Analisis de muestras de los malwares relacionados entre si , VBNA, BUZUS, SIREFEF, PROXY EXI, SIMDA,

Ofrecemos a continuacion los preanalisis de las últimas muestras que hemos recibido y que +hemos pasado a controlar con las versiones de hoy del ELIVBNA, ELISIREF, ELISTARA,
Preanalisis de ultima muestra del VBNA (detectado actualmente por solo 7 AV de 43):
File name: Muestra VBNA.exe.VIR
Submission date: 2012-01-03 16:09:51 (UTC)

Result: 7/ 42 (16.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.03.00 2012.01.03 –
AntiVir 7.11.20.132 2012.01.03 –
Antiy-AVL 2.0.3.7 2012.01.03 –
Avast 6.0.1289.0 2012.01.03 –
AVG 10.0.0.1190 2012.01.03 –
BitDefender 7.2 2012.01.03 –
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.03 –
ClamAV 0.97.3.0 2012.01.03 –
Commtouch 5.3.2.6 2012.01.03 –
Comodo 11181 2012.01.03 –
DrWeb 5.0.2.03300 2012.01.03 Trojan.VbCrypt.81
Emsisoft 5.1.0.11 2012.01.03 Trojan.Win32.Diple!IK
eSafe 7.0.17.0 2012.01.03 –
eTrust-Vet 37.0.9660 2012.01.03 Win32/Changeup.A!generic
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.03 –
Fortinet 4.3.388.0 2012.01.03 –
GData 22 2012.01.03 –
Ikarus T3.1.1.109.0 2011.12.31 –
Jiangmin 13.0.900 2012.01.03 –
K7AntiVirus 9.123.5838 2012.01.02 –
Kaspersky 9.0.0.837 2012.01.03 Trojan.Win32.Diple.efjx
McAfee 5.400.0.1158 2012.01.03 VBObfus.cm
McAfee-GW-Edition 2010.1E 2012.01.03 –
Microsoft 1.7903 2012.01.03 –
NOD32 6764 2012.01.03 Win32/AutoRun.VB.AQP
Norman 6.07.13 2012.01.03 –
nProtect 2012-01-03.01 2012.01.03 –
Panda 10.0.3.5 2012.01.03 Suspicious file
PCTools 8.0.0.5 2012.01.03 –
Prevx 3.0 2012.01.03 –
Rising 23.90.05.01 2011.12.31 –
Sophos 4.72.0 2012.01.03 –
SUPERAntiSpyware 4.40.0.1006 2012.01.03 –
Symantec 20111.2.0.82 2012.01.03 –
TheHacker 6.7.0.1.371 2012.01.03 –
TrendMicro 9.500.0.1008 2012.01.03 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.03 –
VIPRE 11343 2012.01.03 –
ViRobot 2012.1.3.4861 2012.01.03 –
VirusBuster 14.1.147.0 2012.01.03 –

Additional informationShow all
MD5   : fe968b53501233f9dace8bc87cd20587
SHA1  : a00284763139b1197b4a28f748586a43703feb07

File size : 339968 bytes

publisher….: n/a
copyright….: n/a
product……: yOLyYJq
description..: n/a
original name: gvQFgtdH.exe
internal name: gvQFgtdH
file version.: 1.00
__________

