....
0x3372e49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x3373e4e0061006d0065000000410064007700N.a.m.e...A.d.w.
0x3374e54006500730074002e00650078006500T.e.s.t...e.x.e.
0x3375e00008400300001004c00650067006100....0...L.e.g.a.
0x3376e6c0043006f0070007900720069006700l.C.o.p.y.r.i.g.
0x3377e68007400000054004f0044004f003a00h.t...T.O.D.O.:.
0x3378e200028006300290020003c0043006f00 .(.c.). .<.C.o.
⋯7 more rows
0x3380e6400770054006500730074002e006500d.w.T.e.s.t...e.
0x3381e7800650000004a001500010050007200x.e...J.....P.r.
0x3382e6f0064007500630074004e0061006d00o.d.u.c.t.N.a.m.
0x3383e65000000000054004f0044004f003a00e.....T.O.D.O.:.
0x3384e20003c00500072006f00640075006300 .<.P.r.o.d.u.c.