Nueva gama de FakeTools pasa a ser controlada heuristicamente por el ELISTARA

Si bien ya controlamos exhaustivamente las muestras solicitadas de los FAKE TOOLS, por el ELISTARA, que nos llegan para analizar, el caso es que el sistema heuristico al respecto ha tenido que ser renovado al cambiar la ubicacion y sistema de las nuevas versiones de la nueva gama de FAKE SYSDEF que han empezado a aparecer hoy, de diferente comportamiento respecto a los conocidos hasta el momento.

Por ello a partir de la version de hoy del ELISTARA 22.24 se pasará a pedir muestras basandonos en los nuevos metodos, sin despreciar los antiguos.

Así podremos “cazar” y pedir muestras de ficheros como estos dos que hemos tenido que solicitar basandonos en los informes del SPROCES:

File name: ctnKGbMoGI.vir
Submission date: 2010-12-21 13:03:21 (UTC)
Current status: finished
Result: 10 /43 (23.3%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.12.21.03 2010.12.21 –
AntiVir 7.11.0.117 2010.12.21 –
Antiy-AVL 2.0.3.7 2010.12.21 –
Avast 4.8.1351.0 2010.12.21 Win32:FakeSysdef-G
Avast5 5.0.677.0 2010.12.21 Win32:FakeSysdef-G
AVG 9.0.0.851 2010.12.21 –
BitDefender 7.2 2010.12.21 Gen:Variant.Kazy.6275
CAT-QuickHeal 11.00 2010.12.21 –
ClamAV 0.96.4.0 2010.12.21 –
Command 5.2.11.5 2010.12.21 –
Comodo 7135 2010.12.21 –
DrWeb 5.0.2.03300 2010.12.21 –
Emsisoft 5.1.0.1 2010.12.21 –
eSafe 7.0.17.0 2010.12.19 –
eTrust-Vet 36.1.8052 2010.12.21 –
F-Prot 4.6.2.117 2010.12.20 –
F-Secure 9.0.16160.0 2010.12.21 Gen:Variant.Kazy.6275
Fortinet 4.2.254.0 2010.12.21 W32/Krap.GAO!tr
GData 21 2010.12.21 Gen:Variant.Kazy.6275
Ikarus T3.1.1.90.0 2010.12.21 –
Jiangmin 13.0.900 2010.12.21 –
K7AntiVirus 9.73.3296 2010.12.20 –
Kaspersky 7.0.0.125 2010.12.21 Packed.Win32.Krap.ao
McAfee 5.400.0.1158 2010.12.21 –
McAfee-GW-Edition 2010.1C 2010.12.21 –
Microsoft 1.6402 2010.12.21 –
NOD32 5720 2010.12.21 a variant of Win32/Kryptik.JBF
Norman 6.06.12 2010.12.21 –
nProtect 2010-12-21.01 2010.12.21 –
Panda 10.0.2.7 2010.12.20 Suspicious file
PCTools 7.0.3.5 2010.12.21 –
Prevx 3.0 2010.12.21 –
Rising 22.79.00.04 2010.12.21 –
Sophos 4.60.0 2010.12.21 –
SUPERAntiSpyware 4.40.0.1006 2010.12.21 Trojan.Agent/Gen-FakeSoft
Symantec 20101.3.0.103 2010.12.21 –
TheHacker 6.7.0.1.104 2010.12.21 –
TrendMicro 9.120.0.1004 2010.12.21 –
TrendMicro-HouseCall 9.120.0.1004 2010.12.21 –
VBA32 3.12.14.2 2010.12.20 –
VIPRE 7744 2010.12.21 –
ViRobot 2010.12.20.4210 2010.12.21 –
VirusBuster 13.6.105.1 2010.12.21 –
Additional informationShow all 
MD5   : c929dc8543bfa9ce503a6bd17bb0adaf
SHA1  : 56dd5a30f2cf9cc27658b5e2be1d60b940b4749a

