While updating my Petya/Notpetya notes, I saw that ClamAV now detects resources 1 and 2 (zlib compressed PE files) as Mimikatz. Curious about how they detect Mimikatz, I wanted to take a look at the signature. I’ve done this before, but I forgot exactly how. So here is a blog post to remind me next time.
First I update the signatures (yup, that’s ClamAV on Windows):
This is a standard scan:
The signature is Win.Trojan.Mimikatz-6331391-0.
Then I do a scan with option –debug, this will print out the signature:
The signature is: 2813d34f6197eb4df42c886ec7f234a1:47616:Win.Trojan.Mimikatz-6331391-0
I hoped for something more interesting: this is an MD5 hash-based signature. 2813d34f6197eb4df42c886ec7f234a1 is the MD5 hash of the file, 47616 is its file size, and Win.Trojan.Mimikatz-6331391-0 is the signature name.
Didier Stevens 
[…] previous blog post “Analyzing ClamAV Signatures” is incorrect. Here is a better […]
Pingback by Analyzing ClamAV Signatures – Correction | Didier Stevens — Thursday 13 July 2017 @ 23:26
[…] Analyzing ClamAV Signatures […]
Pingback by Overview of Content Published In July | Didier Stevens — Tuesday 1 August 2017 @ 21:52