Nuevas variantes de ROOTKIT DORKBOT cazadas por la heuristica del ELISTARA

Varias muestras del RootKit DORKBOT pasan a ser controladas a partir del ELISTARA 25.16 de hoy

Los preanalisis de virustotal ofrecen estos informes:
SHA256: 88eb60af9540e775dec42524b6bd978f3a99d974ff3b38edf91dcf4be517c0b2
SHA1: ab077fa16bcd286ec002f4eaaefff11639a1648d
MD5: 191c6e9850334f6c249c27cd0cb5369b
Tamaño: 112.0 KB ( 114688 bytes )
Nombre: AOFOFO.EXE.Muestra EliStartPage v24.41
Tipo: Win32 EXE
Detecciones: 36 / 43
Fecha de análisis: 2012-03-23 11:20:31 UTC ( hace 56 minutos )

01Antivirus Resultado Actualización
AhnLab-V3 Trojan/Win32.VBKrypt 20120322
AntiVir TR/Drop.VB.bdib 20120323
Antiy-AVL Trojan/Win32.VB.gen 20120323
Avast Win32:VBLoader [Trj] 20120320
AVG Dropper.Generic4.BMLV 20120323
BitDefender Trojan.Generic.6749304 20120323
ByteHero – 20120319
CAT-QuickHeal TrojanDropper.VB.bdib 20120323
ClamAV Trojan.Dropper-31325 20120322
Commtouch – 20120323
Comodo UnclassifiedMalware 20120323
DrWeb Trojan.MulDrop3.8104 20120323
Emsisoft Trojan-Dropper.Win32.VB!IK 20120323
eSafe Win32.TRDrop.VB.Bdib 20120322
eTrust-Vet – 20120323
F-Prot – 20120322
F-Secure Trojan.Generic.6749304 20120323
Fortinet W32/Refroso.BLC!tr 20120323
GData Trojan.Generic.6749304 20120323
Ikarus Trojan-Dropper.Win32.VB 20120323
Jiangmin TrojanDropper.VB.abek 20120322
K7AntiVirus Trojan 20120321
Kaspersky Trojan-Dropper.Win32.VB.bdib 20120323
McAfee Generic Dropper!1dd 20120323
McAfee-GW-Edition Heuristic.LooksLike.Win32.SuspiciousPE.F!80 20120322
Microsoft VirTool:Win32/VBInject.gen!DG 20120323
NOD32 a variant of Win32/Injector.KEY 20120323
Norman W32/Suspicious_Gen2.dam 20120323
nProtect Trojan/W32.Agent.114688.BHB 20120323
Panda Generic Malware 20120322
PCTools Trojan.Gen 20120323
Prevx – 20120323
Rising – 20120323
Sophos Mal/Generic-L 20120323
SUPERAntiSpyware Trojan.Agent/Gen-Jorik 20120322
Symantec Trojan.Gen 20120323
TheHacker Trojan/Agent.gen 20120322
TrendMicro WORM_IRCBOT.SMC 20120323
TrendMicro-HouseCall WORM_IRCBOT.SMC 20120323
VBA32 TrojanDropper.VB.bdib 20120322
VIPRE Trojan.Win32.Generic!BT 20120323
ViRobot Trojan.Win32.Inject.114688.J 20120323
VirusBuster – 20120322

____________
SHA256: dd33754bc0294aa4bd50d2be887ff5cae1afd2a4cd0ecd79165562edf7e6e4b7
SHA1: 0caaf6444f269ab9b0e79d0a1caaa5e559e31e46
MD5: 8a58b6b8cf83be69a84bf9af003ee77f
Tamaño: 116.0 KB ( 118784 bytes )
Nombre: LCMMMX.EXE.Muestra EliStartPage v23.56
Tipo: Win32 EXE
Detecciones: 33 / 43
Fecha de análisis: 2012-03-23 12:18:54 UTC ( hace 0 minutos )

