Variantes de BUZUS descargados de reciente worm VBNA, todavía podo controlados por los AV actuales (5 de 43)

Como informabamos en el analisis del último VBNA, este descarga ficheros con BUZUS, asi como dropper del SIREFEF y PROXY EXI, que analizaremos posteriormente

El preanalisis de estos BUZUS a virustotal, ofrecen este informe:
File name: daiwiz.com
Submission date: 2012-01-10 12:12:44 (UTC)
Result: 5/ 43 (11.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.10.00 2012.01.10 –
AntiVir 7.11.20.221 2012.01.10 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2012.01.10 –
Avast 6.0.1289.0 2012.01.10 Win32:Sirefef-JO [Drp]
AVG 10.0.0.1190 2012.01.10 –
BitDefender 7.2 2012.01.10 –
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.10 –
ClamAV 0.97.3.0 2012.01.10 –
Commtouch 5.3.2.6 2012.01.10 –
Comodo 11233 2012.01.10 –
DrWeb 5.0.2.03300 2012.01.10 Trojan.Siggen3.19245
Emsisoft 5.1.0.11 2012.01.10 –
eSafe 7.0.17.0 2012.01.09 –
eTrust-Vet None 2012.01.10 –
F-Prot 4.6.5.141 2012.01.09 –
F-Secure 9.0.16440.0 2012.01.10 –
Fortinet 4.3.388.0 2012.01.10 –
GData 22.342/22.636 2012.01.10 Win32:Sirefef-JO
Ikarus T3.1.1.109.0 2012.01.10 –
Jiangmin 13.0.900 2012.01.09 –
K7AntiVirus 9.124.5897 2012.01.09 –
Kaspersky 9.0.0.837 2012.01.10 –
McAfee 5.400.0.1158 2012.01.10 –
McAfee-GW-Edition 2010.1E 2012.01.10 Heuristic.LooksLike.Win32.FakeYak.E
Microsoft 1.7903 2012.01.10 –
NOD32 6781 2012.01.10 –
Norman 6.07.13 2012.01.09 –
nProtect 2012-01-10.01 2012.01.10 –
Panda 10.0.3.5 2012.01.09 –
PCTools 8.0.0.5 2012.01.10 –
Prevx 3.0 2012.01.10 –
Rising 23.92.01.02 2012.01.10 –
Sophos 4.73.0 2012.01.10 –
SUPERAntiSpyware 4.40.0.1006 2012.01.10 –
Symantec 20111.2.0.82 2012.01.10 –
TheHacker 6.7.0.1.375 2012.01.10 –
TrendMicro 9.500.0.1008 2012.01.10 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.10 –
VBA32 3.12.16.4 2012.01.10 –
VIPRE 11378 2012.01.10 –
ViRobot 2012.1.10.4873 2012.01.10 –
VirusBuster 14.1.158.1 2012.01.09 –

Additional informationShow all
MD5   : 992a4cbb67f29917820302addb65c72b
SHA1  : efad3c5145600e7e57fca3a7c7728b0c65f081af
File size : 864256 bytes
publisher….: n/a
copyright….: n/a
product……: rgF39AOlGI
description..: n/a
original name: g25e88.exe
internal name: g25e88
file version.: 1.00

_________
File name: file-3391551_com
Submission date: 2012-01-09 16:00:01 (UTC)
Current status: finished
Result: 9 /43 (20.9%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.09.00 2012.01.09 –
AntiVir 7.11.20.200 2012.01.09 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2012.01.09 –
Avast 6.0.1289.0 2012.01.09 –
AVG 10.0.0.1190 2012.01.09 –
BitDefender 7.2 2012.01.09 –
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.09 –
ClamAV 0.97.3.0 2012.01.09 –
Commtouch 5.3.2.6 2012.01.09 –
Comodo 11223 2012.01.09 –
DrWeb 5.0.2.03300 2012.01.09 BackDoor.Maxplus.680
Emsisoft 5.1.0.11 2012.01.09 Trojan-Dropper!IK
eSafe 7.0.17.0 2012.01.08 –
eTrust-Vet 37.0.9671 2012.01.09 –
F-Prot 4.6.5.141 2012.01.09 –
F-Secure 9.0.16440.0 2012.01.09 –
Fortinet 4.3.388.0 2012.01.09 –
GData 22 2012.01.09 –
Ikarus T3.1.1.109.0 2012.01.09 Trojan-Dropper
Jiangmin 13.0.900 2012.01.08 –
K7AntiVirus 9.123.5881 2012.01.06 –
Kaspersky 9.0.0.837 2012.01.09 Trojan.Win32.Diple.eiax
McAfee 5.400.0.1158 2012.01.09 Artemis!B3CF1F2DE4E4
McAfee-GW-Edition 2010.1E 2012.01.09 Heuristic.LooksLike.Win32.FakeYak.E
Microsoft 1.7903 2012.01.09 Trojan:Win32/Sirefef.V
NOD32 6779 2012.01.09 a variant of Win32/TrojanDropper.VB.NZG
Norman 6.07.13 2012.01.09 –
nProtect 2012-01-09.01 2012.01.09 –
Panda 10.0.3.5 2012.01.09 –
PCTools 8.0.0.5 2012.01.09 –
Prevx 3.0 2012.01.09 –
Rising 23.92.00.02 2012.01.09 –
Sophos 4.73.0 2012.01.09 –
SUPERAntiSpyware 4.40.0.1006 2012.01.07 –
Symantec 20111.2.0.82 2012.01.09 –
TheHacker 6.7.0.1.373 2012.01.08 –
TrendMicro 9.500.0.1008 2012.01.09 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.09 –
VBA32 3.12.16.4 2012.01.09 –
VIPRE 11374 2012.01.09 –
ViRobot 2012.1.9.4871 2012.01.09 –
VirusBuster 14.1.157.0 2012.01.08 –

