Skip to content

Instantly share code, notes, and snippets.

@neriberto

neriberto/all_hashes.txt

Last active June 12, 2018 20:29
Show Gist options
  • Save neriberto/cca83b91902c3ceaf433c3b05a2518cc to your computer and use it in GitHub Desktop.
Save neriberto/cca83b91902c3ceaf433c3b05a2518cc to your computer and use it in GitHub Desktop.
Download ZIP
Fake Adobe Reader - Samples and Yara rule
Raw
readme.md
title date
Trojan Fake Adobe
2018-06-07

URLs

  1. https://1a0fdf84-a-62cb3a1a-s-sites.googlegroups.com/site/novojpedido/FL0128.rar

Yara rule

rule fakeadobe {
    meta:
        description = "Fake Adobe Reader"
        author = "Neriberto C.Prado <neriberto@gmail.com>"
        date = "2018-06-06"
        sample1 = "3ec46840e0dbbe8b7f79b870344ca20c7653511d98151921ae9aa6e3d1f43fc8"
        sample2 = "398f0cfa814b31dd8d1483f0d60a2c9bf97ad20b992f14012abb2d4db6f46ca2"
        sample3 = "2af473d18877c93a7acd9185bf38b50da526d56624b3a724894614ae1c9bd99a"
        sample4 = "459943bf4fdf54e18153414321a3cb09c96472871cc05830d5af62ba741d618a"
        sample5 = "cef4430114faf4f9af05685937f4a0a119471603ec06b763357687178db88211"
        sample6 = "d011105bae9fb7a98c128c19389dd988aa83fa0558b8ca519a554b7bd6ee7747"
        sample7 = "6fba6474264b7a311476c777f718094f93514b63e8f80b588e3d40d0fe2ffd53"
        sample8 = "a2f4aed42425c986ec2154f57df4018cad6270487799a885e2683216860d0c8b"
    strings:
        // $btn means "bFechou.bFechar"
        $btn = { 62 46 65 63 68 6f 75 00 62 46 65 63 68 61 72 }
        $guid1 = "$0e59f1d2-1fbe-11d0-8ff2-00a0d10038bc*MSScriptControl.DScriptControlSource_Event"
        $guid2 = "$0E59F1D3-1FBE-11D0-8FF2-00A0D10038BC"
        $guid3 = "$8B167D60-8605-11D0-ABCB-00A0C90FFFC0"
        $A1 = "wL21df.Form1.resources"
        $A2 = "wL21df.Properties.Resources.resources"
        $B1 = "wL53456ad.Form1.resources"
        $B2 = "wL53456ad.Properties.Resources.resources"
        $C1 = "Yn3wz2.Form1.resources"
        $C2 = "Yn3wz2.Properties.Resources.resources"
    condition:
        (all of ($A*)) or (all of ($B*)) or (all of ($C*)) and all of ($btn*,$guid*)
}
Raw
all_hashes.txt
9d76abe0d6e2b32c5ca4b68fb263b9e915d341bea96c8d02a1c372ec60a11b5b
9ab7b12d3fb79f41bfaaf234073722884070445e00178b14a58cbf6611a821e3
3ec46840e0dbbe8b7f79b870344ca20c7653511d98151921ae9aa6e3d1f43fc8
398f0cfa814b31dd8d1483f0d60a2c9bf97ad20b992f14012abb2d4db6f46ca2
d011105bae9fb7a98c128c19389dd988aa83fa0558b8ca519a554b7bd6ee7747
10a49a952aadb510e6da0b87e7267c32bc38cbbbe571027836db75d5acabd8a4
11c87dde6d5900e47d93124624f2b20afcd9b5df4045c865ec582c3c536eec18
1a8e986ae10b6399a9ef7b08edf51c307e054ca43173e87a7c7e9b0c1b4ead65
2af473d18877c93a7acd9185bf38b50da526d56624b3a724894614ae1c9bd99a
fac03a0efd71af5e14f25c0d256e9fbfe80b46ef1b6e75a182afe49ec0b4c723
cef4430114faf4f9af05685937f4a0a119471603ec06b763357687178db88211
a2f4aed42425c986ec2154f57df4018cad6270487799a885e2683216860d0c8b
