NUEVA VARIANTE DE MALWARE LISEC DESCARGADOS POR UN DOWNLOADER SOUNDER Y CAZADOS POR LA HEURISTICA DEL ELISTARA

La ejecución de un downloader SOUNDER nos ha instalado 41 ficheros que pasamos a controlar como MALWARE LISEC

El MD5 de dichos ficheros ofrece los siguientes datos:

MD5                                 NOMBRE                                      TAMAÑO

“B788EEF76A3E0BB1D43284CDC96F36FA” -> LISECEWWEVW.EXE.Muestra EliStartPage v35.47  164352
“5EB842FC3F7D54FBC4D99C113F7A5AF2” -> LISECEWWEVW.EXE.Muestra EliStartPage v35.55  98304
“DF7F170C5CA331860CCF2B6EEAA16C0D” -> LISECOSYS.EXE.Muestra EliStartPage v35.47  164864
“CF387F2219B19014196CB202FEB89547” -> LISECOSYS.EXE.Muestra EliStartPage v35.55  94208
“0A7F68365FBD9F7A9D3A82C03BCA4240” -> LISECOSYS32.EXE.Muestra EliStartPage v35.47  165888
“09FBC953E7A294A8027977D75A0E8982” -> LISECOSYS32.EXE.Muestra EliStartPage v35.55  94208
“3850D0542BDD5F496331B133DD491A41” -> LJA7SHAYNE10.EXE.Muestra EliStartPage v35.47  165376
“D7BD5C5B1AE3E2F75E87BC9C0E2EBCC9” -> LJA7SHAYNE10.EXE.Muestra EliStartPage v35.55  90112
“0401981B49CF64441680F3FDCD84F44E” -> LJA7SHAYNE2.EXE.Muestra EliStartPage v35.47  162816
“60CBA66FFCE90133D4EB43EB732DF577” -> LJA7SHAYNE2.EXE.Muestra EliStartPage v35.55  90112
“F5E8BC4DDDB4CD9EEBC5225CD7EAA16B” -> LJA7SHAYNE3.EXE.Muestra EliStartPage v35.47  165888
“49F3B55DCD23F1FA5166F8A3226595BC” -> LJA7SHAYNE3.EXE.Muestra EliStartPage v35.55  90112
“F28B53D40AE021AC6A7E86A423D3ECC5” -> LJA7SHAYNE4.EXE.Muestra EliStartPage v35.47  163840
“D01E8185B2C426B5F22B08281CA4FFF9” -> LJA7SHAYNE4.EXE.Muestra EliStartPage v35.55  90112
“53B3E9DF8DC86ABC2E092378F4D1165E” -> LJA7SHAYNE6.EXE.Muestra EliStartPage v35.47  166400
“2764C817481D6A040DB753A656FD97B0” -> LJA7SHAYNE6.EXE.Muestra EliStartPage v35.55  94208
“AA662CC5F17725F4F689A244B7F7740A” -> LJA7SHAYNE7.EXE.Muestra EliStartPage v35.47  163840
“DD43DC7C25EF031CE67E0E2E8322E6EC” -> LJA7SHAYNE7.EXE.Muestra EliStartPage v35.55  90112
“097659C9696797439D491EB0EB7B887F” -> LJA7SHAYNE8.EXE.Muestra EliStartPage v35.47  163840
“8A0FBDD589060826018D0E187A07A403” -> LJA7SHAYNE8.EXE.Muestra EliStartPage v35.55  90112
“F4064852EFC7774DD0A3D2E033D4C339” -> LLISECONC1.EXE.Muestra EliStartPage v35.47  164352
“A1FDF28B80EED7548DCE058B210D1F3F” -> LLISECONC1.EXE.Muestra EliStartPage v35.55  98304
“D0C754F55809F675A4908D2B104B9D32” -> LLISECONC2.EXE.Muestra EliStartPage v35.47  163840
“DF52D283A4D7B55174F5DFDCE4C1006B” -> LLISECONC2.EXE.Muestra EliStartPage v35.55  98304
“AA066AC76F8A2FF1CE5DB6AC44051962” -> LLISECONC4.EXE.Muestra EliStartPage v35.47  164864
“B86B56A8392C89092685CA52EE5AB843” -> LLISECONC4.EXE.Muestra EliStartPage v35.55  94208
“20CB37370C982E7AE7A999EDB287483B” -> LLISECONC5.EXE.Muestra EliStartPage v35.47  164864
“67611DEE29928510FCE304BBA3E1297E” -> LLISECONC5.EXE.Muestra EliStartPage v35.55  94208
“5A12BD96A263B0AFDA96E80E59E06BBC” -> LLISECONC8.EXE.Muestra EliStartPage v35.55  94208
“84E3069CD13B4FC46441452C68DCBE66” -> LLISECONC8A.EXE.Muestra EliStartPage v35.55  90112
“4A74DD3DFB1390FBEBD63ABB40CF8788” -> SCVHCHOST232.EXE.Muestra EliStartPage v35.55  220672
“2D27D0DB19F4A1F836A342AFE5810C5F” -> SCVHCHOST332.EXE.Muestra EliStartPage v35.55  156160
“F9C87EC6E762C89F170A822BD1F4489E” -> SCVHCHOST532.EXE.Muestra EliStartPage v35.55  156160
“FEEB407B65325A081E2A22ECA3A82668” -> SCVHCHOST732.EXE.Muestra EliStartPage v35.55  221696
“B43FAAF1125D17CCB04D1B36DDFA4060” -> SCVHCHOST932.EXE.Muestra EliStartPage v35.55  222208
“8FFBA49F5F5A15F086218AC191BEAC57” -> SCVHCHOSTC6600A.EXE.Muestra EliStartPage v35.55  221696
“29D0D3A7344BB01309594A86D18FF9C4” -> SCVHCHV00AD.EXE.Muestra EliStartPage v35.55  220672
“2BB1BC52EAA46FE9CED9094BEC8A8ACB” -> SYSAEWAZBYS32.EXE.Muestra EliStartPage v35.47  166400
“25A5068781C71B217D1D7D35F4B13CB9” -> SYSAEWAZBYS32.EXE.Muestra EliStartPage v35.55  98304
“832E75C07093EFA46932CCA303B01F51” -> SYSTEEZ.EXE.Muestra EliStartPage v35.55  199680
“0CD1E9E20EE8E9F729EDB5920DCBEDE9” -> SYSTEMWINDOWS32.EXE.Muestra EliStartPage v35.55  223232

