OTRAS 5 VARIANTES DE TESLACRYPT QUE PASAMOS A CONTROLAR CON ELISTARA

Recibidas 5 nuevas muestras de este conocido ransomware, las pasamos a controlar a partir del ELISTARA 33.54 de hoy

El preanalisis de virustotal de dichas 5 nuevas variantes ofrecen los siguientes informes:

MD5 61435b0bb4a42d22a59c263a39277839
SHA1 06f08c76467256e72e81afe157e75f320750beea
File size 355.0 KB ( 363520 bytes )
SHA256: defd18bff0817d51b27acb20553fee14760bb28173d54b30c707a5cd3446eb7c
File name: 61435b0bb4a42d22a59c263a39277839
Detection ratio: 33 / 54
Analysis date: 2015-12-14 14:46:29 UTC ( 1 hour, 1 minute ago )

0 3
Antivirus Result Update
AVG Crypt5.SXK 20151214
AVware Trojan.Win32.Generic!BT 20151214
Ad-Aware Trojan.GenericKD.2924100 20151214
AhnLab-V3 Trojan/Win32.Teslacrypt 20151214
Antiy-AVL Trojan[Ransom]/Win32.Bitman 20151214

Arcabit Trojan.Generic.D2C9E44 20151214
Avast Win32:Trojan-gen 20151214
Avira TR/Crypt.Xpack.340952 20151214
Baidu-International Adware.Win32.iBryte.EIEF 20151214
BitDefender Trojan.GenericKD.2924100 20151214
DrWeb Trojan.Encoder.3285 20151214
ESET-NOD32 a variant of Win32/Kryptik.EIEF 20151214
Emsisoft Trojan.GenericKD.2924100 (B) 20151214
F-Secure Trojan.GenericKD.2924100 20151214
Fortinet W32/Strap.S!tr 20151214
GData Trojan.GenericKD.2924100 20151214
Ikarus Trojan.Win32.Crypt 20151214
K7AntiVirus Trojan ( 004d92591 ) 20151214
K7GW Trojan ( 004d92591 ) 20151214
Kaspersky Trojan-Ransom.Win32.Bitman.ajy 20151214
Malwarebytes Ransom.TeslaCrypt 20151214
McAfee Artemis!61435B0BB4A4 20151214
McAfee-GW-Edition BehavesLike.Win32.Trojan.fh 20151214
MicroWorld-eScan Trojan.GenericKD.2924100 20151214
Microsoft Ransom:Win32/Tescrypt.A 20151214
NANO-Antivirus Trojan.Win32.Kryptik.dzepzw 20151214
Panda Trj/CI.A 20151213
Qihoo-360 Win32/Trojan.Ransom.f8b 20151214
Symantec Trojan.Cryptolocker.N 20151214
Tencent Win32.Trojan.Bitman.Wlpb 20151214
VIPRE Trojan.Win32.Generic!BT 20151214
ViRobot Trojan.Win32.R.Agent.363520.C[h] 20151214
nProtect Trojan.GenericKD.2924100 20151214

________

Una segunda muestra ofrece el siguiente informe:

MD5 69ff7a50547e99b55d7618a35fc0763d
SHA1 18fb33f14b180638786f10a93adfd09ce4fcea58
File size 436.0 KB ( 446464 bytes )
SHA256: b06c84b38251f43387c6ed3c2c2b3fc627435ee1b442d7f412f70f6fc5186af2
File name: 69ff7a50547e99b55d7618a35fc0763d
Detection ratio: 30 / 53
Analysis date: 2015-12-14 15:40:19 UTC ( 11 minutes ago )
0 3
Antivirus Result Update
AVG Crypt5.SUO 20151214
AVware Trojan.Win32.Generic!BT 20151214
Ad-Aware Trojan.Ransom.AMW 20151214
AhnLab-V3 Win-Trojan/Teslacrypt.Gen 20151214
Antiy-AVL Trojan/Win32.TSGeneric 20151214
Arcabit Trojan.Ransom.AMW 20151214
Avast Win32:Trojan-gen 20151214
Avira TR/Crypt.Xpack.340694 20151214
BitDefender Trojan.Ransom.AMW 20151214
Comodo UnclassifiedMalware 20151214
ESET-NOD32 Win32/Filecoder.EM 20151214
Emsisoft Trojan.Ransom.AMW (B) 20151214
F-Secure Trojan.Ransom.AMW 20151214
GData Trojan.Ransom.AMW 20151214
Ikarus Trojan.Win32.Filecoder 20151214
K7AntiVirus Trojan ( 004b56ff1 ) 20151214
K7GW Trojan ( 004b56ff1 ) 20151214
Malwarebytes Ransom.TeslaCrypt 20151214
McAfee GenericR-FIU!69FF7A50547E 20151214
McAfee-GW-Edition BehavesLike.Win32.Downloader.gc 20151214
MicroWorld-eScan Trojan.Ransom.AMW 20151214
Microsoft Ransom:Win32/Tescrypt.A 20151214
NANO-Antivirus Trojan.Win32.AVKill.dzeqhj 20151214
Panda Trj/TeslaCrypt.A 20151213
Qihoo-360 Trojan.Generic 20151214
Rising PE:Trojan.Ransom-Tesla!1.A322 [F] 20151212
Tencent Win32.Trojan.Crypt.Wsup 20151214
VIPRE Trojan.Win32.Generic!BT 20151214
ViRobot Trojan.Win32.R.Agent.446464.G[h] 20151214
nProtect Trojan/W32.Cryptodef.446464 20151214
_________

