Y NO PARAN DE LLEGAR NUEVAS VARIANTES DE RANSOMWARE THOR (BASE LOCKY)

Como cada día, es una montaña de Ransomwares lo que nos llega para analizar y controlar, y aunque lo vamos haciendo, empezamos a pensar que es una guerra sin fin, pues solo hoy han sido mas de 60 las nuevas variantes, todas ellas distintas, que nos han llegado y pasamos a controlar a partir del ELISTARA 35.61 de hoy
Ofrecemos un resumen de los MD5, nombre de ficheros, y tamaño que pasamos a controlar hoy, además de los ya controlados, claro.

MD5                            NOMBRE     TAMAÑO

“E68D05A8378E060ACB45B45DA9E815DB” -> 116peo.dll  118784
“A5EE2A27E4AF79F7835D6250BA16EA68” -> 13ptmq.dll  118784
“951E7390CE7299F1C440F712757AA3F3” -> 1cpzm0.dll  118272
“F178CDCD549AFE3DA75BE4E48782E711” -> 1kee8.dll  118784
“B1159124BFC7F50F1796ACA98DE2EF92” -> 223ivzu.dll  118272
“DEC41416E5C94ACAC77C9CCEEB2E5CE3” -> 2alw6ja.dll  119296
“D4AC60464E2B833B6100093C469F3380” -> 2ej2cqf.dll  118784
“1F945A94D00B1640DFEC4427D02B4DF8” -> 2lex9.dll  118784
“7891681665F2EAAF0FF75D2EAF80DF41” -> 2yr5egml.dll  118784
“DEACFBCA08BFD8DBBAB3A222A785ABCF” -> 39hv30q9.dll  118784
“CB401816D3CAA5DC0AEAF73F0F0C04C0” -> 3ne9284q.dll  118784
“14BABB4AF65CD4DF7E09396B62DAB80E” -> 3xx77m97.dll  118784
“2CC64F56085980D91D59816DF00FA016” -> 487ygfh(01).dll  217088
“844CD011920AA9D11B4EBBD4C800D2D8” -> 487ygfh(02).dll  258048
“D545C7898B5F00CCD9D50FF9A7578702” -> 48cco1.dll  119296
“567D7ECFF8C44D5A785D545740B57B0C” -> 4hz27zup.dll  118784
“41AD118D4F131FD38D6A09C673FCA780” -> 5k0si.dll  119296
“4F05611B605B4257521199974D894170” -> 5qtko.dll  118784
“55E3D2DEAF23E2328374E597D7DC535B” -> 6xs6hc.dll  119296
“BA6BDE92F6A1C69896DD9622967C5271” -> 7pzlkzx.dll  118784
“CAF92A0162B6015D8C534953446D9EFB” -> 8955p7n2.dll  118784
“79F6F4E11CCD1A148C3D0A49D3462264” -> 89zax.dll  119296
“B197CB1AA456873F68D88AA9A1F678DB” -> a1j9k4.dll  118784
“2649951083AD114038C853AD4742E2AA” -> ajvr9q.dll  118784
“3E700434DA8A2580B2ADA643F0794806” -> bc5mzpyo.dll  118272
“C16986178525B7F16085C3F9596D80EE” -> bp88nlf.dll  118784
“8EB7D20FEE5EF84100C03EFF7A757566” -> byhpm.dll  119296
“67B90D82C9B3CD71DA3237BE4586EC8D” -> demqa.dll  118784
“45A6E81883F53C07429E9814287F2FB9” -> ef6wxcl.dll  118272
“919AECFB5E0746E529882949E76DD079” -> f230s.dll  118784
“B318B73F95E4B143602E006D5E3EED06” -> huc61o7.dll  119808
“FAFAC9026CB41F3B3F8E12CEFD5370E6” -> hy16wnx.dll  119296
“D76F3B31E1D8A10D53CC009386826B27” -> j00q0yi.dll  119296
“DBB3F17AEDFC963050C80C3B9EC9184B” -> j5t02o.dll  118784
“97F2C3C2FC765EF14A50C08612540FF5” -> jkssg.dll  119296
“7FABDAE9C43DDE749C5DA5874E053DCB” -> jodu7fb.dll  118784
“9976A81615F68DFF28AF888C2725E1E6” -> jq6itied.dll  119296
“C8A7FFC7EEDF7F432637522F4DBA1DEB” -> lfmx70p.dll  118272
“94127E4BCC9F0E83D3A404E56AFE77C3” -> lr4ys.dll  119296
“A32ECB988D4481467AC1D9D48392C7EC” -> ly784b41.dll  119296
“2EEC57F3733A686DE17F635153C08151” -> lyrdalwu.dll  118272
“0FC18747ED18A5DDCFD7499A8A0343C4” -> m6xgia.dll  119296
“50B6B3AE8762CDC19B8E7EACF5096865” -> mblr6o.dll  118784
“E32374306450F8938736F50BF2DFBA04” -> mycn9y5a.dll  119296
“572BC619CB9B7B564E2743EA90ED3CB2” -> n1uxie4z.dll  118272
“1E62CADCA39D2B4DA609043FD7B1B2E2” -> ncy0ya.dll  118784
“842539CA06E467634B0F8B28556CC9D9” -> oxq4y0yh.dll  119808
“B1663182EDCF102A3FFC47CD24821388” -> p82et8.dll  118784
“0DA8181BA6CF1498173B56A6EBC13491” -> pvum0.dll  118784
“ECE7A8C50E2226AF3A7E1595761B5907” -> r6tq8.dll  119296
“5233E8CAD75A6A75B795D55C0ECF6AE8” -> tdjjp7kg.dll  118272
“F2936F8E063BF14FE9E3D1C858787B5A” -> u1qmyaw.dll  119296
“4FB979F21BB0F9933059E04AEB92C17A” -> u8gz8qj.dll  119296
“8DC2F7545293629FF4789AFE24BB5D7D” -> ud7gv4.dll  118272
“F4ACA9EAFA811A0F195DA3FC017A68B7” -> vrchsk.dll  118272
“4B5BDDEACA59E509B884B75CF76F3080” -> x6usth1.dll  118272
“18157804E8EEE3C4FEF3BBEAC5663981” -> xd7ipc.dll  118784
“3A72533AB2071783618ABBF48F7F5B80” -> ykga5p.dll  119296
“B35F212D107557DCBC56D889B2AF6438” -> yogoasib.dll  119808
“6660452726DCBE649C03376172D74015” -> yxtnvs.dll  119296
“D77D5A1A86E07144327F672BD73CCB9C” -> zhryhn.dll  118272
“CD0A84B0713A86B7A4129C65530DE5D3” -> zk0ir.dll  118784

