Add CypherIT/Frenchy shellcode packer signature

[ditekshen]

Have been collecting/testing this since August 2019. Additional information can be found here: https://research.checkpoint.com/2019/decypherit-all-eggs-in-one-basket/

Tested Samples:

02da2c34381cecfc909f32ed8c7e9b95696fcb827e51fdc5b23fa18326485940 (AgentTesla)
046a547b698fc5f691119ec3ef08e02fc10873c60b1d08879188aec47bd72a23 (AgentTesla)
07cd2c4cd8dcc5bbea48c137c5ca445889e50c2bac36c96af6e77c48193744f6 (AgentTesla)
0e34d154167323b19ae76ef52ff135f68b35a37d1e4454f77f45618d585fa960 (AgentTesla)
1688a4161ae0292575ff27c65fd33047642b4e4c31b0af825940f277365699e2 (AgentTesla)
176c6d49d475cfcf0723824e0b401eff33d1e2f55a07bddbdc7a47755f7c9bd1 (AgentTesla)
17908389f2e584e8498a2ad737c0a827439ca9173cf254f5344d12930281f08f (AgentTesla)
18641d970be3485f8a9badbfca970c423645e76f869ccebf67d38a29254a8bab (AgentTesla)
1aafc199a6852495ccd2891c427c9f94e8453c227249fa5fde64323e47ee300c (AgentTesla)
280949834f1325329e0acebc02993a5197e57e0401dbcd41c4910684bc5ef485 (AgentTesla)
2a89038f81bc8b932d356d10ed9eea4855b25452d19c82abeb766c4f2bd29d79 (AgentTesla)
307dea0d3f6a110dab46f973c4a363cffa7cdbe063dc21540595cf800be76e82 (AgentTesla)
357391330da116eacf362e86c209f95069edf15a1f2ff1877939914e2ca89d3a (AgentTesla)
363e426a7a9fc982e0aaa7c7ee314bd39d95764a47db52b61d50b5b8e692a2ce (AgentTesla)
3b0742951446d7810cab20c25a46dc039ee71b65d89bfc9168e2ed0dbd35b495 (AgentTesla)
3c64ad508b629d094eb05cf4a16c3930bfb0b1fc363bb85fcecb624a256d11c3 (AgentTesla)
484774400f9f6d66469349b00ed0f750654fd42c8b0aa0da45d5c8bac28f63d8 (AgentTesla)
4ba992fd6af388a1421ed61cbd887da3e505c18e5faeae2b1448cc822813fac6 (AgentTesla)
4c1bc02b6e04c63ac3e4cf011a47e43ddce002470dd39798d05367f09876cb51 (AgentTesla)
5073c2bfd03245968f258456e9a0a79d4bd2f75672783d5108ef8e17def84ddb (AgentTesla)
61729c50d146044643ecb493d91f8e3730ec3135d80041676a746c378bb12070 (AgentTesla)
6c2aa1408417d28e4971a9287d6a1e24132432cbd51db2f50d5302a573e7cb6f (AgentTesla)
690b5923d20ddae20456a142e2aa08da17965aeec22ee205e077e2b738958ed5 (AgentTesla)
6bdd04f603e1fd8e6865f5691c86f296c94ad488bfe30cb326ce612aac62484b (AgentTesla)
70c4f8d4ba7734aeb571ce224ae09091fba3a31adbf2414f80b457a8da38203b (AgentTesla)
72e81ddfb3997411963b83c68b3fcbb8f5ccd8528e4cc1a31c6e9c37de19848f (AgentTesla)
8091393768cf5deab106547033f2903da5a5c6b348931367cb711ce519a7995c (AgentTesla)
