NUEVAS VARIANTES DE NEMUCOD QUE SE RECIBEN EN MAILS MASIVOS MALICIOSOS

Se estan recibiendo mails masivos con estas caracteristicas:

MAIL MASIVO MALICIOSO
______________________
Asunto: Invoice #74200372/15
De: =?UTF-8?B?TWFyaSBtYWNrYXk=?= <mackayMari40644@thelingeriecollection.co.uk>
Fecha: 01/03/2016 06:32
Para: =?UTF-8?B?dmlydXM=?= <DESTINATARIO>

Dear costumer,

You are receiving this informational letter because of the fact that you have a debt totaling $850,70 due to late payment of invoices dating March ‘15.

In attachment you will find a reconciliation of the past 12 months (year 2015).

Please study the file and contact us immediately to learn what steps you should take to avoid the accrual of penalties.

anexado: Invoice_ref-74200372.zip (contiene invoice_igWiQD.js con DOWNLOADER NEMUCOD)

_________________________

FIN MAIL MASIVO MALICIOSO

Asunto: Invoice #59389085/15
De: =?UTF-8?B?QWhtZWQgeWVhdGVz?= <yeatesAhmed182@liaudis.lt>
Fecha: 01/03/2016 06:17
Para: =?UTF-8?B?c2F0?= <DESTINATARIO>

Dear costumer,

You are receiving this informational letter because of the fact that you have a debt totaling $831,50 due to late payment of invoices dating March ‘15.

In attachment you will find a reconciliation of the past 12 months (year 2015).

Please study the file and contact us immediately to learn what steps you should take to avoid the accrual of penalties.
AMEXADO: Invoice_ref-59389085.zip (contiene invoice_igWiQD.js con DOWLOADER NEMUCOD)

__________________

FIN MAIL MALICIOSO

Como puede verse, los ficheros desempaquetados de los dos ZIP anexados, contienen el mismo fichero, que pasamos a controlar a partir del ELISTARA 34.05 de hoy

El preanalisis de virustotal de dicho fichero ofrece el siguiente informe:

MD5 f017a93aaa4c867b0ffb8dea96a60821
SHA1 13ee917f8f92c5406caa63af17dd551ae3ebbaba
Tamaño del fichero 2.5 KB ( 2564 bytes )

SHA256: 5f96c8f27039c7cce5cf33a5aa0b36bdd18e87186fc318865e2428206c5599db
Nombre: invoice_igWiQD.js
Detecciones: 12 / 55
Fecha de análisis: 2016-03-01 09:16:34 UTC ( hace 25 minutos )
0 2

Antivirus Resultado Actualización
AVG JS/Downloader.Agent 20160301
Ad-Aware JS:Trojan.JS.Downloader.CM 20160301
Arcabit JS:Trojan.JS.Downloader.CM 20160301
BitDefender JS:Trojan.JS.Downloader.CM 20160301
Cyren JS/Downldr.DP.gen 20160301
F-Secure JS:Trojan.JS.Downloader.CM 20160301
Fortinet JS/Nemucod.FW!tr 20160301
GData JS:Trojan.JS.Downloader.CM 20160301
K7AntiVirus Trojan ( 0001140e1 ) 20160301
K7GW Trojan ( 0001140e1 ) 20160301
Kaspersky Trojan-Downloader.JS.Agent.hro 20160301
eScan JS:Trojan.JS.Downloader.CM 20160301

Dicha version del ELISTARA 34.05 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy

saludos

ms, 1-3-2016