NUEVA VARIANTE DE ADWARE SSFK (PUP) QUE PASAMOS A CONTROLAR CON ELISTARA

Tras la Instalación de un Downware tipo OutBrowse, se crean en “%Archivos de Programa%\ SFK” varios ficheros, EXE y DLL que pasamos a controlar a partir del ELISTARA 32.90 de hoy

l preanalisis de virustotal ofrecen los siguientes informes:

uno de los EXE: SFKEX64.exe
MD5 3375efa8964c402a11a0593e7fb41269
SHA1 f9c7af9c7c96cc70372ac3e79f9e6f9ed1721828
File size 120.0 KB ( 122880 bytes )
SHA256: 91989a1079ee556886e6f17cfad0b436394955c40ae06bb6ac221267f6659162
File name: SFKEX64.exe
Detection ratio: 24 / 56
Analysis date: 2015-09-08 06:04:09 UTC ( 2 hours, 50 minutes ago )

0 3
Antivirus Result Update
AVware Adware.Win64.Agent 20150901
Agnitum PUA.Agent! 20150907
AhnLab-V3 PUP/Win64.MySearch 20150908
Antiy-AVL GrayWare[AdWare:not-a-virus]/Win64.Agent 20150908
Baidu-International Adware.Win64.Agent.be 20150907
CAT-QuickHeal AdWare.Win64.r6 (Not a Virus) 20150908
ESET-NOD32 a variant of Win64/ELEX.A potentially unwanted 20150908
Fortinet Adware/Agent 20150908
GData Win32.Application.Elex.P 20150908
K7AntiVirus Adware ( 004c5cba1 ) 20150908
K7GW Adware ( 004c5cba1 ) 20150908
Kaspersky not-a-virus:AdWare.Win64.Agent.be 20150908
Malwarebytes Trojan.Downloader 20150907
McAfee RDN/Generic PUP.z 20150908
McAfee-GW-Edition RDN/Generic PUP.z 20150907
Microsoft BrowserModifier:Win32/SupTab 20150908
NANO-Antivirus Riskware.Win64.Agent.dvuuce 20150908
Panda Trj/CI.A 20150907
Symantec Trojan.Gen.2 20150907
TrendMicro PUA_Elex 20150908
TrendMicro-HouseCall PUA_Elex 20150908
VBA32 AdWare.Win64.Agent 20150907
VIPRE Adware.Win64.Agent 20150907
ViRobot Adware.Agent.122880.AB[h] 20150908
y una de las DLL: SFKEX.dll
MD5 7e12b7fd0e91268b3f32ff6a2515d6f8
SHA1 aae08c34a40924160c03fb6bb71d45c910acd94d
File size 344.5 KB ( 352768 bytes )
SHA256: c41261b2f0637473457de33a6e1498f57eb6af63d0b0648f82eacfc5f5b7bd7d
File name: SFKEX.dll
Detection ratio: 26 / 57
Analysis date: 2015-09-08 09:02:03 UTC ( 6 minutes ago )

0 1
Antivirus Result Update
AVG Elex.HH 20150908
Ad-Aware Gen:Variant.Application.Graftor.243776 20150908
Agnitum Riskware.Agent! 20150907
Arcabit Trojan.Graftor.D3B567 20150905
Avira ADWARE/ELEX.A.173 20150908
Baidu-International Adware.Win32.ELEX.EK 20150908
BitDefender Gen:Variant.Application.Graftor.243776 20150908
Cyren W32/Trojan.PVIP-0168 20150908
ESET-NOD32 a variant of Win32/ELEX.EK potentially unwanted 20150908
F-Secure Gen:Variant.Application.Graftor 20150908
Fortinet Riskware/Elex 20150908
GData Gen:Variant.Application.Graftor.243776 20150908
K7AntiVirus Adware ( 004ccae21 ) 20150908
K7GW Adware ( 004ccae21 ) 20150908
Malwarebytes Adware.Hijack.SFK 20150908
McAfee RDN/Generic.dx 20150908
McAfee-GW-Edition RDN/Generic.dx 20150907
MicroWorld-eScan Gen:Variant.Application.Graftor.243776 20150908
Microsoft BrowserModifier:Win32/SupTab 20150908
NANO-Antivirus Riskware.Win32.ELEX.dwqiao 20150908
Qihoo-360 HEUR/QVM30.1.Malware.Gen 20150908
SUPERAntiSpyware PUP.Elex/Variant 20150908
Symantec Trojan.Gen.2 20150907
TrendMicro TROJ_GEN.R00JC0OI415 20150908
VIPRE Trojan.Win32.Generic!BT 20150908
ViRobot Adware.Agent.352768.B[h] 20150908
Ya con el ELIPUP se detectan similares PUP, ofreciendo desisntalarlos desde Agregar o Quitar Programas, y en este caso con el ELISTARA ya se eliminan directamente.

Dicha version del ELISTARA 32.90 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy
saludos

ms, 8-9-2015