NUEVO MAIL MASIVO QUE SE ESTÀ RECIBIENDO ANEXANDO DOWNLOADER TEPFER

Se está recibiendo masivamente mail malicioso anexando fichero malware con downloader TEPFER
El contenido del mail es similar a:

MAIL MALICIOSO:
_______________
Asunto: RE: Feed Back on specific market
De: “Karen Waithe”<fabutrading@gmail.com>
Fecha: 28/09/2015 14:12
Para: undisclosed-recipients:;

Hello Sir,

Trust all is in order and I hope this email will find you in good health.

As below two of our customers needs the attached order ASAP

Please, Kindly go through the attached order carefull and quote with your most
competitive price ASAP.

Awaiting your feed back urgently

Genuinely,
Fred A. Rizk

From: Pankaj Deshpande
Date: 23 June 2015 16:54:45 GMT+4
To: ‘Fred Rizk’ <fred.rizk@syonlogistics.ae>
Cc:
Subject: Feed Back on specific market

Dear Mr. Fred,

Greetings!!

As discussed with Mr. Navdeep Oberoi on our new order:
We need the attached order ASAP

1)In Iran the customer need 3 40ft container ,with order #34 in a very large quantity
2) In UAE ,the customer needs order #435 ASAP
Kindly forward to the dealar and have them quote thier most competitive price and mode of shipment ASAP.
And please note, payment term should be T/T in advance.
Waiting for your urgent feed back

Thanks & Kind Regards,

Pankaj Deshpande,

ANEXADO: Scan_013910-jpg.zip

______________________

FIN DEL MAIL MALICIOSO

Lo pasamos a controlar a partir del ELISTARA 32.02
El preanalisis de virustotal ofrece el siguiente informe:
SHA256: 2b1b972b3c2683a64bb3e8276946b80dfd69f8d763ea7352fa153244ed16a7eb
File name: Scan_013910-jpg.exe
Detection ratio: 21 / 57
Analysis date: 2015-09-28 14:45:17 UTC ( 4 minutes ago )

0 1

Antivirus Result Update
AVG MSIL9.FCN 20150928
Ad-Aware Trojan.MSIL.Crypt.AK 20150928
Arcabit Trojan.MSIL.Crypt.AK 20150928
Avast Win32:Malware-gen 20150928
BitDefender Trojan.MSIL.Crypt.AK 20150928
Cyren W32/MSIL_Troj.EX.gen!Eldorado 20150928
DrWeb Trojan.PWS.Multi.1693 20150928
ESET-NOD32 a variant of MSIL/Injector.MBD 20150928
Emsisoft Trojan.GenericKD.2758425 (B) 20150928
F-Prot W32/MSIL_Troj.EX.gen!Eldorado 20150928
F-Secure Trojan.MSIL.Crypt.AK 20150928
GData Trojan.MSIL.Crypt.AK 20150928
Ikarus Trojan.MSIL.Agent 20150928
Kaspersky Trojan-PSW.Win32.Tepfer.pswyxs 20150928
Malwarebytes Spyware.Pony 20150928
MicroWorld-eScan Trojan.MSIL.Crypt.AK 20150928
Qihoo-360 HEUR/QVM03.0.Malware.Gen 20150928
Rising PE:Malware.RDM.16!5.16[F1] 20150927
Symantec Suspicious.Cloud.9 20150927
TrendMicro TSPY_YAKBEEX.E 20150928
TrendMicro-HouseCall TSPY_YAKBEEX.E 20150928

Dicha versión del ELISTARA 32.02 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy
saludos

ms, 28-9-2015