DESCARGAS DE MALWARES EFECTUADAS POR DOWNLOADERS UPATRE QUE HEMOS IDO RECIBIENDO EN MAILS MALICIOSOS

Ya hemos ido informando de varios downloaders de la familia UPATRE que se reciben anexados a mails maliciosos que se reciben masivamente, los cuales pasamos a controlar a partir del ELISTARA 32.84 de hoy

Ofrecemos informes del preanalisis de virustotal de las descargas de los ultimos que hemos recibido y que pasamos a controlar:

PREANALISIS DE VIRUSTOTAL DEL FICHERO DESCARGADO “camwugo.exe”

MD5 e2abe9188b0e601aab5819c52011e198
SHA1 fe0cf71d3fbbd55037ea1ff263a91fbc2d0db7d1
File size 450.5 KB ( 461312 bytes )
SHA256: 310c7bcd13be69ad37d02eca5aef238784bf1eb05b94a2a4c7ff3da06d02f54f
File name: camwugo.exe
Detection ratio: 43 / 56
Analysis date: 2015-08-31 06:42:56 UTC ( 1 hour, 59 minutes ago )

0 4
Antivirus Result Update
ALYac Backdoor.Agent.gc 20150831
AVG Ransomer.JRY 20150830
AVware Trojan.Win32.Generic!BT 20150831
Ad-Aware Trojan.GenericKD.2676457 20150831
AhnLab-V3 Trojan/Win32.Upatre 20150830
Arcabit Trojan.Generic.D28D6E9 20150830
Avast Win32:Malware-gen 20150830
Avira TR/Rogue.aiohzb 20150831
Baidu-International Trojan.Win32.Battdil.AO 20150830
BitDefender Trojan.GenericKD.2676457 20150831
Bkav HW32.Packed.14BD 20150831
CAT-QuickHeal (Suspicious) – DNAScan 20150829
Cyren W32/Downloader.WBMR-8808 20150831
DrWeb Trojan.Dyre.579 20150831
ESET-NOD32 Win32/Battdil.AO 20150831
Emsisoft Trojan-Downloader.Win32.Upatre (A) 20150831
F-Secure Trojan.GenericKD.2676457 20150829
Fortinet W32/Waski.F!tr 20150831
GData Trojan.GenericKD.2676457 20150831
Ikarus Trojan.Injector 20150831
Jiangmin TrojanDownloader.Dofoil.bhq 20150830
K7AntiVirus Riskware ( 0040eff71 ) 20150831
K7GW Riskware ( 0040eff71 ) 20150831
Kaspersky Trojan.Win32.Agent.igeo 20150831
Malwarebytes Spyware.Dyre 20150830
McAfee RDN/Generic.dx 20150831
McAfee-GW-Edition RDN/Generic.dx 20150830
MicroWorld-eScan Trojan.GenericKD.2676457 20150831
Microsoft PWS:Win32/Dyzap 20150831
NANO-Antivirus Trojan.Win32.Agent.dvsufb 20150831
Panda Generic Suspicious 20150830
Qihoo-360 HEUR/QVM19.1.Malware.Gen 20150831
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik 20150829
Sophos Troj/Upatre-LD 20150831
Symantec Downloader.Upatre!gen9 20150830
Tencent Win32.Trojan.Inject.Auto 20150831
TrendMicro TROJ_UPATRE.YYSMO 20150831
TrendMicro-HouseCall TROJ_UPATRE.YYSMO 20150831
VBA32 Heur.Trojan.Hlux 20150829
VIPRE Trojan.Win32.Generic!BT 20150831
ViRobot Trojan.Win32.Upatre.461312[h] 20150831
Zillya ‘Downloader.UpatreGen.Win32.68 20150830
nProtect Trojan.GenericKD.2676457 20150828

PREANALISIS DE VIRUSTOTAL DEL FICHERO DESCARGADO “noztegip.exe”