6fba6474264b7a311476c777f718094f93514b63e8f80b588e3d40d0fe2ffd53
459943bf4fdf54e18153414321a3cb09c96472871cc05830d5af62ba741d618a
5a8b86fdba01ae8dbcb21efeb8ffc98e6dd5f627e71ea53d7713bc8d79804158
8be86f15613b704f7e631e4a97be494ed9b9808e077e978ca27a457476ed8158
Raw
hosts.csv
sha256 domains request
9d76abe0d6e2b32c5ca4b68fb263b9e915d341bea96c8d02a1c372ec60a11b5b candsilvasa.club http://candsilvasa.club/hnbdb15/load1.php
d011105bae9fb7a98c128c19389dd988aa83fa0558b8ca519a554b7bd6ee7747 2cavajexltda.info http://2cavajexltda.info/fhtregrt10/load1.php
10a49a952aadb510e6da0b87e7267c32bc38cbbbe571027836db75d5acabd8a4 arquivosmuller.serveirc.com http://arquivosmuller.serveirc.com/jdfjrggw11/load1.php
11c87dde6d5900e47d93124624f2b20afcd9b5df4045c865ec582c3c536eec18 arquivosmuller.serveirc.com http://arquivosmuller.serveirc.com/jdfjrggw11/load2.php
abc940a2291696dc7112be334ce88aa3c8be151ac930fd53cf55a70dd982fc7f arquivosmuller.serveirc.com http://arquivosmuller.serveirc.com/jdfjrggw11/load2.php
9ab7b12d3fb79f41bfaaf234073722884070445e00178b14a58cbf6611a821e3 alcolfax.club http://alcolfax.club/ghtytjh11/load2.php
8be86f15613b704f7e631e4a97be494ed9b9808e077e978ca27a457476ed8158 alcolfax.club http://alcolfax.club/ghtytjh11/load2.php
3cf1b621309c038098b90afb1e8b789a35072888ae5ca678e21485d487e46a26 candsilvaltda.club http://candsilvaltda.club/hnbdb15/load1.php
2a72aae3a590eedd093d4d9e93e1a76418b22ca185dde2cb4c1c4e2141447fd2 candsilvaltda.club http://candsilvaltda.club/hnbdb15/load1.php
10d9a8c050b6037077932988a33cd789974379dc1f061f8d6ef4f4cfca32a7a3 candsilvaltda.club http://candsilvaltda.club/hnbdb15/load1.php
cef4430114faf4f9af05685937f4a0a119471603ec06b763357687178db88211 s354zalife.site http://s354zalife.site/vxdgt15/load1.php
9d76abe0d6e2b32c5ca4b68fb263b9e915d341bea96c8d02a1c372ec60a11b5b candsilvasa.club http://candsilvasa.club/hnbdb15/load1.php
459943bf4fdf54e18153414321a3cb09c96472871cc05830d5af62ba741d618a modulossss2017.zlmxxbox.club http://modulossss2017.zlmxxbox.club/hgtrwt15/load2.php
3ec46840e0dbbe8b7f79b870344ca20c7653511d98151921ae9aa6e3d1f43fc8 32sfd2pro.online http://32sfd2pro.online/dhtawed18/load1.php
2af473d18877c93a7acd9185bf38b50da526d56624b3a724894614ae1c9bd99a atendimentocandsilva.club http://atendimentocandsilva.club/sghttee18/load1.php
5a8b86fdba01ae8dbcb21efeb8ffc98e6dd5f627e71ea53d7713bc8d79804158 modulossss2017.zlmxxbox.club http://modulossss2017.zlmxxbox.club/hgtrwt15/load2.php
Raw
samples.csv
sha256 timestamp hybrid-analysis PDB Path URL
1a8e986ae10b6399a9ef7b08edf51c307e054ca43173e87a7c7e9b0c1b4ead65 2018:03:05 16:03:25+01:00 no e:\Fontes\zFox\loads\wL21df\wL21df\obj\Release\wL21df.pdb
d011105bae9fb7a98c128c19389dd988aa83fa0558b8ca519a554b7bd6ee7747 2018:03:07 16:49:16+01:00 yes e:\Fontes\zFox\loads\wL21df\wL21df\obj\Release\wL21df.pdb
10a49a952aadb510e6da0b87e7267c32bc38cbbbe571027836db75d5acabd8a4 2018:03:13 05:11:27+01:00 no e:\Fontes\zFox\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