Preanalisis de nueva muestra de BUZUS, solom controlada actualmente por 6 AV de 43
File name: cauva.com
Submission date: 2012-01-03 16:47:59 (UTC)
Result: 6/ 43 (14.0%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.03.00 2012.01.03 –
AntiVir 7.11.20.132 2012.01.03 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2012.01.03 –
Avast 6.0.1289.0 2012.01.03 –
AVG 10.0.0.1190 2012.01.03 –
BitDefender 7.2 2012.01.03 –
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.03 –
ClamAV 0.97.3.0 2012.01.03 –
Commtouch 5.3.2.6 2012.01.03 –
Comodo 11181 2012.01.03 –
DrWeb 5.0.2.03300 2012.01.03 Win32.HLLW.Facebook.1005
Emsisoft 5.1.0.11 2012.01.03 –
eSafe 7.0.17.0 2012.01.03 –
eTrust-Vet 37.0.9660 2012.01.03 –
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.03 –
Fortinet 4.3.388.0 2012.01.03 W32/Dropper.ZKU!tr
GData 22.329/22.622 2012.01.03 –
Ikarus T3.1.1.109.0 2011.12.31 –
Jiangmin 13.0.900 2012.01.03 –
K7AntiVirus 9.123.5849 2012.01.03 –
Kaspersky 9.0.0.837 2012.01.03 Trojan.Win32.Diple.eflt
McAfee 5.400.0.1158 2012.01.03 –
McAfee-GW-Edition 2010.1E 2012.01.03 Heuristic.LooksLike.Win32.FakeYak.E
Microsoft 1.7903 2012.01.03 –
NOD32 6764 2012.01.03 a variant of Win32/TrojanDropper.VB.NZB
Norman 6.07.13 2012.01.03 –
nProtect 2012-01-03.01 2012.01.03 –
Panda 10.0.3.5 2012.01.03 –
PCTools 8.0.0.5 2012.01.03 –
Prevx 3.0 2012.01.03 –
Rising 23.90.05.01 2011.12.31 –
Sophos 4.72.0 2012.01.03 –
SUPERAntiSpyware 4.40.0.1006 2012.01.03 –
Symantec 20111.2.0.82 2012.01.03 –
TheHacker 6.7.0.1.371 2012.01.03 –
TrendMicro 9.500.0.1008 2012.01.03 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.03 –
VBA32 3.12.16.4 2012.01.03 –
VIPRE 11345 2012.01.03 –
ViRobot 2012.1.3.4861 2012.01.03 –
VirusBuster 14.1.147.0 2012.01.03 –

Additional informationShow all
MD5   : 2977dec018789eb84c30e874daec4496
SHA1  : 4025456b70aa5a2a8d2a1046314a89af08f3f29a

File size : 761856 bytes

publisher….: n/a
copyright….: n/a
product……: w5lNx6YK
description..: n/a
original name: h6OsdM4.exe
internal name: h6OsdM4
file version.: 1.00
__________
Preanalisis de nueva muestra de SIREFEF, solo controlada actualmente por 4 AV de 43 !
File name: serial.sys
Submission date: 2012-01-03 16:17:41 (UTC)
Current status: queued queued analysing finished
Result: 4/ 43 (9.3%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.03.00 2012.01.03 –
AntiVir 7.11.20.132 2012.01.03 –
Antiy-AVL 2.0.3.7 2012.01.03 –
Avast 6.0.1289.0 2012.01.03 –
AVG 10.0.0.1190 2012.01.03 –
BitDefender 7.2 2012.01.03 Gen:Variant.Graftor.12325
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.03 –
ClamAV 0.97.3.0 2012.01.03 –
Commtouch 5.3.2.6 2012.01.03 –
Comodo 11181 2012.01.03 –
DrWeb 5.0.2.03300 2012.01.03 –
Emsisoft 5.1.0.11 2012.01.03 Rootkit.Win32.ZAccess!IK
eSafe 7.0.17.0 2012.01.03 –
eTrust-Vet 37.0.9660 2012.01.03 –
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.03 –
Fortinet 4.3.388.0 2012.01.03 W32/ZAccess.K!tr.rkit
GData 22 2012.01.03 –
Ikarus T3.1.1.109.0 2011.12.31 Rootkit.Win32.ZAccess
Jiangmin 13.0.900 2012.01.03 –
K7AntiVirus 9.123.5849 2012.01.03 –
Kaspersky 9.0.0.837 2012.01.03 –
McAfee 5.400.0.1158 2012.01.03 –
McAfee-GW-Edition 2010.1E 2012.01.03 –
Microsoft 1.7903 2012.01.03 –
NOD32 6764 2012.01.03 –
Norman 6.07.13 2012.01.03 –
nProtect 2012-01-03.01 2012.01.03 –
Panda 10.0.3.5 2012.01.03 –
PCTools 8.0.0.5 2012.01.03 –
Prevx 3.0 2012.01.03 –
Rising 23.90.05.01 2011.12.31 –
Sophos 4.72.0 2012.01.03 –
SUPERAntiSpyware 4.40.0.1006 2012.01.03 –
Symantec 20111.2.0.82 2012.01.03 –
TheHacker 6.7.0.1.371 2012.01.03 –
TrendMicro 9.500.0.1008 2012.01.03 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.03 –
VBA32 3.12.16.4 2012.01.03 –
VIPRE 11343 2012.01.03 –
ViRobot 2012.1.3.4861 2012.01.03 –
VirusBuster 14.1.147.0 2012.01.03 –