MD5 de3050772aba6d1f6d23ec9946da0949
SHA1 36355dd08b418508243cfd7d795119ff151492d9
File size 410.5 KB ( 420352 bytes )
SHA256: 736baf53246347f6f46a83ab50d8422e2f778161ea5e073310c6bcb392bd58e5
File name: noztegip.exe
Detection ratio: 38 / 56
Analysis date: 2015-08-31 08:45:15 UTC ( 1 minute ago )
0 1
Antivirus Result Update
ALYac Gen:Variant.Zusy.156846 20150831
AVG Ransomer.JRZ 20150831
AVware Trojan.Win32.Generic!BT 20150831
Ad-Aware Gen:Variant.Zusy.156846 20150831
Agnitum Trojan.Battdil! 20150829
AhnLab-V3 Trojan/Win32.PWS 20150830
Arcabit Trojan.Zusy.D264AE 20150831
Avast Win32:Malware-gen 20150830
Avira TR/Dropper.Gen 20150831
Baidu-International Trojan.Win32.Battdil.AP 20150830
BitDefender Gen:Variant.Zusy.156846 20150831
Bkav W32.ZjbuatS.Trojan 20150831
CAT-QuickHeal TrojanPWS.Dyzap.r4 20150829
Cyren W32/Trojan.EHSA-1131 20150831
DrWeb Trojan.DownLoader15.63337 20150831
ESET-NOD32 a variant of Win32/Battdil.AP 20150831
Emsisoft Gen:Variant.Zusy.156846 (B) 20150831
F-Secure Gen:Variant.Zusy.156846 20150829
Fortinet W32/Battdil.AP!tr 20150831
GData Gen:Variant.Zusy.156846 20150831
Ikarus Trojan.Win32.Battdil 20150831
K7AntiVirus Trojan ( 004cdddf1 ) 20150831
K7GW Trojan ( 004cdddf1 ) 20150831
Kaspersky UDS:DangerousObject.Multi.Generic 20150831
Malwarebytes Spyware.Dyre 20150830
McAfee RDN/Generic.grp 20150831
McAfee-GW-Edition RDN/Generic.grp 20150831
MicroWorld-eScan Gen:Variant.Zusy.156846 20150831
Microsoft PWS:Win32/Dyzap!rfn 20150831
NANO-Antivirus Trojan.Win32.Battdil.dvtjpb 20150831
Panda Trj/Genetic.gen 20150830
Qihoo-360 Win32/Trojan.BO.0dc 20150831
Sophos Mal/Generic-S 20150831
Symantec Trojan.Gen.2 20150830
Tencent Win32.Trojan.Inject.Auto 20150831
TrendMicro TROJ_GEN.R047C0DHR15 20150831
VIPRE Trojan.Win32.Generic!BT 20150831
nProtect Trojan/W32.Agent.420352.EB 20150828

PREANALISIS DE VIRUSTOTAL DEL FICHERO DESCARGADO “milvejute.exe”

MD5 20b3a91a5f3a14070cf0472a2a9858e6
SHA1 8dd147bd2aa8058aff95611e682a44eb15e9e038
File size 545.5 KB ( 558592 bytes )
SHA256: cbeaff44a37dcd3274a7ccc4ca099cdfb41e8fe0fc278c20813a668b0a4e345c
File name: milvejute.exe
Detection ratio: 35 / 57
Analysis date: 2015-08-31 08:50:55 UTC ( 2 minutes ago )