01
Antivirus Resultado Actualización
AhnLab-V3 Trojan/Win32.Jorik 20120322
AntiVir TR/Jorik.IRCbot.akj 20120323
Antiy-AVL Trojan/win32.agent.gen 20120323
Avast Win32:VBLoader [Trj] 20120320
AVG VBCrypt.CTK 20120323
BitDefender Worm.Generic.336052 20120323
ByteHero – 20120319
CAT-QuickHeal – 20120323
ClamAV – 20120322
Commtouch – 20120323
Comodo UnclassifiedMalware 20120323
DrWeb Win32.HLLW.Autoruner.54534 20120323
Emsisoft Worm.Win32.Ngrbot!IK 20120323
eSafe – 20120322
eTrust-Vet – 20120323
F-Prot – 20120322
F-Secure Worm.Generic.336052 20120323
Fortinet W32/VBKrypt.BBBQ!tr 20120323
GData Worm.Generic.336052 20120323
Ikarus Worm.Win32.Ngrbot 20120323
Jiangmin Trojan/Jorik.isk 20120322
K7AntiVirus Trojan 20120323
Kaspersky Worm.Win32.Ngrbot.a 20120323
McAfee Generic.tra!e 20120323
McAfee-GW-Edition Heuristic.LooksLike.Win32.SuspiciousPE.F!80 20120322
Microsoft VirTool:Win32/VBInject.gen!FA 20120323
NOD32 Win32/Dorkbot.B 20120323
Norman W32/Suspicious_Gen2.dam 20120323
nProtect Worm.Generic.336052 20120323
Panda Generic Trojan 20120323
PCTools Trojan.IRCBot 20120323
Prevx – 20120323
Rising – 20120323
Sophos Troj/Agent-SOM 20120323
SUPERAntiSpyware – 20120322
Symantec W32.IRCBot.NG 20120323
TheHacker Trojan/Jorik.IRCbot.akj 20120322
TrendMicro WORM_NGRBOT.WA 20120323
TrendMicro-HouseCall WORM_NGRBOT.WA 20120323
VBA32 Trojan.Jorik.IRCbot.akj 20120322
VIPRE Worm.Win32.Nusump.ab (v) 20120323
ViRobot Trojan.Win32.Generic.118784.I 20120323
VirusBuster Worm.Dorkbot!jlJYYO/z6bg 20120322

__________
SHA256: ec77ead953a2da22a50d94e48ed52ca7c71d234f943469718683486f47f4b6ba
SHA1: d593e23ebfe866dac6740402391143e44e70d342
MD5: e10529e60eb38d26a52c3fe3ec6e26b3
Tamaño: 112.0 KB ( 114688 bytes )
Nombre: PHZIZX.EXE.Muestra EliStartPage v24.11
Tipo: Win32 EXE
Detecciones: 39 / 43
Fecha de análisis: 2012-03-23 12:21:20 UTC ( hace 0 minutos )

01
Antivirus Resultado Actualización
AhnLab-V3 Win-Trojan/Ircbot.114688.B 20120322
AntiVir TR/Jorik.IRCbot.cna 20120323
Antiy-AVL Trojan/Win32.Jorik.gen 20120323
Avast Win32:VBLoader [Trj] 20120320
AVG Generic25.SEC 20120323
BitDefender Trojan.IrcBot.ABA 20120323
ByteHero – 20120319
CAT-QuickHeal Trojan.Jorik.IRCbot.cna.cw3 20120323
ClamAV – 20120322
Commtouch W32/Jorik.D 20120323
Comodo TrojWare.Win32.Jorik.~A 20120323
DrWeb Win32.HLLW.Autoruner.62167 20120323
Emsisoft Trojan.Win32.Jorik!IK 20120323
eSafe Win32.IRCBot.Ng 20120322
eTrust-Vet Win32/Dorkbot.GP 20120323
F-Prot W32/Jorik.D 20120322
F-Secure Trojan.IrcBot.ABA 20120323
Fortinet W32/Jorik_IRCbot.B!worm 20120323
GData Trojan.IrcBot.ABA 20120323
Ikarus Trojan.Win32.Jorik 20120323
Jiangmin Trojan/Jorik.aalf 20120322
K7AntiVirus Trojan 20120323
Kaspersky Trojan.Win32.Jorik.IRCbot.cna 20120323
McAfee W32/IRCbot.gen.a 20120323
McAfee-GW-Edition Heuristic.LooksLike.Win32.SuspiciousPE.F!80 20120322
Microsoft Worm:Win32/Dorkbot.A 20120323
NOD32 Win32/Dorkbot.B 20120323
Norman W32/Suspicious_Gen2.dam 20120323
nProtect Trojan/W32.Agent.114688.BDG 20120323
Panda Generic Malware 20120323
PCTools Trojan.IRCBot 20120323
Prevx – 20120323
Rising – 20120323
Sophos Mal/Generic-L 20120323
SUPERAntiSpyware Trojan.Agent/Gen-Jorik 20120322
Symantec W32.IRCBot.NG 20120323
TheHacker Trojan/Agent.gen 20120322
TrendMicro WORM_IRCBOT.SMC 20120323
TrendMicro-HouseCall WORM_IRCBOT.SMC 20120323
VBA32 Trojan.Jorik.IRCbot.cna 20120322
VIPRE Backdoor.IRCBot 20120323
ViRobot Trojan.Win32.Inject.114688.J 20120323
VirusBuster Worm.Dorkbot!jWayrInWozo 20120322

