virussign.com_fd56b448f98aa1f3bcc979cb8654c3e0.vir
Self-replicating virus with taunts
Virus.Hijack Agent DCBC lockerSelf-copy into Windows system directory with Run key
SHA-256ef891437839f37b4448acc3fe66de69cefecbb398be8371fcc1c46ff53e66ed0
Evidence
⋯5 more rows
0xff000000000000000000000000000000000................
0x1000aac576a8c4a67ec5a67e7490000000c5..v...~..~t.....
0x1010a204c170803a84c5a67ea87428000000...p.:...~.t(...
0x1020c5a27ec5f2ae61020066666666666666..~...a..fffffff
0x1030aac576a8c4a67ec5a67e743d830000c5..v...~..~t=....
0x1040f2aee166666666666666666666666666...fffffffffffff
0x1050aac576a8c4a67ec5a67e74240c0000c5..v...~..~t$....
0x1060f2aee166666666666666666666666666...fffffffffffff
0x1070aac576c5a204287441020000c16202ae..v...(tA....b..
0x108061020066666666666666666666666666a..fffffffffffff
0x1090aac576a8c4a67ec5a67e74d8ffffffc5..v...~..~t.....
0x10a0a204c170803a84c5a67ea87460ffffff...p.:...~.t`...
0x10b0c5a27ec5f2ae61020066666666666666..~...a..fffffff
0x10c0aac576a8c4a67ec5a2062887dba604a8..v...~...(.....
0x10d0c5a67e7417900000c5f2ae6104006666..~t.......a..ff
0x10e0aac576a8c4a67e3580c5a27ec52410a8..v...~5...~.$..
0x10f0ff8a6ca92100c5f2aee1666666666666..l.!.....ffffff
0x1100aac576a8c4a67e3500c5a27ec52410a8..v...~5...~.$..
0x1110ff8a6ca92100c5f2aee1666666666666..l.!.....ffffff
0x1120aac576a8c4a67ec5a67e7440320000c5..v...~..~t@2...
0x1130f2ae6102006666666666666666666666..a..fffffffffff
0x1140aac576a8c4a67ec5a20428c5a67ec5a8..v...~...(..~..
0x11501029ff8a6aa92100c5f2ae6102006666.)..j.!....a..ff
0x1160aac576a8c4a67ec5a20828c5a606a8c5..v...~...(.....
0x1170aa0429c5a27ec52402a8ff8a66a92100..)..~.$....f.!.
0x1180c5f2ae61060066666666666666666666...a..ffffffffff
0x1190aac576c17604c4a67ec1be7e00ba84e3..v.v...~..~....
0x11a0a27c00000000f584c5a27ec52402c4a6.|........~.$...
0x11b07cc5a27cc5f2aee16666666666666666|..|....ffffffff
0x11c0aac576a8c4a67ec5a20828c5a606a8c5..v...~...(.....
0x11d0aa0429c5a27ec52410a8ff8a62a92100..)..~.$....b.!.
0x11e0c5f2ae61060066666666666666666666...a..ffffffffff
0x11f0aac576a8c4a67ec5a27ec52410a8ff8a..v...~..~.$....
0x120060a92100c5f2aee16666666666666666`.!.....ffffffff
0x1210aac576a8c4a67ec5a20828c5a606a8c5..v...~...(.....
0x1220aa0429c5a27ec52410a8ff8a3ca92100..)..~.$....<.!.
0x1230c5f2ae61060066666666666666666666...a..ffffffffff
0x1240aac576a8c4a67ec5a20428c5a606a834..v...~...(....4
0x125040000000c5aa7ec5211028ff8a62a921@.....~.!.(..b.!
0x126000c5f2ae610400666666666666666666....a..fffffffff
0x1270aac576a8c4a67ec5a20a28c5a608a8c5..v...~...(.....
0x24f9000000000000000000000000000000000................
0x24fa000000000000000000000000000000000................
0x24fb000000000000000000000000000000000................
0x24fc000000000000000000000000000000000................
0x24fd000000000000000000000000000000000................
0x24fe000000000000000000000000000000000................
0x24ff000000000000000000000000000000000................
0x2500030ca020022ca020012ca020000ca02000..."...........
0x25010f0c90200dcc90200cec90200bcc90200................