y el preanalisis de virustotal del mayor de ellos, por escoger alguno, ofrece el siguiente informe:
MD5 844cd011920aa9d11b4ebbd4c800d2d8
SHA1 7d1793e3f5b7883beb0fe3ef520cb926e48b0a70
File size 252.0 KB ( 258048 bytes )
SHA256:  eb19e3967bca8a1e183aabb66684c97bc4798545e62d5ea51f57771af58f849a
File name:  487ygfh(02).dll
Detection ratio:  39 / 55
Analysis date:  2016-11-14 15:17:51 UTC ( 2 minutes ago )
0
3

Antivirus  Result  Update
ALYac  Trojan.RanSerKD.3693589  20161114
AVG  FileCryptor.NFG  20161114
AVware  Trojan.Win32.Generic!BT  20161114
Ad-Aware  Trojan.RanSerKD.3693589  20161114
AhnLab-V3  Trojan/Win32.Locky.N2152743363  20161114
Avast  Win32:Malware-gen  20161114
Avira (no cloud)  TR/Crypt.ZPACK.tmhtn  20161114
Baidu  Win32.Trojan.WisdomEyes.16070401.9500.9706  20161111
BitDefender  Trojan.RanSerKD.3693589  20161114
Bkav  W32.eHeur.Malware03  20161112
Comodo  TrojWare.Win32.Kryptik.XJV  20161114
CrowdStrike Falcon (ML)  malicious_confidence_100% (D)  20161024
Cyren  W32/Trojan.TFFO-4392  20161114
DrWeb  Trojan.Encoder.7044  20161114
ESET-NOD32  Win32/Filecoder.Locky.H  20161114
Emsisoft  Trojan.RanSerKD.3693589 (B)  20161114
F-Secure  Trojan.RanSerKD.3693589  20161114
Fortinet  W32/Locky.C!tr  20161114
GData  Trojan.RanSerKD.3693589  20161114
Ikarus  Trojan.Win32.Filecoder  20161114
Invincea  trojan.win32.lethic.k  20161018
K7AntiVirus  Trojan ( 004f3c581 )  20161114
K7GW  Trojan ( 004f3c581 )  20161114
Kaspersky  Trojan-Ransom.Win32.Locky.vug  20161114
McAfee  Artemis!844CD011920A  20161114
McAfee-GW-Edition  BehavesLike.Win32.MultiPlug.dh  20161114
eScan  Trojan.RanSerKD.3693589  20161114
Microsoft  Ransom:Win32/Locky  20161114
NANO-Antivirus  Trojan.Win32.Locky.eihhzc  20161114
Qihoo-360  HEUR/QVM40.1.1ADC.Malware.Gen  20161114
Rising  Trojan.Ransom-Locky!8.4655-F70huFze5NJ (cloud)  20161114
Sophos  Mal/RansomDl-C  20161114
Symantec  Ransom.Locky  20161114
Tencent  Win32.Trojan.Raas.Auto  20161114
TrendMicro  Ransom_LOCKY.AQJ  20161114
TrendMicro-HouseCall  Ransom_LOCKY.AQJ  20161114
VIPRE  Trojan.Win32.Generic!BT  20161114
ViRobot  Trojan.Win32.U.Locky.258048.B[h]  20161114
Yandex  Trojan.Locky!  20161114

Dicha versión del ELISTARA 35.61 que los detecta y elimina, estará disponible en nuestra web a partir del 15-11-2016

saludos

ms, 14-11-2016