Descargas efectuadas por el ultimo Worm VBNA analizado hoy (y controlado por el ELIVBNA 2.12)

Como con otras variantes del WORM VBNA , nos ha descargadao e instalado en el ordenador en el que se monitorizaba, los malwares de las cuatro familias típicas, ademas de insertar en el MBR el Rootkit implantado por el

ALUREON:

ALUREON (1 de los dos temporales, que copia como EXE y DLL respectivamente)

File name: 8.tmp
Submission date: 2011-03-28 14:29:15 (UTC)
Current status: queued (#8) queued analysing finished
Result: 13/ 43 (30.2%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.03.26.00 2011.03.25 Trojan/Win32.Tdss
AntiVir 7.11.5.79 2011.03.25 –
Antiy-AVL 2.0.3.7 2011.03.26 –
Avast 4.8.1351.0 2011.03.26 –
Avast5 5.0.677.0 2011.03.26 –
AVG 10.0.0.1190 2011.03.26 –
BitDefender 7.2 2011.03.26 Gen:Variant.Kazy.16907
CAT-QuickHeal 11.00 2011.03.26 –
ClamAV 0.96.4.0 2011.03.26 –
Commtouch 5.2.11.5 2011.03.24 –
Comodo 8111 2011.03.26 –
DrWeb 5.0.2.03300 2011.03.26 BackDoor.Tdss.based.7
Emsisoft 5.1.0.4 2011.03.26 –
eSafe 7.0.17.0 2011.03.24 –
eTrust-Vet 36.1.8236 2011.03.25 Win32/TDSS.G!generic
F-Prot 4.6.2.117 2011.03.26 –
F-Secure 9.0.16440.0 2011.03.23 –
Fortinet 4.2.254.0 2011.03.26 –
GData 21 2011.03.26 Gen:Variant.Kazy.16907
Ikarus T3.1.1.97.0 2011.03.26 –
Jiangmin 13.0.900 2011.03.26 –
K7AntiVirus 9.94.4219 2011.03.26 –
Kaspersky 7.0.0.125 2011.03.26 –
McAfee 5.400.0.1158 2011.03.26 Artemis!8A4D0BCBFC56
McAfee-GW-Edition 2010.1C 2011.03.26 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Trojan.B
Microsoft 1.6702 2011.03.26 Trojan:Win32/Alureon.DX
NOD32 5987 2011.03.26 a variant of Win32/Kryptik.LYD
Norman 6.07.03 2011.03.26 –
nProtect 2011-02-10.01 2011.02.15 –
Panda 10.0.3.5 2011.03.26 Trj/Alureon.CN
PCTools 7.0.3.5 2011.03.26 –
Prevx 3.0 2011.03.28 Medium Risk Malware
Rising 23.50.05.05 2011.03.26 –
Sophos 4.64.0 2011.03.26 –
SUPERAntiSpyware 4.40.0.1006 2011.03.26 –
Symantec 20101.3.0.103 2011.03.26 –
TheHacker 6.7.0.1.157 2011.03.26 –
TrendMicro 9.200.0.1012 2011.03.26 –
TrendMicro-HouseCall 9.200.0.1012 2011.03.26 –
VBA32 3.12.14.3 2011.03.25 Trojan.TDSS.7
VIPRE 8825 2011.03.26 Packed.Win32.Tdss.Gen (v)
ViRobot 2011.3.26.4378 2011.03.26 –
VirusBuster 13.6.270.0 2011.03.25 –
Additional informationShow all
MD5   : 8a4d0bcbfc562cba895593ffb837b93e
SHA1  : 3ab97a1ab769d7bb59d4158d7243fa1601df2907

File size : 129024 bytes

publisher….: Cadillac
copyright….: Cadillac
product……: Cadillac
description..: Cadillac
original name: Cadillac
internal name: Cadillac
file version.: 9,9,761,19193
comments…..: Cadillac

