Nueva variante de TROJAN DOWNLOADER CUTWAIL

McAfee avisa de una nueva deteccion a partir de los DAT 5932 de mañana, de una nueva variante de CUTWAIL, del que si el ELISTARA no lo detecta y elimina, lo aparcará y pedirá muestra para analizar y controlar:

Información de McAfee al respecto:

Cutwail!6393442E

Type
    Trojan
SubType
    Win32
Discovery Date
    03/25/2010
Length
    55,296 Bytes
Minimum DAT
    5932 (03/26/2010)
Updated DAT
    5932 (03/26/2010)
Minimum Engine
    5.3.00
Description Added
    03/25/2010
Description Modified
    03/25/2010 3:02 AM (PT)
    * Mal/FakeAV-AX [Sophos]

    * Trojan.DownLoad.37236 [Dr.Web]

    * Trojan.Downloader.Cutwail.S [BitDefender]

    * Trojan.Win32.Pakes.nrv [Kaspersky]

    * TrojanDownloader:Win32/Cutwail.gen!C [Microsoft]

Characteristics

— Update March 25, 2010 —
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:   http://www.theregister.co.uk/2010/03/22/microsoft_live_captcha_bypass/
—

When executed, this malware drops the following files:

    * %UserProfile%\reader_s.exe [Copy of malware]
    * %System%\reader_s.exe [Copy of malware]
    * %System%\dllcache\ndis.sys [Detected as Cutwail.gen]

The malware then injects its code into the Windows svchost.exe process.

Note:

    * %UserProfile% is a variable that specifies the current user’s profile folder
    * %System% is a variable that refers to the System folder

The malware creates the following registry entries:

    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    * HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
      reader_s = “%System%\reader_s.exe”

This ensures that the malware runs every time Windows starts

The malware attempts to connet to the following IP addresses on port 25:

    * 115.84.164.86
    * 128.174.5.46
    * 159.204.58.46
    * 193.201.39.6
    * 194.154.164.60
    * 195.10.21.211
    * 203.246.159.80
    * 205.237.99.175
    * 208.65.144.12
    * 208.80.204.33

The malware attempts to connet to the following IP addresses on port 80:

    * 221.230.2.208

 
Symptoms

    * Unexpected HTTP/SMTP connections
    * Presence of files and registry keys mentioned above

 Fuente
saludos

ms, 25-3-2010