NUEVAS VARIANTES DEL TROYANO LISEC (ALIAS LETHIC), DESCARGADO POR UN SOUNDER

Tras la infección de un DownLoader.Sounder, se descarga y ejecuta varios ficheros que copia en C:\RECYCLER (que era la papelera en el antiguo XP, y que en los actuales sistemas crea, al no encontrarla)

Los pasamos a controlar a partir del ELISTARA 35.92 de hoy.

Los ficheros que nos ha creado en la monitorización, tienen los siguientes MD5:

“2D829C378D0923410391FCBC001EAA84” -> lja7shayne10(32).exe 199680
“A73017B6A80F432CD424713CC83FFCE8” -> lja7shayne2(32).exe 197120
“31848B02BF63337E0213BC75138BA6DF” -> lja7shayne3(32).exe 200192
“4ABE14BAEA7C19D3C5EBC5AA340ED89B” -> lja7shayne4(32).exe 200192
“EAD91DD1179B227FFB574DE6D10BC61D” -> lja7shayne6(32).exe 201216
“13C341706B5865745083A740C79D879A” -> lja7shayne7(32).exe 197632
“34F312FF54422B42D02F2FAD35BF1276” -> lja7shayne8(32).exe 197632
“02B36885801B53ED9F41CB1461386746” -> lliseconc8(78).exe 201216
“23D018C8A145C906DD0BD313F150F7EC” -> lliseconc8a(78).exe 199168
“F376C7FD7F90F723D3FFC9C664C1BD1F” -> systeez(21).exe 220672

Y subido al virustotal el último de ellos, ofrece el siguiente informe:

MD5 f376c7fd7f90f723d3ffc9c664c1bd1f
SHA1 24dfe87fc06ae78e9ffca6274a97f75bd841c919
File size 215.5 KB ( 220672 bytes )
SHA256: d9a5109f57572490c0181111619f07b7f5cc869f42c212555a874c105f5392d3
File name: systeez(21).exe
Detection ratio: 40 / 57
Analysis date: 2017-01-02 13:54:14 UTC ( 3 minutes ago )
0
1

Antivirus Result Update
AVG GenericX.702 20170102
AVware LooksLike.Win32.Crowti.b (v) 20170102
Ad-Aware Trojan.GenericKD.4100563 20170102
AhnLab-V3 Trojan/Win32.NgrBot.C1730363 20170102
Antiy-AVL Trojan/Win32.TSGeneric 20170102
Arcabit Trojan.Generic.D3E91D3 20170102
Avast Win32:Dorder-BF [Trj] 20170102
Avira (no cloud) TR/Crypt.ZPACK.hfkwv 20170102
Baidu Win32.Trojan.WisdomEyes.16070401.9500.9764 20161207
BitDefender Trojan.GenericKD.4100563 20170102
Bkav W32.FamVT.RazyNHmA.Trojan 20161229
CMC Trojan.Win32.Swizzor.1!O 20170102
CrowdStrike Falcon (ML) malicious_confidence_100% (W) 20161024
Cyren W32/S-e2e07e9d!Eldorado 20170102
DrWeb BackDoor.IRC.NgrBot.966 20170102
ESET-NOD32 a variant of Win32/Kryptik.FMKE 20170102
Emsisoft Trojan.GenericKD.4100563 (B) 20170102
F-Prot W32/S-e2e07e9d!Eldorado 20170102
F-Secure Trojan.GenericKD.4100563 20170102
Fortinet W32/Kryptik.FMKE!tr 20170102
GData Trojan.GenericKD.4100563 20170102
Ikarus Trojan.Win32.Crypt 20170102
Invincea worm.win32.dorkbot.i 20161216
Jiangmin Trojan.Generic.apydj 20170102
K7AntiVirus Trojan ( 00501a741 ) 20170102
K7GW Trojan ( 00501a741 ) 20170102
Kaspersky UDS:DangerousObject.Multi.Generic 20170102
Malwarebytes Trojan.Dropper 20170102
McAfee RDN/Generic.hbg 20170102
McAfee-GW-Edition RDN/Generic.hbg 20170102
eScan Trojan.GenericKD.4100563 20170102
Microsoft Trojan:Win32/Lethic.B 20170102
Panda Trj/Genetic.gen 20170101
Qihoo-360 Win32/Trojan.857 20170102
Rising Trojan.Kryptik!8.8-9Tu4W77IzgP (cloud) 20170102
Sophos Mal/Generic-S 20170102
Symantec Heur.AdvML.B 20170102
TrendMicro TROJ_GEN.R02SC0DA217 20170102
TrendMicro-HouseCall TROJ_GEN.R02SC0DA217 20170102
VIPRE LooksLike.Win32.Crowti.b (v) 20170102

Dicha versión del ELISTARA 35.92 que los detecta y elimina, estará disponible en nuestra web a partir del 3-1-2017

saludos

ms, 2-1-2016