_________

SHA256: 2f49ead993ad9c0b7bbff925a9752993640653f756abb0608e953f88c596cf6e
SHA1: cf611fdb100002d2beb94320d2a9b7148adad4a6
MD5: 143e46ae31e3c91ab13104867e0e665a
Tamaño: 152.0 KB ( 155648 bytes )
Nombre: WYAEAA.EXE.Muestra EliStartPage v23.96
Tipo: Win32 EXE
Detecciones: 36 / 43
Fecha de análisis: 2012-03-23 12:23:25 UTC ( hace 0 minutos )

01
Antivirus Resultado Actualización
AhnLab-V3 Trojan/Win32.VBKrypt 20120322
AntiVir TR/Graftor.839.1 20120323
Antiy-AVL Worm/Win32.Ngrbot.gen 20120323
Avast Win32:VB-AAHY [Trj] 20120320
AVG Dropper.Generic4.BHUL 20120323
BitDefender Gen:Heur.Spesr.VB.1 20120323
ByteHero – 20120319
CAT-QuickHeal Worm.Dorkbot.A 20120323
ClamAV – 20120322
Commtouch – 20120323
Comodo UnclassifiedMalware 20120323
DrWeb Trojan.MulDrop3.26650 20120323
Emsisoft Trojan-Dropper.Win32.VB!IK 20120323
eSafe – 20120322
eTrust-Vet – 20120323
F-Prot – 20120322
F-Secure Gen:Heur.Spesr.VB.1 20120323
Fortinet W32/Ruskill.AGR!tr 20120323
GData Gen:Heur.Spesr.VB.1 20120323
Ikarus Trojan-Dropper.Win32.VB 20120323
Jiangmin Worm/Ngrbot.bx 20120322
K7AntiVirus EmailWorm 20120323
Kaspersky Worm.Win32.Ngrbot.gdv 20120323
McAfee Generic.dx!bbch 20120323
McAfee-GW-Edition Generic.dx!bbch 20120322
Microsoft Worm:Win32/Dorkbot.A 20120323
NOD32 a variant of Win32/Injector.LUS 20120323
Norman W32/Suspicious_Gen2.RJRQA 20120323
nProtect Trojan/W32.Agent.155648.ACD 20120323
Panda Generic Malware 20120323
PCTools Trojan.IRCBot 20120323
Prevx – 20120323
Rising Trojan.Win32.Generic.129E289A 20120323
Sophos Mal/Generic-L 20120323
SUPERAntiSpyware Trojan.Agent/Gen-VBKrypt 20120322
Symantec W32.IRCBot.NG 20120323
TheHacker Trojan/Injector.jub 20120322
TrendMicro Mal_VBWrap-1 20120323
TrendMicro-HouseCall Mal_VBWrap-1 20120323
VBA32 Malware-Cryptor.VB.gen 20120322
VIPRE Trojan.Win32.Generic!BT 20120323
ViRobot Worm.Win32.Ngrbot.155648 20120323
VirusBuster Worm.Ngrbot!X4mynCai9/c 20120322
__________
Dicha version del ELISTARA 25.16 que los detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy

SALUDOS

ms, 23-3-2012