virussign.com_653b27187f028b48ea44caf324f4b5a0.vir
Agent DCBC malware strings
Virus.Hijack Agent DCBC lockerSelf-copy into Windows system directory with Run key
SHA-256e69e4c8358a57a75a8e77b79c0a21d5907e8025e389f634f0f3faf2e69a1b031
Evidence
⋯5 more rows
0xff000000000000000000000000000000000................
0x1000c0360de026008d36008d2d636a6a6a36.6..&..6..-cjjj6
0x1010402a766d62c92236008de02de86a6a6a@*vmb."6...-.jjj
0x1030c0360de026008d36008d2db9526a6a36.6..&..6..-.Rjj6
0x10404580740c0c0c0c0c0c0c0c0c0c0c0c0cE.t.............
0x1050c0360de026008d36008d2d28aa6a6a36.6..&..6..-(.jj6
0x10604580740c0c0c0c0c0c0c0c0c0c0c0c0cE.t.............
0x1070c0360d36402ae82d7e4a6a6a764c4a80.6.6@*.-~JjjvLJ.
0x10807c4a6a0c0c0c0c0c0c0c0c0c0c0c0c0c|Jj.............
0x1090c0360de026008d36008d2de795959536.6..&..6..-....6
0x10a0402a766d62c92236008de02d6c959595@*vmb."6...-l...
0x10c0c0360de026008d36400ae812d7002ae0.6..&..6@.....*.
0x10d036008d2d1b636a6a3645807c2a6a0c0c6..-.cjj6E.|*j..
0x10f095c2acf0786a364580740c0c0c0c0c0c....xj6E.t......
0x111095c2acf0786a364580740c0c0c0c0c0c....xj6E.t......
0x1120c0360de026008d36008d2d6e496a6a36.6..&..6..-nIjj6
0x113045807c4a6a0c0c0c0c0c0c0c0c0c0c0cE.|Jj...........
0x1140c0360de026008d36402ae836008d36e0.6..&..6@*.6..6.
0x11506bf895c2ccf0786a3645807c4a6a0c0ck.....xj6E.|Jj..
0x11803645807c0a6a0c0c0c0c0c0c0c0c0c0c6E.|.j..........
0x1190c0360d760d2a26008d76818d6ac12254.6.v.*&..v..j."T
0x11e03645807c0a6a0c0c0c0c0c0c0c0c0c0c6E.|.j..........
0x12006cf0786a364580740c0c0c0c0c0c0c0cl.xj6E.t........
0x12303645807c0a6a0c0c0c0c0c0c0c0c0c0c6E.|.j..........
0x1240c0360de026008d36402ae836000ae029.6..&..6@*.6...)
0x12506e6a6a6a36c08d36786be895c24cf078njjj6..6xk...L.x
0x12606a3645807c2a6a0c0c0c0c0c0c0c0c0cj6E.|*j.........
0x24f9000000000000000000000000000000000................
0x24fa000000000000000000000000000000000................
0x24fb000000000000000000000000000000000................
0x24fc000000000000000000000000000000000................
0x24fd000000000000000000000000000000000................
0x24fe000000000000000000000000000000000................
0x24ff000000000000000000000000000000000................
0x2500030ca020022ca020012ca020000ca02000..."...........
0x25010f0c90200dcc90200cec90200bcc90200................
0x25020aec90200000000000cc902001ec90200................
0x2503032c902003ec9020050c9020090c802002...>...P.......
0x25040f6c80200e2c80200ccc80200b8c80200................
0x25050a8c80200fcc70200ecc7020084c80200................
0x2506076c802006ac802005ac802004cc80200v...j...Z...L...
0x2507040c8020036c8020028c802001ac80200@...6...(.......
0x250800ac802009ec80200000000005cbe0200............\...
0x2509068be020078be020092be02009ebe0200h...x...........
0x250a0aabe0200babe0200c8be0200dabe0200................
