ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Signature For New N. Korean Virus 5/3/20

Joined: 09 Jul 2006
Posts: 4664
Location: USA
Reply with quote
There is a new state-sponsored virus produced by the North Korean Lazarus group. It is mainly a phishing virus that is targeting sources of information in other countries, but they could use it to download any malware. I submit the signatures below for ClamWin users that might be interested in protection from it. The signatures are all MDB signatures.

Copy the MDB signatures to a Notepad file and save it in the ClamWin db program data folder, or add the signatures to an existing MDB file if you already have one in the folder. Do not save the file with a .txt or .text extension on the end of the name. Save the file as Sigfile.mdb. Select file type All Files to prevent the .txt or .text from being used at the end of the filename. Check the file before you save it to make sure it will be saved correctly. ClamWin is unable to recognize a text file as a signature. After saving the file, scan something with ClamWin to make sure the signature works--delete the signature file if it does not or remove the signature from an existing MDB file if you have one there and re-save it.

Signatures may last up to a week or longer, depending upon how lazy the malware authors are about changing their version. MDB signatures are signatures for a section of a malware file, and they sometimes can last up to a month, especially if the section is re-used in another malware.


View user's profileSend private message
Signature For New N. Korean Virus 5/3/20
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

 Reply to topic