NUEVO MAIL MASIVO MALICIOSO QUE ANEXA FICHERO ZIP CONTENIENDO DOWNLOADER NEMUCOD

Otro mail de los que anexan fichero empaquetado malicioso, en este caso el copy_invoice_00614953.zip, que contiene el invoice_copy_eFhOCp.js, que es un downloader NEMUCOD, pasa a ser controlado a partir del ELISTARA 33.51 de hoy

El contenido del mail que se recibe es del siguiente tipo:

MAIL MALICIOSO:
_______________

Asunto: Your order #00614953 – Corresponding Invoice #569B989D
De: =?UTF-8?B?Rm9ycmVzdCBXaGl0YWtlcg==?= <WhitakerForrest05@maison-chance.org>
Fecha: 09/12/2015 13:33
Para: =?UTF-8?B?dmlydXM=?= <DESTINATARIO>

Dear Valued Customer,

We are pleased to inform you that your order #00614953 has been processed and ready to be dispatched. However, according to our records, above mentioned invoice is still unpaid.
We would highly appreciate if you sent your payment promptly. For your information, don’t hesitate to check the invoice enclosed to this letter or contact us directly.
In case if you have already sent your payment, please disregards this letter and kindly allow us up to 3 business days to clear the incoming payment.

We look forward to your remittance and will the dispatch the goods.

Thank you for choosing our services we sincerely hope to continue doing business with you again.

Sincerely,
Forrest Whitaker

Sales Department Manager
Fretter Inc.
2715 Sycamore Road
Nyssa, OR 97913

anexo : copy_invoice_00614953.zip
__________________________

FIN DEL MAIL MALICIOSO

El preanalisis de virustotal ofrece el siguiente informe:
MD5 9252d119abc1187efdec8500e2cdf600
SHA1 f8f4c14fce26492c2022640288a801ddede115f7
File size 9.1 KB ( 9319 bytes )
SHA256: 04e1570707c9c756587d3cf22f9133c3f99695121d5aa6a0311435d2c4b39962
File name: invoice_copy_eFhOCp.js
Detection ratio: 2 / 54
Analysis date: 2015-12-09 16:05:28 UTC ( 1 minute ago )

0 1

Antivirus Result Update
Cyren JS/Downldr.CZ.gen 20151209
McAfee-GW-Edition BehavesLike.JS.ExploitBlacole.zv 20151209

Dicha version del ELISTARA 33.51 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy.

Al ser muy poco detectado y aun no conocerlo Kaspersky, les enviamos muestra del malware para que añadan su control y eliminación a partir las nuevas versiones de su antivirus. (Tambien a McAfee al solo detectarlo actualmente la versión GW EDITION)
saludos