Nueva variante de FAKE TOOL descargado por el Downloader DX-Diag del falso mail de “CORREOS”

El ya popular falso mail de correo masivo falsamente enviado por CORREOS, identificado como Downloader DX-Diag, descarga actualmente nuevo Dropper que genera nuevo scanner de una nueva familia, FAKE TOOL DATA REPAIR, que es cazado heuristicamente por el ELISTARA 23.96 y que pasamos a controlar especificamente a partir del ELISTARA 23.97 de hoy

El preanalisis de virustotal los dos (dropper y scanner) ofrece los siguientes informes:
Dropper

File name: Dropper FAKE TOOL DATA REPAIR.EXE.Muestra EliStartPage v23.96
Submission date: 2011-09-28 09:42:02 (UTC)
Current status: finished
Result: 14 /43 (32.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.27.01 2011.09.27 Trojan/Win32.Jorik
AntiVir 7.11.15.54 2011.09.28 –
Antiy-AVL 2.0.3.7 2011.09.28 –
Avast 6.0.1289.0 2011.09.27 –
AVG 10.0.0.1190 2011.09.28 Generic25.DEC
BitDefender 7.2 2011.09.28 Gen:Variant.Kazy.38815
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.28 (Suspicious) – DNAScan
ClamAV 0.97.0.0 2011.09.28 –
Commtouch 5.3.2.6 2011.09.28 –
Comodo 10270 2011.09.28 –
DrWeb 5.0.2.03300 2011.09.28 Trojan.Fakealert.25103
Emsisoft 5.1.0.11 2011.09.28 –
eSafe 7.0.17.0 2011.09.27 –
eTrust-Vet 36.1.8585 2011.09.27 –
F-Prot 4.6.2.117 2011.09.27 –
F-Secure 9.0.16440.0 2011.09.28 –
Fortinet 4.3.370.0 2011.09.28 –
GData 22 2011.09.28 Gen:Variant.Kazy.38815
Ikarus T3.1.1.107.0 2011.09.28 –
Jiangmin 13.0.900 2011.09.27 –
K7AntiVirus 9.113.5203 2011.09.27 Trojan
Kaspersky 9.0.0.837 2011.09.28 Trojan.Win32.FakeAV.emgo
McAfee 5.400.0.1158 2011.09.28 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.09.28 FakeAlert-SysDef.b
Microsoft 1.7702 2011.09.28 –
NOD32 6499 2011.09.28 –
Norman 6.07.11 2011.09.28 –
nProtect 2011-09-28.02 2011.09.28 Gen:Variant.Kazy.38815
Panda 10.0.3.5 2011.09.27 Trj/CI.A
PCTools 8.0.0.5 2011.09.28 –
Prevx 3.0 2011.09.28 –
Rising 23.77.01.04 2011.09.28 –
Sophos 4.69.0 2011.09.28 –
SUPERAntiSpyware 4.40.0.1006 2011.09.27 Trojan.Agent/Gen-FakeAntiSpy
Symantec 20111.2.0.82 2011.09.28 –
TheHacker 6.7.0.1.312 2011.09.27 –
TrendMicro 9.500.0.1008 2011.09.28 –
TrendMicro-HouseCall 9.500.0.1008 2011.09.28 –
VBA32 3.12.16.4 2011.09.27 –
VIPRE 10603 2011.09.28 –
ViRobot 2011.9.28.4693 2011.09.28 –
VirusBuster 14.0.236.1 2011.09.27 –
Additional informationShow all
MD5   : 54bbb7a2585130c3e152dfd3b073ab46
SHA1  : 98e37bd68cdaa067a07bc504ebff8bf9350908ff

File size : 458752 bytes

publisher….: NetPlay Software
copyright….: Copyright (C) 2002-2007
product……: Instant Demo
description..: Instant Demo Application
original name: InstantDemo.EXE
internal name: InstantDemo
file version.: 6, 50, 56, 0
__________

scanner:

File name: Scanner FAKE TOOL DATA REPAIR.EXE.Muestra EliStartPage v23.97
Submission date: 2011-09-28 09:43:12 (UTC)
Current status: finished
Result: 15 /43 (34.9%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.27.01 2011.09.27 Trojan/Win32.Jorik
AntiVir 7.11.15.54 2011.09.28 –
Antiy-AVL 2.0.3.7 2011.09.28 –
Avast 6.0.1289.0 2011.09.27 –
AVG 10.0.0.1190 2011.09.28 Generic25.DEC
BitDefender 7.2 2011.09.28 Gen:Variant.Kazy.38815
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.28 (Suspicious) – DNAScan
ClamAV 0.97.0.0 2011.09.28 –
Commtouch 5.3.2.6 2011.09.28 –
Comodo 10270 2011.09.28 –
DrWeb 5.0.2.03300 2011.09.28 Trojan.Fakealert.25103
Emsisoft 5.1.0.11 2011.09.28 –
eSafe 7.0.17.0 2011.09.27 –
eTrust-Vet 36.1.8586 2011.09.28 –
F-Prot 4.6.2.117 2011.09.27 –
F-Secure 9.0.16440.0 2011.09.28 –
Fortinet 4.3.370.0 2011.09.28 –
GData 22 2011.09.28 Gen:Variant.Kazy.38815
Ikarus T3.1.1.107.0 2011.09.28 –
Jiangmin 13.0.900 2011.09.27 –
K7AntiVirus 9.113.5203 2011.09.27 Trojan
Kaspersky 9.0.0.837 2011.09.28 Trojan.Win32.FakeAV.emgo
McAfee 5.400.0.1158 2011.09.28 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.09.28 FakeAlert-SysDef.b
Microsoft 1.7702 2011.09.28 –
NOD32 6499 2011.09.28 –
Norman 6.07.11 2011.09.28 –
nProtect 2011-09-28.02 2011.09.28 Gen:Variant.Kazy.38815
Panda 10.0.3.5 2011.09.27 Trj/CI.A
PCTools 8.0.0.5 2011.09.28 –
Prevx 3.0 2011.09.28 –
Rising 23.77.01.04 2011.09.28 –
Sophos 4.69.0 2011.09.28 –
SUPERAntiSpyware 4.40.0.1006 2011.09.27 Trojan.Agent/Gen-FakeAntiSpy
Symantec 20111.2.0.82 2011.09.28 –
TheHacker 6.7.0.1.312 2011.09.27 –
TrendMicro 9.500.0.1008 2011.09.28 –
TrendMicro-HouseCall 9.500.0.1008 2011.09.28 –
VBA32 3.12.16.4 2011.09.27 –
VIPRE 10603 2011.09.28 Trojan.Win32.Jorik.Fraud.un (v)
ViRobot 2011.9.28.4693 2011.09.28 –
VirusBuster 14.0.236.1 2011.09.27 –
Additional informationShow all
MD5   : 6e0f57d60a67b652cc5b4d3174d99e34
SHA1  : b89ba8481b37902f8e6537632d84b8a5fa22506f
SHA256: b7f3e4e443516cbbe6e16fb13805987419a0916833e8dd3bb8f1a01e0c5e427b
ssdeep: 6144:My77vroEjjOVb4mU9F7jBhkpSU2OXALYQD8UQUOEKI702dnEO+oRk:Z7MEjaqmU9FfBhIw
LbYR9C02dEyR
File size : 346624 bytes
First seen: 2011-09-28 00:33:08
Last seen : 2011-09-28 09:43:12
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: NetPlay Software
copyright….: Copyright (C) 2002-2007
product……: Instant Demo
description..: Instant Demo Application
original name: InstantDemo.EXE
internal name: InstantDemo
file version.: 6, 50, 56, 0
Como los anteriores similares descargados por el anexado del mail en cuestion, oculta todos los ficheros del disco duro y como en otros casos, modifica el MBR y crea un Botao en un fichero de nombre variable, polimorfico y extension rara (lo lanza con RUNDLL32) todo lo cual detectamos con el ELISTARA.

Dicha version del ELISTARA 23.97 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

SALUDOS

ms. 28-9-2011