Nuevas variantes de ROOTKIT DORKBOT

Pasamos a controlar a partir del ELISTARA 24.36 de hoy, dos nuevas variantes de DORKBOT que hemos recibido del mismo usuario.

El preanalisis de Virus Total ofrecen el siguiente informe:

File name: 0xFFD12566.exe
Submission date: 2011-11-28 14:11:24 (UTC)
Current status: queued queued analysing finished
Result: 29/ 43 (67.4%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.27.00 2011.11.27 Trojan/Win32.Buzus
AntiVir 7.11.18.87 2011.11.28 TR/Offend.KD.404730.1
Antiy-AVL 2.0.3.7 2011.11.28 Trojan/Win32.Buzus.gen
Avast 6.0.1289.0 2011.11.28 Win32:Malware-gen
AVG 10.0.0.1190 2011.11.28 Generic25.BWZQ
BitDefender 7.2 2011.11.28 Trojan.Generic.KD.404730
ByteHero 1.0.0.1 2011.11.14 –
CAT-QuickHeal 12.00 2011.11.28 Worm.Dorkbot.i
ClamAV 0.97.3.0 2011.11.28 –
Commtouch 5.3.2.6 2011.11.28 –
Comodo 10791 2011.11.27 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.11.28 BackDoor.IRC.Bot.911
Emsisoft 5.1.0.11 2011.11.28 Trojan.SuspectCRC!IK
eSafe 7.0.17.0 2011.11.27 –
eTrust-Vet 37.0.9590 2011.11.28 Win32/FraudPack.F!generic
F-Prot 4.6.5.141 2011.11.27 –
F-Secure 9.0.16440.0 2011.11.28 Trojan.Generic.KD.404730
Fortinet 4.3.370.0 2011.11.27 W32/Kryptik.AL!tr
GData 22 2011.11.28 Trojan.Generic.KD.404730
Ikarus T3.1.1.109.0 2011.11.28 Trojan.SuspectCRC
Jiangmin 13.0.900 2011.11.27 Trojan/Buzus.ailj
K7AntiVirus 9.119.5542 2011.11.25 Riskware
Kaspersky 9.0.0.837 2011.11.28 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.11.28 PWS-Zbot.gen.ke
McAfee-GW-Edition 2010.1D 2011.11.28 W32/Kolab.gen.q
Microsoft 1.7801 2011.11.28 Worm:Win32/Dorkbot.I
NOD32 6666 2011.11.28 a variant of Win32/Injector.KVE
Norman 6.07.13 2011.11.28 W32/Suspicious_Gen2.SMUKP
nProtect 2011-11-28.02 2011.11.28 Trojan/W32.Agent.143360.BBH
Panda 10.0.3.5 2011.11.27 Generic Malware
PCTools 8.0.0.5 2011.11.28 –
Prevx 3.0 2011.11.28 –
Rising 23.86.00.01 2011.11.28 –
Sophos 4.71.0 2011.11.28 Mal/EncPk-AAQ
SUPERAntiSpyware 4.40.0.1006 2011.11.26 –
Symantec 20111.2.0.82 2011.11.28 –
TheHacker 6.7.0.1.350 2011.11.27 –
TrendMicro 9.500.0.1008 2011.11.28 TROJ_SPNR.02KO11
TrendMicro-HouseCall 9.500.0.1008 2011.11.28 TROJ_SPNR.02KO11
VBA32 3.12.16.4 2011.11.28 –
VIPRE 11170 2011.11.28 Trojan.Win32.Generic!BT
ViRobot 2011.11.28.4797 2011.11.28 –
VirusBuster 14.1.88.0 2011.11.28 –
Additional informationShow all
MD5   : 0e54f00420d508904dab0b169b4bfde5
SHA1  : 3ad2e15360a7863a3cca95554308df1166585ae8

File size : 143360 bytes

publisher….:
copyright….:
product……:
description..:
original name:
internal name:
file version.: 2, 0, 8, 1
________

y el otro:

