cve-2013-7331

cve-2015-2546

intent.nofrillspace.com

box62.a-inet.net

joomlastats.a-inet.net

server.joomlastats.co.cc

mobileworld.darktech.org

bpl.blogsite.org

www.yumpu.com

bogor.doc

ops.doc

fun.doc

space.gif

indonesia.doc

semboyan_1.doc

resume.docx

pk2.exe

bdagent.exe

blackd.exe

savservice.exe

rstray.exe

cmctrayicon.exe

lsass.exe

winlogon.exe

mstbl.dll

c:\program files\windows journal\templates\cpl\jnwmon.exe

9a4e82ba371cd2fedea0b889c879daee7a01e1b1

0bc08dca86bd95f43ccc78ef4b27d81f28b4b769

1bdc1a0bc995c1beb363b11b71c14324be8577c9

d6a795e839f51c1a5aeabf5c10664936ebbef8ea

f751cdfaef99c6184f45a563f3d81ff1ada25565

dff2fee984ba9f5a8f5d97582c83fca4fa1fe131

ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a

2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24

0096a3e0c97b85ca75164f48230ae530c94a2b77

d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd

fa087986697e4117c394c9a58cb9f316b2d9f7d8

48b89f61d58b57dba6a0ca857bce97bab636af65

3907a9e41df805f912f821a47031164b6636bd04

99c08d31af211a0e17f92dd312ec7ca2b9469ecb

99dcb148b053f4cef6df5fa1ec5d33971a58bd1e

831a5a29d47ab85ee3216d4e75f18d93641a9819

3119de80088c52bd8097394092847cd984606c88

6d1169775a552230302131f9385135d385efd166

d807648ddecc4572c7b04405f496d25700e0be6e

bbd4992ee3f3a3267732151636359cf94fb4575d

2abb8e1e9cac24be474e4955c63108ff86d1a034

3a678b5c9c46b5b87bfcb18306ed50fadfc6372e

88ff852b1b8077ad5a19cc438afb2402462fbd1a

dc991ef598825daabd9e70bac92c79154363bab2

209.45.65.163

192.192.114.1

https://www.yumpu.com/en/document/view/14255220/alexsyscan13/23.

rule Trojan_Win32_Platual : Platinum {
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$class_name = "AVCObfuscation"
		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
	condition:
		$class_name and $scrambled_dir
}

rule Trojan_Win32_Dipsind_B : Platinum {
	meta:
		author = "Microsoft"
		description = "Dipsind Family"
		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$frg1 = { 8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
		$frg2 = { 68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA }
		$frg3 = { C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63 }
	condition:
		$frg1 and $frg2 and $frg3
}

rule Trojan_Win32_Adupib : Platinum {
	meta:
		author = "Microsoft"
		description = "Adupib SSL Backdoor"
		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = "POLL_RATE"
		$str2 = "OP_TIME(end hour)"
		$str3 = "%d:TCP:*:Enabled"
		$str4 = "%s[PwFF_cfg%d]"
		$str5 = "Fake_GetDlgItemTextW: ***value***="
	condition:
		$str1 and $str2 and $str3 and $str4 and $str5
}

rule Trojan_Win32_Plagon : Platinum {
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = "VPLRXZHTU"
		$str2 = { 64 6F 67 32 6A 7E 6C }
		$str3 = "Dqpqftk(Wou\"Isztk)"
		$str4 = "StartThreadAtWinLogon"
	condition:
		$str1 and $str2 and $str3 and $str4
}

rule Trojan_Win32_Plainst : Platinum {
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = { 66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04 }
		$str2 = { 4B D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97 }
	condition:
		$str1 and $str2
}

rule Trojan_Win32_Plaklog : Platinum {
	meta:
		author = "Microsoft"
		description = "Hook-based keylogger"
		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = "++[%s^^unknown^^%s]++"
		$str2 = "vtfs43/emm"
		$str3 = { 33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3 }
	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plabit : Platinum {
	meta:
		author = "Microsoft"
		description = "Installer component"
		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = { 4B D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97 }
		$str2 = "GetInstanceW"
		$str3 = { 8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE }
	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Placisc3 : Platinum {
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = { BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00 }
		$str2 = "VPLRXZHTU"
		$str3 = { 8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03 }
	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plakpers : Platinum {
	meta:
		author = "Microsoft"
		description = "Injector / loader component"
		original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = "MyFileMappingObject"
		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
		$str3 = "%s\\{%s}\\%s" wide
	condition:
		$str1 and $str2 and $str3
}

rule Trojan_Win32_Plakpeer : Platinum {
	meta:
		author = "Microsoft"
		description = "Zc tool v2"
		original_sample_sha1 = "2155c20483528377b5e3fde004bb604198463d29"
		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"
	strings:
		$str1 = "@@E0020(%d)" wide
		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
		$str3 = "---###---" wide
		$str4 = "---@@@---" wide
	condition:
		$str1 and $str2 and $str3 and $str4
}