BACKDOOR FINLOSKY, EL DROPPER Y EL CREADO POR ÉL

Otra variante del Keylogger Finlosky pasa a ser controlado a partir del ELISTARA 31.92 de hoy (tanto el dropper como el creado por él)

Los preanalisis de virustotal del dropper y del que crea, son los siguiente:

MD5 38a1e71e2112448c87ab0997a7e23781
SHA1 ad4e9c7afc27404959d589e355b5e2435c4b3f4e
Tamaño del fichero 501.5 KB ( 513536 bytes )
SHA256: b010e2f6792ca851dbce6ae07ab39537b7aab3141c49ad174e69283a57a2b329
Nombre: mail_origin_steam_120rbrut.exe
Detecciones: 40 / 55
Fecha de análisis: 2015-03-23 09:47:46 UTC ( hace 1 hora, 3 minutos )

0 1

Antivirus Resultado Actualización
ALYac MemScan:Trojan.Inject.AUZ 20150323
AVG BackDoor.Generic16.CNXD.dropper 20150323
AVware Trojan-Spy.Win32.Usteal.da (v) 20150320
Ad-Aware MemScan:Trojan.Inject.AUZ 20150323
Agnitum Trojan.FruStealer.Gen.LG 20150322
AhnLab-V3 Trojan/Win32.Ruftar 20150323
Avast Win32:Agent-AVIF [Trj] 20150323
Avira TR/Crypt.ULPM.Gen 20150323
Baidu-International Trojan.Win32.Usteal.C 20150323
BitDefender MemScan:Trojan.Inject.AUZ 20150323
CAT-QuickHeal TrojanSpy.Usteal.D.mue 20150323
Cyren W32/Usteal.A.gen!Eldorado 20150323
ESET-NOD32 a variant of Win32/Spy.Usteal.C 20150323
Emsisoft MemScan:Trojan.Inject.AUZ (B) 20150323
F-Prot W32/Usteal.A.gen!Eldorado 20150323
F-Secure MemScan:Trojan.Inject.AUZ 20150323
Fortinet W32/Krypt.DDS!tr 20150323
GData MemScan:Trojan.Inject.AUZ 20150323
Ikarus Trojan-Spy.Win32.Usteal 20150323
Jiangmin Backdoor/DarkKomet.ndt 20150322
K7AntiVirus Trojan ( 00012a951 ) 20150323
K7GW Trojan ( 00012a951 ) 20150323
Kaspersky Backdoor.Win32.DarkKomet.xyk 20150323
Malwarebytes Trojan.PWS.LDPinch 20150323
McAfee Trojan-FBXH!38A1E71E2112 20150323
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.hc 20150323
Microsoft Backdoor:Win32/Fynloski.A 20150323
NANO-Antivirus Trojan.Win32.UFR.dpbhfv 20150323
Norman Downloader.HJVR 20150323
Qihoo-360 Win32/Backdoor.f57 20150323
Sophos Mal/Generic-S 20150323
Symantec Infostealer.Ldpinch!g2 20150323
Tencent Trojan.Win32.YY.Gen.6 20150323
TrendMicro TROJ_SCAR.BMC 20150323
TrendMicro-HouseCall TROJ_SCAR.BMC 20150323
VBA32 TrojanPSW.Usteal.gen 20150322
VIPRE Trojan-Spy.Win32.Usteal.da (v) 20150323
ViRobot Trojan.Win32.S.Agent.513536.DG[h] 20150323
Zillya Backdoor.DarkKomet.Win32.28636 20150322
nProtect MemScan:Trojan.Inject.AUZ 20150320

y el creado por él:

MD5 b9a8b3ce79b278d7b96d3314fe9d32ad
SHA1 974091dfa0344682f419fbf16ce8cb9209e7df32
Tamaño del fichero 756.0 KB ( 774144 bytes )
SHA256: a04c42a16b0aeb2200ec5581f7cc6eb4f61000a686515a6f4cf3246156eef21e
Nombre: mail_origin_steam_120rbrutaaa.exe
Detecciones: 52 / 57
Fecha de análisis: 2015-03-23 10:42:25 UTC ( hace 2 minutos )

0 1

Antivirus Resultado Actualización
ALYac Trojan.Inject.AUZ 20150323
AVG BackDoor.Generic16.CNXD 20150323
AVware Backdoor.Win32.Fynloski.A (v) 20150320
Ad-Aware Trojan.Inject.AUZ 20150323
Agnitum Trojan.Comet.Gen.LO 20150322
AhnLab-V3 Trojan/Win32.DelfInject 20150323
Antiy-AVL Trojan[Backdoor]/Win32.DarkKomet 20150323
Avast Win32:Agent-ASXK [Trj] 20150323
Avira BDS/DarkKomet.GR 20150323
Baidu-International Backdoor.Win32.DarkKomet.xyk 20150323
BitDefender Trojan.Inject.AUZ 20150323
Bkav W32.OnGamesLTKVPOK.Trojan 20150321
CAT-QuickHeal Backdoor.Fynloski.A9 20150323
CMC Backdoor.Win32.DarkKomet!O 20150323
ClamAV WIN.Trojan.DarkKomet 20150323
Comodo Backdoor.Win32.Agent.XAB 20150323
Cyren W32/Downloader.C.gen!Eldorado 20150323
DrWeb BackDoor.Comet.2020 20150323
ESET-NOD32 Win32/Fynloski.AA 20150323
Emsisoft Trojan.Inject.AUZ (B) 20150323
F-Prot W32/Downloader.C.gen!Eldorado 20150323
F-Secure Trojan.Inject.AUZ 20150323
Fortinet W32/DarkKomet.ID!tr.bdr 20150323
GData Trojan.Inject.AUZ 20150323
Ikarus Backdoor.Win32.DarkKomet 20150323
Jiangmin Trojan/Generic.afytr 20150322
K7AntiVirus Backdoor ( 0039fb811 ) 20150323
K7GW Backdoor ( 0039fb811 ) 20150323
Kaspersky Backdoor.Win32.DarkKomet.xyk 20150323
Kingsoft Win32.Hack.HuigeziT.cz 20150323
Malwarebytes Backdoor.Agent.DCRSAGen 20150323
McAfee Generic BackDoor.xa 20150323
McAfee-GW-Edition BehavesLike.Win32.Backdoor.bh 20150323
MicroWorld-eScan Trojan.Inject.AUZ 20150323
Microsoft Backdoor:Win32/Fynloski.A 20150323
NANO-Antivirus Trojan.Win32.DarkKomet.cssoim 20150323
Norman Downloader.HJVR 20150323
Qihoo-360 Malware.Radar01.Gen 20150323
Rising PE:Backdoor.Pontoeb!1.6637 20150323
SUPERAntiSpyware Trojan.Agent/Gen-DarkKomet 20150321
Sophos Troj/Backdr-ID 20150323
Symantec Backdoor.Graybird 20150323
Tencent Backdoor.Win32.Darkkomet.a 20150323
TheHacker Backdoor/DarkKomet.dyz 20150322
TotalDefense Win32/Fynloski.A!generic 20150323
TrendMicro TROJ_SCAR.BMC 20150323
TrendMicro-HouseCall BKDR_FYNLOS.SMM 20150323
VBA32 Backdoor.DarkKomet 20150322
VIPRE Backdoor.Win32.Fynloski.A (v) 20150323
ViRobot Backdoor.Win32.Agent.674304.A[h] 20150323
Zillya Trojan.Fynloski.Win32.3190 20150322
nProtect Trojan/W32.Agent.774144.HJ 20150320
Dicha version del ELISTARA 31.92 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 23-3-2015