0x250b0ecbe0200febe02000abf020018bf0200................
0x250c02abf020036bf02004abf020050be0200*...6...J...P...
0x250d084bf020098bf0200aabf0200babf0200................
0x250e0c8bf0200d6bf0200e4bf0200f2bf0200................
0x250f00cc0020024c002003ec0020058c00200....$...>...X...
0x2510072c002007cc002008cc002009ec00200r...|...........
0x25110aec00200bec00200cec00200e0c00200................
0x25120f2c0020002c1020018c102003ebe0200............>...
0x251302ebe02001abe020008be0200f0bd0200................
0x25140e6bd0200cebd0200bebd0200b0bd0200................
0x25150a4bd020088bd020078bd020068bd0200........x...h...
0x2516050bd020042bd02002abd02001cbd0200P...B...*.......
0x251700ebd0200fcbc0200f0bc0200e6bc0200................
0x25180d0bc0200bebc0200b2bc0200a2bc0200................
0x251908abc020074bc020064bc020052bc0200....t...d...R...
0x251a042bc020034bc020024bc020006bc0200B...4...$.......
0x251b0f2bb0200dcbb0200c4bb0200aabb0200................
0x251c098bb020088bb020078bb020068bb0200........x...h...
0x251d058bb020046bb020038bb02002cbb0200X...F...8...,...
0x251e01ebb020010bb0200fcba0200eeba0200................
0x251f0dcba0200ccba0200b6ba0200a0ba0200................
0x252008aba02007eba020076ba020062ba0200....~...v...b...
0x2521050ba020044ba020036ba020020ba0200P...D...6... ...
0x252200cba020004ba0200eeb90200e0b90200................
0x25230d4b90200c6b90200bab90200acb90200................
0x25240a0b902008eb902007eb9020066bf0200........~...f...
0x2525000000000090000800c00008008000080................
0x25260000000005eb9020046b9020030b90200....^...F...0...
0x2527020b902000000000060ca020050ca0200 .......`...P...
0x252800000000096ca020080ca020000000000................
⋯7 more rows
0x287004461746554696d655370616e00000000DateTimeSpan....
0x28710433a5c77696e646f77735c2573000000C:\windows\%s...
0x28720433a5c77696e646f77735c7379737465C:\windows\syste
0x287306d33325c25730000433a5c77696e646fm32\%s..C:\windo
0x2874077735c73797374656d5c257300000000ws\system\%s....
0x287507762000073746172742025730a000000wb..start %s....
⋯6 more rows
0x287c0206d6f74686572206675636b65722021 mother fucker !
0x287d0000000005c2573005c2573004e745265....\%s.\%s.NtRe
0x287e073756d6550726f63657373006e74646csumeProcess.ntdl
0x287f06c2e646c6c000000633a5c73746f702dl.dll...c:\stop-
0x288006164772e7478740025780000534f4654adw.txt.%x..SOFT
0x28810574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28820696e646f77735c43757272656e745665indows\CurrentVe
0x288307273696f6e5c52756e5c0000534f4654rsion\Run\..SOFT
0x28840574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28850696e646f77735c43757272656e745665indows\CurrentVe
0x288607273696f6e5c52756e5c000063616c63rsion\Run\..calc
0x288702e657865000000006f70656e00000000.exe....open....
0x288806e6f74657061642e657865006f70656enotepad.exe.open
0x28890000000006d737061696e742e65786500....mspaint.exe.
