PROLIFERAN LOS DOWNLOADERS DE RANSOMWARES, ESPECIALMENTE DE LOCKY

Como ya se está viendo en muchas noticias de e-mails que anexan ZIP conteniendo JS, estos son downloaders de ransomwares, de los que actualmente el LOCKY se lleva la palma.

Sin olvidar los demás caminos que usan para enviar downloaders, como son los VBS, los DOC con macros, o directamente los EXE, los .JS son los downloaders mas utilizados, y ofrecemos los hashes SHA1 de mas de 80 de ellos que pasamos a controlar a partir del ELISTARA 34.57 de hoy:
“586CFE55CCE800CFA537D984127BA3A872C66BEC” -> Anexo-Imagem4439.js 16475
“02025E4B80CC64991641FB6C23033EA1386C4122” -> urgent 091418 – copy (2).js 1063998
“960A8633EC75DB5252C714A1241C1B8357B705D7” -> 8119850_8119850 – copy (4).js 239042
“44B9F63577339C5C51E4F467F4771BB3BE34AE97” -> urgent 7850470 – copy.js 1064594
“88F7E62D84533909E2F1858D7F01BC6A12BD4E37” -> transactions 90538070.js 533234
“50B481E983F8EE5DDF5E3F2C52A3375DFD65A2FC” -> 43709994_43709994.js 603498
“8EAEAECCD330F4E99F0C1994B214AB7A5882FF25” -> ref_Ht4qxkP2BAX.js 26769
“44B9F63577339C5C51E4F467F4771BB3BE34AE97” -> urgent 7850470.js 1064594
“366FF6FA9394BD071EC324F40F517AE2695A1894” -> 39437_39437 – copy (2).js 234626
“9EC0356D4804F0F51B85BFCAB6DEFBFE9553DC86” -> 56201008_56201008.js 535934
“3BF34B2156A799EAB4883EA55C5ED651BBB1760A” -> balance 28182588 – copy (4).js 1052233
“960A8633EC75DB5252C714A1241C1B8357B705D7” -> 8119850_8119850 – copy (3).js 239042
“02025E4B80CC64991641FB6C23033EA1386C4122” -> urgent 091418.js 1063998
“9EC0356D4804F0F51B85BFCAB6DEFBFE9553DC86” -> 56201008_56201008 – copy.js 535934
“AA2820F7709DF036F54F6F4BADE15B386B0BB1B5” -> balance 39488 – copy (3).js 1052231
“17528FD6AC7F11141781BD697FD95382B2BD3D5E” -> transactions 2274197.js 533993
“960A8633EC75DB5252C714A1241C1B8357B705D7” -> 8119850_8119850 – copy.js 239042
“48F47F803626A66BCD2988518D3AC603B41E2087” -> urgent 58900022.js 1064058
“960A8633EC75DB5252C714A1241C1B8357B705D7” -> 8119850_8119850.js 239042
“960A8633EC75DB5252C714A1241C1B8357B705D7” -> 8119850_8119850 – copy (2).js 239042
“02025E4B80CC64991641FB6C23033EA1386C4122” -> urgent 091418 – copy.js 1063998
“3BF34B2156A799EAB4883EA55C5ED651BBB1760A” -> balance 28182588 – copy (3).js 1052233
“7F1FA16FF3481BC34DB0A69041A886E58C753123” -> urgent 41421 – copy (2).js 1064593
“E20B40839E08882061C8CFAFB1AD624FCE7E61BB” -> bc5f7.js 4985
“366FF6FA9394BD071EC324F40F517AE2695A1894” -> 39437_39437.js 234626
“E0EC4CA1051D98314DBE2BE03227FC51E2CEA52F” -> balance 923036.js 1052092
“17528FD6AC7F11141781BD697FD95382B2BD3D5E” -> transactions 2274197 – copy.js 533993
“2861C9F051C3D052BB6AABFB5952795B12113E56” -> transactions 23020644 – copy.js 533198
“287D39040BDEAC76EFAA95F75AB9069A02C813D8” -> urgent 363726 – copy (2).js 1064583
“700A5FDF0A9CC30C24B35D9AD9DC169E842DFE44” -> 70278b85.js 4983
“88F7E62D84533909E2F1858D7F01BC6A12BD4E37” -> transactions 90538070 – copy (2).js 533234
“366FF6FA9394BD071EC324F40F517AE2695A1894” -> 39437_39437 – copy (3).js 234626
“39EA8C60824254512EE6CD3554A0029B80AFFA90” -> 73762227_73762227.js 472412
“AA2820F7709DF036F54F6F4BADE15B386B0BB1B5” -> balance 39488 – copy (4).js 1052231
“91F664CE992E37FA616EB00530154120A659B209” -> Photo 05-11-2016, 22 10 15.js 7002
“BCE9FA09F9A740666062BD0F80BACB4E32B33019” -> 90453581_67580815.js 10478
“366FF6FA9394BD071EC324F40F517AE2695A1894” -> 39437_39437 – copy (4).js 234626
“E38F5C2E3DA86C4B900F7A16035C4DC4D7F3A0D4” -> 22309703_22309703.js 536269
“2174740CEA1A69CE2C350A497B2DE7889E60743E” -> 4751266_4751266.js 603713
“7F1FA16FF3481BC34DB0A69041A886E58C753123” -> urgent 41421 – copy.js 1064593