0 1
Antivirus Result Update
ALYac Gen:Variant.Mikey.22550 20150831
AVG Crypt4.BZJZ 20150831
AVware Trojan.Win32.Generic!BT 20150831
Ad-Aware Gen:Variant.Mikey.22550 20150831
Agnitum Trojan.Kryptik!f7OWki4c5pI 20150829
AhnLab-V3 Trojan/Win32.Agent 20150830
Arcabit Trojan.Mikey.D5816 20150831
Avast Win32:Malware-gen 20150830
Avira TR/Crypt.ZPACK.176520 20150831
Baidu-International Adware.Win32.iBryte.DUAO 20150830
BitDefender Gen:Variant.Mikey.22550 20150831
Cyren W32/Trojan.OAKC-4402 20150831
ESET-NOD32 a variant of Win32/Kryptik.DUAO 20150831
Emsisoft Gen:Variant.Mikey.22550 (B) 20150831
F-Secure Gen:Variant.Mikey.22550 20150829
Fortinet W32/Kryptik.DUAO!tr 20150831
GData Gen:Variant.Mikey.22550 20150831
Ikarus Trojan.Win32.Crypt 20150831
K7AntiVirus Trojan ( 004cd9a01 ) 20150831
K7GW Trojan ( 004cd9a01 ) 20150831
Kaspersky UDS:DangerousObject.Multi.Generic 20150831
Malwarebytes Spyware.Dyre 20150830
McAfee RDN/Generic PWS.y 20150831
McAfee-GW-Edition RDN/Generic PWS.y 20150831
MicroWorld-eScan Gen:Variant.Mikey.22550 20150831
Microsoft VirTool:Win32/Obfuscator.AOS 20150831
NANO-Antivirus Trojan.Win32.ZPACK.dvrnfo 20150831
Panda Trj/Genetic.gen 20150830
Qihoo-360 HEUR/QVM02.0.Malware.Gen 20150831
Sophos Mal/Generic-S 20150831
Symantec Trojan.Gen.2 20150830
Tencent Win32.Trojan.Crypt.Hqbr 20150831
TrendMicro TSPY_DYRE.XXA 20150831
TrendMicro-HouseCall TSPY_DYRE.XXA 20150831
VIPRE Trojan.Win32.Generic!BT 20150831

PREANALISIS DE VIRUSTOTAL DEL FICHERO DESCARGADO “WRCyARjAPFiWKWk.exe”

MD5 41c36735aa2f0d818dc46491ba845e63
SHA1 711b6cd7cf12a10ef452294058ec891beb5c884b
File size 483.0 KB ( 494592 bytes )
SHA256: 970858f16d3d44d1e54ec147533ee855faa61b7a3b3a37c3eb14141a399b8a70
File name: WRCyARjAPFiWKWk.exe
Detection ratio: 35 / 57
Analysis date: 2015-08-31 08:55:22 UTC ( 3 minutes ago )

0 3
Antivirus Result Update
ALYac Trojan.GenericKD.2652739 20150831
AVG Ransomer.JQR 20150831
AVware Trojan.Win32.Generic!BT 20150831
Ad-Aware Trojan.GenericKD.2652739 20150831
Agnitum Trojan.DL.Agent!h2DpQu6li2s 20150829
Arcabit Trojan.Generic.D287A43 20150831
Avast Win32:Malware-gen 20150830
Avira TR/Rogue.aiohrb 20150831
Baidu-International Trojan.Win32.Downloader.wsmfx 20150830
BitDefender Trojan.GenericKD.2652739 20150831
Bkav HW32.Packed.1190 20150831
CAT-QuickHeal TrojanDownloader.Agent.r4 20150829
Cyren W32/Trojan.CKCI-3230 20150831
ESET-NOD32 Win32/Battdil.AM 20150831
Emsisoft Trojan.GenericKD.2652739 (B) 20150831
F-Secure Trojan.GenericKD.2652739 20150829
Fortinet W32/Kryptik.DRAC!tr 20150831
GData Trojan.GenericKD.2652739 20150831
Ikarus Trojan.Win32.Battdil 20150831
K7AntiVirus Trojan ( 004cd4621 ) 20150831
K7GW Trojan ( 004cd4621 ) 20150831
Kaspersky Trojan-Downloader.Win32.Agent.wsmfx 20150831
Malwarebytes Trojan.Krypt 20150830
McAfee RDN/Generic Downloader.x 20150831
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.gc 20150831
MicroWorld-eScan Trojan.GenericKD.2652739 20150831
Microsoft Trojan:Win32/Bulta!rfn 20150831
NANO-Antivirus Trojan.Win32.Agent.dvkxsj 20150831
Panda Trj/Genetic.gen 20150830
Qihoo-360 HEUR/QVM20.1.Malware.Gen 20150831
Sophos Mal/Generic-S 20150831
Symantec Trojan.Gen 20150830
TrendMicro TROJ_GEN.R01TC0DHL15 20150831
VIPRE Trojan.Win32.Generic!BT 20150831
nProtect Trojan.GenericKD.2652739 20150828

Dicha version 32.84 del ELISTARA que los detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy

saludos

ms, 31-8-2015