0x288a06f70656e0000000077726974652e6578open....write.ex
0x288b0650000006f70656e00000000596f7520e...open....You
0x288c07375636b00000000596f75207265616csuck....You real
0x288d079207468696e6b20796f752063616e20y think you can
0x288e0657363617065206d650000004d657373escape me...Mess
0x288f02077697468207468652062657374202c with the best ,
0x2890020646965206c696b6520746865207265 die like the re
0x28910737400004920616d20746865206f6e65st..I am the one
0x2892020616e64206f6e6c7900000048412048 and only...HA H
0x289304120484100000000436f6d606f6e202cA HA....Com`on ,
0x2894020746861746073207468652062657374 that`s the best
0x2895020796f752063616e20646f0049606d20 you can do.I`m
0x2896076657279206469737361706f696e7465very dissapointe
0x2897064207769746820796f75722070657266d with your perf
0x289806f726d61636500004e6f626164792063ormace..Nobady c
⋯7 more rows
0x2c9a057494e53504f4f4c2e4452560000eb01WINSPOOL.DRV....
0x2c9b05265674f70656e4b6579410004025265RegOpenKeyA...Re
0x2c9c06753657456616c75654578410000cb01gSetValueExA....
0x2c9d0526567436c6f73654b657900f7015265RegCloseKey...Re
0x2c9e067517565727956616c75654578410000gQueryValueExA..
0x2c9f0ec015265674f70656e4b657945784100..RegOpenKeyExA.
0x2ca00d1015265674372656174654b65794578..RegCreateKeyEx
0x2ca104100d40152656744656c6574654b6579A...RegDeleteKey
0x2ca204100dd01526567456e756d4b65794100A...RegEnumKeyA.
0x2ca30f601526567517565727956616c756541..RegQueryValueA
0x2ca40000041445641504933322e646c6c0000..ADVAPI32.dll..
0x2ca5007015368656c6c457865637574654100..ShellExecuteA.
0x2ca60af005348476574466f6c646572506174..SHGetFolderPat
⋯3 more rows
0x2caa046696c654e616d65410053484c574150FileNameA.SHLWAP
0x2cab0492e646c6c004f4c4541555433322e64I.dll.OLEAUT32.d
0x2cac06c6c0000000000000000000000000000ll..............
0x2cad000000000000000000000000000000000................
⋯7 more rows
⋯5 more rows
0x335ae01001800a80c00000100300334000000..........0.4...
0x335be560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x335ce4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x3363e300034003000390030003400650034000.4.0.9.0.4.e.4.
0x3364e00004a001500010043006f006d007000..J.....C.o.m.p.
0x3365e61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x3366e000054004f0044004f003a0020003c00..T.O.D.O.:. .<.
0x3367e43006f006d00700061006e0079002000C.o.m.p.a.n.y. .
0x3368e6e0061006d0065003e00000000005a00n.a.m.e.>.....Z.
0x3369e19000100460069006c00650044006500....F.i.l.e.D.e.
0x336ae73006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x336be6e000000000054004f0044004f003a00n.....T.O.D.O.:.
0x336ce20003c00460069006c00650020006400 .<.F.i.l.e. .d.
0x336de65007300630072006900700074006900e.s.c.r.i.p.t.i.
0x336ee6f006e003e0000000000300008000100o.n.>.....0.....
0x336fe460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x3370e69006f006e000000000031002e003000i.o.n.....1...0.
0x3371e2e0030002e003100000038000c000100..0...1...8.....
0x3372e49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x3373e4e0061006d0065000000410064007700N.a.m.e...A.d.w.
0x3374e54006500730074002e00650078006500T.e.s.t...e.x.e.
0x3375e00008400300001004c00650067006100....0...L.e.g.a.
0x3376e6c0043006f0070007900720069006700l.C.o.p.y.r.i.g.
0x3377e68007400000054004f0044004f003a00h.t...T.O.D.O.:.
0x3378e200028006300290020003c0043006f00 .(.c.). .<.C.o.
⋯7 more rows
0x3380e6400770054006500730074002e006500d.w.T.e.s.t...e.
0x3381e7800650000004a001500010050007200x.e...J.....P.r.
0x3382e6f0064007500630074004e0061006d00o.d.u.c.t.N.a.m.
0x3383e65000000000054004f0044004f003a00e.....T.O.D.O.:.
0x3384e20003c00500072006f00640075006300 .<.P.r.o.d.u.c.