Nuevas variantes de SIREFEF

Van llegando muestras de Sirefef y aunque no haya relación, algunas son de ordenadores infectados con proxy EXI, quizas por algun downloader que ha bajado los dos a la vez…

Las anteriores muestras incluidas estas, pasan a estar controladas a partir del ELISIREF 1.16, que ya está disponioble en nuestra web

LOs preanalisis de virustotal, ofrecen los siguientes informes:
File name: 4.exe.vir
Submission date: 2011-12-02 10:28:53 (UTC)

Result: 13/ 43 (30.2%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.01.02 2011.12.01 –
AntiVir 7.11.18.198 2011.12.02 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2011.12.02 –
Avast 6.0.1289.0 2011.12.02 Win32:BackDoor-YK [Trj]
AVG 10.0.0.1190 2011.12.02 Generic26.KVK
BitDefender 7.2 2011.12.02 Gen:Variant.Kazy.46517
ByteHero 1.0.0.1 2011.11.29 Virus.Win32.Heur.c
CAT-QuickHeal 12.00 2011.12.02 –
ClamAV 0.97.3.0 2011.12.02 –
Commtouch 5.3.2.6 2011.12.02 –
Comodo 10810 2011.12.02 –
DrWeb 5.0.2.03300 2011.12.02 BackDoor.Maxplus.418
Emsisoft 5.1.0.11 2011.12.02 –
eSafe 7.0.17.0 2011.12.01 –
eTrust-Vet 37.0.9599 2011.12.02 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.02 Gen:Variant.Kazy.46517
Fortinet 4.3.388.0 2011.12.02 –
GData 22 2011.12.02 Gen:Variant.Kazy.46517
Ikarus T3.1.1.109.0 2011.12.02 –
Jiangmin 13.0.900 2011.12.02 –
K7AntiVirus 9.119.5570 2011.11.30 –
Kaspersky 9.0.0.837 2011.12.02 Trojan.Win32.Jorik.ZAccess.arq
McAfee 5.400.0.1158 2011.12.02 –
McAfee-GW-Edition 2010.1D 2011.12.01 –
Microsoft 1.7903 2011.12.02 –
NOD32 6668 2011.12.01 –
Norman 6.07.13 2011.12.01 W32/ZAccess.BA
nProtect 2011-12-02.01 2011.12.02 –
Panda 10.0.3.5 2011.12.01 Trj/CI.A
PCTools 8.0.0.5 2011.12.02 –
Prevx 3.0 2011.12.02 –
Rising 23.86.04.02 2011.12.02 –
Sophos 4.71.0 2011.12.02 Mal/FakeAV-IS
SUPERAntiSpyware 4.40.0.1006 2011.12.02 –
Symantec 20111.2.0.82 2011.12.02 –
TheHacker 6.7.0.1.352 2011.12.01 –
TrendMicro 9.500.0.1008 2011.12.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.12.02 –
VBA32 3.12.16.4 2011.12.01 –
VIPRE 11190 2011.12.02 Trojan.Win32.Generic!BT
ViRobot 2011.12.2.4805 2011.12.02 –
VirusBuster 14.1.95.0 2011.12.01 –
Additional informationShow all
MD5   : c9e79c6cf6021cab8a00685cb6b0d376
SHA1  : 406c857697ea3b26d1f1c75c208196972596d22f

File size : 349696 bytes
_______
File name: 5.exe.vir
Submission date: 2011-12-02 10:31:16 (UTC)
Current status: queued queued analysing finished
Result: 16/ 43 (37.2%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.01.02 2011.12.01 –
AntiVir 7.11.18.198 2011.12.02 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2011.12.02 –
Avast 6.0.1289.0 2011.12.02 Win32:BackDoor-YK [Trj]
AVG 10.0.0.1190 2011.12.02 Generic26.KYZ
BitDefender 7.2 2011.12.02 Gen:Variant.Kazy.46517
ByteHero 1.0.0.1 2011.11.29 Virus.Win32.Heur.c
CAT-QuickHeal 12.00 2011.12.02 –
ClamAV 0.97.3.0 2011.12.02 –
Commtouch 5.3.2.6 2011.12.02 –
Comodo 10810 2011.12.02 –
DrWeb 5.0.2.03300 2011.12.02 BackDoor.Maxplus.418
Emsisoft 5.1.0.11 2011.12.02 Win32.SuspectCrc!IK
eSafe 7.0.17.0 2011.12.01 –
eTrust-Vet 37.0.9599 2011.12.02 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.02 Gen:Variant.Kazy.46517
Fortinet 4.3.388.0 2011.12.02 –
GData 22 2011.12.02 Gen:Variant.Kazy.46517
Ikarus T3.1.1.109.0 2011.12.02 Win32.SuspectCrc
Jiangmin 13.0.900 2011.12.02 –
K7AntiVirus 9.119.5570 2011.11.30 –
Kaspersky 9.0.0.837 2011.12.02 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.12.02 Artemis!DB6B35875FA0
McAfee-GW-Edition 2010.1D 2011.12.01 Artemis!DB6B35875FA0
Microsoft 1.7903 2011.12.02 –
NOD32 6668 2011.12.01 –
Norman 6.07.13 2011.12.01 W32/ZAccess.BA
nProtect 2011-12-02.01 2011.12.02 –
Panda 10.0.3.5 2011.12.01 Trj/CI.A
PCTools 8.0.0.5 2011.12.02 –
Prevx 3.0 2011.12.02 –
Rising 23.86.04.02 2011.12.02 –
Sophos 4.71.0 2011.12.02 Mal/FakeAV-IS
SUPERAntiSpyware 4.40.0.1006 2011.12.02 –
Symantec 20111.2.0.82 2011.12.02 –
TheHacker 6.7.0.1.352 2011.12.01 –
TrendMicro 9.500.0.1008 2011.12.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.12.02 –
VBA32 3.12.16.4 2011.12.01 –
VIPRE 11190 2011.12.02 –
ViRobot 2011.12.2.4805 2011.12.02 –
VirusBuster 14.1.95.0 2011.12.01 –
Additional informationShow all
MD5   : db6b35875fa02ab2d6b9a02db5930e81
SHA1  : e50d62f716e1df187c8e4a358cfddaf1514ebfd9