11c87dde6d5900e47d93124624f2b20afcd9b5df4045c865ec582c3c536eec18 2018:03:13 05:11:59+01:00 no e:\Fontes\zFox\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
abc940a2291696dc7112be334ce88aa3c8be151ac930fd53cf55a70dd982fc7f 2018:03:13 05:12:18+01:00 yes e:\Fontes\zFox\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
9ab7b12d3fb79f41bfaaf234073722884070445e00178b14a58cbf6611a821e3 2018:03:14 14:42:29+01:00 no e:\Fontes\zFox\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
8be86f15613b704f7e631e4a97be494ed9b9808e077e978ca27a457476ed8158 2018:03:14 14:42:00+01:00 no e:\Fontes\zFox\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
3cf1b621309c038098b90afb1e8b789a35072888ae5ca678e21485d487e46a26 2018:05:17 21:59:57+02:00 no c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
2a72aae3a590eedd093d4d9e93e1a76418b22ca185dde2cb4c1c4e2141447fd2 2018:05:17 23:53:39+01:00 no c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
10d9a8c050b6037077932988a33cd789974379dc1f061f8d6ef4f4cfca32a7a3 2018:05:17 23:55:07+01:00 no c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
398f0cfa814b31dd8d1483f0d60a2c9bf97ad20b992f14012abb2d4db6f46ca2 2018:05:18 00:53:02+02:00 yes c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
5a8b86fdba01ae8dbcb21efeb8ffc98e6dd5f627e71ea53d7713bc8d79804158 2018:05:22 03:04:12+02:00 no c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
cef4430114faf4f9af05685937f4a0a119471603ec06b763357687178db88211 2018:05:22 04:16:06+01:00 yes c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
9d76abe0d6e2b32c5ca4b68fb263b9e915d341bea96c8d02a1c372ec60a11b5b 2018:05:22 05:00:14+01:00 no c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
459943bf4fdf54e18153414321a3cb09c96472871cc05830d5af62ba741d618a 2018:05:23 12:26:05+01:00 yes c:\fontes\zMestre\loads\wL53456ad\wL53456ad\obj\Release\wL53456ad.pdb
3ec46840e0dbbe8b7f79b870344ca20c7653511d98151921ae9aa6e3d1f43fc8 2018:06:04 04:22:09+01:00 yes c:\fontes\zMestre\Yn3wz2\Yn3wz2\obj\Release\Yn3wz2.pdb
2af473d18877c93a7acd9185bf38b50da526d56624b3a724894614ae1c9bd99a 2018:06:06 17:45:06+01:00 yes c:\fontes\zMestre\Yn3wz2\Yn3wz2\obj\Release\Yn3wz2.pdb https://1a0fdf84-a-62cb3a1a-s-sites.googlegroups.com/site/novojpedido/FL0128.rar
0c325be449b12653f6774a950a13009ddf21beba7ad889865fed96cae91dd3ef 2018:06:06 17:45:01+01:00 no c:\fontes\zMestre\Yn3wz2\Yn3wz2\obj\Release\Yn3wz2.pdb
6fba6474264b7a311476c777f718094f93514b63e8f80b588e3d40d0fe2ffd53 2018:03:07 05:31:47+01:00 yes e:\Fontes\zFox\loads\wL21df\wL21df\obj\Release\wL21df.pdb
a2f4aed42425c986ec2154f57df4018cad6270487799a885e2683216860d0c8b 2018:03:05 16:03:43+01:00 yes e:\Fontes\zFox\loads\wL21df\wL21df\obj\Release\wL21df.pdb
fac03a0efd71af5e14f25c0d256e9fbfe80b46ef1b6e75a182afe49ec0b4c723 2018:03:01 03:09:37+01:00 no e:\Fontes\zFox\loads\wL21df\wL21df\obj\Release\wL21df.pdb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment