Nueva variante de PROXY-EXI

Recibidos varios ficheros de la misma infección de un usuario, los pasamos a controlar como PROXY-EXI a partir del ELISTARA 24.50 DE HOY
Además del F0A.EXE, hay 7 .tmp iguales, segun puede verse con el SMD5:

______

sMD5 v1.3b (c)2009 S.G.H. / Satinfo S.L.
(Creado en Noviembre del 2008)
Listado de MD5 (Message Digest Algorithm 5)
——————————————-

Ficheros de: “A:\”
“7C1EEC1582656B89AA5F301D20F3294D” -> F.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> 6.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> 10.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> 16.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> 26.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> 78.TMP.Muestra EliStartPage v24.45  103936
“7C1EEC1582656B89AA5F301D20F3294D” -> A.TMP.Muestra EliStartPage v24.45  103936

7 Ficheros Analizados.

_______

Los informes de los ficheros indicados reportados por el virustotal son
File name: F8.tmp
Submission date: 2011-12-12 07:47:23 (UTC)
Current status: finished
Result: 23 /43 (53.5%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.10.02 2011.12.11 Backdoor/Win32.Gbot
AntiVir 7.11.19.61 2011.12.12 TR/Agent.eea
Antiy-AVL 2.0.3.7 2011.12.12 –
Avast 6.0.1289.0 2011.12.11 Win32:Cycbot-PJ [Trj]
AVG 10.0.0.1190 2011.12.11 Generic26.UKS
BitDefender 7.2 2011.12.12 –
ByteHero 1.0.0.1 2011.12.07 Trojan.Win32.Heur.Gen
CAT-QuickHeal 12.00 2011.12.12 –
ClamAV 0.97.3.0 2011.12.12 –
Commtouch 5.3.2.6 2011.12.11 –
Comodo 10929 2011.12.12 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.12.12 Trojan.PWS.Multi.363
Emsisoft 5.1.0.11 2011.12.12 Trojan-PWS.Win32.Fareit!IK
eSafe 7.0.17.0 2011.12.11 –
eTrust-Vet 37.0.9616 2011.12.09 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.12 –
Fortinet 4.3.388.0 2011.12.12 W32/BDoor.E!tr
GData 22.304/22.569 2011.12.12 Win32:Cycbot-PJ
Ikarus T3.1.1.109.0 2011.12.12 Trojan-PWS.Win32.Fareit
Jiangmin 13.0.900 2011.12.11 –
K7AntiVirus 9.119.5640 2011.12.09 Backdoor
Kaspersky 9.0.0.837 2011.12.12 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.12.12 BackDoor-EXI.gen.aa
McAfee-GW-Edition 2010.1E 2011.12.11 BackDoor-EXI.gen.aa
Microsoft 1.7903 2011.12.12 –
NOD32 6691 2011.12.07 –
Norman 6.07.13 2011.12.11 W32/Cycbot.EW
nProtect 2011-12-11.01 2011.12.12 –
Panda 10.0.3.5 2011.12.11 Trj/CI.A
PCTools 8.0.0.5 2011.12.12 –
Prevx 3.0 2011.12.12 –
Rising 23.88.00.01 2011.12.12 –
Sophos 4.72.0 2011.12.12 Mal/Generic-L
SUPERAntiSpyware 4.40.0.1006 2011.12.10 Trojan.Agent/Gen-NumTemp
Symantec 20111.2.0.82 2011.12.12 –
TheHacker 6.7.0.1.356 2011.12.11 –
TrendMicro 9.500.0.1008 2011.12.12 TSPY_FAREIT.E
TrendMicro-HouseCall 9.500.0.1008 2011.12.12 TSPY_FAREIT.E
VBA32 3.12.16.4 2011.12.09 –
VIPRE 11239 2011.12.12 Trojan.Win32.FakeAV.IS (v)
ViRobot 2011.12.12.4820 2011.12.12 –
VirusBuster 14.1.110.0 2011.12.11 Trojan.Kryptik!j0/lY1ybBHI
Additional informationShow all
MD5   : 7c1eec1582656b89aa5f301d20f3294d
SHA1  : d7caf59191b059a12d64efa058fede62f61ead03

