NUEVA VARIANTE DE BANLOAD, DESCARGADOR SE SPYBANKER

Recibido en mail en portugues, probablemente del Brasil, pasamos a controlar esta nueva variante de malware que instala un cazapasswords bancario

El preanalisis de virustotal ofrece el siguiente informe:

MD5 be919326afafbbf4f1a97500ad30c669
SHA1 a4ddf998d81d063a3f040c9ab9a8c38017481a50
File size 687.5 KB ( 704000 bytes )

SHA256: 7fd63a2b2206f578fb994913b9b28ec8939743b8596bbfd19eb928e2e0fa0df0
File name: Comprovante.exe
Detection ratio: 34 / 55
Analysis date: 2015-05-14 13:20:45 UTC ( 32 minutes ago )

0 2
Antivirus Result Update
ALYac Trojan.Crypt.Delf.E 20150514
AVG Downloader.Banload2.ACLC 20150514
AVware Trojan.Win32.Generic!BT 20150514
Ad-Aware Trojan.Crypt.Delf.E 20150514
AhnLab-V3 Trojan/Win32.Banload 20150514
Avast Win32:Malware-gen 20150514
Avira TR/ATRAPS.Gen 20150514
Baidu-International Trojan.Win32.Banload.VQI 20150513
BitDefender Trojan.Crypt.Delf.E 20150514
Comodo TrojWare.Win32.TrojanDownloader.Dadobra.~JK 20150514
Cyren W32/Downloader.AOVD-6031 20150514
ESET-NOD32 a variant of Win32/TrojanDownloader.Banload.VQI 20150514
Emsisoft Trojan.Crypt.Delf.E (B) 20150514
F-Secure Trojan.Crypt.Delf.E 20150514
Fortinet W32/Banload.VQI!tr.dldr 20150514
GData Trojan.Crypt.Delf.E 20150514
Ikarus Trojan-Downloader.Win32.Banload 20150514
K7AntiVirus Trojan-Downloader ( 004c11501 ) 20150514
K7GW Trojan-Downloader ( 004c11501 ) 20150514
Kaspersky Trojan.Win32.Delf.lcz 20150514
Malwarebytes Trojan.Banker.AXA 20150514
McAfee RDN/Generic Downloader.x!nl 20150514
McAfee-GW-Edition RDN/Generic Downloader.x!nl 20150514
MicroWorld-eScan Trojan.Crypt.Delf.E 20150514
NANO-Antivirus Trojan.Win32.Delf.drksjy 20150514
Norman Suspicious_Gen4.IIVWG 20150514
Panda Trj/CI.A 20150514
Qihoo-360 Win32/Trojan.f42 20150514
Sophos Mal/Generic-S 20150514
Symantec Downloader 20150514
TrendMicro-HouseCall TROJ_GEN.R047H09EB15 20150514
VBA32 suspected of Trojan.Notifier.gen 20150514
VIPRE Trojan.Win32.Generic!BT 20150514
nProtect Trojan.Crypt.Delf.E 20150514

Dicha version del ELISTARA 32.29 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 14-5-2015