Variantes de worm VBNA ya controlados por actual ELIVBNA

Recibidas tres muestras de VBNA; se comprueba que ya las detecta y elimina el actual ELIVBNA (v 2.27) pero se ofrece el preanalisis del VirusTotal para ver los distintos nombre con los que los detectan los diferentes AV:

File name: geadin.exe
Submission date: 2011-10-24 08:58:34 (UTC)

Result: 36/ 43 (83.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Win32/Kashu.E
AntiVir 7.11.16.110 2011.10.24 W32/Sality.AT
Antiy-AVL 2.0.3.7 2011.10.24 –
Avast 6.0.1289.0 2011.10.24 Win32:Kukacka
AVG 10.0.0.1190 2011.10.23 Worm/VB.12.AH
BitDefender 7.2 2011.10.24 Win32.Sality.3
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal None 2011.10.24 –
ClamAV 0.97.3.0 2011.10.24 –
Commtouch 5.3.2.6 2011.10.23 W32/Sality.gen2
Comodo 10542 2011.10.23 Virus.Win32.Sality.Gen
DrWeb 5.0.2.03300 2011.10.24 Win32.Sector.21
Emsisoft 5.1.0.11 2011.10.24 Worm.Win32.Vobfus!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8636 2011.10.24 Win32/Sality.AA
F-Prot 4.6.5.141 2011.10.23 W32/Sality.gen2
F-Secure 9.0.16440.0 2011.10.24 Win32.Sality.3
Fortinet 4.3.370.0 2011.10.24 –
GData 22 2011.10.24 Win32.Sality.3
Ikarus T3.1.1.107.0 2011.10.24 Worm.Win32.Vobfus
Jiangmin 13.0.900 2011.10.23 Win32/HLLP.Kuku.Gen
K7AntiVirus 9.116.5326 2011.10.22 Virus
Kaspersky 9.0.0.837 2011.10.24 Worm.Win32.VBNA.alxm
McAfee 5.400.0.1158 2011.10.24 W32/Sality.gen.z
McAfee-GW-Edition 2010.1D 2011.10.24 W32/Sality.gen.z
Microsoft 1.7801 2011.10.24 Virus:Win32/Sality.AU
NOD32 6568 2011.10.24 Win32/Sality.NBA
Norman 6.07.13 2011.10.24 W32/Sality.BM
nProtect 2011-10-24.01 2011.10.24 Trojan/W32.Agent.229376.JM
Panda 10.0.3.5 2011.10.23 W32/Lineage.KFS
PCTools 8.0.0.5 2011.10.24 Malware.Changeup
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 Trojan.Win32.VBCode.cbr
Sophos 4.70.0 2011.10.24 Mal/Sality-D
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-FakeAlert[Alg]
Symantec 20111.2.0.82 2011.10.24 W32.Changeup.C
TheHacker 6.7.0.1.330 2011.10.24 W32/Sality.gen
TrendMicro 9.500.0.1008 2011.10.24 PE_SALITY.RL
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 PE_SALITY.RL
VBA32 3.12.16.4 2011.10.24 Virus.Win32.Sality.bakb
VIPRE 10858 2011.10.24 Virus.Win32.Sality.at (v)
ViRobot 2011.10.24.4734 2011.10.24 Win32.Sality.N
VirusBuster 14.1.26.0 2011.10.23 Win32.Sality.BK
Additional informationShow all
MD5   : 433687be136459f154fbc76e9786c7e2
SHA1  : 4ae3bc734b18d9af258daad637e77126d263be22
SHA256: d1a0655b2afdbb97c3977dd5aa86db99568591cf33b8f0f8a22fb94a0c50fa14
ssdeep: 3072:94qKCCl8DwhCjG8G3GbGVGBGfGuGxGWYcrf6KadEZKXb4Lqr/wcnK4e8Svy19zjO:94zCC
mwAYcD6KaddXrr/wsNe8F9zj1rk
File size : 229376 bytes
First seen: 2011-10-24 08:58:34
Last seen : 2011-10-24 08:58:34
TrID:
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: RmwbFplJ
description..: n/a
original name: RmwbFplJ.exe
internal name: RmwbFplJ
file version.: 2.67

