Variante de Downloader TRACUR

A partir de ElistarA 24.09 de hoy, pasamos a controlar esta nueva variante de downloader.

El preanalisis del VirusTotal ofrece el siguiente informe:

File name: KB11053934.exe.vir
Submission date: 2011-10-17 13:53:42 (UTC)
Current status: queued (#1) queued analysing finished
Result: 31/ 43 (72.1%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.16.00 2011.10.17 Trojan/Win32.Menti
AntiVir 7.11.16.25 2011.10.17 TR/Crypt.ZPACK.Gen2
Antiy-AVL 2.0.3.7 2011.10.17 Trojan/win32.agent.gen
Avast 6.0.1289.0 2011.10.17 Win32:Tracur-FN
AVG 10.0.0.1190 2011.10.17 Generic25.TUA
BitDefender 7.2 2011.10.17 Gen:Variant.Kazy.38242
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.10.17 –
ClamAV 0.97.0.0 2011.10.17 –
Commtouch 5.3.2.6 2011.10.17 –
Comodo 10474 2011.10.17 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.10.17 Trojan.DownLoader1.13618
Emsisoft 5.1.0.11 2011.10.17 Trojan-Downloader.Win32.Tracur!IK
eSafe 7.0.17.0 2011.10.17 Win32.Trojan
eTrust-Vet 36.1.8623 2011.10.17 –
F-Prot 4.6.5.141 2011.10.17 –
F-Secure 9.0.16440.0 2011.10.17 Gen:Variant.Kazy.38242
Fortinet 4.3.370.0 2011.10.17 –
GData 22 2011.10.17 Gen:Variant.Kazy.38242
Ikarus T3.1.1.107.0 2011.10.17 Trojan-Downloader.Win32.Tracur
Jiangmin 13.0.900 2011.10.17 Trojan/Generic.ompu
K7AntiVirus 9.115.5290 2011.10.17 Riskware
Kaspersky 9.0.0.837 2011.10.17 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.10.17 Downloader.a!sb
McAfee-GW-Edition 2010.1D 2011.10.17 Downloader.a!sb
Microsoft 1.7702 2011.10.17 TrojanDownloader:Win32/Tracur.AF
NOD32 6550 2011.10.17 a variant of Win32/Kryptik.TJO
Norman 6.07.11 2011.10.17 W32/Suspicious_Gen2.RIILB
nProtect 2011-10-17.01 2011.10.17 Gen:Variant.Kazy.38242
Panda 10.0.3.5 2011.10.17 Generic Trojan
PCTools 8.0.0.5 2011.10.17 Trojan.Gen
Prevx 3.0 2011.10.17 High Risk Cloaked Malware
Rising 23.80.00.01 2011.10.17 Suspicious
Sophos 4.70.0 2011.10.17 Mal/Tracur-E
SUPERAntiSpyware 4.40.0.1006 2011.10.17 –
Symantec 20111.2.0.82 2011.10.17 Trojan.Gen
TheHacker 6.7.0.1.325 2011.10.17 –
TrendMicro 9.500.0.1008 2011.10.17 TROJ_GEN.R49C8J9
TrendMicro-HouseCall 9.500.0.1008 2011.10.17 TROJ_GEN.R49C8J9
VBA32 3.12.16.4 2011.10.17 –
VIPRE 10788 2011.10.17 Trojan.Win32.Generic!BT
ViRobot 2011.10.17.4723 2011.10.17 –
VirusBuster 14.1.15.0 2011.10.17 –
Additional informationShow all
MD5 : 1e9797fac266e8c048b48142e28a8424
SHA1 : 8fceef8212918c14facfe41e39db02ec6438aa15
SHA256: 807bf564b6731b5bc4592319649454be130e6912dd0574dff14dedda9f6810bc
ssdeep: 1536:cUmfO1UVFGUWRSNLt+slMR0W1PGAm5t9uTNN3/x6wLSehg/FcuE4MwV:cU+GUPGU2Mks8N
Gvt4fRLjF4TV
File size : 104960 bytes
First seen: 2011-10-06 16:12:11
Last seen : 2011-10-17 13:53:42
TrID:
Win32 Executable Generic (58.5%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: Sybase, Inc.
copyright….: Copyright (c) 1991-2010 Sybase, Inc. and its subsidiaries.
product……: PowerDesigner
description..: Edit DLL
original name: PDEDIT15.dll
internal name: PDEDIT15
file version.: 15.2.0.3042 Unicode
Dicha version de ElistarA 24.09 que lo detecta y elimina, estará disponible en nuestra web a partri de las 19 h CEST de hoy

saludos

ms, 17-11-2011