SE ESTAN RECIBIENDO VARIOS MAILS MASIVOS CON PARECIDO TEXTO Y VARIOS .ZIP QUE RESULTAN SER VARIANTES DEL DOWNLOADER SOUNDER

Se reciben mails con estos contenidos:
________________

Asunto: visa inf.
De: carole.clydesdale@telefonica.net
Fecha: 28/09/2015 04:23
Para: <destinatario>

the copy is sent to you
ANEXADO: PDF_5301965601615.DOC.zip
_________________

Asunto: bill
De: betstom@yahoo.ca
Fecha: 28/09/2015 18:55
Para: <DESTINATARIO>

the copy is sent to you
ANEXADO: PDF_8702746059062.DOC.zip
__________________
Asunto: tax
De: eddie.mccarthy@outlook.com
Fecha: 28/09/2015 07:06
Para: <DESTINATARIO>

the copy is sent to you
ANEXADO: PDF_3991325932916.DOC.zip
___________________

Asunto: invoice
De: UKKMiraTechSuppEngineers@live.co.uk
Fecha: 28/09/2015 07:07
Para: <DESTINATARIO>

the copy is sent to you
ANEXADO : PDF_1387067140581.DOC.zip
___________________

Todos ellos llevan anexado diferente fichero, que en todos los casos resulta ser una variante del DOWNLOADER SOUNDER, cuyo preanalisis en virustotal viene a ofrecer el siguiente informe:

MD5 d2d09c47d1874e22ca69b7495d0c5fe6
SHA1 483b919b6f0385b6263bf26a6a86ff01f4bfc86d
File size 166.8 KB ( 170810 bytes )
SHA256: 639fd7b7ec407bfbbe4996c6bdd2df5137a3fc2528b06c5b08846b1674936306
File name: PDF_9837872687488.DOC.exe
Detection ratio: 42 / 57
Analysis date: 2015-09-28 09:29:31 UTC ( 3 minutes ago )

0 9
Antivirus Result Update
ALYac Trojan.GenericKD.2749985 20150928
AVG Generic_r.FXD 20150928
AVware Trojan.Win32.Generic!BT 20150927
Ad-Aware Trojan.GenericKD.2749985 20150928
Agnitum Trojan.Agent!QZO26F47SWM 20150927
AhnLab-V3 Trojan/Win32.MDA 20150927
Antiy-AVL Trojan/Win32.Inject 20150928
Arcabit Trojan.AD194A8BB 20150928
Avast Win32:Trojan-gen 20150928
Avira TR/Crypt.Xpack.282501 20150928
BitDefender Trojan.GenericKD.2749985 20150928
Comodo TrojWare.Win32.TrojanDownloader.Wauchos.~P 20150928
Cyren W32/Androm.CKJS-6093 20150928
DrWeb Trojan.Siggen.65341 20150928
ESET-NOD32 Win32/TrojanDownloader.Wauchos.AK 20150928
Emsisoft Trojan.GenericKD.2749985 (B) 20150928
F-Prot W32/Androm.CP 20150928
F-Secure Trojan.GenericKD.2749985 20150928
Fortinet W32/Wauchos.6306!tr 20150928
GData Trojan.GenericKD.2749985 20150928
Ikarus Trojan.Win32.Crypt 20150928
K7AntiVirus Riskware ( 0040eff71 ) 20150928
K7GW Riskware ( 0040eff71 ) 20150928
Kaspersky Trojan.Win32.Inject.viav 20150928
Malwarebytes Trojan.Injector 20150928
McAfee Trojan-FHDS!D2D09C47D187 20150928
McAfee-GW-Edition Artemis!Trojan 20150927
MicroWorld-eScan Trojan.GenericKD.2749985 20150928
Microsoft VirTool:Win32/Obfuscator.APL 20150928
NANO-Antivirus Trojan.Win32.Inject.dxifla 20150928
Panda Trj/Injector.BD 20150927
Qihoo-360 HEUR/QVM10.1.Malware.Gen 20150928
Rising PE:Malware.Obscure/Heur!1.9E03[F1] 20150927
Sophos Mal/Inject-FX 20150928
Symantec Trojan.Gen 20150927
Tencent Win32.Trojan.Crypt.Wrzs 20150928
TotalDefense Heur/Backdoor.ZACU!suspicious 20150928
TrendMicro BKDR_ANDROM.CPF 20150928
TrendMicro-HouseCall BKDR_ANDROM.CPF 20150928
VIPRE Trojan.Win32.Generic!BT 20150928
ViRobot Trojan.Win32.S.Agent.170810[h] 20150928
nProtect Trojan/W32.Inject.170810 20150925

A todos ellos los pasamos a controlar a partir del ELISTARA 33.01 que ya esta disponible en nuestra web

saludos

ms, 28-9-2015