97e3eb9ad13724c2f14075659b4feefc738a6e75886448ed1e16c11116f455ae (AgentTesla)
815ac07486b02e2a2e71fd0e575c5b9c41504eb4d0f903f519c1b674d9763524 (AgentTesla)
8569dcdb72e711a9c98e57983d023dd5a84bb817f2ef0238cc2065d6ced7c6b4 (AgentTesla)
8610f469a8d7d884e6b6fbfc25072b78e5251b595d858e68989298817179a066 (AgentTesla)
89fdba0145ed8733abfe81b1aeac810e816ee7e7e8a0821980550378551cccf2 (AgentTesla)
8c949b7e4a2b053c2bcfa385bb028ef8ae732360a3976bfd06eab3b2301c508a (AgentTesla)
8dfbfb6c99e396438dbdea73059e1c0546c2242111981afa2f0d3f6e318f8442 (AgentTesla)
92a56fda5709f0d489d4359632199eab479a8fcbb33e5454424a86ee791f2f1f (AgentTesla)
97eff76fe1977fdb6cb0cc0a9b278cd4aa9c454aea4f2d5672f5b953f6a8eb8d (AgentTesla)
99e18b50a73d854b55b730d9ee0006554799f64f91661194dea0bc97b60be6b9 (AgentTesla)
9e4035b96ff9dec31125d57a0b845cbe4fbaf057565583637601609c26a62976 (AgentTesla)
a506c9c011373ca1a98822ff187b91ff04cb7972dd0ac2cff4a1f5d5f532f269 (AgentTesla)
a758516e200a5afb49ab2082c433fa59a8dbe2cf28973da6691a74759de479e1 (AgentTesla)
a7801d1726b6c3c92bb8226cb3297bb0c8d3ee4670a1d74d6ec1f2e15c782332 (AgentTesla)
a831e672b9eb104d21af45f1d2e59e6b40e204721c928e9c5b47429ee11f872f (AgentTesla)
a8da9b7c73dccc1819907a4ce5cdbe46fb5bc87985640d77e8145d28b28628f0 (AgentTesla)
b0947df6f5d431385d9c3ad737877f7eae1af4aa5eeebd5b0079b0797473fa16 (AgentTesla)
b7bbaa994050c43be051e32465c8cd9dfdf30b1a53b9f1dc558432dd9b0d831a (AgentTesla)
ba93831961b4939d6189c8a39cdc65e117641f897b65459d92d2f193b13134dd (AgentTesla)
bc3eb903cfc078f515952f1e89fa7aa78e8b567199a56add96ff22065012439d (AgentTesla)
c09987c5a9d800d1d0b808994921480d8e0469cdb5cac9fc990388b5a286ce3d (AgentTesla)
c431b1c96590c1c61f6c507c4d5f3f31dfc5844fa7c7ea268e99b068f61bdc5a (AgentTesla)
cd1ca22c23e8ae8afc85d9a236cfb68f77999c2aef59f535712a5dc741a8aaea (AgentTesla)
d0986d3a4e148ea7d315b81b55e70a2bcd9bf6385b6e510152c82f7ac2895948 (AgentTesla)
d2b005781bafeafec5706269af0844e6646b0ff60d0e0092ee54b1157a0ffadd (AgentTesla)
d43a8678ada46151f50203853e919a49ced7a6e9179a6f13117236b99d70ee6d (AgentTesla)
d8f2f85894d8a8d4a0f2c5b9fc3ab388ab814033d6a4c2fb8eeec4423afc542d (AgentTesla)
deb9d67740a8b032071bf1cade9f3a70622b44ea83ff14db563bcbd611f5f4c5 (AgentTesla)
e4c94c442555d692417b14e3187a5dab04ac0864c34b7f8876d21551a977bf75 (AgentTesla)
e94d4d17555e0335a7f22adb3a140bf89f51d766c4a5e54f3269778ac8297b78 (AgentTesla)
ee197739f96481d28ad7e3e135d7caf2b8e5e68a977bcdaf0769e7d43f30264f (AgentTesla)
