Tres nuevas variantes de PUPER cazadas por la heuristica del ELISTARA

A partir del ELISTARA 24.70 pasamos a controlar especificamente tres muestras de variantes de PUPER que la heuristica del ELISTARA ha pedido para analizar

El preanalisis con virustotal de dichas muestras ofrece los siguientes informes:

Nombre de fichero: PSQNUVO.DLL (SharedTaskScheduler).vir

SHA256: c6498989cca88eee93a3cdbac50aa3df839bfae5f504621963d8b29ab5c9c090
SHA1: 6432e05ac226e77d823cac9363f44eec80c63a9a
MD5: 8f5d9b28ad52ab08ee74ddad234b6ab8
File size: 13.0 KB ( 13312 bytes )
File type: Win32 DLL
Detection ratio: 37 / 43
Analysis date: 2012-01-20 10:50:25 UTC ( 1 minute ago )

01
Antivirus Result Update
AhnLab-V3 Win-AppCare/Agent.13312.U 20120119
AntiVir TR/Dldr.FakeAlert.L 20120120
Antiy-AVL Hoax/Win32.Agent.gen 20120119
Avast Win32:Trojan-gen 20120119
AVG Generic10.AYUU 20120120
BitDefender Trojan.Downloader.FakeAlert.L 20120120
ByteHero – 20120111
CAT-QuickHeal Win32.TrojanDownloader.Renos.CO.5 20120120
ClamAV – 20120120
Commtouch W32/Downldr2.HRKE 20120120
Comodo TrojWare.Win32.TrojanDownloader.FakeAlert.DO 20120119
DrWeb Joke.Forgery.234 20120120
Emsisoft Hoax.Win32.Agent!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Crushpy.CK 20120120
F-Prot W32/Downldr2.HRKE 20120119
F-Secure Trojan.Downloader.FakeAlert.L 20120120
Fortinet Malware_fam.gw 20120120
GData Trojan.Downloader.FakeAlert.L 20120119
Ikarus Hoax.Win32.Agent 20120120
Jiangmin Hoax.Agent.j 20120119
K7AntiVirus Trojan 20120119
Kaspersky Hoax.Win32.Agent.dg 20120120
McAfee FakeAlert-S.dll 20120119
McAfee-GW-Edition FakeAlert-S.dll 20120120
Microsoft TrojanDownloader:Win32/Renos.AC 20120120
NOD32 Win32/TrojanDownloader.FakeAlert.DO 20120120
Norman FakeAlert.D 20120119
nProtect Joke/W32.Agent.13312.J 20120119
Panda Adware/AntiSpyCheck 20120119
PCTools RogueAntiSpyware.SpyAxe 20120120
Prevx – 20120120
Rising Trojan.Win32.Generic.11E5F4F8 20120118
Sophos Mal/FakeAlert-A 20120120
SUPERAntiSpyware Trojan.Smitfraud Variant 20120120
Symantec Downloader.MisleadApp 20120120
TheHacker – 20120120
TrendMicro ADW_RENOS 20120120
TrendMicro-HouseCall ADW_RENOS 20120119
VBA32 – 20120119
VIPRE FakeAlert.Zlob 20120120
ViRobot Hoax.Agent.13312.Z 20120120
VirusBuster Trojan.Agent!OYCwX1/2CRM 20120120
_______

