NUEVO MAIL MASIVO QUE SE ESTA RECIBIENDO ANEXANDO DOWNLOADER UPATRE

Un nuevo mail que aparenta falso remitente de paypal anexa un fichero ZIP que contiene fichero EXE con icono de PDF:
MAIL MALICIOSO:
_______________

Asunto: Your PayPal Invoice is Ready
De: “PayPal” <service@paypal.com>
Fecha: 12/10/2015 12:38
Para: <destinatario>

Dear PayPal Customer,

Please open the attached file to view invoice.

Your monthly account statement is available anytime; just log in to your account. To correct any errors, please contact us through our Help Centre.

Please note: the attached file is in PDF format. If you are unable to open the attached file, please download the free Adobe Acrobat Reader by entering the following address in your web browser: http://www.adobe.com/products/acrobat/readstep.html ______________________________________________________________________
This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click “Contact Us” at the bottom of any page.

ANEXADO paypal_490018265154721_121015.zip

__________________

FIN DEL MAIL MALICIOSO

El fichero que desempaqueta dicho ZIP es el siguiente:

paypal_490018265154721_121015.exe
que pasamos a controlar a partir del ELISTARA 32.12 de hoy
El preanalisis de virus total de dicho fichero, ofrece el siguiente informe:

MD5 1bb2c23f3a9166aec5f9c54c912036ca
SHA1 cecd2085a018ce671f951eeffdd448df768a51f1
File size 32.0 KB ( 32768 bytes )
SHA256: e866b6b752547f2d20a965a032dd09a85ad6478a0bed8eafb6e11f659fc74fc6
File name: paypal_490018265154721_121015.exe
Detection ratio: 30 / 57
Analysis date: 2015-10-12 22:15:07 UTC ( 9 hours, 38 minutes ago )

0 5
Antivirus Result Update
AVG Generic_s.FPN 20151012
AVware Trojan.Win32.Generic.pak!cobra 20151013
Ad-Aware Trojan.Agent.BNKE 20151013
Arcabit Trojan.D 20151013
Avast Win32:Trojan-gen 20151013
Avira TR/Crypt.ZPACK.187980 20151013
Baidu-International Trojan.Win32.Waski.A 20151012
BitDefender Trojan.GenericKD.2792255 20151013
Cyren W32/Upatre.EI.gen!Eldorado 20151013
DrWeb Trojan.Upatre.8823 20151013
ESET-NOD32 Win32/TrojanDownloader.Waski.A 20151013
Emsisoft Trojan-Downloader.Win32.Waski (A) 20151013
F-Prot W32/Upatre.EI.gen!Eldorado 20151013
F-Secure Trojan.Agent.BNKE 20151013
Fortinet W32/Monlin.GK!tr 20151012
GData Trojan.Agent.BNKE 20151013
Ikarus Trojan-Downloader.Win32.Upatre 20151013
Kaspersky Trojan-Downloader.Win32.Upatre.fbns 20151013
Malwarebytes Trojan.Upatre 20151012
McAfee Upatre-FACH!1BB2C23F3A91 20151013
McAfee-GW-Edition Artemis!Trojan 20151013
MicroWorld-eScan Trojan.Agent.BNKE 20151013
Microsoft TrojanDownloader:Win32/Upatre 20151013
Panda Generic Suspicious 20151012
Qihoo-360 HEUR/QVM20.1.Malware.Gen 20151013
Sophos Mal/Upatre-V 20151013
Tencent Win32.Trojan.Fakedoc.Auto 20151013
TrendMicro TROJ_UPATRE.ADL 20151013
TrendMicro-HouseCall TROJ_UPATRE.ADL 20151013
VIPRE Trojan.Win32.Generic.pak!cobra 20151013
Dicha versión del ELISTARA 33.12 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy
saludos

ms, 13-10-2015