File size : 357376 bytes
_________
y los drivers:

File name: ipsec.sys
Submission date: 2011-12-02 10:34:04 (UTC)
Current status: queued (#1) queued (#1) analysing finished
Result: 9/ 43 (20.9%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.01.02 2011.12.01 –
AntiVir 7.11.18.198 2011.12.02 TR/Rootkit.Gen
Antiy-AVL 2.0.3.7 2011.12.02 –
Avast 6.0.1289.0 2011.12.02 Win32:ZAccess-CY [Rtk]
AVG 10.0.0.1190 2011.12.02 –
BitDefender 7.2 2011.12.02 –
ByteHero 1.0.0.1 2011.11.29 –
CAT-QuickHeal 12.00 2011.12.02 –
ClamAV 0.97.3.0 2011.12.02 –
Commtouch 5.3.2.6 2011.12.02 –
Comodo 10780 None.. –
DrWeb 5.0.2.03300 2011.12.02 –
Emsisoft 5.1.0.11 2011.12.02 Rootkit.Win32.ZAccess!IK
eSafe 7.0.17.0 2011.12.01 –
eTrust-Vet 37.0.9599 2011.12.02 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.02 –
Fortinet 4.3.388.0 2011.12.02 W32/ZAccess.G!tr.rkit
GData 22 2011.12.02 Win32:ZAccess-CY
Ikarus T3.1.1.109.0 2011.12.02 Rootkit.Win32.ZAccess
Jiangmin 13.0.900 2011.12.02 –
K7AntiVirus 9.119.5570 2011.11.30 –
Kaspersky 9.0.0.837 2011.12.02 Rootkit.Win32.ZAccess.g
McAfee 5.400.0.1158 2011.12.02 –
McAfee-GW-Edition 2010.1D 2011.12.01 –
Microsoft 1.7903 2011.12.02 –
NOD32 6668 2011.12.01 –
Norman 6.07.13 2011.12.01 –
nProtect 2011-12-02.01 2011.12.02 –
Panda 10.0.3.5 2011.12.01 –
PCTools 8.0.0.5 2011.12.02 –
Prevx 3.0 2011.12.02 –
Rising 23.86.04.02 2011.12.02 –
Sophos 4.71.0 2011.12.02 –
SUPERAntiSpyware 4.40.0.1006 2011.12.02 Trojan.Agent/Gen-ZAccess
Symantec 20111.2.0.82 2011.12.02 –
TheHacker 6.7.0.1.352 2011.12.01 –
TrendMicro 9.500.0.1008 2011.12.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.12.02 –
VBA32 3.12.16.4 2011.12.01 –
VIPRE 11190 2011.12.02 Trojan.Win32.ZAccess.a (v)
ViRobot 2011.12.2.4805 2011.12.02 –
VirusBuster 14.1.95.0 2011.12.01 –
Additional informationShow all
MD5   : d8828677004a8e4d6366d6706d881c42
SHA1  : 9add18ff2797eee403affef668f32c48dc54b076

