Hi Sophos team, Can you please share the steps for importing this malicious file hash ? MD5 SHA256 File name 21307227ECE129B1E12797ECC2C9B6D9 8A4D2BAA8CF519C7A9B91F414A0A9D8BA2B9E96D21D9E77DA7B34ED849830A36 mks.exe 6F0338AF379659A5155B3D2A4F1A1E92 CA8DC152DC93EC526E505CF2A173A635562FFBF55507E3980F7DC6D508F0F258 hptasks.exe 0489978ffa3b864ede646d0470500336 2A99BCB5D21588E0A43F56AADA4E2F386791E0F757126B2773D943D7CBF47195 ENTASKLOADER.EXE. Creates forti.exe a1ffca7ba257b4eca7fe7d1e78bac623 3C86FC0A93299A0D0843C7D7FF1A137A9E799F8F2858D3D30F964E3C12C28C9E forti.exe f27cf59b00dacdd266ad7894a1df0894 92b0f4517fb22535d262a7f17d19f7c21820a011bfe1f72a2ec9fbffbdc7e3e0 javaupdate.exe, creates g.exe a1ffca7ba257b4eca7fe7d1e78bac623 3C86FC0A93299A0D0843C7D7FF1A137A9E799F8F2858D3D30F964E3C12C28C9E g.exe 511778c279b76cac40d5d695c56db4f5 91146EE63782A2061701DB3229320C161352EE2BC4059CCC3123A33114774D66 svchost.exe, Creates lsasvs.exe f774c0588da59a944abc78d5910be407 A7EA1852D7E73EF91EFB5EC9E26B4C482CA642D7BC2BDB6F36AB72B2691BA05A lsasvs.exe, Creates 50793105.exe 8386379a88a7c9893a62a67ea3073742 7F8166589023CD62AE55A59F5FCA60705090D17562B7F526359A3753EB74EA2F 50793105.exe, Creates taskhcst.exe 3bc855bfadfea71a445080ba72b26c1c 043E0D0D8B8CDA56851F5B853F244F677BD1FD50F869075EF7BA1110771F70C2 taskhcst.exe, WannaCry F27CF59B00DACDD266AD7894A1DF0894 92B0F4517FB22535D262A7F17D19F7C21820A011BFE1F72A2EC9FBFFBDC7E3E0 armsvc.exe, javaupdate.exe E8C6ACC1EB7256DB728C0F3FED5D23D7 524F8F0F8C31A89DF46A77C7A30AF5D2A1DC7525B08BFAFBED98748C3D8A3F1C jusched.exe 1D4EC831292B611F1FF8983EBD1DB5D4 41E9D6C3374FD0E78853E945B567F9309446084E05FD013805C70A6A8205CD70 msinj32.exe D0CE651A344979C8CD11B8019F8E4D7E 436195BD6786BAAE8980BDFED1D7D7DBCCCB7D5085E79EBDCC43E22D8BAE08A8 goyqsvc.dll 9A5FA5C5F3915B2297A1C379BE9979F0 9F177A6FB4EA5AF876EF8A0BF954E37544917D9AABA04680A29303F24CA5C72C exldcmgmt.dll 86759CE27D0FE0B203AAA19D4390A416 AE8E9FF2DC0EC82B6BAE7C4D978E3FEAC93353CB3CD903E15873D31E30749150 oledbg32.dll FCF3702E52AE32C995A36F7516C662B7 FC079CEFA19378A0F186E3E3BF90BDEA19AB717B61A88BF20A70D357BF1DB6B8 bitssvcs.dll e117406e3c14ab8e98b27c3697aea0b6 2BA20E39FF90E36086044D02329D43A8F7AE6A7663EB1198B91A95EA556CF563 00bebc12.exe or this is already included in the latest antivirus definition to stop future Ransomware infection ? Thanks in advance.

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Importing malicious file hash to the Sophos AV ?

Hi Sophos team,

Can you please share the steps for importing this malicious file hash ?