File size : 458752 bytes

publisher….: MediaPlayer software
copyright….: (c) MediaPlayer Software.
product……: MediaPlayer software
description..: mediaplayer
original name: mediaplay
internal name: mediaplayer
file version.: 4747
 

y paralelamente tambien este otro:
File name: jleEjKNDDi.VIR
Submission date: 2010-12-21 13:01:28 (UTC)
Current status: finished
Result: 14 /43 (32.6%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.12.21.03 2010.12.21 –
AntiVir 7.11.0.117 2010.12.21 –
Antiy-AVL 2.0.3.7 2010.12.21 –
Avast 4.8.1351.0 2010.12.21 Win32:FakeSysdef-G
Avast5 5.0.677.0 2010.12.21 Win32:FakeSysdef-G
AVG 9.0.0.851 2010.12.21 –
BitDefender 7.2 2010.12.21 Gen:Variant.Kazy.6252
CAT-QuickHeal 11.00 2010.12.21 –
ClamAV 0.96.4.0 2010.12.21 –
Command 5.2.11.5 2010.12.21 –
Comodo 7135 2010.12.21 –
DrWeb 5.0.2.03300 2010.12.21 –
Emsisoft 5.1.0.1 2010.12.21 –
eSafe 7.0.17.0 2010.12.19 –
eTrust-Vet 36.1.8052 2010.12.21 –
F-Prot 4.6.2.117 2010.12.20 –
F-Secure 9.0.16160.0 2010.12.21 Gen:Variant.Kazy.6252
Fortinet 4.2.254.0 2010.12.21 W32/Krap.GAO!tr
GData 21 2010.12.21 Gen:Variant.Kazy.6252
Ikarus T3.1.1.90.0 2010.12.21 –
Jiangmin 13.0.900 2010.12.21 –
K7AntiVirus 9.73.3296 2010.12.20 –
Kaspersky 7.0.0.125 2010.12.21 Packed.Win32.Krap.ao
McAfee 5.400.0.1158 2010.12.21 –
McAfee-GW-Edition 2010.1C 2010.12.21 –
Microsoft 1.6402 2010.12.21 –
NOD32 5720 2010.12.21 a variant of Win32/Kryptik.JBF
Norman 6.06.12 2010.12.21 –
nProtect 2010-12-21.01 2010.12.21 Gen:Variant.Kazy.6252
Panda 10.0.2.7 2010.12.20 Suspicious file
PCTools 7.0.3.5 2010.12.21 –
Prevx 3.0 2010.12.21 Medium Risk Malware Dropper
Rising 22.79.00.04 2010.12.21 Packer.Win32.Agent.bk
Sophos 4.60.0 2010.12.21 –
SUPERAntiSpyware 4.40.0.1006 2010.12.21 Trojan.Agent/Gen-FakeSoft
Symantec 20101.3.0.103 2010.12.21 Suspicious.Cloud.5
TheHacker 6.7.0.1.104 2010.12.21 –
TrendMicro 9.120.0.1004 2010.12.21 –
TrendMicro-HouseCall 9.120.0.1004 2010.12.21 –
VBA32 3.12.14.2 2010.12.20 –
VIPRE 7744 2010.12.21 –
ViRobot 2010.12.20.4210 2010.12.21 –
VirusBuster 13.6.105.1 2010.12.21 –
Additional informationShow all 
MD5   : f412394c3e4cce9beb5ed0fd0976f233
SHA1  : 5e4462a567d8653989c628bf52764a7146c0e48c
File size : 533504 bytes
publisher….: MOSE software
copyright….: (c) MOSE Software.
product……: MOE software
description..: mplayer
original name: mplayer
internal name: mplayer
file version.: 0.144
 

y paralelamente:

File name: yIQ8TbLAn6iyw.VIR
Submission date: 2010-12-21 12:58:26 (UTC)
Current status: finished
Result: 13 /43 (30.2%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.12.21.03 2010.12.21 –
AntiVir 7.11.0.117 2010.12.21 –
Antiy-AVL 2.0.3.7 2010.12.21 –
Avast 4.8.1351.0 2010.12.21 Win32:FakeSysdef-G
Avast5 5.0.677.0 2010.12.21 Win32:FakeSysdef-G
AVG 9.0.0.851 2010.12.21 –
BitDefender 7.2 2010.12.21 Gen:Variant.Kazy.6268
CAT-QuickHeal 11.00 2010.12.21 (Suspicious) – DNAScan
ClamAV 0.96.4.0 2010.12.21 –
Command 5.2.11.5 2010.12.21 –
Comodo 7135 2010.12.21 –
DrWeb 5.0.2.03300 2010.12.21 –
Emsisoft 5.1.0.1 2010.12.21 –
eSafe 7.0.17.0 2010.12.19 –
eTrust-Vet 36.1.8052 2010.12.21 –
F-Prot 4.6.2.117 2010.12.20 –
F-Secure 9.0.16160.0 2010.12.21 Gen:Variant.Kazy.6268
Fortinet 4.2.254.0 2010.12.21 –
GData 21 2010.12.21 Gen:Variant.Kazy.6268
Ikarus T3.1.1.90.0 2010.12.21 –
Jiangmin 13.0.900 2010.12.21 –
K7AntiVirus 9.73.3296 2010.12.20 –
Kaspersky 7.0.0.125 2010.12.21 Packed.Win32.Krap.ao
McAfee 5.400.0.1158 2010.12.21 –
McAfee-GW-Edition 2010.1C 2010.12.21 –
Microsoft 1.6402 2010.12.21 –
NOD32 5720 2010.12.21 a variant of Win32/Kryptik.JBF
Norman 6.06.12 2010.12.21 –
nProtect 2010-12-21.01 2010.12.21 Gen:Variant.Kazy.6268
Panda 10.0.2.7 2010.12.20 Suspicious file
PCTools 7.0.3.5 2010.12.21 –
Prevx 3.0 2010.12.21 –
Rising 22.79.00.04 2010.12.21 Packer.Win32.Agent.bk
Sophos 4.60.0 2010.12.21 –
SUPERAntiSpyware 4.40.0.1006 2010.12.21 Trojan.Agent/Gen-FakeSoft
Symantec 20101.3.0.103 2010.12.21 Suspicious.Cloud.5
TheHacker 6.7.0.1.104 2010.12.21 –
TrendMicro 9.120.0.1004 2010.12.21 –
TrendMicro-HouseCall 9.120.0.1004 2010.12.21 –
VBA32 3.12.14.2 2010.12.20 –
VIPRE 7744 2010.12.21 –
ViRobot 2010.12.20.4210 2010.12.21 –
VirusBuster 13.6.105.1 2010.12.21 –
Additional informationShow all 
MD5   : 183628a5bd144a63db0ca1b259f3dc07
SHA1  : 8543d00bad2859d6438eb9da497c3e691b3ebfac
SHA256: c9372a74b859472d75d46f36dbeffce8c0d7acae313b6c28c5ea224801545b8f
ssdeep: 6144:jNjjU2hCntFyGl60FRytQs8s/bFPozke/K8vIs269SaodZUDgmLqZ/1QjqzJwQF0:5jjU2
h8XlbytQs8yZozVys2GSa22DBkW
File size : 377344 bytes
First seen: 2010-12-21 12:58:26
Last seen : 2010-12-21 12:58:26
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable Generic (38.3%)
Win32 Dynamic Link Library (generic) (34.1%)
Win16/32 Executable Delphi generic (9.3%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
sigcheck:
publisher….: Optimization Corporation
copyright….: (c) Optimization Software . All rights reserved.
product……: Optimization
description..: Optimization
original name: Optimization
internal name: Optimization
file version.: 10
 
A partir de la version de hoy del ELISTARA 22.24, QUE ESTARÁ DISPONIBLE A PARTIR DE LAS 19 HORAS EN NUESTRA WEB, ya se controlarán estas nuevas variantes

saludos

ms, 21-12-2010

NOTA  :  Esta gama se identifica como DISK REPAIR, asi que el ELISTARA las detectará como FAKE TOOL DISK REPAIR