f1730479ac0a4941f63f7f4e216f57964a089b28c5af3a40adc1f35e629271a5 (AgentTesla)
f25901052061e433ccb4079f43955d61d9fdd7bc4eac8c0af62813b877ca42b2 (AgentTesla)
f2a8728b5880f11fe7a2d6a0f156a166d5db1b9cb6f9b0e107d2ef6ad40b6db9 (AgentTesla)
f5f7ce73417cab313cba64d821913acf222377a5cffcfd652a43fa7a310ae3a1 (AgentTesla)
f785b68f4777b11ce1789d78d60e373b66c35e9293313598abb91501362815c1 (AgentTesla)
f945a8b0c1515ffd87614c090d8946bef0154c8a68e77fe40f5b1b3a27a404fb (AgentTesla)
1acddda80b85fe275fa1e6706937909c1d18f41fc2138ec07d6fa1404d461d5f (Nanocore)
2e29947d7b512f3e10f1713124083d2da61b556c3a8b89fe7f0d15d79b08486c (Nanocore)
3c094942e47ddfc79c9ffa196ad2537dbce8b97841fb01e1d62fbc803e3317de (Nanocore)
508da5efd01dd70065931d2d0c80dbbccf2728a01961d427fc8d7ac74a60c5f9 (Nanocore)
575cf314d16bad7eed307a575e3657b22204b9c8f809e9afca02db39cc0c333f (Nanocore)
5e5502ec00aea3fcb59bc671fa23ebab7c13cca54fa2e83c86d5023fdcaca3af (Nanocore)
6965af4ea7d344e68c0e6e6d0172e54c8f8b62e02c6b7c9fd85f7c79794cd765 (Nanocore)
91d539af85599fda3fb2fb023866b72d64adc2bb95f6153e655cc844564de02e (Nanocore)
975172a3a55f7be1ae6fcc73908626b6f92f2647d2e9e97421f42eeb6d53d126 (Nanocore)
ab88aec38e87890820488a8994521763859160b2026dc5db66476470386edfa0 (Nanocore)
b08066e014b9f51ec0cb6ba2bfc3e2f663b8b526ae6b26e748aaef8d613fe80f (Nanocore)
dd1feae3743c164e7058d0c0372a19a39feb1528ec5b50d27cad6c1deab0a6d6 (Nanocore)
ea7e582ffac6169d4fd22a852fab56cc3c61340ff36a1d65299c6b87b8baf71d (Nanocore)
ee4f0cca3dd81380897f9eeb961e763368f61a52d7f41d8c341170a75f306069 (Nanocore)
35a3498ef894c29cc11efa20ace1fc28f38566dac2e5e11156413c7d893c12e8 (HawkEye)
7a007425c85f92f8afab0e4fbe013b4a7417b17d68dbcac114b0a1f1d2d0c389 (HawkEye)
815ce26a2608e755bb5d9d029bd9f4f7dffe8fc1ea2105ab3b1fb1d92fc45198 (HawkEye)
8494ce17e1d1e2a8015c78dadd13e22347cfbb7eeb4bc0fa9f91296da09114aa (HawkEye)
84f2f60ff2fe3113033908ec7fa7dd57dfa233f617d9676ebce7f1a997cb6ce8 (HawkEye)
8f57f33a7fa92f0daa82ae57591bd985a282c6fd4065549de2ff791cddd58d73 (HawkEye)
924f7561a9d2edf9478f558941b533080ba8fd33f469ad37d53bc8962382cf24 (HawkEye)
a9b11604d8683cb4b46223c39584836a8c35d49e224736a8dd9d6e65aa0bdf49 (HawkEye)
cabae110afa57e30e21cf6d2b77b8be3b5f179f10534e9a18381e90ef61ea976 (HawkEye)
f045c0a222245df33d7ba3a78f55f1aa5b3deea7ede0be470f6ccf1031592492 (HawkEye)
fec1446cc333b702c82c32ee6563191c9c8ecc179c4383788881416fc244f0dc (HawkEye)