Additional informationShow all
MD5   : 3e0108810711e0143b66d955a032df3b
SHA1  : 33e28b40ccc440b1608dd33f739c9b95ba90de29

File size : 65792 bytes
____________
Preanalisis de nueva muestra de PROXY EXI solo controlada ACTUALMENTE por 9 de 43 Av

File name: lvvm.exe.VIR
Submission date: 2012-01-03 16:26:47 (UTC)

Result: 9/ 43 (20.9%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.03.00 2012.01.03 Trojan/Win32.Jorik
AntiVir 7.11.20.132 2012.01.03 –
Antiy-AVL 2.0.3.7 2012.01.03 –
Avast 6.0.1289.0 2012.01.03 Win32:Cybota [Trj]
AVG 10.0.0.1190 2012.01.03 –
BitDefender 7.2 2012.01.03 Gen:Variant.Kazy.51566
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.03 –
ClamAV 0.97.3.0 2012.01.03 –
Commtouch 5.3.2.6 2012.01.03 –
Comodo 11181 2012.01.03 –
DrWeb 5.0.2.03300 2012.01.03 –
Emsisoft 5.1.0.11 2012.01.03 –
eSafe 7.0.17.0 2012.01.03 –
eTrust-Vet 37.0.9660 2012.01.03 –
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.03 –
Fortinet 4.3.388.0 2012.01.03 –
GData 22 2012.01.03 Win32:Cybota
Ikarus T3.1.1.109.0 2011.12.31 –
Jiangmin 13.0.900 2012.01.03 –
K7AntiVirus 9.123.5849 2012.01.03 Backdoor
Kaspersky 9.0.0.837 2012.01.03 –
McAfee 5.400.0.1158 2012.01.03 BackDoor-EXI.gen.aa
McAfee-GW-Edition 2010.1E 2012.01.03 –
Microsoft 1.7903 2012.01.03 Backdoor:Win32/Cycbot.G
NOD32 6764 2012.01.03 a variant of Win32/Kryptik.YIZ
Norman 6.07.13 2012.01.03 –
nProtect 2012-01-03.01 2012.01.03 –
Panda 10.0.3.5 2012.01.03 Suspicious file
PCTools 8.0.0.5 2012.01.03 –
Prevx 3.0 2012.01.03 –
Rising 23.90.05.01 2011.12.31 –
Sophos 4.72.0 2012.01.03 –
SUPERAntiSpyware 4.40.0.1006 2012.01.03 –
Symantec 20111.2.0.82 2012.01.03 –
TheHacker 6.7.0.1.371 2012.01.03 –
TrendMicro 9.500.0.1008 2012.01.03 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.03 –
VBA32 3.12.16.4 2012.01.03 –
VIPRE 11343 2012.01.03 –
ViRobot 2012.1.3.4861 2012.01.03 –
VirusBuster 14.1.147.0 2012.01.03 –

Additional informationShow all
MD5   : 6841022dd8e34757e1bf4237f83d6a27
SHA1  : 053db68ca4d59ec6b0d6e2ae8e8e35d9434e30e7

File size : 184832 bytes
Todos ellos pasan a ser controlados por ELISTARA 24.58 y el SIREFEF por el ELISIREF 1.31 que estarán disponibles en nuestra web a partir de las 19 h CEST de hoy

Cabe añadir una recomendacion importante:  Cuando se detecte un Sirefef o un PROXY EXI, descargar la ultima versiones de ELISIREF y de ELISTARA, luego desconectar el ordenador de internet, para que no pueda recibir actualizaciones de dichos malwares, y probar ambas utilidades, reiniciando si lo pide, y enviandonos muestra de los que se solicite.

Y por si eso fuera poco, ahora vienen los de nueva generacion, SIMDA, LRELOADER, Rodricter y malware NLS, y justamente este ultimo usa diferente nombre en cada ordenador, y mientras esté activo, el SIMDA contenido en el fichero ACPI.SYS es invisible, mostrando el del sistema en lugar del malicioso, pero esto será objeto de otro estudiuo…

saludos

ms, 3-1-2012