NUEVO MAIL MASIVO MALICIOSO QUE ANEXA FICHERO MALWARE CONTENIDO EN FICHERO ANEXADO TIPO ZIP

En un mail masivo malicioso se recibe anexado el fichero

copy_invoice_69713757.zip

que contiene el fichero invoice_SCAN_U0Onq.js

El mail en cuestion presenta estas caracteristicas:
MAIL MALICIOSO
______________

Asunto: Reference Number #69713757, Last Payment Notice
De: =?UTF-8?B?U2FuZm9yZCBMZWU=?= <LeeSanford147@ca.charter.com>
Fecha: 10/12/2015 11:00
Para: =?UTF-8?B?amMubW9saW5l?= <DESTINATARIO>

Dear Client,

This e-mail is pursuant to your contract with Foreman&Clark Ltd. for our services date November 15, 2015 for the amount of $4,718.
Your failure to pay as per the December 1, 2015 invoice equals to the breach of our contract.

Please, acknowledge the receipt of this e-mail within three business days. Please, make your payment to the corresponding account, stated in the invoice attached no later than January 2, 2016.
In case you fail to respond to this e-mail we well be compelled to pursue all the necessary legal actions.

Thank you beforehand for your attention to this case.
Looking forward to hearing back from you.

Sincerely,
Sanford Lee
Sales Manager

Foreman&Clark Ltd.
256 Raccoon RunSeattle,
WA 98101

ANEXADO : copy_invoice_69713757.zip
______________________

FIN DEL MAIL MALICIOSO

El fichero anexado es un downloader de la familia BLACOLE, que pasamos a controlar a partir del ELISTARA 33.52 de hoy
El preanalisis de virustotal ofrece el siguiente informe:

MD5 5b51571a730b81d7b50000bb9c91a009
SHA1 79efbc1ba921bd71bdc3112c9f62ea26cae7a003
File size 15.2 KB ( 15614 bytes )
SHA256: 722fbd940ea3a5716c89817f85ff5fc4e476a9c8aa3443595af9f7da08a9a2f1
File name: invoice_SCAN_U0Onq.js
Detection ratio: 3 / 54
Analysis date: 2015-12-10 11:41:18 UTC ( 1 minute ago )

0 1
Antivirus Result Update
Cyren JS/Downldr.CZ.gen 20151210
F-Prot JS/Downldr.CZ.gen 20151210
McAfee-GW-Edition BehavesLike.JS.ExploitBlacole.lv 20151210
Dicha version del ELISTARA 33.52 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy
saludos

ms, 10-12-2015