Nuevo Downloader MALWARE SYS FULL que descarga fichero tipo Banker que queda residente

Un nuevo Downloader casi no detectado actualmente por ningun antivirus (solo AVIRA y AVG) y que está claro que es un Downloader, descarga fichero tipo Banker, que intenta figurar que es de Logitech, pero que realmente es un cazapasswords bancario:

File name: Postal_amor_gusanito_co_retiver_date_15-05-2011.scr
Submission date: 2011-05-19 07:59:10 (UTC)
Result: 2/ 43 (4.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.05.19.00 2011.05.18 –
AntiVir 7.11.8.62 2011.05.19 TR/Dldr.Lucky.KI
Antiy-AVL 2.0.3.7 2011.05.19 –
Avast 4.8.1351.0 2011.05.19 –
Avast5 5.0.677.0 2011.05.18 –
AVG 10.0.0.1190 2011.05.18 Downloader.Banload.BJHJ
BitDefender 7.2 2011.05.19 –
CAT-QuickHeal 11.00 2011.05.19 –
ClamAV 0.97.0.0 2011.05.19 –
Commtouch 5.3.2.6 2011.05.18 –
Comodo 8754 2011.05.19 –
DrWeb 5.0.2.03300 2011.05.19 –
Emsisoft 5.1.0.5 2011.05.19 –
eSafe 7.0.17.0 2011.05.17 –
eTrust-Vet 36.1.8335 2011.05.18 –
F-Prot 4.6.2.117 2011.05.18 –
F-Secure 9.0.16440.0 2011.05.19 –
Fortinet 4.2.257.0 2011.05.19 –
GData 22 2011.05.19 –
Ikarus T3.1.1.104.0 2011.05.19 –
Jiangmin 13.0.900 2011.05.18 –
K7AntiVirus 9.103.4678 2011.05.18 –
Kaspersky 9.0.0.837 2011.05.19 –
McAfee 5.400.0.1158 2011.05.19 –
McAfee-GW-Edition 2010.1D 2011.05.18 –
Microsoft 1.6903 2011.05.19 –
NOD32 6133 2011.05.19 –
Norman 6.07.07 2011.05.18 –
nProtect 2011-05-18.01 2011.05.19 –
Panda 10.0.3.5 2011.05.18 –
PCTools 7.0.3.5 2011.05.19 –
Prevx 3.0 2011.05.19 –
Rising 23.58.02.03 2011.05.18 –
Sophos 4.65.0 2011.05.19 –
SUPERAntiSpyware 4.40.0.1006 2011.05.19 –
Symantec 20111.1.0.186 2011.05.19 –
TheHacker 6.7.0.1.201 2011.05.18 –
TrendMicro 9.200.0.1012 2011.05.19 –
TrendMicro-HouseCall 9.200.0.1012 2011.05.19 –
VBA32 3.12.16.0 2011.05.18 –
VIPRE 9322 2011.05.19 –
ViRobot 2011.5.19.4467 2011.05.19 –
VirusBuster 13.6.361.0 2011.05.18 –
Additional informationShow all
MD5   : 22827bb6fbad9cf8ae88024f02235de4
SHA1  : c83a81a3de17c0cf232cb7912a76738c455090f3

File size : 73728 bytes

publisher….: InfrAngeluX
copyright….: n/a
product……: Proyecto1
description..: n/a
original name: FullD.exe
internal name: FullD
file version.: 1.00
El fichero que descarga tiene por nombre windowssysfull.exe y en propiedades figura ser de Logitech, sin estar firmado digitalmente, claro
File name: windowssysfull.exe
Submission date: 2011-05-19 09:17:32 (UTC)

Result: 5/ 43 (11.6%)
VT Community

not reviewed
Safety score: –
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.05.19.00 2011.05.18 –
AntiVir 7.11.8.62 2011.05.19 TR/Spy.Bancos.KI
Antiy-AVL 2.0.3.7 2011.05.19 –
Avast 4.8.1351.0 2011.05.19 –
Avast5 5.0.677.0 2011.05.19 –
AVG 10.0.0.1190 2011.05.18 PSW.Banker5.CIXE
BitDefender 7.2 2011.05.19 Trojan.Generic.KD.225501
CAT-QuickHeal 11.00 2011.05.19 –
ClamAV 0.97.0.0 2011.05.19 –
Commtouch 5.3.2.6 2011.05.18 –
Comodo 8754 2011.05.19 –
DrWeb 5.0.2.03300 2011.05.19 –
Emsisoft 5.1.0.5 2011.05.19 –
eSafe 7.0.17.0 2011.05.17 –
eTrust-Vet 36.1.8336 2011.05.19 –
F-Prot 4.6.2.117 2011.05.18 –
F-Secure 9.0.16440.0 2011.05.19 –
Fortinet 4.2.257.0 2011.05.19 –
GData 22 2011.05.19 Trojan.Generic.KD.225501
Ikarus T3.1.1.104.0 2011.05.19 –
Jiangmin 13.0.900 2011.05.18 –
K7AntiVirus 9.103.4678 2011.05.18 –
Kaspersky 9.0.0.837 2011.05.19 –
McAfee 5.400.0.1158 2011.05.19 –
McAfee-GW-Edition 2010.1D 2011.05.18 –
Microsoft 1.6903 2011.05.19 –
NOD32 6133 2011.05.19 –
Norman 6.07.07 2011.05.18 –
nProtect 2011-05-19.01 2011.05.19 Trojan.Generic.KD.225501
Panda 10.0.3.5 2011.05.18 –
PCTools 7.0.3.5 2011.05.19 –
Prevx 3.0 2011.05.19 –
Rising 23.58.02.03 2011.05.18 –
Sophos 4.65.0 2011.05.19 –
SUPERAntiSpyware 4.40.0.1006 2011.05.19 –
Symantec 20111.1.0.186 2011.05.19 –
TheHacker 6.7.0.1.201 2011.05.18 –
TrendMicro 9.200.0.1012 2011.05.19 –
TrendMicro-HouseCall 9.200.0.1012 2011.05.19 –
VBA32 3.12.16.0 2011.05.18 –
VIPRE 9322 2011.05.19 –
ViRobot 2011.5.19.4468 2011.05.19 –
VirusBuster 13.6.361.0 2011.05.18 –
Additional informationShow all
MD5   : 67069258c5cb62f38a7e7ac2303b9155
SHA1  : eacdd252e0821816b0e29514e4952d12968f4c8c

File size : 110592 bytes

publisher….: Logitech
copyright….: n/a
product……: Spinning Back Elbow
description..: n/a
original name: WebCamHighDefinition.exe
internal name: WebCamHighDefinition
file version.: 50.05.5005
comments…..: n/a
signers……: –
signing date.: –
verified…..: Unsigned

La version del ELISTARA 23.25 que detecta y elimina estas variantes, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 19-5-2011