__________________
BOAXXE

File name: zsvcpyxk.dll
Submission date: 2011-03-28 14:30:21 (UTC)
Current status: queued (#9) queued (#1) analysing finished
Result: 12/ 43 (27.9%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.03.28.00 2011.03.28 –
AntiVir 7.11.5.94 2011.03.28 TR/Spy.739328.7
Antiy-AVL 2.0.3.7 2011.03.28 –
Avast 4.8.1351.0 2011.03.28 Win32:Kryptik-BAN
Avast5 5.0.677.0 2011.03.28 Win32:Kryptik-BAN
AVG 10.0.0.1190 2011.03.28 –
BitDefender 7.2 2011.03.28 Gen:Trojan.Heur.TC8ayGVarRic
CAT-QuickHeal 11.00 2011.03.28 –
ClamAV 0.96.4.0 2011.03.28 –
Commtouch 5.2.11.5 2011.03.24 W32/Boaxxe.F.gen!Eldorado
Comodo 8133 2011.03.28 –
DrWeb 5.0.2.03300 2011.03.28 –
Emsisoft 5.1.0.4 2011.03.28 –
eSafe 7.0.17.0 2011.03.27 –
eTrust-Vet 36.1.8239 2011.03.28 Win32/Boaxxe.GA
F-Prot 4.6.2.117 2011.03.28 W32/Boaxxe.F.gen!Eldorado
F-Secure 9.0.16440.0 2011.03.23 Gen:Trojan.Heur.TC8ayGVarRic
Fortinet 4.2.254.0 2011.03.28 –
GData 21 2011.03.28 Gen:Trojan.Heur.TC8ayGVarRic
Ikarus T3.1.1.97.0 2011.03.28 –
Jiangmin 13.0.900 2011.03.28 –
K7AntiVirus 9.94.4231 2011.03.28 Riskware
Kaspersky 7.0.0.125 2011.03.28 –
McAfee 5.400.0.1158 2011.03.28 Suspect-AB!DEC894155585
McAfee-GW-Edition 2010.1C 2011.03.28 –
Microsoft 1.6702 2011.03.28 –
NOD32 5993 2011.03.28 –
Norman 6.07.03 2011.03.28 –
nProtect 2011-02-10.01 2011.02.15 –
Panda 10.0.3.5 2011.03.27 –
PCTools 7.0.3.5 2011.03.26 –
Prevx 3.0 2011.03.28 –
Rising 23.51.00.06 2011.03.28 –
Sophos 4.64.0 2011.03.28 –
SUPERAntiSpyware 4.40.0.1006 2011.03.28 PotentiallyUnwanted.TioIE
Symantec 20101.3.0.103 2011.03.28 –
TheHacker 6.7.0.1.159 2011.03.28 –
TrendMicro 9.200.0.1012 2011.03.28 –
TrendMicro-HouseCall 9.200.0.1012 2011.03.28 –
VBA32 3.12.14.3 2011.03.28 –
VIPRE 8847 2011.03.28 –
ViRobot 2011.3.28.4380 2011.03.28 –
VirusBuster 13.6.273.0 2011.03.28 –
Additional informationShow all
MD5   : dec8941555853e6b7e70b47def55cf85
SHA1  : 8544f1fc115917af8eba6dd090a2228f5fb75ec8

File size : 739328 bytes

publisher….: zebbwzajut Corporation
copyright….: (c) zebbwzajut Corporation. All rights reserved.
product……: Microsoft_ Windows_ Operating System
description..: tioieija DLL
original name: tioieija.dll
internal name: tioieija
file version.: 5.1.2600.5167

_____________________

KATUSHA (1 de los 4, el que descarga el FA Renos)
File name: Knf.exe
Submission date: 2011-03-28 14:37:51 (UTC)
Current status: queued (#7) queued analysing finished
Result: 6/ 43 (14.0%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.03.26.00 2011.03.25 –
AntiVir 7.11.5.79 2011.03.25 –
Antiy-AVL 2.0.3.7 2011.03.26 –
Avast 4.8.1351.0 2011.03.26 –
Avast5 5.0.677.0 2011.03.26 –
AVG 10.0.0.1190 2011.03.26 –
BitDefender 7.2 2011.03.26 –
CAT-QuickHeal 11.00 None.. –
ClamAV 0.96.4.0 2011.03.26 –
Commtouch 5.2.11.5 2011.03.24 –
Comodo 8111 2011.03.26 Packed.Win32.Krap.AS
DrWeb 5.0.2.03300 2011.03.26 –
Emsisoft 5.1.0.4 2011.03.26 –
eSafe 7.0.17.0 2011.03.24 –
eTrust-Vet 36.1.8236 2011.03.25 Win32/Renos.D!generic
F-Prot 4.6.2.117 2011.03.26 –
F-Secure 9.0.16440.0 2011.03.23 –
Fortinet 4.2.254.0 2011.03.26 W32/PackZbot.D!tr
GData 21 2011.03.26 –
Ikarus T3.1.1.97.0 2011.03.26 –
Jiangmin 13.0.900 2011.03.26 –
K7AntiVirus 9.94.4219 2011.03.26 –
Kaspersky 7.0.0.125 2011.03.26 –
McAfee 5.400.0.1158 2011.03.26 –
McAfee-GW-Edition 2010.1C 2011.03.26 –
Microsoft 1.6702 2011.03.26 –
NOD32 5987 2011.03.26 –
Norman 6.07.03 2011.03.26 –
nProtect 2011-02-10.01 2011.02.15 –
Panda 10.0.3.5 2011.03.26 –
PCTools 7.0.3.5 2011.03.26 –
Prevx 3.0 2011.03.28 Medium Risk Malware
Rising 23.50.05.05 2011.03.26 –
Sophos 4.64.0 2011.03.26 Mal/FakeAV-IZ
SUPERAntiSpyware 4.40.0.1006 2011.03.26 –
Symantec 20101.3.0.103 2011.03.26 Suspicious.Cloud.5
TheHacker 6.7.0.1.157 2011.03.26 –
TrendMicro 9.200.0.1012 2011.03.26 –
TrendMicro-HouseCall 9.200.0.1012 2011.03.26 –
VBA32 3.12.14.3 2011.03.25 –
VIPRE 8825 2011.03.26 –
ViRobot 2011.3.26.4378 2011.03.26 –
VirusBuster 13.6.270.0 2011.03.25 –
Additional informationShow all
MD5   : 910d2c1e010dadab84b66483c1e20155
SHA1  : c2eb56301fc33356751ab3e3109525b7cce08f5c