358909198842649d86034d0d45bc8e721de3d3b857552d266d4cfeee2ff57312 (Formbook)
bc4de1bbee879571e3b565e36dd07096cb81624b8402e3c8eb279ec8764ab1b6 (Formbook)
c222b07df99688f8ba5c35ce475d970b9fd0597420061d42707b553d00c788aa (Formbook)
ce4fa221f57413a46474d033d76021db799096d2f7a64d47bb549717063280d3 (Formbook)
1377f1947afc519f39ee725b556557a6ee53ae512ffcf457552b6d239645341a (Remcos)
1401a2614b82dc1375312ddea0c21113085455d80cf5461f8bd5d8470946be68 (Remcos)
3bd52ab059db40fbeb713b1caf07793c78ac6d825b4b8ba9d2b3fcf54f2d30d2 (Remcos)
519e83f680188918b1bf528c47984ed7447fa2d4acc02f1a68d775b134955da0 (Remcos)
eb8662a90fae9047c1636c3bceff2c552924e363251545994f4f61f9e3188836 (Remcos)
f9c6261dcd317a343f3c6fad9a5329cec1c29b8ee754d8548233e20aa4590a95 (Remcos)
2be873726dedb8f3a26d8fb61c513c95354d9a9b47f81934670497fcdbe4e0da (Njrat / Bladabindi)
ab1ff8207742af14e27ac9d374ead574feab22c032d0b2b6a3033731fce87808 (Njrat / Bladabindi)
651688fbe0e8dd48630bee11fa1659af2a8558a06fe7c9ecc3f51f8032a19304 (Azorult)
8a407de1e700212f976a48a5add1320ce16a8ff143f947d37c0858af206da20e (Azorult)
c1b45eb4ada3f1f2f07877ecd0ea59802fe8aac774bb41b214712e62c793648a (Fareit)
f2cd14694d8c043e2061c9c3820a760b1488648abf642ad52b856998a84d882c (Fareit)
27387ec53dfd8046f7c4bdcaed8d415b64710b5da5671e4e21f1a94efaddc5a4 (Lokibot)
d8cae304584b879934aa18e2f8e5434b29924ac3782955bf83f9b91e59a07303 (Lokibot)
f767831e5211083b12c553edb8e98eba8cbbe31abb8968cf5f4ac59443635fc7 (Lokibot)
393ad71e5604b74db67d6da6151015e26edbf55f977625c994269941994b85b7 (LimeRAT)
476e9763487384a9bd699cb05a83ffe6d2e85bce3211c9c9e5fc93c14f89fded (LimeRAT)
b65a74a2e9780a5a3c10974f6f5c1c2caa10ab7881e2f5e58b109231c01a4b23 (Phoenix)
014270226811bd61200bf58979c21f3a2a73f0f97e6119bcd45ec885894186e6 (AgentTeslav2)
0e499165632f9158f7a3a43c51708e3dd374d6d303e8ea2c1de2aec7f0862128 (AgentTeslav2)
816977411046f0569a482b704f5595d795816f4dd51a5f094af4ec99a89b03a7 (AgentTeslav2)
a0eb0137818ad7c4a63ed7c037fef7a1146729dcac8fa1b48e5a03c34d4e8503 (AgentTeslav2)
a61d0b049b1f6c145654281086d884f1b46442d0c09404300df1b55464737a60 (AgentTeslav2)
a4ebcec251be27fd43ae50cd5ed0ef126cc26e91bb10d29bb23b2956732c797d (AgentTeslav2)
ae07f36938ffa08f12e20e9d73c407b2295bb5e3e7b3f64b46aa54f255a84af1 (AgentTeslav2)
d126ff6b8868fe839dcd29e7cbf2fd1966d49d5ad8320dd086f49969fd9b7b6e (AgentTeslav2)
e6b629c5ca555786431543aac8afdd9f1561af2470be80713be7e98d00b45f72 (AgentTeslav2)

[doomedraven]

nice thanks