MAS VARIANTES DE BACKDOOR KIRTS QUE PASAMOS A CONTROLAR CON ELISTARA 35.88

Nuevas variantes de este Backdoor que infecta pendrives y se actualiza descargando nuevas variantes, pasan a ser controlados a partir del ELISTARA 35.88 de hoy

Los MD5 de las nuevas variantes indican los siguientes hashes:

“01B3B3D9F41A7F95F9D9605BD810B305” -> 01b3b3d9.exe 178112
“7B82464693AF25FB65F51F085BFDCBEB” -> 7b824646.exe 99776
“F3B66C085703EB8E5996DBC2DBDB7E79” -> f3b66c08.exe 104384
“632BA2CD7B5E5EE89839685147C32BD5” -> winmgr(140).exe 85440

El preanalisis de virustotal del último indicado, ofrece el siguiente informe:

MD5 632ba2cd7b5e5ee89839685147c32bd5
SHA1 88bb0717c243b7d5d3db75face1f485144ad43ac
File size 83.4 KB ( 85440 bytes )
SHA256: cca0ec40b386b7f96d2fef1b2697b3a15a2517b7ae335be1f8836cc57e37383e
File name: winmgr(140).exe
Detection ratio: 36 / 57
Analysis date: 2016-12-27 10:14:28 UTC ( 4 minutes ago )
0
1

Antivirus Result Update
ALYac Trojan.GenericKD.4026474 20161227
AVG MSIL11.DHH 20161227
AVware Trojan.Win32.Generic!BT 20161227
Ad-Aware Trojan.GenericKD.4026474 20161227
AegisLab Troj.W32.Ircbot!c 20161227
AhnLab-V3 Trojan/Win32.MSIL.R192269 20161227
Antiy-AVL Trojan/Generic.ASBOL.A2E1 20161227
Arcabit Trojan.Generic.D3D706A 20161227
Avast Win32:Dropper-gen [Drp] 20161227
Avira (no cloud) TR/Dropper.MSIL.ridmg 20161227
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9999 20161207
BitDefender Trojan.GenericKD.4026474 20161227
CrowdStrike Falcon (ML) malicious_confidence_62% (W) 20161024
DrWeb Trojan.DownLoader17.15248 20161227
ESET-NOD32 a variant of MSIL/Injector.QXZ 20161227
Emsisoft Trojan.GenericKD.4026474 (B) 20161227
F-Secure Trojan.GenericKD.4026474 20161227
Fortinet MSIL/Injector.QXZ!tr 20161227
GData Trojan.GenericKD.4026474 20161227
Ikarus Trojan.MSIL.Injector 20161226
Invincea backdoor.win32.kirts.a 20161216
K7AntiVirus Trojan ( 00500f0a1 ) 20161227
K7GW Trojan ( 00500f0a1 ) 20161227
Kaspersky Trojan.Win32.IRCbot.aoyo 20161227
McAfee RDN/Spybot.worm.gen 20161227
McAfee-GW-Edition BehavesLike.Win32.Dropper.mh 20161227
eScan Trojan.GenericKD.4026474 20161227
Microsoft Trojan:Win32/Dynamer!ac 20161227
Panda Trj/GdSda.A 20161226
Qihoo-360 HEUR/QVM03.0.0F1F.Malware.Gen 20161227
Sophos Mal/Generic-S 20161227
Symantec Trojan.Gen 20161227
TrendMicro-HouseCall TROJ_GEN.R0C1H0CLQ16 20161227
VIPRE Trojan.Win32.Generic!BT 20161227
ViRobot Trojan.Win32.Z.Injector.85440.A[h] 20161227
Yandex Trojan.Scarsi!xgR/5wGlwCY 20161226

Dicha versión del ELISTARA 35.88 que los detecta y elimina, estará disponible en nuestra web a partir del 28-12-2016

saludos

ms, 27-12-2016