Tres nuevas variantes de worm VBNA cazadas por la heuristica del ELISTARA

A partir de la version 2.44 del ELIVBNA de hoy, pasamos a controlar estas nuevas muestras facilitadas por el ELISTARA

El preanalisis de las mismas en virustotal ofrecen los siguientes informes

nombre fichero : KYTIOV.EXE.Muestra EliStartPage v24.69

SHA256: 2f49ace95e686adebe2a9847b6fe0f1a54e7a3ec74ee5fd2b5c00f17993bb176
SHA1: fe82472d87b45f0eca90780908f9273e97aed313
MD5: a857710bb1665981e17b52929b5264a0
File size: 316.0 KB ( 323584 bytes )
File type: Win32 EXE
Detection ratio: 29 / 43
Analysis date: 2012-01-20 11:41:25 UTC ( 0 minutes ago )

01
Antivirus Result Update
AhnLab-V3 Trojan/Win32.Menti 20120119
AntiVir Worm/VB.AutoR.AQE.1 20120120
Antiy-AVL – 20120119
Avast Win32:VB-AAMJ [Trj] 20120120
AVG Worm/Generic2.BELV 20120120
BitDefender Gen:Variant.Graftor.10670 20120120
ByteHero – 20120116
CAT-QuickHeal Worm.Vobfus.Gen 20120120
ClamAV – 20120120
Commtouch W32/Vobfus.Z5.gen!Eldorado 20120120
Comodo TrojWare.Win32.VB.CIB 20120120
DrWeb Trojan.VbCrypt.81 20120120
Emsisoft Trojan.Win32.Diple!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Vobfus.AAA 20120120
F-Prot W32/Vobfus.Z5.gen!Eldorado 20120119
F-Secure Gen:Variant.Graftor.10670 20120120
Fortinet W32/Diple.ZMH!tr 20120120
GData Gen:Variant.Graftor.10670 20120119
Ikarus Trojan.Win32.Diple 20120120
Jiangmin – 20120119
K7AntiVirus Trojan 20120119
Kaspersky Worm.Win32.WBNA.bqi 20120120
McAfee VBObfus.ch 20120120
McAfee-GW-Edition VBObfus.ch 20120120
Microsoft Trojan:Win32/Otran 20120120
NOD32 a variant of Win32/AutoRun.VB.AQE 20120120
Norman W32/Diple.BK 20120120
nProtect – 20120120
Panda Generic Trojan 20120119
PCTools – 20120120
Prevx – 20120120
Rising – 20120118
Sophos Mal/SillyFDC-T 20120120
SUPERAntiSpyware – 20120120
Symantec – 20120120
TheHacker – 20120120
TrendMicro WORM_VOBFUS.SMAB 20120120
TrendMicro-HouseCall WORM_VOBFUS.SMAB 20120120
VBA32 BScope.Trojan.FakePict.1021 20120119
VIPRE Trojan.Win32.Generic!BT 20120120
ViRobot – 20120120
VirusBuster – 20120120

__________

Nombre de fichero: FILAH.EXE.Muestra EliStartPage v24.69

SHA256: e34512ba402a7eb17effbc80871be8af2659a9e6cb05072bfa1b1d28358271a8
SHA1: f19733e5a17a5f293e5798a47da294d482c231a9
MD5: c9946a147cfce5c35e98c388ff2a370c
File size: 316.0 KB ( 323584 bytes )
File type: Win32 EXE
Detection ratio: 30 / 43
Analysis date: 2012-01-20 11:34:07 UTC ( 0 minutes ago )

