Variantes de Backdoor Kirts que además de su función como backdoor, descarga malwares como BOAXE

Algunas variantes de este malware pasan a ser controladas a partir del ELISTARA 35.14 de hoy.

El preanalisis de virustotal de uno de ellos, ofrece el siguiente informe:

MD5 9c05e7d3d147e2124568d9bf9115ddca
SHA1 58fc81a34a0f0d32189ee3fce6cfdeae50c7f4af
File size 337.5 KB ( 345576 bytes )
SHA256: 0312946bd5c7d7972c61768107d5b052982792a9c10ba8d7ad04cb07075869f9
File name: 9c05e7d3d147e2124568d9bf9115ddca.exe
Detection ratio: 32 / 57
Analysis date: 2016-09-03 20:54:54 UTC ( 1 day, 16 hours ago )
0
2

Antivirus Result Update
ALYac Trojan.GenericKD.3507412 20160903
AVware Trojan.Win32.Generic!BT 20160903
Ad-Aware Trojan.GenericKD.3507412 20160903
AegisLab W32.Troj.Stealer!c 20160903
AhnLab-V3 Dropper/Win32.Injector.N2095389003 20160903
Antiy-AVL Trojan/Win32.TSGeneric 20160903
Arcabit Trojan.Generic.D3584D4 20160903
Avast Win32:Malware-gen 20160903
Avira (no cloud) TR/Dropper.MSIL.tznya 20160903
BitDefender Trojan.GenericKD.3507412 20160903
Cyren W32/Trojan.ENUU-3213 20160903
DrWeb Trojan.Siggen6.65162 20160903
ESET-NOD32 a variant of MSIL/Kryptik.HDY 20160903
Emsisoft Trojan.MSIL.Crypt (A) 20160903
F-Secure Trojan.GenericKD.3507412 20160903
Fortinet MSIL/Kryptik.HDY!tr 20160903
GData Trojan.GenericKD.3507412 20160903
Ikarus Trojan.MSIL.Crypt 20160903
Invincea trojanspy.msil.omaneat.b 20160830
K7AntiVirus Trojan ( 004f73781 ) 20160903
K7GW Trojan ( 004f73781 ) 20160903
Kaspersky UDS:DangerousObject.Multi.Generic 20160903
McAfee Trojan-FJMJ!9C05E7D3D147 20160903
McAfee-GW-Edition Trojan-FJMJ!9C05E7D3D147 20160903
eScan Trojan.GenericKD.3507412 20160903
Microsoft Trojan:Win32/Dynamer!ac 20160903
Rising Trojan.Kryptik!8.8-uhEmC61XQ9C (cloud) 20160903
Sophos Mal/Generic-S 20160903
Symantec Heur.AdvML.C 20160903
TrendMicro TROJ_GEN.R01BC0DI316 20160903
TrendMicro-HouseCall TROJ_GEN.R01BC0DI316 20160903
Yandex Trojan.Kryptik!KzGMPN59QfI 20160903

Dicha versión del ELISTARA 35.14 que los detecta y elimina, estará disponible en nuestra web a partir del 6-9-2016

saludos

ms, 5-9-2016