File size : 103936 bytes
_______
File name: F0A.EXE.Muestra EliStartPage v24.45
Submission date: 2011-12-21 08:31:54 (UTC)
Current status: finished
Result: 33 /42 (78.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.19.03 2011.12.19 Win-Trojan/Cycbot.292352.C
AntiVir 7.11.19.166 2011.12.20 TR/Cybota.A.3
Antiy-AVL 2.0.3.7 2011.12.20 Backdoor/Win32.Gbot.gen
Avast 6.0.1289.0 2011.12.20 Win32:Cybota [Trj]
AVG 10.0.0.1190 2011.12.20 Win32/Cryptor
BitDefender 7.2 2011.12.20 Gen:Variant.Kazy.48659
ByteHero 1.0.0.1 2011.12.07 –
CAT-QuickHeal 12.00 2011.12.20 –
ClamAV 0.97.3.0 2011.12.20 –
Commtouch 5.3.2.6 2011.12.20 –
Comodo 11025 2011.12.20 TrojWare.Win32.Kryptik.XEN
DrWeb 5.0.2.03300 2011.12.20 BackDoor.Gbot.1851
Emsisoft 5.1.0.11 2011.12.20 Virus.Win32.Cryptor!IK
eSafe 7.0.17.0 2011.12.20 Win32.TRCybota.A
eTrust-Vet 37.0.9637 2011.12.21 Win32/Gbot.E!generic
F-Prot 4.6.5.141 2011.12.19 –
Fortinet 4.3.388.0 2011.12.20 W32/CycBot.R!tr
GData 22 2011.12.20 Gen:Variant.Kazy.48659
Ikarus T3.1.1.109.0 2011.12.20 Virus.Win32.Cryptor
Jiangmin 13.0.900 2011.12.20 –
K7AntiVirus 9.119.5720 2011.12.19 Backdoor
Kaspersky 9.0.0.837 2011.12.21 Backdoor.Win32.Gbot.qvp
McAfee 5.400.0.1158 2011.12.20 BackDoor-EXI.gen.aa
McAfee-GW-Edition 2010.1E 2011.12.21 BackDoor-EXI.gen.aa
Microsoft 1.7903 2011.12.20 Backdoor:Win32/Cycbot.G
NOD32 6726 2011.12.20 Win32/Cycbot.AK
Norman 6.07.13 2011.12.20 W32/Suspicious_Gen2.UBLBW
nProtect 2011-12-20.02 2011.12.20 Backdoor/W32.GBot.292352.B
Panda 10.0.3.5 2011.12.19 Suspicious file
PCTools 8.0.0.5 2011.12.21 Backdoor.Trojan
Prevx 3.0 2011.12.21 –
Rising 23.89.01.03 2011.12.20 Trojan.Win32.Generic.12AAD57D
Sophos 4.72.0 2011.12.20 Troj/CycBot-R
SUPERAntiSpyware 4.40.0.1006 2011.12.20 Trojan.Agent/Gen-Kazy[NF]
Symantec 20111.2.0.82 2011.12.21 Backdoor.Trojan
TheHacker 6.7.0.1.362 2011.12.19 –
TrendMicro 9.500.0.1008 2011.12.20 TROJ_GEN.RC1CDLG
TrendMicro-HouseCall 9.500.0.1008 2011.12.20 TROJ_GEN.RC1CDLG
VBA32 3.12.16.4 2011.12.20 –
VIPRE 11279 2011.12.20 Trojan.Win32.Generic!BT
ViRobot 2011.12.20.4835 2011.12.20 Backdoor.Win32.Gbot.292352
VirusBuster 14.1.125.0 2011.12.20 Backdoor.Gbot!w7UFNLTHwFo
Additional informationShow all
MD5   : 9b8eeb57aebb5dcdc2705858b5994ebf
SHA1  : 4d00aedcd1671cecdc16fd299be25dc535a68b65

File size : 292352 bytes
Dicha version del ELISTARA 24.50 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 21-12-2011