El preanalisis de virustotal ofrece el siguiente informe:
MD5 09fbc953e7a294a8027977d75a0e8982
SHA1 902f45d630df2e0b948bfd1ca86688b1ad61093e
File size 92.0 KB ( 94208 bytes )
SHA256:  24853e90d7cac96a2e6449b3d56e68489c6790f1fcecbf49df36d1f5e03ed7fe
File name:  4ad4b7e9b6d321886e3233411bbd8657181d6bf4
Detection ratio:  31 / 56
Analysis date:  2016-11-13 17:05:08 UTC ( 18 hours, 38 minutes ago )
0
1

Antivirus  Result  Update
Avast  Win32:Malware-gen  20161113
Baidu  Win32.Trojan.WisdomEyes.16070401.9500.9982  20161111
Microsoft  Trojan:Win32/Lethic.B  20161113
AhnLab-V3  Trojan/Win32.Garrun.N2153423069  20161113
Antiy-AVL  Trojan/Win32.Garrun  20161113
nProtect  Trojan/W32.Garrun.94208.C  20161113
Invincea  trojan.win32.lethic.b  20161018
AVware  Trojan.Win32.Generic!BT  20161113
VIPRE  Trojan.Win32.Generic!BT  20161113
Kaspersky  Trojan.Win32.Garrun.ejl  20161113
NANO-Antivirus  Trojan.Win32.Garrun.eihtvk  20161113
Arcabit  Trojan.Generic.D12C32C5  20161113
Emsisoft  Trojan.Generic.19673797 (B)  20161113
Ad-Aware  Trojan.Generic.19673797  20161113
BitDefender  Trojan.Generic.19673797  20161113
F-Secure  Trojan.Generic.19673797  20161113
GData  Trojan.Generic.19673797  20161113
eScan  Trojan.Generic.19673797  20161113
Malwarebytes  Trojan.DorkBot  20161113
Symantec  Trojan Horse  20161113
K7GW  Trojan ( 004fd1dc1 )  20161113
AegisLab  Troj.W32.Garrun!c  20161113
Avira (no cloud)  TR/Crypt.ZPACK.ktnpf  20161113
Rising  Malware.Generic!sf7b7maV7YO@5 (thunder)  20161113
CrowdStrike Falcon (ML)  malicious_confidence_100% (D)  20161024
Sophos  Mal/Generic-S  20161113
Qihoo-360  HEUR/QVM09.0.1C80.Malware.Gen  20161113
AVG  Generic_r.PHC  20161113
McAfee-GW-Edition  Artemis!Trojan  20161113
McAfee  Artemis!09FBC953E7A2  20161113
ESET-NOD32  a variant of Win32/Kryptik.FJQC  20161113

Dicha versión del ELISTARA 35.61 que los detecta y elimina, estará disponible en nuestra web a partir del 15-11-2016
saludos

ms, 14-11-2016