Additional informationShow all
MD5   : b3cf1f2de4e4b7f84f2b4c2174fb4947
SHA1  : e12502f44777a9769a2c62e6d9115b57ce7d02b2

File size : 868352 bytes

publisher….: n/a
copyright….: n/a
product……: Q2t70lJ1
description..: n/a
original name: W8OjzXOWn0.exe
internal name: W8OjzXOWn0
file version.: 1.00
______
File name: ziepat.com
Submission date: 2012-01-10 12:20:12 (UTC)

Result: 9/ 42 (21.4%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.10.00 2012.01.10 –
AntiVir 7.11.20.221 2012.01.10 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2012.01.10 –
Avast 6.0.1289.0 2012.01.10 Win32:Sirefef-JO [Drp]
AVG 10.0.0.1190 2012.01.10 Dropper.Generic5.RDK
BitDefender 7.2 2012.01.10 –
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.10 –
ClamAV 0.97.3.0 2012.01.10 –
Commtouch 5.3.2.6 2012.01.10 –
Comodo 11233 2012.01.10 UnclassifiedMalware
DrWeb 5.0.2.03300 2012.01.10 BackDoor.Maxplus.680
Emsisoft 5.1.0.11 2012.01.10 –
eSafe 7.0.17.0 2012.01.09 –
eTrust-Vet 37.0.9673 2012.01.10 –
F-Prot 4.6.5.141 2012.01.09 –
F-Secure 9.0.16440.0 2012.01.10 –
Fortinet 4.3.388.0 2012.01.10 –
GData 22 2012.01.10 Win32:Sirefef-JO
Ikarus T3.1.1.109.0 2012.01.10 –
Jiangmin 13.0.900 2012.01.09 –
K7AntiVirus 9.124.5897 2012.01.09 –
Kaspersky 9.0.0.837 2012.01.10 Trojan.Win32.Diple.eikf
McAfee 5.400.0.1158 2012.01.10 –
McAfee-GW-Edition 2010.1E 2012.01.10 Heuristic.LooksLike.Win32.FakeYak.E
Microsoft 1.7903 2012.01.10 –
NOD32 6781 2012.01.10 a variant of Win32/TrojanDropper.VB.NZG
Norman 6.07.13 2012.01.09 –
nProtect 2012-01-10.01 2012.01.10 –
Panda 10.0.3.5 2012.01.09 –
PCTools 8.0.0.5 2012.01.10 –
Prevx 3.0 2012.01.10 –
Rising 23.92.01.02 2012.01.10 –
Sophos 4.73.0 2012.01.10 –
SUPERAntiSpyware 4.40.0.1006 2012.01.10 –
Symantec 20111.2.0.82 2012.01.10 –
TheHacker 6.7.0.1.375 2012.01.10 –
TrendMicro 9.500.0.1008 2012.01.10 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.10 –
VIPRE 11378 2012.01.10 –
ViRobot 2012.1.10.4873 2012.01.10 –
VirusBuster 14.1.158.1 2012.01.09 –

Additional informationShow all
MD5   : 1337ac85d7b869d4db874b537cdbfc2e
SHA1  : 5a6f853e7338390df4b8327e6f44583bd3f314da

File size : 868352 bytes

publisher….: n/a
copyright….: n/a
product……: Q2t70lJ1
description..: n/a
original name: W8OjzXOWn0.exe
internal name: W8OjzXOWn0
file version.: 1.00
Dicha version del ELISTARA 24.62 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms,10-1-2012