Otra variante del veterano VUNDO 5 solo detectada por 7 de los 43 AV

Detectada por la heuristica del ELISTARA, llega otra muestra de la familia VUNDO5:

File name: BYWTSQ.DLL.Muestra EliStartPage v22.05
Submission date: 2010-11-23 10:50:27 (UTC)
Current status: queued queued analysing finished
Result: 7/ 43 (16.3%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.21.01 2010.11.21 –
AntiVir 7.10.14.56 2010.11.21 –
Antiy-AVL 2.0.3.7 2010.11.22 –
Avast 4.8.1351.0 2010.11.21 –
Avast5 5.0.594.0 2010.11.21 –
AVG 9.0.0.851 2010.11.21 –
BitDefender 7.2 2010.11.22 Gen:Variant.Kazy.3771
CAT-QuickHeal 11.00 2010.11.09 –
ClamAV 0.96.4.0 2010.11.21 –
Command 5.2.11.5 2010.11.21 –
Comodo 6802 2010.11.22 –
DrWeb 5.0.2.03300 2010.11.22 –
Emsisoft 5.0.0.50 2010.11.22 –
eSafe 7.0.17.0 2010.11.21 –
eTrust-Vet 36.1.7992 2010.11.22 –
F-Prot 4.6.2.117 2010.11.21 –
F-Secure 9.0.16160.0 2010.11.22 Gen:Variant.Kazy.3771
Fortinet 4.2.254.0 2010.11.20 –
GData 21 2010.11.22 Gen:Variant.Kazy.3771
Ikarus T3.1.1.90.0 2010.11.22 –
Jiangmin 13.0.900 2010.11.20 –
K7AntiVirus 9.68.3041 2010.11.20 –
Kaspersky 7.0.0.125 2010.11.22 –
McAfee 5.400.0.1158 2010.11.22 Generic Obfuscated.g
McAfee-GW-Edition 2010.1C 2010.11.22 –
Microsoft 1.6402 2010.11.22 –
NOD32 5637 2010.11.21 a variant of Win32/Kryptik.IHN
Norman 6.06.10 2010.11.21 –
nProtect 2010-11-22.01 2010.11.22 Gen:Variant.Kazy.3771
Panda 10.0.2.7 2010.11.21 Suspicious file
PCTools 7.0.3.5 2010.11.22 –
Prevx 3.0 2010.11.23 –
Rising 22.74.06.03 2010.11.22 –
Sophos 4.59.0 2010.11.22 –
SUPERAntiSpyware 4.40.0.1006 2010.11.22 –
Symantec 20101.2.0.161 2010.11.22 –
TheHacker 6.7.0.1.087 2010.11.20 –
TrendMicro 9.120.0.1004 2010.11.22 –
TrendMicro-HouseCall 9.120.0.1004 2010.11.22 –
VBA32 3.12.14.2 2010.11.19 –
VIPRE 7376 2010.11.22 –
ViRobot 2010.11.20.4158 2010.11.22 –
VirusBuster 13.6.52.1 2010.11.21 –
Additional informationShow all 
MD5   : 0da643712a79ff912657876b215183c2
SHA1  : af759a15b0257032715d1de8b74a947eb2c19f45
SHA256: 0017d5c4944dabe8630d30ad0982f48105c797a3dd1dd013a2b0743ef55a5428
ssdeep: 1536:vFOwiLoKZjMDwsvWuwfwzbHrwvlSrySAC8fRkkov3LT7RP7iMinKMMiU1aoauY:vTm4f9y
sbMvlS+S8RkkujRyKMMiU1m9
File size : 116224 bytes
First seen: 2010-11-22 16:21:00
Last seen : 2010-11-23 10:50:27
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: foobar2000.org
copyright….: (c) Peter Pawlowski. All rights reserved.
product……: foobar2000
description..: foobar2000
original name: foobar2000_0.9.2.exe
internal name: n/a
file version.: 0.9.2
 
Sin duda es reciente, dados los pocos antivirus que actualmente la controlan 7 de los 43 AV del VirusTotal.

La pasamos a controlar a partir del ELISTARA 22.06

saludos

ms, 23-11-2010