0x25020aec90200000000000cc902001ec90200................
0x2503032c902003ec9020050c9020090c802002...>...P.......
0x25040f6c80200e2c80200ccc80200b8c80200................
0x25050a8c80200fcc70200ecc7020084c80200................
0x2506076c802006ac802005ac802004cc80200v...j...Z...L...
0x2507040c8020036c8020028c802001ac80200@...6...(.......
0x250800ac802009ec80200000000005cbe0200............\...
0x2509068be020078be020092be02009ebe0200h...x...........
0x250a0aabe0200babe0200c8be0200dabe0200................
0x250b0ecbe0200febe02000abf020018bf0200................
0x250c02abf020036bf02004abf020050be0200*...6...J...P...
0x250d084bf020098bf0200aabf0200babf0200................
0x250e0c8bf0200d6bf0200e4bf0200f2bf0200................
0x250f00cc0020024c002003ec0020058c00200....$...>...X...
0x2510072c002007cc002008cc002009ec00200r...|...........
0x25110aec00200bec00200cec00200e0c00200................
0x25120f2c0020002c1020018c102003ebe0200............>...
0x251302ebe02001abe020008be0200f0bd0200................
0x25140e6bd0200cebd0200bebd0200b0bd0200................
0x25150a4bd020088bd020078bd020068bd0200........x...h...
0x2516050bd020042bd02002abd02001cbd0200P...B...*.......
0x251700ebd0200fcbc0200f0bc0200e6bc0200................
0x25180d0bc0200bebc0200b2bc0200a2bc0200................
0x251908abc020074bc020064bc020052bc0200....t...d...R...
0x251a042bc020034bc020024bc020006bc0200B...4...$.......
0x251b0f2bb0200dcbb0200c4bb0200aabb0200................
0x251c098bb020088bb020078bb020068bb0200........x...h...
0x251d058bb020046bb020038bb02002cbb0200X...F...8...,...
0x251e01ebb020010bb0200fcba0200eeba0200................
0x251f0dcba0200ccba0200b6ba0200a0ba0200................
0x252008aba02007eba020076ba020062ba0200....~...v...b...
0x2521050ba020044ba020036ba020020ba0200P...D...6... ...
0x252200cba020004ba0200eeb90200e0b90200................
0x25230d4b90200c6b90200bab90200acb90200................
0x25240a0b902008eb902007eb9020066bf0200........~...f...
0x2525000000000090000800c00008008000080................
0x25260000000005eb9020046b9020030b90200....^...F...0...
0x2527020b902000000000060ca020050ca0200 .......`...P...
0x252800000000096ca020080ca020000000000................
⋯7 more rows
0x287004461746554696d655370616e00000000DateTimeSpan....
0x28710433a5c77696e646f77735c2573000000C:\windows\%s...
0x28720433a5c77696e646f77735c7379737465C:\windows\syste
0x287306d33325c25730000433a5c77696e646fm32\%s..C:\windo
0x2874077735c73797374656d5c257300000000ws\system\%s....
0x287507762000073746172742025730a000000wb..start %s....
⋯6 more rows
0x287c0206d6f74686572206675636b65722021 mother fucker !
0x287d0000000005c2573005c2573004e745265....\%s.\%s.NtRe
0x287e073756d6550726f63657373006e74646csumeProcess.ntdl
0x287f06c2e646c6c000000633a5c73746f702dl.dll...c:\stop-
0x288006164772e7478740025780000534f4654adw.txt.%x..SOFT
0x28810574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28820696e646f77735c43757272656e745665indows\CurrentVe
0x288307273696f6e5c52756e5c0000534f4654rsion\Run\..SOFT
0x28840574152455c4d6963726f736f66745c57WARE\Microsoft\W
0x28850696e646f77735c43757272656e745665indows\CurrentVe
0x288607273696f6e5c52756e5c000063616c63rsion\Run\..calc
0x288702e657865000000006f70656e00000000.exe....open....
0x288806e6f74657061642e657865006f70656enotepad.exe.open
0x28890000000006d737061696e742e65786500....mspaint.exe.