File name: b845ef76.exe
Submission date: 2011-11-28 14:25:43 (UTC)
Current status: queued queued analysing finished
Result: 31/ 41 (75.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.27.00 2011.11.27 Trojan/Win32.Jorik
AntiVir 7.11.18.87 2011.11.28 TR/Jorik.IRCbot.dsy
Antiy-AVL 2.0.3.7 2011.11.28 Trojan/Win32.Jorik.gen
Avast 6.0.1289.0 2011.11.28 Win32:Malware-gen
AVG 10.0.0.1190 2011.11.28 Generic25.CFLT
BitDefender 7.2 2011.11.28 Trojan.Generic.6900865
ByteHero 1.0.0.1 2011.11.14 Trojan.Win32.Heur.Gen
CAT-QuickHeal 12.00 2011.11.28 Trojan.Jorik.IRCbot.dsy
ClamAV 0.97.3.0 2011.11.28 –
Commtouch 5.3.2.6 2011.11.28 –
Comodo 10791 2011.11.27 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.11.28 Win32.HLLW.Autoruner1.3328
Emsisoft 5.1.0.11 2011.11.28 Trojan.Win32.Jorik!IK
eSafe 7.0.17.0 2011.11.28 –
eTrust-Vet 37.0.9590 2011.11.28 –
F-Prot 4.6.5.141 2011.11.27 –
F-Secure 9.0.16440.0 2011.11.28 Trojan.Generic.6900865
Fortinet 4.3.370.0 2011.11.27 W32/VBInjector.KFC!tr
GData 22 2011.11.28 Trojan.Generic.6900865
Ikarus T3.1.1.109.0 2011.11.28 Trojan.Win32.Jorik
Jiangmin 13.0.900 2011.11.27 Trojan/Jorik.yes
K7AntiVirus 9.119.5542 2011.11.25 Riskware
Kaspersky 9.0.0.837 2011.11.28 Trojan.Win32.Jorik.IRCbot.dsy
McAfee 5.400.0.1158 2011.11.28 Swisyn.ap
McAfee-GW-Edition 2010.1D 2011.11.28 Swisyn.ap
Microsoft 1.7801 2011.11.28 Worm:Win32/Dorkbot.A
NOD32 6666 2011.11.28 Win32/Dorkbot.B
Norman 6.07.13 2011.11.28 IRCbot.BMQF
nProtect 2011-11-28.02 2011.11.28 Trojan/W32.Jorik.172032.N
Panda 10.0.3.5 2011.11.27 Generic Malware
PCTools 8.0.0.5 2011.11.28 Trojan.IRCBot
Prevx 3.0 2011.11.28 –
Rising 23.86.00.01 2011.11.28 –
Sophos 4.71.0 2011.11.28 Mal/Generic-L
SUPERAntiSpyware 4.40.0.1006 2011.11.26 Trojan.Agent/Gen-Autorun[Dorkbot]
TheHacker 6.7.0.1.350 2011.11.27 –
TrendMicro 9.500.0.1008 2011.11.28 TROJ_SPNR.02KO11
TrendMicro-HouseCall 9.500.0.1008 2011.11.28 TROJ_SPNR.02KO11
VIPRE 11170 2011.11.28 Trojan.Win32.Generic!BT
ViRobot 2011.11.28.4797 2011.11.28 –
VirusBuster 14.1.88.0 2011.11.28 –
Additional informationShow all
MD5   : d3dc8f9646705dd4c08e286b68e77b00
SHA1  : 6ec482901a7cbfd1f6e35177da6e903964639e2f

File size : 172032 bytes

publisher….: Graffiti
copyright….: n/a
product……: GORRAGORRAGORRCIRCU
description..: n/a
original name: GORRAGORRAGORRCIRCUN.exe
internal name: GORRAGORRAGORRCIRCUN
file version.: 50.05.5005
Dicha version del ELISTARA 24.36 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

mns, 28-11-2011