File size : 221696 bytes

publisher….: Jordan Russell
copyright….: Copyright (c) 2010 s Setup Technologies
product……: G Internet Security 3
description..: I6 Setup Self-Extractor
original name: J5 Windows setup m3
internal name: J5 Windows setup m3
file version.: 3.0.0.0

________________

FAKE ALERT RENOS

File name: sshnas21.dll
Submission date: 2011-03-28 14:39:50 (UTC)
Current status: queued queued analysing finished
Result: 4/ 43 (9.3%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.03.26.00 2011.03.25 –
AntiVir 7.11.5.79 2011.03.25 –
Antiy-AVL 2.0.3.7 2011.03.26 –
Avast 4.8.1351.0 2011.03.26 –
Avast5 5.0.677.0 2011.03.26 –
AVG 10.0.0.1190 2011.03.26 –
BitDefender 7.2 2011.03.26 –
CAT-QuickHeal 11.00 2011.03.26 –
ClamAV 0.96.4.0 2011.03.26 –
Commtouch 5.2.11.5 2011.03.24 –
Comodo 8111 2011.03.26 –
DrWeb 5.0.2.03300 2011.03.26 –
Emsisoft 5.1.0.4 2011.03.26 –
eSafe 7.0.17.0 2011.03.24 –
eTrust-Vet 36.1.8236 2011.03.25 Win32/Renos.D!generic
F-Prot 4.6.2.117 2011.03.26 –
F-Secure 9.0.16440.0 2011.03.23 –
Fortinet 4.2.254.0 2011.03.26 W32/PackZbot.D!tr
GData 21 2011.03.26 –
Ikarus T3.1.1.97.0 2011.03.26 –
Jiangmin 13.0.900 2011.03.26 –
K7AntiVirus 9.94.4219 2011.03.26 –
Kaspersky 7.0.0.125 2011.03.26 –
McAfee 5.400.0.1158 2011.03.26 –
McAfee-GW-Edition 2010.1C 2011.03.26 –
Microsoft 1.6702 2011.03.26 –
NOD32 5987 2011.03.26 –
Norman 6.07.03 2011.03.26 –
nProtect 2011-02-10.01 2011.02.15 –
Panda 10.0.3.5 2011.03.26 –
PCTools 7.0.3.5 2011.03.26 –
Prevx 3.0 2011.03.28 Medium Risk Malware
Rising 23.50.05.05 2011.03.26 –
Sophos 4.64.0 2011.03.26 –
SUPERAntiSpyware 4.40.0.1006 2011.03.26 –
Symantec 20101.3.0.103 2011.03.26 –
TheHacker 6.7.0.1.157 2011.03.26 –
TrendMicro 9.200.0.1012 2011.03.26 –
TrendMicro-HouseCall 9.200.0.1012 2011.03.26 –
VBA32 3.12.14.3 2011.03.25 –
VIPRE 8825 2011.03.26 VirTool.Win32.Obfuscator.hg!b1 (v)
ViRobot 2011.3.26.4378 2011.03.26 –
VirusBuster 13.6.270.0 2011.03.25 –
Additional informationShow all
MD5   : 495ac4b874d711e4a49394ec2aa39477
SHA1  : 7f1e88997bdb4b9eb4dccff24357e56cd5aef982

File size : 180224 bytes

publisher….: Jordan Russell
copyright….: Copyright (c) 2010 Setup Technologies
product……: w Internet Security Or
description..: q Setup Self-Extractor CE
original name: Windows setup deG.dll
internal name: Windows setup deG.dll
file version.: 3.0.0.0

TOdas estas variantes serán controladas y eliminadas por el ELISTARA 22.80, que estará disponible en nuestra web a partir de las 19 h CET de hoy:

saludos

ms, 28-3-2011