NUEVA VARIANTE DE RANSOMWARE TROLDESH.G QUE AÑADE .ALETA A LOS FICHEROS CIFRADOS, ADEMAS DE UNA DIRECCION DE CORREO

Una nueva variante de Troldesh añade .aleta a los ficheros cifrados, además de una dirección de correo para contactar con el hacker:

(write us to the e-mail decryptyourfileshereee1@cock.li)

El mensaje que presenta en pantalla dice lo siguiente:

All your files have been encrypted!All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail decryptyourfileshereee1@cock.li in body of your message write your IDYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guaranteeBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.) How to obtain BitcoinsThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention!Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. Your ID……
______________

Codifica ficheros BAT, BMP, DLL, EXE, GIF, INI, JPG, MID, PNG, SYS, TXT, WAV,XML, ZIP, etc… de todas las unidades mapeadas (respetando %WinDir%)

A los ficheros codificados les añade “.[decryptyourfileshereee1@cock.li].aleta”

Pasamos a controlarlo a partir del ELISTARA 37.28 de hoy
Llega anexado a un email, en un fichero empaquetado con extension .ZI,  que es un ZIP que contiene otro ZIP que desempaquetado ofrece al final este fichero :
5ac8d507.EXE
cuyo preanalisis en virustotal ofrece el siguiente informe:

MD5 0e9dbfef192e62acc9e171b0a36f53b7

SHA1 9df59f1d94a85a5810ebcae922a6ea66a6273d80Tamaño del fichero 738.5 KB ( 756224 bytes )

SHA256: 88765f9b234de7211e331314ef9abfd76d31739ea065bed48d18ce14e5070772

Nombre: WindowsUpdate(05).exeDetecciones: 47 / 63

Fecha de análisis: 2017-07-18 11:08:42 UTC ( hace 0 minutos )

total

Dicha versión del ELISTARA 37.28 que lo detecta y elimina, estará disponible en nuestra web a partir del 19.7 prox

saludos
ms, 18-7-2017