NUEVA VARIANTE DE DOWNLOADER KADENA (derivado del UPATRE)

Una nueva gama de UPATRES pero con diferencias sensibles, pasa a ser controlado a partir del ELISTARA 32.25 de hoy

Aparenta ser un mensaje del Administardor de la Red, instalando y descargando su malware en cuestion.
MAIL MALICIOSO
______________

Asunto: Administrator – Exchange Email id4728345
De: “Administrator@dominio destinatario <Administrator@dominio destinatario>
Fecha: 24/07/2014 11:35
Para: <destinatario>

This attachment(Exchange_id4728345.zip) provides you with managing facilities for your mailboxes, public folders, distribution lists, contact and mail service general settings. Please save the attached file to your hard drive before deleting this message.
Thank you,
Administrator

ANEXO: Exchange_id4728345.zip      

______________________

FIN DEL MAIL MALICIOSO
El preanalisis de virustotal ofrece el siguiente informe:

MD5 2879f96a721057cc1ccdcfa3665dbf96
SHA1 92c098190d752186f1dd34aaf3a7d1930791e3ed
File size 128.0 KB ( 131072 bytes )
SHA256: 60c93c997895162c4ee29f6877781a866a123659dc6d5a4f21123950fe46b585
File name: Exchange_id341700.exe
Detection ratio: 32 / 56
Analysis date: 2015-05-08 07:20:10 UTC ( 35 minutes ago )

0 13
Antivirus Result Update
AVG Generic36.BKKP 20150508
AVware Win32.Malware!Drop 20150508
Ad-Aware Trojan.GenericKD.2382690 20150508
Avast Win32:Malware-gen 20150508
Baidu-International Trojan.Win32.Agent.BEL 20150507
BitDefender Trojan.GenericKD.2382690 20150508
Cyren W32/Trojan.YQVX-4364 20150508
DrWeb Trojan.Inject1.54688 20150508
ESET-NOD32 Win32/TrojanDownloader.Agent.BEL 20150508
Emsisoft Trojan.GenericKD.2382690 (B) 20150508
F-Prot W32/Trojan3.PKO 20150508
F-Secure Trojan.GenericKD.2382690 20150508
Fortinet W32/Kryptik.DHIG!tr 20150508
GData Trojan.GenericKD.2382690 20150508
Ikarus Win32.Outbreak 20150508
K7AntiVirus Riskware ( 0040eff71 ) 20150508
K7GW Riskware ( 0040eff71 ) 20150508
Kaspersky Trojan-Spy.Win32.BitWall.hm 20150508
Malwarebytes Trojan.Agent 20150508
McAfee Downloader-FATT!2879F96A7210 20150508
MicroWorld-eScan Trojan.GenericKD.2382690 20150508
Microsoft Trojan:Win32/Kadena.gen!C 20150508
Panda Trj/Genetic.gen 20150507
Qihoo-360 HEUR/QVM07.1.Malware.Gen 20150508
Rising PE:Malware.Obscure!1.9C59 20150507
Sophos Troj/Kadena-A 20150508
Symantec Infostealer.Limitail 20150508
Tencent Trojan.Win32.Qudamah.Gen.24 20150508
TrendMicro TROJ_UPATRE.MJYS 20150508
TrendMicro-HouseCall TROJ_UPATRE.MJYS 20150508
VIPRE Win32.Malware!Drop 20150508
nProtect Trojan-Spy/W32.BitWall.131072 20150508
Dicha versión del ELISTARA 32.25 que lo detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy.

saludos

ms, 8-5-2015