La tercera muestra ofrece este otro informe:
MD5 6dc389fd250dd59432980b6c228b33e1
SHA1 7c81dbb047372d522b21755beb61de124bb58ca9
File size 444.0 KB ( 454656 bytes )

SHA256: 1284badb39be5a037888a3e48be042c6eb2c6878814361cf263fffb57e12e577
File name: 6dc389fd250dd59432980b6c228b33e1
Detection ratio: 34 / 54
Analysis date: 2015-12-14 14:32:29 UTC ( 1 hour, 22 minutes ago )
0 5
Analysis
File detail
Additional information
Comments 3
Votes
Behavioural information
Antivirus Result Update
AVG Crypt5.SUN 20151214
AVware Trojan.Win32.Generic!BT 20151214
Ad-Aware Trojan.GenericKD.2923309 20151214
AhnLab-V3 Win-Trojan/Teslacrypt.Gen 20151214
Antiy-AVL Trojan[Ransom]/Win32.Bitman 20151214
Arcabit Trojan.Generic.D2C9B2D 20151214
Avast Win32:Trojan-gen 20151214
Avira TR/Crypt.Xpack.340503 20151214
Baidu-International Trojan.Win32.Filecoder.EM 20151214
BitDefender Trojan.GenericKD.2923309 20151214
Comodo UnclassifiedMalware 20151214
DrWeb Trojan.AVKill.59621 20151214
ESET-NOD32 Win32/Filecoder.EM 20151214
Emsisoft Trojan.GenericKD.2923309 (B) 20151214
F-Secure Trojan.GenericKD.2923309 20151214
GData Trojan.GenericKD.2923309 20151214
Ikarus Trojan.Win32.Filecoder 20151214
K7AntiVirus Trojan ( 004b56ff1 ) 20151214
K7GW Trojan ( 004b56ff1 ) 20151214
Kaspersky UDS:DangerousObject.Multi.Generic 20151214
Malwarebytes Ransom.TeslaCrypt 20151214
McAfee GenericR-FIU!6DC389FD250D 20151214
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc 20151214
MicroWorld-eScan Trojan.GenericKD.2923309 20151214
Microsoft Ransom:Win32/Tescrypt.A 20151214
NANO-Antivirus Trojan.Win32.AVKill.dzejmp 20151214
Panda Generic Suspicious 20151213
Qihoo-360 Win32/Trojan.Multi.daf 20151214
Rising PE:Trojan.Ransom-Tesla!1.A322 [F] 20151212
Symantec Trojan.Gen 20151214
Tencent Win32.Trojan.Crypt.Wtdz 20151214
VIPRE Trojan.Win32.Generic!BT 20151214
ViRobot Trojan.Win32.R.Agent.454656.AL[h] 20151214
nProtect Trojan.GenericKD.2923309 20151214

__________

Una cuarta muestra ofrece el siguiente informe:

MD5 4bbdf576558913f6e640448f053a36cc
SHA1 eab86b2c67c5a6b4b52d8859fe89135aff1ca242
File size 444.0 KB ( 454656 bytes )
SHA256: 5be482fca0b794427addd7e7c9adc3137a1e8e0f08e3a9e8686e61f05f5359f8
File name: 4bbdf576558913f6e640448f053a36cc
Detection ratio: 32 / 53
Analysis date: 2015-12-14 14:45:43 UTC ( 1 hour, 10 minutes ago )
0 5
Antivirus Result Update
AVG Crypt5.SUN 20151214
AVware Trojan.Win32.Generic!BT 20151214
Ad-Aware Trojan.GenericKD.2923325 20151214
AhnLab-V3 Win-Trojan/Teslacrypt.Gen 20151214
Antiy-AVL Trojan[Ransom]/Win32.Bitman 20151214
Arcabit Trojan.Generic.D2C9B3D 20151214
Avast Win32:Trojan-gen 20151214
Avira TR/Crypt.Xpack.340503 20151214
Baidu-International Trojan.Win32.Ransom.ajk 20151214
BitDefender Trojan.GenericKD.2923325 20151214
Comodo UnclassifiedMalware 20151214
DrWeb Trojan.AVKill.59621 20151214
ESET-NOD32 Win32/Filecoder.EM 20151214
Emsisoft Trojan.GenericKD.2923325 (B) 20151214
F-Secure Trojan.GenericKD.2923325 20151214
GData Trojan.GenericKD.2923325 20151214
Ikarus Trojan.Win32.Filecoder 20151214
K7AntiVirus Trojan ( 004b56ff1 ) 20151214
K7GW Trojan ( 004b56ff1 ) 20151214
Kaspersky Trojan-Ransom.Win32.Bitman.ajk 20151214
Malwarebytes Ransom.TeslaCrypt 20151214
McAfee RDN/GenericR-FIU 20151214
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc 20151214
MicroWorld-eScan Trojan.GenericKD.2923325 20151214
Microsoft Ransom:Win32/Tescrypt.A 20151214
NANO-Antivirus Trojan.Win32.AVKill.dzejmp 20151214
Panda Generic Suspicious 20151213
Qihoo-360 Trojan.Generic 20151214
Rising PE:Trojan.Ransom-Tesla!1.A322 [F] 20151212
VIPRE Trojan.Win32.Generic!BT 20151214
ViRobot Trojan.Win32.R.Agent.454656.AH[h] 20151214
nProtect Trojan.GenericKD.2923325 20151214
_________

y la quinta muestra de este grupo de TeslaCrypts:
MD5 3d901fb04dead3e603589fee484fb4d5
SHA1 8d2599c9227f7568a1196f3b1f1ac6d26ba4376f
File size 444.0 KB ( 454656 bytes )
SHA256: a8e540f1da966a97b567d49f4c6bb5092cf96e02c8bc7a7cc49b7b17f00f77fe
File name: 3d901fb04dead3e603589fee484fb4d5
Detection ratio: 32 / 54
Analysis date: 2015-12-14 14:45:14 UTC ( 1 hour, 12 minutes ago )
0 2
Antivirus Result Update
AVG Crypt5.SUN 20151214
AVware Trojan.Win32.Generic!BT 20151214
Ad-Aware Trojan.TeslaCrypt.D 20151214
AhnLab-V3 Win-Trojan/Teslacrypt.Gen 20151214
Antiy-AVL Trojan[Ransom]/Win32.Bitman 20151214
Arcabit Trojan.TeslaCrypt.D 20151214
Avast Win32:Trojan-gen 20151214
Avira TR/Crypt.Xpack.340503 20151214
Baidu-International Trojan.Win32.Filecoder.EM 20151214
BitDefender Trojan.TeslaCrypt.D 20151214
Comodo UnclassifiedMalware 20151214
DrWeb Trojan.AVKill.59621 20151214
ESET-NOD32 Win32/Filecoder.EM 20151214
Emsisoft Trojan.TeslaCrypt.D (B) 20151214
F-Secure Trojan.TeslaCrypt.D 20151214
GData Trojan.TeslaCrypt.D 20151214
Ikarus Trojan.Win32.Filecoder 20151214
K7AntiVirus Trojan ( 004b56ff1 ) 20151214
K7GW Trojan ( 004b56ff1 ) 20151214
Kaspersky UDS:DangerousObject.Multi.Generic 20151214
Malwarebytes Ransom.TeslaCrypt 20151214
McAfee GenericR-FIU!3D901FB04DEA 20151214
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc 20151214
MicroWorld-eScan Trojan.TeslaCrypt.D 20151214
Microsoft Ransom:Win32/Tescrypt!rfn 20151214
NANO-Antivirus Trojan.Win32.AVKill.dzejmp 20151214
Qihoo-360 Trojan.Generic 20151214
Rising PE:Trojan.Ransom-Tesla!1.A322 [F] 20151212
Tencent Win32.Trojan.Crypt.Lnem 20151214
VIPRE Trojan.Win32.Generic!BT 20151214
ViRobot Trojan.Win32.R.Agent.454656.AK[h] 20151214
nProtect Trojan.TeslaCrypt.D 20151214

Todas dichas nuevas variantes serán detectadas y eliminadas a partir del ELISTARA 33.54 de hoy, que estará disponible en nuestra web a partir de las 18 horas CE$ST de hoy

Recordamos que este TESLACRYPT añade .VVV a la extension de los ficheros cifrados, y es la que está de moda actualmente, llegando generalmente anexado a mails no solicitados, pudiendo ser descargados a traves de NEMUCODS creados por las macros de ficheros DOC y XLS de ficheros con dichas extensiones ( de Word y de EXCEL)

Ver la anterior noticia al respecto donde se indicaban otras caracteristicas de esta familia en:

https://blog.satinfo.es/2015/nueva-variante-de-teslacrypt-k-que-anade-vvv-a-la-extension-de-los-ficheros-cifrados/
saludos

ms, 14-12-2015