File size : 75264 bytes
_________

File name: serial.sys
Submission date: 2011-12-01 11:18:56 (UTC)
Current status: finished
Result: 5 /43 (11.6%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.01.00 2011.12.01 –
AntiVir 7.11.18.164 2011.12.01 TR/Rootkit.Gen
Antiy-AVL 2.0.3.7 2011.12.01 –
Avast 6.0.1289.0 2011.12.01 –
AVG 10.0.0.1190 2011.12.01 –
BitDefender 7.2 2011.12.01 –
ByteHero 1.0.0.1 2011.11.29 –
CAT-QuickHeal 12.00 2011.12.01 –
ClamAV 0.97.3.0 2011.12.01 –
Commtouch 5.3.2.6 2011.12.01 –
Comodo 10799 2011.12.01 –
DrWeb 5.0.2.03300 2011.12.01 –
Emsisoft 5.1.0.11 2011.12.01 Rootkit.Win32.ZAccess!IK
eSafe 7.0.17.0 2011.11.30 –
eTrust-Vet 37.0.9597 2011.12.01 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.01 –
Fortinet 4.3.388.0 2011.12.01 W32/ZAccess.G!tr.rkit
GData 22 2011.12.01 –
Ikarus T3.1.1.109.0 2011.12.01 Rootkit.Win32.ZAccess
Jiangmin 13.0.900 2011.11.30 –
K7AntiVirus 9.119.5570 2011.11.30 –
Kaspersky 9.0.0.837 2011.12.01 Rootkit.Win32.ZAccess.g
McAfee 5.400.0.1158 2011.12.01 –
McAfee-GW-Edition 2010.1D 2011.12.01 –
Microsoft 1.7903 2011.12.01 –
NOD32 6668 2011.11.29 –
Norman 6.07.13 2011.11.30 –
nProtect 2011-12-01.01 2011.12.01 –
Panda 10.0.3.5 2011.11.30 –
PCTools 8.0.0.5 2011.12.01 –
Prevx 3.0 2011.12.01 –
Rising 23.86.03.01 2011.12.01 –
Sophos 4.71.0 2011.12.01 –
SUPERAntiSpyware 4.40.0.1006 2011.12.01 –
Symantec 20111.2.0.82 2011.12.01 –
TheHacker 6.7.0.1.352 2011.11.30 –
TrendMicro 9.500.0.1008 2011.12.01 –
TrendMicro-HouseCall 9.500.0.1008 2011.12.01 –
VBA32 3.12.16.4 2011.12.01 –
VIPRE 11187 2011.12.01 –
ViRobot 2011.12.1.4803 2011.12.01 –
VirusBuster 14.1.93.0 2011.11.30 –
Additional informationShow all
MD5   : c562a57cef77df89009b43fc44300b5d
SHA1  : 8a258d235810cb3264b3e2a29eeff3d00c5ce35d

File size : 65792 bytes
_______
y el X sin extensión, que tambien está relacionado:

le name: X
Submission date: 2011-12-02 10:43:45 (UTC)
Current status: queued (#1) queued (#1) analysing finished
Result: 12/ 43 (27.9%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.01.02 2011.12.01 –
AntiVir 7.11.18.198 2011.12.02 –
Antiy-AVL 2.0.3.7 2011.12.02 –
Avast 6.0.1289.0 2011.12.02 Win32:Malware-gen
AVG 10.0.0.1190 2011.12.02 Generic26.KWU
BitDefender 7.2 2011.12.02 –
ByteHero 1.0.0.1 2011.11.29 Virus.Win32.Heur.c
CAT-QuickHeal 12.00 2011.12.02 –
ClamAV 0.97.3.0 2011.12.02 –
Commtouch 5.3.2.6 2011.12.02 –
Comodo 10810 2011.12.02 –
DrWeb 5.0.2.03300 2011.12.02 BackDoor.Maxplus.232
Emsisoft 5.1.0.11 2011.12.02 Trojan.Win32.Yakes!IK
eSafe 7.0.17.0 2011.12.01 –
eTrust-Vet 37.0.9599 2011.12.02 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.02 –
Fortinet 4.3.388.0 2011.12.02 –
GData 22.293/22.546 2011.12.02 Win32:Malware-gen
Ikarus T3.1.1.109.0 2011.12.02 Trojan.Win32.Yakes
Jiangmin 13.0.900 2011.12.02 –
K7AntiVirus 9.119.5570 2011.11.30 –
Kaspersky 9.0.0.837 2011.12.02 Trojan.Win32.Yakes.ksw
McAfee 5.400.0.1158 2011.12.02 –
McAfee-GW-Edition 2010.1D 2011.12.01 –
Microsoft 1.7903 2011.12.02 –
NOD32 6668 2011.12.01 –
Norman 6.07.13 2011.12.02 W32/ZAccess.BA
nProtect 2011-12-02.01 2011.12.02 –
Panda 10.0.3.5 2011.12.01 Bck/Cycbot.F
PCTools 8.0.0.5 2011.12.02 –
Prevx 3.0 2011.12.02 –
Rising 23.86.04.02 2011.12.02 –
Sophos 4.71.0 2011.12.02 Mal/FakeAV-IS
SUPERAntiSpyware 4.40.0.1006 2011.12.02 –
Symantec 20111.2.0.82 2011.12.02 Suspicious.Cloud.5
TheHacker 6.7.0.1.352 2011.12.01 –
TrendMicro 9.500.0.1008 2011.12.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.12.02 –
VBA32 3.12.16.4 2011.12.01 –
VIPRE 11190 2011.12.02 –
ViRobot 2011.12.2.4805 2011.12.02 –
VirusBuster 14.1.95.0 2011.12.01 –
Additional informationShow all
MD5   : c49a4b74f5a9985f71b56f4b3a96d479
SHA1  : 07dc97279fdb2e69c419df37e4222388c903493a

File size : 59392 bytes

Todo ello ya está controlado a partir del ELISIREF 1.16 de ayer, disponible en nuestra web

saludos

ms, 2-11-2011