NUEVO MALWARE QUE LEGA EN UN JAR EMPAQUETADO EN UN ZIP RECIBIDO ANEXADO A UN eMAIL

A partir del ELISTARA 37.72 de hoy pasamos a controlar un JAR (empaquetado de java) que llega en un ZIP anexado a un mail

El texto del mail es el siguiente:

Asunto: Urgent Request for Quotation

De: “Sales1 ” <marketing@obsnap.com>

Fecha: 24/10/2017 13:01

Para: tecnic@destinatario

Good Day,
Enclosed please find attached our Purchase Order 8221/17. Kindly acknowledge our Order by return mail and advise us the earliest time item can be ready, your estimated delivery schedule with the actual export port (Taiwan or Vietnam).
You can also contact us through Tel: +65 9977 2864. Your immediate respond is highly appreciated.

Best RegardsNathaniel NgoProcurement Specialist
Follow us on Facebook | You can find us on YouTube
P Save a tree…please don’t print this e-mail unless you REALLY need to
Please consider the environment before printing this e-mail.

Confidentiality Notice: This e-mail message, including attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.

  Virus-free. www.avast.com

(El comentario final es para despistar, pueden indicar cualquier antivirus conocido, que es información falsa, claro.)
Anexado a exte mail se recibe un ZIP conteniendo un JAR con el siguiente nombre:

RFQ20171024.jar
total ofrece el siguiente informe:

Dicha versión del ELISTARA 37.72 que lo detecta y elimina, estará disponible en nuestra web a partir del 25/10 prox

saludos

ms, 24-10-2017