VARIOS MAILS CON DIFERENTE TEXTO ENVIAN ANEXADOS FICHEROS ZIP CON RANSOWMARE TIPO LOCKY (THOR)

Son varios los mails recibidos estos días, con anexado malicioso que instalan ransomware de la familia Locky  (THOR):
Los textos de los mails vienen a ser:

Asunto: Wrong tracking number
De: “Josue Fulton” <Fulton.33371@voyagescinqetoiles.com>
Fecha: 31/10/2016 16:19
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.

ANEXADO :  tracking number E480D2 PDF.zip -> tracking number E480D2 PDF.VBS

_______________

Asunto: Wrong tracking number
De: “Marva Miles” <Miles.0792@mysipl.com>
Fecha: 31/10/2016 16:47
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.
ANEXADO:  tracking number F0235BB3 PDF.ZIP ->   tracking number F0235BB3 PDF.VBS
_______________
Asunto: Wrong tracking number
De: “Marva Miles” <Miles.0792@mysipl.com>
Fecha: 31/10/2016 16:47
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.

ANEXADO:   transaction_details_8C643D8D_PDF.ZIP —>   transaction_details_8C643D8D_PDF.VBS
______________
Asunto: Blank 5
De: SONDRA RICE <sondrarice9388@gmail.com>
Fecha: 31/10/2016 10:30
Para: <destinatario>
sin texto

ANEXADO: Blank 5.zip   —>   II4300-0167.WSF
Todos ellos pasan a ser controlados a partir del ELISTARA 35.53 de hoy
El preanalisis de virustotal de uno de ellos ofrece el siguiente informe

VARIOS MAILS CON DIFERENTE TEXTO ENVIAN ANEXADOS FICHEROS ZIP CON RANSOWMARE TIPO LOCKY
Son varios los mails recibidos estos días, con anexado malicioso que instalan ransomware de la familia Locky:
Los textos de los mails vienen a ser:

Asunto: Wrong tracking number
De: “Josue Fulton” <Fulton.33371@voyagescinqetoiles.com>
Fecha: 31/10/2016 16:19
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.

ANEXADO :  tracking number E480D2 PDF.zip -> tracking number E480D2 PDF.VBS

_______________

Asunto: Wrong tracking number
De: “Marva Miles” <Miles.0792@mysipl.com>
Fecha: 31/10/2016 16:47
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.
ANEXADO:  tracking number F0235BB3 PDF.ZIP ->   tracking number F0235BB3 PDF.VBS
_______________
Asunto: Wrong tracking number
De: “Marva Miles” <Miles.0792@mysipl.com>
Fecha: 31/10/2016 16:47
Para: <destinatario>

It looks like the delivery company gave us the wrong tracking number.

Please contact them as soon as possible and ask them regarding the shipment number 302856 information attached.

ANEXADO:   transaction_details_8C643D8D_PDF.ZIP —>   transaction_details_8C643D8D_PDF.VBS
______________
Asunto: Blank 5
De: SONDRA RICE <sondrarice9388@gmail.com>
Fecha: 31/10/2016 10:30
Para: <destinatario>
sin texto

ANEXADO: Blank 5.zip   —>   II4300-0167.WSF
Todos ellos pasan a ser controlados a partir del ELISTARA 35.53 de hoy
El preanalisis de virustotal del primero de ellos, ofrece el siguiente informe

MD5 7722af3145c4b075dd9af67a25a16b44
SHA1 2a526524556af794cb78ee67f4f779d996afc411
File size 4.5 KB ( 4613 bytes )
SHA256:  6ec27a26e7f346d0c12f44e17ee649aa02df4f9bb14e0f5a47259a74d72e3555
File name:  transaction_details_8C643D8D_PDF.vbs
Detection ratio:  20 / 54
Analysis date:  2016-11-02 08:27:12 UTC
0
1

Antivirus  Result  Update
AegisLab  Vbs.Dl1.Gen!c  20161102
Avira (no cloud)  VBS/Dldr.Agent.UKT  20161102
Baidu  VBS.Trojan-Downloader.Agent.qa  20161101
Cyren  VBS/Locky.B  20161102
DrWeb  VBS.DownLoader.748  20161102
ESET-NOD32  VBS/TrojanDownloader.Agent.OOW  20161102
F-Prot  VBS/Locky.B  20161102
Fortinet  VBS/Agent.LKY!tr  20161102
Ikarus  Win32.SuspectCrc  20161101
Kaspersky  Trojan-Downloader.VBS.Cryptoload.d  20161102
McAfee  VBS/Downloader.dx  20161102
NANO-Antivirus  Trojan.Script.Mlw.ehymqi  20161102
Qihoo-360  virus.vbs.gen.85  20161102
Rising  Trojan.Downloader!1.A537 (classic)  20161102
Sophos  VBS/DwnLdr-PKV  20161102
Symantec  JS.Downloader  20161102
Tencent  Js.Trojan.Raas.Auto  20161102
TheHacker  VBS/Psyme  20161101
TrendMicro  HEUR_VBS.DL1  20161102
TrendMicro-HouseCall  VBS_LOCKY.SMAA  20161102

Dicha versión del ELISTARA 35.53 que los detecta y elimina, estará disponible en nuestra web a partir del 3-11-2016
saludos

ms, 2-11-2016
Dicha versión del ELISTARA 35.53 que los detecta y elimina, estará disponible en nuestra web a partir del 3-11-2016
saludos

ms, 2-11-2016