MAIL MALICIOSO QUE SE ESTA RECIBIENDO MASIVAMENTE ANEXANDO DOWNLOADER UPATRE

Se está recibiendo mail masivo con este contenido:

______________

Asunto: Invoice B
rekke-Schiller – mayert.com
De: “incoming.fax@kenzo.fr” <incoming.fax@kenzo.fr>
Fecha: 28/09/2015 11:19
Para: <destinatario>
Confirmation Sent: Thu, 28 Sep 2015 10:16:45 +0100

Name: Haylee Wolf
Email: incoming.fax@kenzo.fr
Quote(s)/Invoice(s): 96UJ4Hvz
Transaction No: HaAMgZAGkxULp97ot0
Charged Amount: 84125616.79
CC Number: **********8224
Address: 6224 Dietrich Rapids
City: East Denisfort
Zip: 96679-6963

Quote(s)/Invoices(s) 96UJ4Hvz was paid.

Thank you for your payment.

If you have any questions, please contact us.

Brekke-Schiller
www.mayert.com

Contact Us:
1-508-047-3987
accounting@mayert.com

anexado: Quo_96UJ4Hvz_Haylee Wolf_HaAMgZAGkxULp97ot0.zip

_________________

El preanalisis de virustotal ofrece el siguiente informe:
MD5 e1ce5bf371288a9908911b619d3d4007
SHA1 32572a7e02a244ac637e867ffd6f785031a37547
File size 35.0 KB ( 35840 bytes )
SHA256: cf90b1d11630cc73950fd640d84f20fa2a70e0f454d389e0e1c9a8f23fbae286
File name: breaking morbidity rate airman.exe
Detection ratio: 33 / 57
Analysis date: 2015-09-28 05:13:54 UTC ( 4 hours, 28 minutes ago )

0 1
Antivirus Result Update
ALYac Trojan.GenericKD.2750075 20150928
AVG Crypt_s.JGZ 20150928
AVware Trojan.Win32.Generic!BT 20150927
Ad-Aware Trojan.GenericKD.2750075 20150928
AhnLab-V3 Trojan/Win32.MDA 20150927
Antiy-AVL Trojan[Downloader]/Win32.Upatre 20150927
Arcabit Trojan.D 20150928
Avira TR/AD.Yarwi.Y.961 20150927
BitDefender Trojan.GenericKD.2750075 20150928
Cyren W32/Upatre.DH.gen!Eldorado 20150928
DrWeb Trojan.DownLoader16.42693 20150928
ESET-NOD32 a variant of Win32/Kryptik.DYGW 20150928
Emsisoft Trojan.GenericKD.2750075 (B) 20150928
F-Prot W32/Upatre.DH.gen!Eldorado 20150928
F-Secure Trojan.GenericKD.2750075 20150928
Fortinet W32/Monlin.GK!tr 20150928
GData Trojan.GenericKD.2750075 20150928
Ikarus Trojan-Downloader.Upatre 20150928
K7AntiVirus Riskware ( 0040eff71 ) 20150927
K7GW Riskware ( 0040eff71 ) 20150928
Kaspersky Trojan-Downloader.Win32.Upatre.exeh 20150928
Malwarebytes Trojan.Agent 20150927
McAfee Upatre-FADW!E1CE5BF37128 20150928
McAfee-GW-Edition Artemis!Trojan 20150927
MicroWorld-eScan Trojan.GenericKD.2750075 20150928
Microsoft TrojanDownloader:Win32/Upatre!rfn 20150928
Panda Trj/Genetic.gen 20150927
Rising PE:Malware.RDM.21!5.1B[F1] 20150927
Sophos Troj/Upatre-UC 20150928
Tencent Win32.Trojan.Fakedoc.Auto 20150928
TrendMicro TROJ_UPATRE.SMJTZ 20150928
VIPRE Trojan.Win32.Generic!BT 20150928
nProtect Trojan.GenericKD.2750075 20150925
Lo pasamos a controlar especificamente a partir del ELISTARA 33.01 que ya esta disponible en nuestra web
saludos

ms, 28-9-2015