NUEVAS VARIANTE DE RANSOMWARE LOCKY QUE PASAMOS A CONTROLAR CON ELISTARA

A partir del ELISTARA 34.48 de hoy pasamos a controlar estas nuevas 5 variantes de LOCKY, cuyos hashes SHA1 son:
“D63650DD88485C5933CFD8CBF09128A27ED3442F” -> k4isfa.exe 167936
“FEAE65047D59E31BF562E12A198ABE2F009359F5” -> mys3ks.exe 179712
“0FA5D95C41B98CF9084525AD156C88C04D5E7095” -> e7urj.exe 218112
“736E336ACC017DAB31663BF099650810C2AC44A8” -> b6sida.exe 180224
“0E566E01FCACDB638B83E9D302CBC01F7E5989CA” -> 89yg7g87byi.exe 320719
El preanalisis de virustotal del último de ellos, ofrece el siguiente informe:

MD5 b81868c62aff2cce264471e18f773175
SHA1 0e566e01fcacdb638b83e9d302cbc01f7e5989ca
SHA256 ed8390885a6bcdda11cb51f8d3c2553625d1c567f221a490450f44d2ac3cec3a
ssdeep6144:7hEfcrpm3fc/jiTmmwatkbtBsoeGy0omcOTnRkonooN+MYqwo:7hkcrpef4smm2BsZGyo/nR5mzI
authentihash 750ce7d5293846c3829969cce778167a778b6019ac7824a2e8b2f8d555f3d9b0
imphash aa1af471ea4a3f46955de63cec15a5c2
File size 313.2 KB ( 320719 bytes )
SHA256: ed8390885a6bcdda11cb51f8d3c2553625d1c567f221a490450f44d2ac3cec3a
File name: 89yg7g87byi[1].txt.2588.dr
Detection ratio: 21 / 57
Analysis date: 2016-05-04 10:14:04 UTC ( 13 minutes ago )
0 8

Antivirus Result Update
ALYac Trojan.Ransom.LockyCrypt 20160504
Ad-Aware Trojan.GenericKD.3202585 20160504
Antiy-AVL Trojan/Generic.ASMalwS.184F190 20160504
Arcabit Trojan.Generic.D30DE19 20160504
Avira (no cloud) TR/AD.Locky.Y.fcoe 20160504
Baidu Win32.Trojan.WisdomEyes.151026.9950.9999 20160504
BitDefender Trojan.GenericKD.3202585 20160504
ESET-NOD32 Win32/Filecoder.Locky.B 20160504
F-Secure Trojan.GenericKD.3202585 20160504
Fortinet W32/Injector.CXSS!tr 20160504
GData Trojan.GenericKD.3202585 20160504
Ikarus Trojan.Win32.Filecoder 20160504
Kaspersky Trojan.Win32.Inject.wgpg 20160504
McAfee Artemis!B81868C62AFF 20160504
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.fc 20160503
eScan Trojan.GenericKD.3202585 20160504
Panda Trj/Locky.A 20160503
Qihoo-360 HEUR/QVM10.1.Malware.Gen 20160504
Rising Trojan.Inject!8.103-6TzFQWLCfqN (Cloud) 20160504
Symantec Trojan.Cryptolocker.AF 20160504
Tencent Win32.Trojan.Inject.Auto 20160504
Dicha versión del ELISTARA 34.48 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy
saludos

ms, 4-5-2016