OTRO MAIL MASIVO QUE ANEXA FICHERO MALICIOSO CON DOWNLOADER NEMUCOD

Se está recibieno masivamente otro mail con estas caracteristicas:

MAIL MASIVO MALICIOSO:
______________________
Asunto: Urgent Notice # 61515906
De: =?UTF-8?B?R2FsZSBrZW5uYW4=?= <kennanGale62778@mpiochih.gob.mx>
Fecha: 12/03/2016 18:13
Para: =?UTF-8?B?dmlydXM=?= <DESTINATARIO>

Dear Customer!

According to our data you owe our company a sum of $184,35. There are records saying that you have ordered goods in a total amount of $ 184,35 in the third quarter of 2015.

Invoice has been paid only partially. The unpaid invoice #61515906 is enclosed below for your revision.

We are writing to you, hoping for understanding and in anticipation of the early repayment of debt.

Please check out the file and do not hesitate to pay off the debt.

Otherwise we will have to start a legal action against you.

Regards,
Gale kennan
682 N Davis St, Jacksonville,
FL 73398
Phone nr: 349-693-8258

ANEXADO : readme_61515906.zip (CONTENIENDO FICHERO mail_XxXXGJ.js CON JS.DOWNLOADER QUE DESCARGA E INSTALA NUEVO VARIANTE DEL DOWNLOADER NEMUCOD)

______________________

FIN DEL MAIL MALICIOSO

El preanalisis de virustotal del fichero anexado, ofrece el siguiente informe:
MD5 2fd689f3edc3240cd755320e495bdc19
SHA1 f11daf9a3253e2bf5a21c648f44e8e713fff038d
Tamaño del fichero 3.8 KB ( 3934 bytes )

SHA256: ff67270d5705c850b2e8aeb2ff410291bd5934fd5c05ea2a1c092a5e44f48ae0
Nombre: mail_XxXXGJ.js
Detecciones: 19 / 57
Fecha de análisis: 2016-03-14 08:53:59 UTC ( hace 1 minuto )
0 1

Antivirus Resultado Actualización
ALYac JS:Trojan.JS.Downloader.CPB 20160314
AVG JS/Downloader.Agent 20160314
Ad-Aware JS:Trojan.JS.Downloader.CPB 20160314
AegisLab Js.Downloader.Agent!c 20160314
Arcabit JS:Trojan.JS.Downloader.CPB 20160314
BitDefender JS:Trojan.JS.Downloader.CPB 20160314
ESET-NOD32 JS/TrojanDownloader.Nemucod.JL 20160314
Emsisoft JS:Trojan.JS.Downloader.CPB (B) 20160314
F-Prot JS/Agent.TU!Eldorado 20160314
F-Secure JS:Trojan.JS.Downloader.CPB 20160314
Fortinet PossibleThreat.P0 20160314
GData JS:Trojan.JS.Downloader.CPB 20160314
Ikarus Trojan-Downloader.Script.Agent 20160314
McAfee JS/Nemucod.cs 20160314
McAfee-GW-Edition BehavesLike.JS.Exploit.zj 20160313
eScan JS:Trojan.JS.Downloader.CPB 20160314
Qihoo-360 trojan.js.downloader.1 20160314
Sophos JS/DwnLdr-NHF 20160314
Tencent Js.Trojan.Raas.Auto 20160314

Dicha version del ELISTARA 34.14 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy

saludos

ms, 14-3-2016