MD5	SHA256	File name
21307227ECE129B1E12797ECC2C9B6D9	8A4D2BAA8CF519C7A9B91F414A0A9D8BA2B9E96D21D9E77DA7B34ED849830A36	mks.exe
6F0338AF379659A5155B3D2A4F1A1E92	CA8DC152DC93EC526E505CF2A173A635562FFBF55507E3980F7DC6D508F0F258	hptasks.exe
0489978ffa3b864ede646d0470500336	2A99BCB5D21588E0A43F56AADA4E2F386791E0F757126B2773D943D7CBF47195	ENTASKLOADER.EXE. Creates forti.exe
a1ffca7ba257b4eca7fe7d1e78bac623	3C86FC0A93299A0D0843C7D7FF1A137A9E799F8F2858D3D30F964E3C12C28C9E	forti.exe
f27cf59b00dacdd266ad7894a1df0894	92b0f4517fb22535d262a7f17d19f7c21820a011bfe1f72a2ec9fbffbdc7e3e0	javaupdate.exe, creates g.exe
a1ffca7ba257b4eca7fe7d1e78bac623	3C86FC0A93299A0D0843C7D7FF1A137A9E799F8F2858D3D30F964E3C12C28C9E	g.exe
511778c279b76cac40d5d695c56db4f5	91146EE63782A2061701DB3229320C161352EE2BC4059CCC3123A33114774D66	svchost.exe, Creates lsasvs.exe
f774c0588da59a944abc78d5910be407	A7EA1852D7E73EF91EFB5EC9E26B4C482CA642D7BC2BDB6F36AB72B2691BA05A	lsasvs.exe, Creates 50793105.exe
8386379a88a7c9893a62a67ea3073742	7F8166589023CD62AE55A59F5FCA60705090D17562B7F526359A3753EB74EA2F	50793105.exe, Creates taskhcst.exe
3bc855bfadfea71a445080ba72b26c1c	043E0D0D8B8CDA56851F5B853F244F677BD1FD50F869075EF7BA1110771F70C2	taskhcst.exe, WannaCry
F27CF59B00DACDD266AD7894A1DF0894	92B0F4517FB22535D262A7F17D19F7C21820A011BFE1F72A2EC9FBFFBDC7E3E0	armsvc.exe, javaupdate.exe
E8C6ACC1EB7256DB728C0F3FED5D23D7	524F8F0F8C31A89DF46A77C7A30AF5D2A1DC7525B08BFAFBED98748C3D8A3F1C	jusched.exe
1D4EC831292B611F1FF8983EBD1DB5D4	41E9D6C3374FD0E78853E945B567F9309446084E05FD013805C70A6A8205CD70	msinj32.exe
D0CE651A344979C8CD11B8019F8E4D7E	436195BD6786BAAE8980BDFED1D7D7DBCCCB7D5085E79EBDCC43E22D8BAE08A8	goyqsvc.dll
9A5FA5C5F3915B2297A1C379BE9979F0	9F177A6FB4EA5AF876EF8A0BF954E37544917D9AABA04680A29303F24CA5C72C	exldcmgmt.dll
86759CE27D0FE0B203AAA19D4390A416	AE8E9FF2DC0EC82B6BAE7C4D978E3FEAC93353CB3CD903E15873D31E30749150	oledbg32.dll
FCF3702E52AE32C995A36F7516C662B7	FC079CEFA19378A0F186E3E3BF90BDEA19AB717B61A88BF20A70D357BF1DB6B8	bitssvcs.dll
e117406e3c14ab8e98b27c3697aea0b6	2BA20E39FF90E36086044D02329D43A8F7AE6A7663EB1198B91A95EA556CF563	00bebc12.exe

or this is already included in the latest antivirus definition to stop future Ransomware infection ?

Thanks in advance.

This thread was automatically locked due to age.

Parents

0 jak over 7 years ago

You can't import them into the product to add to Sophos Labs published rules. The options would be to submit the above to Support who can engage with Sophos Labs to verify the checksums en masse. For ones they don't have in their database they may ask for samples if you have them.

Taking a few examples from the bottom of the list, you could check them here:

2BA20E39FF90E36086044D02329D43A8F7AE6A7663EB1198B91A95EA556CF563

https://www.virustotal.com/sv/file/fc079cefa19378a0f186e3e3bf90bdea19ab717b61a88bf20a70d357bf1db6b8/analysis/

Sophos Mal/Generic-S 20170525

FC079CEFA19378A0F186E3E3BF90BDEA19AB717B61A88BF20A70D357BF1DB6B8

https://www.virustotal.com/sv/file/fc079cefa19378a0f186e3e3bf90bdea19ab717b61a88bf20a70d357bf1db6b8/analysis/

Sophos Mal/Generic-S 20170525

etc..

You could create a hash rule in Software restriction policies (Group Policy) to prevent the files running if you felt it necessary in the short term?
Cancel
Vote Up 0 Vote Down

Cancel

Sophos	Mal/Generic-S	20170525

Sophos	Mal/Generic-S	20170525

Reply

0 jak over 7 years ago

You can't import them into the product to add to Sophos Labs published rules. The options would be to submit the above to Support who can engage with Sophos Labs to verify the checksums en masse. For ones they don't have in their database they may ask for samples if you have them.

Taking a few examples from the bottom of the list, you could check them here:

2BA20E39FF90E36086044D02329D43A8F7AE6A7663EB1198B91A95EA556CF563

https://www.virustotal.com/sv/file/fc079cefa19378a0f186e3e3bf90bdea19ab717b61a88bf20a70d357bf1db6b8/analysis/

Sophos Mal/Generic-S 20170525

FC079CEFA19378A0F186E3E3BF90BDEA19AB717B61A88BF20A70D357BF1DB6B8

https://www.virustotal.com/sv/file/fc079cefa19378a0f186e3e3bf90bdea19ab717b61a88bf20a70d357bf1db6b8/analysis/

Sophos Mal/Generic-S 20170525

etc..

You could create a hash rule in Software restriction policies (Group Policy) to prevent the files running if you felt it necessary in the short term?
Cancel
Vote Up 0 Vote Down

Cancel

Sophos	Mal/Generic-S	20170525

Sophos	Mal/Generic-S	20170525

Children

No Data