01
Antivirus Result Update
AhnLab-V3 Trojan/Win32.Menti 20120119
AntiVir Worm/VB.AutoR.AQE.1 20120120
Antiy-AVL – 20120119
Avast Win32:VB-AAMJ [Trj] 20120120
AVG Worm/Generic2.BELV 20120120
BitDefender Gen:Variant.Graftor.10670 20120120
ByteHero – 20120116
CAT-QuickHeal Worm.Vobfus.Gen 20120120
ClamAV – 20120120
Commtouch W32/Vobfus.Z5.gen!Eldorado 20120120
Comodo TrojWare.Win32.VB.CIB 20120120
DrWeb Trojan.VbCrypt.81 20120120
Emsisoft Trojan.Win32.Diple!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Vobfus.AAA 20120120
F-Prot W32/Vobfus.Z5.gen!Eldorado 20120119
F-Secure Gen:Variant.Graftor.10670 20120120
Fortinet W32/Diple.ZMH!tr 20120120
GData Gen:Variant.Graftor.10670 20120119
Ikarus Trojan.Win32.Diple 20120120
Jiangmin – 20120119
K7AntiVirus Trojan 20120119
Kaspersky Worm.Win32.WBNA.bqi 20120120
McAfee VBObfus.ch 20120120
McAfee-GW-Edition VBObfus.ch 20120120
Microsoft Trojan:Win32/Otran 20120120
NOD32 a variant of Win32/AutoRun.VB.AQE 20120120
Norman W32/Diple.BK 20120119
nProtect – 20120120
Panda Generic Trojan 20120119
PCTools – 20120120
Prevx – 20120120
Rising – 20120118
Sophos Mal/SillyFDC-T 20120120
SUPERAntiSpyware – 20120120
Symantec – 20120120
TheHacker W32/WBNA.bqi 20120120
TrendMicro WORM_VOBFUS.SMAB 20120120
TrendMicro-HouseCall WORM_VOBFUS.SMAB 20120120
VBA32 BScope.Trojan.FakePict.1021 20120119
VIPRE Trojan.Win32.Generic!BT 20120120
ViRobot – 20120120
VirusBuster – 20120120

_________

Nombre fichero : BIITE.EXE.Muestra EliStartPage v24.69

SHA256: dd8ec4d859a980fec8051f06ac40eb27ed4a47209576a2c999828aa7ab2f3fc0
SHA1: 0944f1ea7149ae34489484f3c1286942cb56e19d
MD5: 0a87616fe664de3c516c29bf855805d5
File size: 316.0 KB ( 323584 bytes )
File type: Win32 EXE
Detection ratio: 29 / 43
Analysis date: 2012-01-20 11:31:46 UTC ( 0 minutes ago )

01
Antivirus Result Update
AhnLab-V3 Trojan/Win32.Menti 20120119
AntiVir Worm/VB.AutoR.AQE.1 20120120
Antiy-AVL – 20120119
Avast Win32:VB-AAMJ [Trj] 20120120
AVG Worm/Generic2.BELV 20120120
BitDefender Gen:Variant.Graftor.10670 20120120
ByteHero – 20120116
CAT-QuickHeal Worm.Vobfus.Gen 20120120
ClamAV – 20120120
Commtouch W32/Vobfus.Z5.gen!Eldorado 20120120
Comodo TrojWare.Win32.VB.CIB 20120120
DrWeb Trojan.VbCrypt.81 20120120
Emsisoft Trojan.Win32.Diple!IK 20120120
eSafe – 20120117
eTrust-Vet Win32/Vobfus.AAA 20120120
F-Prot W32/Vobfus.Z5.gen!Eldorado 20120119
F-Secure Gen:Variant.Graftor.10670 20120120
Fortinet W32/Diple.ZMH!tr 20120120
GData Gen:Variant.Graftor.10670 20120119
Ikarus Trojan.Win32.Diple 20120120
Jiangmin – 20120119
K7AntiVirus Trojan 20120119
Kaspersky Worm.Win32.WBNA.bqi 20120120
McAfee VBObfus.ch 20120120
McAfee-GW-Edition VBObfus.ch 20120120
Microsoft Trojan:Win32/Otran 20120120
NOD32 a variant of Win32/AutoRun.VB.AQE 20120120
Norman W32/Diple.BK 20120119
nProtect – 20120120
Panda Generic Trojan 20120119
PCTools – 20120120
Prevx – 20120120
Rising – 20120118
Sophos Mal/SillyFDC-T 20120120
SUPERAntiSpyware – 20120120
Symantec – 20120120
TheHacker – 20120120
TrendMicro WORM_VOBFUS.SMAB 20120120
TrendMicro-HouseCall WORM_VOBFUS.SMAB 20120120
VBA32 BScope.Trojan.FakePict.1021 20120119
VIPRE Trojan.Win32.Generic!BT 20120120
ViRobot – 20120120
VirusBuster – 20120120
Dicha version del ELIVBNA 2.44 que las detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy

saludos

ms, 20-1-2012