“48F47F803626A66BCD2988518D3AC603B41E2087” -> urgent 58900022 – copy.js 1064058
“48F47F803626A66BCD2988518D3AC603B41E2087” -> urgent 58900022 – copy (2).js 1064058
“2A48FFA6B99AE40445FBA40C47C858900D704643” -> 0044303_001287.js 6244
“A1B9B8484F16E2D678C0654589845153C5356C9F” -> Anexo-Imagem3490.js 16131
“E1E22E3FE08E7C57FAC583D29628FCA8979E6D0D” -> transactions 83219736.js 537092
“E1E22E3FE08E7C57FAC583D29628FCA8979E6D0D” -> transactions 83219736 – copy.js 537092
“CB563E3B10BB387E417D228683D2BDA893DA37A7” -> 2383dc8.js 4984
“D553743D655B8FA82EF871B081D4E453E55C3BDB” -> Anexo-Imagem4430.js 14597
“ED3D62E79C973B4E9789C132D3D31E826935AF27” -> transactions 6463724 – copy (2).js 533238
“E1E22E3FE08E7C57FAC583D29628FCA8979E6D0D” -> transactions 83219736 – copy (2).js 537092
“EE478A3875A259AA2863C008AFB1EAF0C42DE0D0” -> Anexo-Imagem5609.js 16695
“1D7CFC93B2929B5164FCC2B870728D0F414EE4EC” -> 84524377_84524377.js 603451
“E29689453B7DD32432CA448D196D3DC9194237DB” -> 2.via Boleto.js 16135
“69CAD17ED216F65ABC4DD03F82E8D958F13F9E8B” -> transactions 2396286.js 533955
“ED3D62E79C973B4E9789C132D3D31E826935AF27” -> transactions 6463724.js 533238
“E38F5C2E3DA86C4B900F7A16035C4DC4D7F3A0D4” -> 22309703_22309703 – copy.js 536269
“AA2820F7709DF036F54F6F4BADE15B386B0BB1B5” -> balance 39488.js 1052231
“E38F5C2E3DA86C4B900F7A16035C4DC4D7F3A0D4” -> 22309703_22309703 – copy (2).js 536269
“FE2FC2F13847D042E54B8F2A3BB4EA76D0E710FC” -> 86258_86258.js 472421
“2320AC1ED48D62CF59DB71D7683349E3C4811B0C” -> warning_kOLbxK68.js 24533
“287D39040BDEAC76EFAA95F75AB9069A02C813D8” -> urgent 363726.js 1064583
“366FF6FA9394BD071EC324F40F517AE2695A1894” -> 39437_39437 – copy.js 234626
“69CAD17ED216F65ABC4DD03F82E8D958F13F9E8B” -> transactions 2396286 – copy (2).js 533955
“3BF34B2156A799EAB4883EA55C5ED651BBB1760A” -> balance 28182588.js 1052233
“9EC0356D4804F0F51B85BFCAB6DEFBFE9553DC86” -> 56201008_56201008 – copy (2).js 535934
“C07A0B5173A43410F135E8CFF8C0144A2FFE4D0E” -> 2bb42e8.js 3308
“DD0972B2CCD2DAFA485FE5DE9E984F4361ABFD77” -> urgent 090466.js 1064681
“7F1FA16FF3481BC34DB0A69041A886E58C753123” -> urgent 41421.js 1064593
“2861C9F051C3D052BB6AABFB5952795B12113E56” -> transactions 23020644 – copy (2).js 533198
“69CAD17ED216F65ABC4DD03F82E8D958F13F9E8B” -> transactions 2396286 – copy.js 533955
“44B9F63577339C5C51E4F467F4771BB3BE34AE97” -> urgent 7850470 – copy (2).js 1064594
“DD0972B2CCD2DAFA485FE5DE9E984F4361ABFD77” -> urgent 090466 – copy (2).js 1064681
“F65AA96DEA06B07AC8C1D1757F80E07729158ED3” -> Photo 05-11-2016, 20 09 20.js 7042
“F917C8066D44667AACB89DC86284A5FA38727136” -> 72457797_72457797.js 603725
“287D39040BDEAC76EFAA95F75AB9069A02C813D8” -> urgent 363726 – copy.js 1064583
“17528FD6AC7F11141781BD697FD95382B2BD3D5E” -> transactions 2274197 – copy (2).js 533993
“2861C9F051C3D052BB6AABFB5952795B12113E56” -> transactions 23020644.js 533198
“DD0972B2CCD2DAFA485FE5DE9E984F4361ABFD77” -> urgent 090466 – copy.js 1064681
“E0EC4CA1051D98314DBE2BE03227FC51E2CEA52F” -> balance 923036 – copy (3).js 1052092
“E0EC4CA1051D98314DBE2BE03227FC51E2CEA52F” -> balance 923036 – copy (4).js 1052092
“88F7E62D84533909E2F1858D7F01BC6A12BD4E37” -> transactions 90538070 – copy.js 533234
“ED3D62E79C973B4E9789C132D3D31E826935AF27” -> transactions 6463724 – copy.js 533238
“0C33E001BDEAC5169454B7B43BFBB4F8BAF0E3D3” -> 5efaf.js 4860
Todos ellos los pasamos a controlar como NEMUCOD, que es el downloader mas usado al efecto, ofreciendo el informe de virustotal sobre uno de ellos:
MD5 5f19d55cf15f6db4cab4bff12dd1ed64
SHA1 0c33e001bdeac5169454b7b43bfbb4f8baf0e3d3
Tamaño del fichero 4.7 KB ( 4860 bytes )

