Nueva variante de PROXY EXI cazada por la heuristica del ELISTARA

A partir del ELISTARA 24.60 de hoy, pasamos a controlar especificamente esta nueva variante de PROXY EXI, de la que aun son pocos los AV que lo detectan actualmente (solo 11 de 43)

El preanalisis de virustotal ofrece este informe:

File name: FF1A9.EXE.Muestra EliStartPage v24.59
Submission date: 2012-01-05 08:58:50 (UTC)
Current status: finished
Result: 11 /43 (25.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.04.00 2012.01.04 –
AntiVir 7.11.20.167 2012.01.05 –
Antiy-AVL 2.0.3.7 2012.01.05 –
Avast 6.0.1289.0 2012.01.04 –
AVG 10.0.0.1190 2012.01.05 –
BitDefender 7.2 2012.01.05 Gen:Variant.Kazy.51721
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.05 –
ClamAV 0.97.3.0 2012.01.05 –
Commtouch 5.3.2.6 2012.01.05 –
Comodo 11196 2012.01.04 –
DrWeb 5.0.2.03300 2012.01.05 BackDoor.Gbot.1591
Emsisoft 5.1.0.11 2012.01.05 Backdoor.Win32.Cycbot.AMN!A2
eSafe 7.0.17.0 2012.01.03 –
eTrust-Vet 37.0.9664 2012.01.04 –
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.05 Gen:Variant.Kazy.51721
Fortinet 4.3.388.0 2012.01.05 –
GData 22 2012.01.05 Gen:Variant.Kazy.51721
Ikarus T3.1.1.109.0 2012.01.05 –
Jiangmin 13.0.900 2012.01.04 –
K7AntiVirus 9.123.5859 2012.01.04 Backdoor
Kaspersky 9.0.0.837 2012.01.05 –
McAfee 5.400.0.1158 2012.01.05 BackDoor-EXI.gen.aa
McAfee-GW-Edition 2010.1E 2012.01.05 BackDoor-EXI.gen.aa
Microsoft 1.7903 2012.01.05 Backdoor:Win32/Cycbot.G
NOD32 6769 2012.01.05 a variant of Win32/Kryptik.YLF
Norman 6.07.13 2012.01.04 –
nProtect 2012-01-05.01 2012.01.05 –
Panda 10.0.3.5 2012.01.04 Trj/CI.A
PCTools 8.0.0.5 2012.01.05 –
Prevx 3.0 2012.01.05 –
Rising 23.91.03.02 2012.01.05 –
Sophos 4.72.0 2012.01.05 –
SUPERAntiSpyware 4.40.0.1006 2012.01.05 –
Symantec 20111.2.0.82 2012.01.05 –
TheHacker 6.7.0.1.371 2012.01.05 –
TrendMicro 9.500.0.1008 2012.01.05 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.05 –
VBA32 3.12.16.4 2012.01.04 –
VIPRE 11355 2012.01.05 –
ViRobot 2012.1.5.4864 2012.01.05 –
VirusBuster 14.1.150.0 2012.01.04 –

Additional informationShow all
MD5   : 9a7814b9e9cc3fa045209950c273eb26
SHA1  : 46c98a57a281c85f24e84056f6de1728deab81db

File size : 169472 bytes
Dicha version del ELISTARA 24.60 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h cEST de hoy

saludos

ms, 5-1-2012