Nuevo malware que roba datos y propaga mails tipo spam publicitando financiación de viagra, solo detectado por 43,9 % AV

Un nuevo engendro que aun no es detectado por los principales antivirus, se propaga por mail como si fuera un spam, haciendo propaganda de financiación para compras de farmacia ONLINE, ofreciendo viagras y drogas “eréctiles” igual que si de un simple spam se tratara.

Hace dias que no nos encontrabamos con virus de este tipo, y mas disfrazados de spam de viagras… y lo malo es que aun no lo controlan la mayoria de antivirus, por lo que debe saber a qué atenerse a la recepcion de dichos mails

Lo pasamos a controlar con el ELISTARA de hoy 18.84, pero ya ahora mismo se detecta y controla con el ELIMD5, aplicando la cadena

44fa40faf361470cd2f21b464eecf355

El analisis de VirusTotal sobre la muestra recibida nos indica aun solo 43,9 % de antivirus lo detectan, y ni lo detectan antivirus tan conocidos AVG, Bit Defender, E-Safe, F-prot, NOD-32, Panda, Symantec o Trend, asi que si se utiliza no de ellos, mucho cuidado .

File sever.exe received on 2009.06.17 11:08:50 (UTC)
Current status: finished

Result: 18/41 (43.90%)

 Compact Print results  Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.17 Trojan.Crypt!IK
AhnLab-V3 5.0.0.2 2009.06.17 Win32/Mailer.worm.432128
AntiVir 7.9.0.187 2009.06.17 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.1 2009.06.17 –
Authentium 5.1.2.4 2009.06.16 –
Avast 4.8.1335.0 2009.06.16 Win32:Walivun
AVG 8.5.0.339 2009.06.17 –
BitDefender 7.2 2009.06.17 –
CAT-QuickHeal 10.00 2009.06.17 I-Worm.Iksmas.chv
ClamAV 0.94.1 2009.06.17 –
Comodo 1349 2009.06.17 –
DrWeb 5.0.0.12182 2009.06.17 Trojan.Spambot.4331
eSafe 7.0.17.0 2009.06.16 –
eTrust-Vet 31.6.6564 2009.06.17 –
F-Prot 4.4.4.56 2009.06.16 –
F-Secure 8.0.14470.0 2009.06.17 Email-Worm.Win32.Iksmas.chv
Fortinet 3.117.0.0 2009.06.17 tor.FH
NOD32 4162 2009.06.17 –
Norman 6.01.09 2009.06.16 –
nProtect 2009.1.8.0 2009.06.17 –
Panda 10.0.0.14 2009.06.16 –
PCTools 4.4.2.0 2009.06.12 –
Prevx 3.0 2009.06.17 Medium Risk Malware
Rising 21.34.23.00 2009.06.17 –
Sophos 4.42.0 2009.06.17 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.17 Email-Worm.Win32.Waledac.Gen (v)
Symantec 1.4.4.12 2009.06.17 –
TheHacker 6.3.4.3.347 2009.06.17 –
TrendMicro 8.950.0.1094 2009.06.17 –
VBA32 3.12.10.7 2009.06.17 Trojan.Win32.Waledac
ViRobot 2009.6.17.1792 2009.06.17 –
VirusBuster 4.6.5.0 2009.06.16 –
Additional information
File size: 432128 bytes
MD5   : 44fa40faf361470cd2f21b464eecf355
SHA1  : bb90fd044c2d91be82f07ac84955730ac0901502

The new Conficker worm (also known as Kido) downloaded scareware – a fake antivirus application offer on infected users’ PCs. It also downloaded the Waledac spam worm also known as Email-Worm.Win32.Iksmas.atz. “Over a 12-hour period, Iksmas connected to its control centers around the globe a number of times and received commands to send out spam mailings. In just 12 hours, one bot alone sent out 42,298 spam messages,” Aleks Gostev, head of Kaspersky Lab’s Global Research and Analysis Team, said in a statement.
Gostev noted that Kaspersky detected over 40,000 domains being used as part of the spam attack with most of the sites located in China. “A simple calculation shows that one Iksmas bot sends out around 80 000 emails in 24 hours,” Gostev commented. “Assuming that there are 5 million infected machines out there, the botnet could send out about 400 billion spam messages over a 24-hour period!”
That sure is a lot of spam. In my opinion, there are a few assumptions in Gostev’s analysis of the total spam volume. It assumes that the bot wouldn’t be detected or blocked over the course of the 24 hour period. That’s the trouble with bots, dormant they can be difficult to detect. But once they start doing stuff, it’s not that hard to see the anomalous activity.
 Fuente