__________________
File name: geadinx.exe
Submission date: 2011-10-24 08:54:26 (UTC)

Result: 37/ 43 (86.0%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Win32/Kashu.E
AntiVir 7.11.16.110 2011.10.24 W32/Sality.AT
Antiy-AVL 2.0.3.7 2011.10.24 –
Avast 6.0.1289.0 2011.10.24 Win32:Kukacka
AVG 10.0.0.1190 2011.10.23 Worm/VB.12.AH
BitDefender 7.2 2011.10.24 Win32.Sality.3
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.10.24 W32.Sality.U
ClamAV 0.97.3.0 2011.10.24 –
Commtouch 5.3.2.6 2011.10.23 W32/Sality.gen2
Comodo 10542 2011.10.23 Virus.Win32.Sality.Gen
DrWeb 5.0.2.03300 2011.10.24 Win32.Sector.21
Emsisoft 5.1.0.11 2011.10.24 Worm.Win32.Vobfus!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8636 2011.10.24 Win32/Sality.AA
F-Prot 4.6.5.141 2011.10.23 W32/Sality.gen2
F-Secure 9.0.16440.0 2011.10.24 Win32.Sality.3
Fortinet 4.3.370.0 2011.10.24 –
GData 22 2011.10.24 Win32.Sality.3
Ikarus T3.1.1.107.0 2011.10.24 Worm.Win32.Vobfus
Jiangmin 13.0.900 2011.10.23 Win32/HLLP.Kuku.Gen
K7AntiVirus 9.116.5326 2011.10.22 Virus
Kaspersky 9.0.0.837 2011.10.24 Worm.Win32.VBNA.alxm
McAfee 5.400.0.1158 2011.10.24 W32/Sality.gen.z
McAfee-GW-Edition 2010.1D 2011.10.24 W32/Sality.gen.z
Microsoft 1.7801 2011.10.24 Virus:Win32/Sality.AU
NOD32 6568 2011.10.24 Win32/Sality.NBA
Norman 6.07.13 2011.10.24 W32/Sality.BM
nProtect 2011-10-24.01 2011.10.24 Trojan/W32.Agent.229376.JM
Panda 10.0.3.5 2011.10.23 W32/Lineage.KFS
PCTools 8.0.0.5 2011.10.24 Malware.Changeup
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 Trojan.Win32.VBCode.cbr
Sophos 4.70.0 2011.10.24 Mal/Sality-D
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-FakeAlert[Alg]
Symantec 20111.2.0.82 2011.10.24 W32.Changeup.C
TheHacker 6.7.0.1.330 2011.10.24 W32/Sality.gen
TrendMicro 9.500.0.1008 2011.10.24 PE_SALITY.RL
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 PE_SALITY.RL
VBA32 3.12.16.4 2011.10.24 Virus.Win32.Sality.bakb
VIPRE 10858 2011.10.24 Virus.Win32.Sality.at (v)
ViRobot 2011.10.24.4734 2011.10.24 Win32.Sality.N
VirusBuster 14.1.26.0 2011.10.23 Win32.Sality.BK
Additional informationShow all
MD5   : 8d3e6bf739d57d35ee1676258e604744
SHA1  : 5234fd68a88e752575fb13c36e9ae536fdb6e896

File size : 229376 bytes

publisher….: n/a
copyright….: n/a
product……: JcuwCWRT
description..: n/a
original name: JcuwCWRT.exe
internal name: JcuwCWRT
file version.: 5.81

___________________
File name: x.exe
Submission date: 2011-10-24 08:56:53 (UTC)
Current status: queued queued analysing finished
Result: 36/ 42 (85.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Win32/Kashu.E
AntiVir 7.11.16.110 2011.10.24 W32/Sality.AT
Antiy-AVL 2.0.3.7 2011.10.24 –
Avast 6.0.1289.0 2011.10.24 Win32:Kukacka
AVG 10.0.0.1190 2011.10.23 Worm/VB.12.AH
BitDefender 7.2 2011.10.24 Win32.Sality.3
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.10.24 W32.Sality.U
ClamAV 0.97.3.0 2011.10.24 –
Commtouch 5.3.2.6 2011.10.23 W32/Sality.gen2
Comodo 10542 2011.10.23 Virus.Win32.Sality.Gen
DrWeb 5.0.2.03300 2011.10.24 Win32.Sector.21
Emsisoft 5.1.0.11 2011.10.24 Worm.Win32.Vobfus!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8636 2011.10.24 Win32/Sality.AA
F-Prot 4.6.5.141 2011.10.23 W32/Sality.gen2
F-Secure 9.0.16440.0 2011.10.24 Win32.Sality.3
Fortinet 4.3.370.0 2011.10.24 –
GData 22 2011.10.24 Win32.Sality.3
Ikarus T3.1.1.107.0 2011.10.24 Worm.Win32.Vobfus
Jiangmin 13.0.900 2011.10.23 Win32/HLLP.Kuku.Gen
K7AntiVirus 9.116.5326 2011.10.22 Virus
Kaspersky 9.0.0.837 2011.10.24 Worm.Win32.VBNA.alxm
McAfee 5.400.0.1158 2011.10.24 W32/Sality.gen.z
McAfee-GW-Edition 2010.1D 2011.10.24 W32/Sality.gen.z
Microsoft 1.7801 2011.10.24 Virus:Win32/Sality.AU
NOD32 6568 2011.10.24 Win32/Sality.NBA
Norman 6.07.13 2011.10.24 W32/Sality.BM
Panda 10.0.3.5 2011.10.23 W32/Lineage.KFS
PCTools 8.0.0.5 2011.10.24 Malware.Changeup
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 Trojan.Win32.VBCode.cbr
Sophos 4.70.0 2011.10.24 Mal/Sality-D
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-FakeAlert[Alg]
Symantec 20111.2.0.82 2011.10.24 W32.Changeup.C
TheHacker 6.7.0.1.330 2011.10.24 W32/Sality.gen
TrendMicro 9.500.0.1008 2011.10.24 PE_SALITY.RL
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 PE_SALITY.RL
VBA32 3.12.16.4 2011.10.24 Virus.Win32.Sality.bakb
VIPRE 10858 2011.10.24 Virus.Win32.Sality.at (v)
ViRobot 2011.10.24.4734 2011.10.24 Win32.Sality.N
VirusBuster 14.1.26.0 2011.10.23 Win32.Sality.BK
Additional informationShow all
MD5   : 8d3e6bf739d57d35ee1676258e604744
SHA1  : 5234fd68a88e752575fb13c36e9ae536fdb6e896
SHA256: 4eeed24dff7f632a20ee1d1025e55886076e379a107b1ba86e313e407c5ef822
ssdeep: 6144:9FfvxtXL3AYcD6KadmXrr/wsNe8F9zj1rk:9FPb3AYA4qbzRrk
File size : 229376 bytes
First seen: 2011-10-24 08:56:53
Last seen : 2011-10-24 08:56:53
TrID:
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: JcuwCWRT
description..: n/a
original name: JcuwCWRT.exe
internal name: JcuwCWRT
file version.: 5.81

Como hemos indicado al principio, el actual ELIVBNA 2,27 ya detecta y elimina estas variantes.

saludos

ms, 24-10-2011