Nombre de fichero : SBMDL.DLL.Muestra EliStartPage v24.69
SHA256: f18f644849c67f8cef43473b419684b2db006307bb8796129906e1bc3b52d531
SHA1: 77ed2ef0b2af2b0b9725eb0d68a420a42d351d01
MD5: 76320e2563cafc623db92774292b3f4a
File size: 8.0 KB ( 8192 bytes )
File type: Win32 DLL
Detection ratio: 35 / 43
Analysis date: 2012-01-20 10:55:37 UTC ( 1 minute ago )
01
Antivirus Result Update
AhnLab-V3 Win-Trojan/Zlob.8192.GB 20120119
AntiVir TR/Dldr.Zlob.pah.1 20120120
Antiy-AVL – 20120119
Avast Win32:Zlob-CEG [Trj] 20120119
AVG Downloader.Zlob 20120120
BitDefender Trojan.Downloader.Zlob.ABUV 20120120
ByteHero – 20120116
CAT-QuickHeal – 20120120
ClamAV Trojan.Zlob-6565 20120120
Commtouch W32/Downldr2.CIAA 20120120
Comodo – 20120119
DrWeb Trojan.Popuper.7004 20120120
Emsisoft Trojan.Zlob!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Puper!generic 20120120
F-Prot W32/Downldr2.CIAA 20120119
F-Secure Trojan.Downloader.Zlob.ABUV 20120120
Fortinet W32/ZLOB.DZZ!tr 20120120
GData Trojan.Downloader.Zlob.ABUV 20120119
Ikarus Trojan.Zlob 20120120
Jiangmin TrojanDownloader.Zlob.kir 20120119
K7AntiVirus Trojan-Downloader 20120119
Kaspersky Trojan-Downloader.Win32.Zlob.pbq 20120120
McAfee Artemis!76320E2563CA 20120119
McAfee-GW-Edition Artemis!76320E2563CA 20120120
Microsoft TrojanDownloader:Win32/Zlob.gen!AW 20120120
NOD32 Win32/TrojanDownloader.Zlob.CAK 20120120
Norman W32/Zlob.BUGZ 20120120
nProtect Trojan.Downloader.Zlob.ABUV 20120120
Panda Adware/MalwareAlarm 20120119
PCTools Downloader.MisleadApp 20120120
Prevx – 20120120
Rising Trojan.DL.Win32.Undef.ok 20120118
Sophos Troj/ZlbBHO-Fam 20120120
SUPERAntiSpyware Trojan.FakeAlert-IEBT 20120120
Symantec Downloader.MisleadApp 20120120
TheHacker Trojan/Downloader.Zlob.pbq 20120120
TrendMicro TROJ_ZLOB.BWC 20120120
TrendMicro-HouseCall TROJ_ZLOB.BWC 20120119
VBA32 – 20120119
VIPRE Trojan-Downloader.Zlob.Media-Codec 20120120
ViRobot – 20120120
VirusBuster Trojan.DL.Zlob!feMC61nFcdU 20120120
__________
Nombre fichero : WAMDL.DLL.Muestra EliStartPage v24.69

SHA256: 1430930c3d422ce14caedcfdda983ed2d08a73788259dffa48a64dfb1efc6ffa
SHA1: 5b33b32cfa09d8c6d6182bf4042896b3fedff97b
MD5: 5fd0c37c266798a1fbeb2419afb0c55f
File size: 88.0 KB ( 90112 bytes )
File type: Win32 DLL
Detection ratio: 32 / 43
Analysis date: 2012-01-20 11:01:14 UTC ( 1 minute ago )

01
Antivirus Result Update
AhnLab-V3 Win-Trojan/Zlob.90112.AR 20120119
AntiVir TR/Zlob.2.Gen.251 20120120
Antiy-AVL – 20120119
Avast Win32:Zlob-CEG [Trj] 20120119
AVG Downloader.Zlob 20120120
BitDefender Trojan.Zlob.2.Gen 20120120
ByteHero – 20120116
CAT-QuickHeal – 20120120
ClamAV – 20120120
Commtouch W32/AdAgent.B.gen!Eldorado 20120120
Comodo TrojWare.Win32.TrojanDownloader.Obfuscated._2 20120119
DrWeb Trojan.Popuper.7004 20120120
Emsisoft Trojan.Zlob!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Puper!generic 20120120
F-Prot W32/AdAgent.B.gen!Eldorado 20120119
F-Secure Trojan-Downloader:W32/Zlob.gen!A 20120120
Fortinet W32/Zlobie.AEG!tr 20120120
GData Trojan.Zlob.2.Gen 20120119
Ikarus Trojan.Zlob 20120120
Jiangmin TrojanDownloader.Zlob.ncx 20120119
K7AntiVirus Adware 20120119
Kaspersky Trojan-Downloader.Win32.Zlob.qok 20120120
McAfee Puper.gen.g 20120119
McAfee-GW-Edition Puper.gen.g 20120120
Microsoft TrojanDownloader:Win32/Zlob.gen!AX 20120120
NOD32 probably a variant of Win32/TrojanDownloader.Obfuscated.ERMZPSA 20120120
Norman W32/DLoader.HRQA 20120120
nProtect Trojan.Zlob.2.Gen 20120120
Panda Trj/Genetic.gen 20120119
PCTools Downloader.MisleadApp 20120120
Prevx – 20120120
Rising – 20120118
Sophos Troj/ZlbBHO-Fam 20120120
SUPERAntiSpyware – 20120120
Symantec Downloader.MisleadApp 20120120
TheHacker – 20120120
TrendMicro TROJ_ZLOB.BVY 20120120
TrendMicro-HouseCall TROJ_ZLOB.BVY 20120119
VBA32 – 20120119
VIPRE Trojan-Downloader.Zlob.Media-Codec 20120120
ViRobot – 20120120
VirusBuster Trojan.DL.Zlob!UwR7R/zdiL8 20120120
Dicha version del ELISTARA 24.70 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 20-1-2012