SHA256: 91700f492b2b46c186dee03bfc78dc9a478905deb8babe323458d41d0d7accf8
Nombre: 5efaf.js
Detecciones: 35 / 57
Fecha de análisis: 2016-05-18 10:58:22 UTC ( hace 1 minuto )
0 1

Antivirus Resultado Actualización
ALYac JS:Trojan.JS.Downloader.DFP 20160518
AVG JS/Downloader.Agent 20160517
AVware Trojan-Downloader.JS.Nemucod.c (v) 20160511
Ad-Aware JS:Trojan.JS.Downloader.DFP 20160518
AegisLab Troj.Downloader.Js!c 20160518
AhnLab-V3 JS/Obfus.S28 20160518
Antiy-AVL Trojan/Generic.ASHS.37 20160518
Arcabit JS:Trojan.JS.Downloader.DFP 20160518
Avast JS:Downloader-CZH [Trj] 20160518
Avira (no cloud) JS/Dldr.Locky.ALM 20160518
Baidu JS.Trojan-Downloader.Nemucod.v 20160518
BitDefender JS:Trojan.JS.Downloader.DFP 20160518
CAT-QuickHeal JS.Dropper.AR 20160518
Comodo TrojWare.JS.TrojanDownloader.Swabfex.A 20160518
Cyren JS/Locky.X.gen 20160518
ESET-NOD32 JS/TrojanDownloader.Nemucod.UH 20160518
Emsisoft JS:Trojan.JS.Downloader.DFP (B) 20160518
F-Prot JS/Locky.X.gen 20160518
F-Secure JS:Trojan.JS.Downloader.DFP 20160518
Fortinet JS/Nemucod.US!tr 20160518
GData JS:Trojan.JS.Downloader.DFP 20160518
Ikarus Trojan-Ransom.Script.Locky 20160518
Kaspersky Trojan-Downloader.JS.Cryptoload.tj 20160518
McAfee JS/Nemucod.ik 20160518
McAfee-GW-Edition JS/Nemucod.ik 20160518
eScan JS:Trojan.JS.Downloader.DFP 20160518
Microsoft TrojanDownloader:JS/Swabfex.P 20160518
NANO-Antivirus Trojan.Script.Nemucod.ebwcxu 20160518
Qihoo-360 trojan.js.downloader.1 20160518
Rising Trojan.DL-Locky!1.A4D0-FvI6GIcVQ1S (Cloud) 20160518
Sophos JS/Agent-ARKR 20160518
Symantec JS.Downloader 20160518
Tencent Js.Trojan.Raas.Auto 20160518
VIPRE Trojan-Downloader.JS.Nemucod.c (v) 20160518
nProtect JS:Trojan.JS.Downloader.DFP 20160518

Dicho ELISTARA 34.57 que los detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy
saludos

ms, 18-5-2016