NUEVA VARIANTE DE RANSOMWARE TROLDESH QUE CODIFICA FICHEROS Y LES AÑADE DIRECCION CORREO PARA CONTACTO HACKER

Una nueva variante de esta familia de ransomwares pasa a ser controlado a partir del ELISTARA 37.00 de hoy

A los ficheros cifrados les añade la dirección de correo para contactar con el hacker:
NOMBRE DE FICHERO CIFRADO[stopstorage@qq.com].master

El preanalisis de virustotal ofrece el siguiente informe:

MD5 d8f3cf00eaf4185cc5bd39846f119677
SHA1 976bba7eb25c209d8fda2758ac15d32583c72a2f
Tamaño del fichero 230.5 KB ( 236032 bytes )
SHA256:
d5979bc57c6252404e65e47337d794d6226a6565fc6ac25ad1e8d92c615f94e1
Nombre:
d8f3cf00.exe
Detecciones:
44 / 61
Fecha de análisis:
2017-06-08 10:24:30 UTC ( hace 22 minutos )

total

Ofrece un fichero de texto como ayuda para pagar el rescate:

_________

!#_RESTORE_FILES_#!..inf__
Your important files produced on this computer have been encrypted due a security problem
If you want to restore them, write us to the e-mail: stopstorage@qq.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

[FREE DECRYPTION AS GUARANTEE]
Before paying you can send to us up to 3 files for free decryption.
Please note that files must NOT contain valuable information
and their total size must be less than 1Mb

[HOW TO OBTAIN BITCOINS]
The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller
by payment method and price
https://localbitcoins.com/buy_bitcoins

[ATTENTION]
Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss
If you not write on e-mail in 36 hours – your key has been deleted and you cant decrypt your files

Your ID:

K+UfWiRFGkqF1ZhT9LLkyxPLFT/GqIASZRmP+FSNC7uF6z6cLdqn2EF0bHQtec2QEoAJ0gwWMBu89IwyqWyPrn/hv8XtXwjBES4cK2Q6MpQpO2F0CfF0FVc5j6rOkuiKAqG+QGLrOC3+KgtnkCKtXwQaqMg0ZuHZ8tUiTLI73EQ=

__________
Nota: Kaspersky lo detecta como
Kaspersky : Trojan-Ransom.Win32.Bitcovar.v 20170608

y McAfee con su motor Artemis, configurando la heuristica a nivel MUY ALTO, como
McAfee : Artemis!D8F3CF00EAF4 20170608

__________
Dicha versión del ELISTARA 37.00 que lo detecta y elimina, estará disponible en nuestra web a partir del 9-6 prox
saludos

ms, 8.6.2017