Nueva variante de AUTORUN.VBML cazado heuristicamente por el ELISTARA

Una nueva muestra “aparcada” por el ELISTARA ha resultado ser una nueva variante del AUTORUN.VBML que pasamos a controlar a partir de la version 22.02 del ELISTARA
File name: WINLOGON.EXE.Muestra EliStartPage v22.01
Submission date: 2010-11-16 15:51:07 (UTC)
Result: 21/ 39 (53.8%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AntiVir 7.10.14.11 2010.11.16 Worm/Esfury.A.361
Antiy-AVL 2.0.3.7 2010.11.16 –
Avast 4.8.1351.0 2010.11.16 Win32:AutoRun-BPN
Avast5 5.0.594.0 2010.11.16 Win32:AutoRun-BPN
AVG 9.0.0.851 2010.11.16 Worm/Generic2.GLB
BitDefender 7.2 2010.11.16 Trojan.Generic.5068231
CAT-QuickHeal 11.00 2010.11.09 –
ClamAV 0.96.4.0 2010.11.16 –
Command 5.2.11.5 2010.11.16 –
Comodo 6741 2010.11.16 UnclassifiedMalware
DrWeb 5.0.2.03300 2010.11.16 –
Emsisoft 5.0.0.50 2010.11.16 Trojan.Win32.Agent!A2
eSafe 7.0.17.0 2010.11.16 –
eTrust-Vet 36.1.7980 2010.11.16 –
F-Prot 4.6.2.117 2010.11.16 –
F-Secure 9.0.16160.0 2010.11.16 Trojan.Generic.5068231
Fortinet 4.2.249.0 2010.11.15 W32/SillyFDC.G!tr
GData 21 2010.11.16 Trojan.Generic.5068231
Ikarus T3.1.1.90.0 2010.11.16 –
Jiangmin 13.0.900 2010.11.16 –
K7AntiVirus 9.67.2973 2010.11.12 –
Kaspersky 7.0.0.125 2010.11.16 –
McAfee 5.400.0.1158 2010.11.16 Generic.dx!uqf
McAfee-GW-Edition 2010.1C 2010.11.16 Heuristic.BehavesLike.Win32.Downloader.A
Microsoft 1.6301 2010.11.16 Worm:Win32/Esfury
NOD32 5624 2010.11.16 Win32/AutoRun.VB.UG
nProtect 2010-11-16.02 2010.11.16 Trojan.Generic.5068231
Panda 10.0.2.7 2010.11.15 W32/Esfury.O.worm
PCTools 7.0.3.5 2010.11.16 Email-Worm.Rontokbro!rem
Prevx 3.0 2010.11.16 Medium Risk Malware
Rising 22.74.00.01 2010.11.16 –
Sophos 4.59.0 2010.11.16 Mal/SillyFDC-G
SUPERAntiSpyware 4.40.0.1006 2010.11.16 –
TheHacker 6.7.0.1.085 2010.11.16 –
TrendMicro 9.120.0.1004 2010.11.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.11.16 –
VBA32 3.12.14.2 2010.11.15 –
VIPRE 7325 2010.11.16 Worm.Win32.Esfury
ViRobot 2010.11.16.4151 2010.11.16 –
Additional informationShow all 
MD5   : d8d245506df4afb21ce296a93fa042e9
SHA1  : d82b18f62856c3ff2cb9cf529c38a10265f7c427
SHA256: 99d04aa0a8ff9c845b67b40cbb143ea299ab960f54f173b552825e7561f9be46
ssdeep: 1536:9cjd75QPYyM+haVCpR/orFNbXV8l0ByhuhgpHFr3+nouy8o0:yjdiPYydUVCptoZJC6pil
r3eouto
File size : 65536 bytes
First seen: 2010-11-11 00:33:06
Last seen : 2010-11-16 15:51:07
TrID:
UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda’s Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: x3bP47ofeod3
description..: n/a
original name: 0.exe
internal name: 0
file version.: 1.00
 
Como sea que se propaga a traves de pendrive, se recomienda vacunar ordenadores y pendrives con el ELIPEN.EXE

La version ELISTARA 22.02 que lo controla estará disponible a partir de las 19 horas de hoy en nuestra web.

saludos

ms, 16-11-2010