0x288a06f70656e0000000077726974652e6578open....write.ex
0x288b0650000006f70656e00000000596f7520e...open....You
0x288c07375636b00000000596f75207265616csuck....You real
0x288d079207468696e6b20796f752063616e20y think you can
0x288e0657363617065206d650000004d657373escape me...Mess
0x288f02077697468207468652062657374202c with the best ,
0x2890020646965206c696b6520746865207265 die like the re
0x28910737400004920616d20746865206f6e65st..I am the one
0x2892020616e64206f6e6c7900000048412048 and only...HA H
0x289304120484100000000436f6d606f6e202cA HA....Com`on ,
0x2894020746861746073207468652062657374 that`s the best
0x2895020796f752063616e20646f0049606d20 you can do.I`m
0x2896076657279206469737361706f696e7465very dissapointe
0x2897064207769746820796f75722070657266d with your perf
0x289806f726d61636500004e6f626164792063ormace..Nobady c
⋯7 more rows
0x2c9a057494e53504f4f4c2e4452560000eb01WINSPOOL.DRV....
0x2c9b05265674f70656e4b6579410004025265RegOpenKeyA...Re
0x2c9c06753657456616c75654578410000cb01gSetValueExA....
0x2c9d0526567436c6f73654b657900f7015265RegCloseKey...Re
0x2c9e067517565727956616c75654578410000gQueryValueExA..
0x2c9f0ec015265674f70656e4b657945784100..RegOpenKeyExA.
0x2ca00d1015265674372656174654b65794578..RegCreateKeyEx
0x2ca104100d40152656744656c6574654b6579A...RegDeleteKey
0x2ca204100dd01526567456e756d4b65794100A...RegEnumKeyA.
0x2ca30f601526567517565727956616c756541..RegQueryValueA
0x2ca40000041445641504933322e646c6c0000..ADVAPI32.dll..
0x2ca5007015368656c6c457865637574654100..ShellExecuteA.
0x2ca60af005348476574466f6c646572506174..SHGetFolderPat
⋯3 more rows
0x2caa046696c654e616d65410053484c574150FileNameA.SHLWAP
0x2cab0492e646c6c004f4c4541555433322e64I.dll.OLEAUT32.d
0x2cac06c6c0000000000000000000000000000ll..............
0x2cad000000000000000000000000000000000................
⋯7 more rows
⋯5 more rows
0x335ae01001800a80c00000100300334000000..........0.4...
0x335be560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x335ce4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x3363e300034003000390030003400650034000.4.0.9.0.4.e.4.
0x3364e00004a001500010043006f006d007000..J.....C.o.m.p.
0x3365e61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x3366e000054004f0044004f003a0020003c00..T.O.D.O.:. .<.
0x3367e43006f006d00700061006e0079002000C.o.m.p.a.n.y. .
0x3368e6e0061006d0065003e00000000005a00n.a.m.e.>.....Z.
0x3369e19000100460069006c00650044006500....F.i.l.e.D.e.
0x336ae73006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x336be6e000000000054004f0044004f003a00n.....T.O.D.O.:.
0x336ce20003c00460069006c00650020006400 .<.F.i.l.e. .d.
0x336de65007300630072006900700074006900e.s.c.r.i.p.t.i.
0x336ee6f006e003e0000000000300008000100o.n.>.....0.....
0x336fe460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x3370e69006f006e000000000031002e003000i.o.n.....1...0.
0x3371e2e0030002e003100000038000c000100..0...1...8.....
0x3372e49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x3373e4e0061006d0065000000410064007700N.a.m.e...A.d.w.
0x3374e54006500730074002e00650078006500T.e.s.t...e.x.e.
0x3375e00008400300001004c00650067006100....0...L.e.g.a.
0x3376e6c0043006f0070007900720069006700l.C.o.p.y.r.i.g.
0x3377e68007400000054004f0044004f003a00h.t...T.O.D.O.:.
0x3378e200028006300290020003c0043006f00 .(.c.). .<.C.o.
⋯7 more rows
0x3380e6400770054006500730074002e006500d.w.T.e.s.t...e.
0x3381e7800650000004a001500010050007200x.e...J.....P.r.
0x3382e6f0064007500630074004e0061006d00o.d.u.c.t.N.a.m.
0x3383e65000000000054004f0044004f003a00e.....T.O.D.O.:.
0x3384e20003c00500072006f00640075006300 .<.P.r.o.d.u.c.