NUEVA VARIANTE DE MALWARE LDRSOFT

A partir de la version 29.63 del ELISTARA de hoy, pasaremos a controlar esta nueva variante de malware, que sobreescribe el HOSTS impidiendo acceder a webs relacionadas con antivirus.

Sobrescribe el HOSTS con estas entradas:

127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 rads.mcafee.com
127.0.0.1 www.secuser.com
127.0.0.1 a188.x.akamai.net
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantec.d4p.net
127.0.0.1 update.symantec.com
127.0.0.1 ftp.nai.com
127.0.0.1 www.grisoft.cz
127.0.0.1 www.grisoft.com
127.0.0.1 free.grisoft.cz
127.0.0.1 tds.diamondcs.com.au
127.0.0.1 ieupdate.gdata.de
127.0.0.1 ieupdate6.gdata.de
127.0.0.1 ieupdate5.gdata.de
127.0.0.1 ieupdate4.gdata.de
127.0.0.1 ieupdate3.gdata.de
127.0.0.1 ieupdate2.gdata.de
127.0.0.1 ieupdate1.gdata.de
127.0.0.1 www.iavs.cz
127.0.0.1 download7.avast.com
127.0.0.1 download6.avast.com
127.0.0.1 download5.avast.com
127.0.0.1 download4.avast.com
127.0.0.1 download3.avast.com
127.0.0.1 download2.avast.com
127.0.0.1 download1.avast.com
127.0.0.1 upgrade.bitdefender.com
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.lavasoftusa.com
127.0.0.1 www.a-2.org
127.0.0.1 updates.a-2.org
127.0.0.1 niuone.norman.no
127.0.0.1 www.diamondcs.com.au
127.0.0.1 www.attechnical.com
127.0.0.1 www.zeylstra.nl
127.0.0.1 fractus.mat.uson.mx
127.0.0.1 toonbox.de
127.0.0.1 radius.turvamies.com
127.0.0.1 diamondcs.fileburst.com
127.0.0.1 downloads.My-eTrust.com
127.0.0.1 acs.pandasoftware.com
127.0.0.1 v4.windowsupdate.microsoft.com
127.0.0.1 www.NoAdware.net
127.0.0.1 www.nod32.com
127.0.0.1 www.eset.sk
127.0.0.1 avu.zonelabs.com
127.0.0.1 retail.sp.f-secure.com
127.0.0.1 retail01.sp.f-secure.com
127.0.0.1 retail02.sp.f-secure.com
127.0.0.1 www.moosoft.com
127.0.0.1 secuser.model-fx.com
127.0.0.1 secuser.com
127.0.0.1 downloads-eu1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 pccreg.antivirus.com
127.0.0.1 dl1.antivir.de
127.0.0.1 dl2.antivir.de
127.0.0.1 dl3.antivir.de
127.0.0.1 dl4.antivir.de
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fastclick.net
127.0.0.1 ads.fastclick.net
127.0.0.1 ar.atwola.com
127.0.0.1 atdmt.com
127.0.0.1 avp.ch
127.0.0.1 avp.com
127.0.0.1 avp.com
127.0.0.1 avp.ru
127.0.0.1 awaps.net
127.0.0.1 banner.fastclick.net
127.0.0.1 banners.fastclick.net
127.0.0.1 ca.com
127.0.0.1 ca.com
127.0.0.1 click.atdmt.com
127.0.0.1 clicks.atdmt.com
127.0.0.1 customer.symantec.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 download.microsoft.com
127.0.0.1 downloads.microsoft.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads1.kaspersky-labs.com
127.0.0.1 downloads2.kaspersky-labs.com
127.0.0.1 downloads3.kaspersky-labs.com
127.0.0.1 downloads4.kaspersky-labs.com
127.0.0.1 downloads-us1.kaspersky-labs.com
127.0.0.1 downloads-us2.kaspersky-labs.com
127.0.0.1 downloads-us3.kaspersky-labs.com
127.0.0.1 engine.awaps.net
127.0.0.1 fastclick.net
127.0.0.1 f-secure.com
127.0.0.1 f-secure.com
127.0.0.1 ftp.avp.ch
127.0.0.1 ftp.downloads2.kaspersky-labs.com
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.kasperskylab.ru
127.0.0.1 ftp.sophos.com
127.0.0.1 go.microsoft.com
127.0.0.1 ids.kaspersky-labs.com
127.0.0.1 kaspersky.com
127.0.0.1 kaspersky-labs.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 media.fastclick.net
127.0.0.1 msdn.microsoft.com
127.0.0.1 my-etrust.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 office.microsoft.com
127.0.0.1 phx.corporate-ir.net
127.0.0.1 rads.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 sophos.com
127.0.0.1 spd.atdmt.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 symantec.com
127.0.0.1 trendmicro.com
127.0.0.1 update.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 updates1.kaspersky-labs.com
127.0.0.1 updates1.kaspersky-labs.com
127.0.0.1 updates2.kaspersky-labs.com
127.0.0.1 updates3.kaspersky-labs.com
127.0.0.1 updates3.kaspersky-labs.com
127.0.0.1 updates4.kaspersky-labs.com
127.0.0.1 updates5.kaspersky-labs.com
127.0.0.1 us.mcafee.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.ru
127.0.0.1 windowsupdate.microsoft.com
127.0.0.1 www.avp.ch
127.0.0.1 www.avp.com
127.0.0.1 www.avp.com
127.0.0.1 www.avp.ru
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.ca.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.grisoft.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.kaspersky.ru
127.0.0.1 www.kaspersky-labs.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.mcafee.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www.symantec.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.viruslist.ru
127.0.0.1 www3.ca.com

aparte,

– Se autoborra.
– Queda residente.
– Se pone en la lista de autorizaciones del Corta Fuegos de Windows como “ldrsoft”
El preanalisis de virUstotal ofrece este informe:

MD5 d23e1b1c21087cfab86abe73c285956f
SHA1 a065a46bb68e72de78c30a4026fd4ac57396de95
Tamaño del fichero 174.7 KB ( 178934 bytes )
SHA256: 1aeb8b42701f84c329785d7d54d4c3f0b3222fa77a1d46bf3b55af6f863e5803
Nombre: 1347963145.exe
Detecciones: 10 / 51
Fecha de análisis: 2014-03-21 11:58:24 UTC ( hace 1 minuto )

0 1
Antivirus  Resultado  Actualización
AhnLab-V3  Spyware/Win32.Zbot  20140320
ByteHero  Virus.Win32.Heur.p  20140321
ESET-NOD32  a variant of Win32/Injector.BAEN  20140321
K7AntiVirus  Trojan ( 0040f79d1 )  20140320
K7GW  Trojan ( 0040f79d1 )  20140320
Kaspersky  Backdoor.Win32.Androm.dqjv  20140321
Kingsoft  Win32.Troj.Generic.a.(kcloud)  20140321
Malwarebytes  Trojan.Crypt.NKN  20140321
Panda  Trj/dtcontx.L  20140321
Qihoo-360  Malware.QVM03.Gen  20140321

Dicha version del ELISTARA 29.63 que lo detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy

saludos

ms, 21-3-2014