28 NUEVAS VARIANTES DE RANSOWMARE LOCKY QUE PASAMOS A CONTROLAR CON ELISTARA

Gracias a información obtenida en VirusTotal, hemos descargado 40 muestras de esta familia de ransomwares, de las cuales 12 han sido ya detectadas y eliminadas por el actual ELISTARA, quedando las 28 restantes para analizar y pasar a controlar a partir del ELISTARA 34.52 de hoy

Los hashes SHA1 de dichos 28 nuevas variantes de Locky spn los siguientes:

38545700CE80B517F103B91CC1DE905C507D02D5″ -> 8y7hybigv.exe 212992
“06F1AD27B250E4BE79E712F423EF716B032D9FDF” -> 7623dh3f.exe 104955
“B35FFD1545A4E37DB71962E1F7C83E0F7D21F4D8” -> 7.exe 190464
“36EE422B92950BB11CA5BE2EFEAA53626BFEBA67” -> k3idv.exe 155049
“D4FB05991F62686552351CA2E06365012F611280” -> 67uh54gb4.exe 212480
“AE2C77498FD7FD89955950B344406D8987670BD5” -> o3isua.exe 163328
“6C01C612F8F2CEBE23C9139B1B62036FC35FFD35” -> k9ospw1.exe 159232
“E2A611CABFC2CDD238FFCDEE35BF7864A1994BDE” -> 4.exe 190464
“4BCC6E2A16D0CE756BBB8B2077CDB802D5BF874B” -> ke4uad.exe 146427
“7CDEB0D1532FE76AC549E408B591AE2597F4E339” -> 9oi654gh3.exe 213504
“368A08374B8C88AA3E959A00D966C20C5209DAA8” -> 98h7b66gb (1).exe 196608
“CA07FE1DC38C51827D6F0464462F72E9D935F38F” -> kd4uds.exe 155648
“A43465AF7E4EEFF1205B8DD5FC102DDDB0E0F512” -> 67j5hg.exe 250880
“85A280251F7F29985000D1297DDD3FA3F8B2CBC6” -> kid8eos.exe 168960
“D78F9A18C35BF1ED715694E08D9BF58DFC17F906” -> dsfg43gf.exe 236544
“244F4F2EB2B83FF7C2672BD9B721AA02B3172869” -> 3476grb4f434r.exe 176128
“4F94153BB25C54835778EA44307AB5CD49A228F6” -> y78hiuok.exe 212992
“DD0DF07CEA814E40D5923D82457A725393977F8A” -> msh4uys.exe 162304
“5826D3A3B466C204B145DE4AD033C83F723C6970” -> nc4f6gf.exe 238592
“0DA1A99A2D53839A500E1D297C6775C43F7B1EE0” -> fduew.exe 159232
“2BF92CA7B567DA5CCEC62CFFC92178B67A5B94F5” -> l1sape.exe 168448
“4F2F57ED37A9A900A1FFA7AE8886AEB69EE55D7A” -> m8dhs.exe 158720
“00291AD3655426654C7BB14B8C3C51CB16844E86” -> 89ok8jhg.exe 212992
“4E62B9614A3E9EA7F0D6D1AA52CD43B61D03BB37” -> 2.exe 190464
“827FA0603FFE62666ADAF91588E5B6CF02BE1187” -> io3cca.exe 168448
“2D5792195196DA30D5395F8EF59B2C81CBDC64CC” -> n3sjax.exe 159274
“C8EF52F7701CA146986CE9D61EF9A3223C28CDA5” -> 2 (1).exe 194048
“D7CFD545310D85B879A752EE3DEE90BD52D6E584” -> kwo9pa.exe 167936

De ellos vemos dos que usan icono atipico, los cuales pasamos a amalizar con virustotal:

MD5 d1703e25263411e1b5042fde8cb9c6b4
SHA1 00291ad3655426654c7bb14b8c3c51cb16844e86
Tamaño del fichero 208.0 KB ( 212992 bytes )
SHA256: 96e80185f1ba2ce55e43181356996c44e056a8b2a6e09096c51d488cbfcb6ba7
Nombre: 89ok8jhg.exe
Detecciones: 48 / 57
Fecha de análisis: 2016-05-10 12:01:35 UTC ( hace 0 minutos )
0 2
Antivirus Resultado Actualización
ALYac Trojan.AgentWDCR.FQA 20160510
AVG Crypt_s.KVS 20160510
AVware Trojan.Win32.Generic!BT 20160510
Ad-Aware Trojan.AgentWDCR.FQA 20160510
AhnLab-V3 Trojan/Win32.Locky 20160509
Antiy-AVL Trojan[Ransom]/Win32.Locky.gena 20160510
Arcabit Trojan.AgentWDCR.FQA 20160510
Avast Win32:Malware-gen 20160510
Avira (no cloud) TR/FileCoder.Y.776534 20160510
Baidu Win32.Trojan.WisdomEyes.151026.9950.9999 20160506
Baidu-International Adware.Win32.iBryte.EQNR 20160510
BitDefender Trojan.AgentWDCR.FQA 20160510
CAT-QuickHeal Ransom.Locky.MUE.G7 20160510
Comodo UnclassifiedMalware 20160510
Cyren W32/Locky.D.gen!Eldorado 20160510
DrWeb Trojan.DownLoader19.56711 20160510
ESET-NOD32 Win32/Filecoder.Locky.A 20160510
Emsisoft Trojan.AgentWDCR.FQA (B) 20160510
F-Prot W32/Locky.D.gen!Eldorado 20160510
F-Secure Trojan.AgentWDCR.FQA 20160510
Fortinet W32/Kryptik.ERJK!tr 20160510
GData Trojan.AgentWDCR.FQA 20160510
Ikarus Trojan.Win32.Crypt 20160510
K7AntiVirus Trojan ( 004dffea1 ) 20160510
K7GW Trojan ( 004dffea1 ) 20160510
Kaspersky Trojan-Ransom.Win32.Locky.du 20160510
Malwarebytes Ransom.Locky 20160510
McAfee Generic.xy 20160510
McAfee-GW-Edition BehavesLike.Win32.Sality.dh 20160510
eScan Trojan.AgentWDCR.FQA 20160510
Microsoft Ransom:Win32/Locky 20160510
NANO-Antivirus Trojan.Win32.FileCoder.eazlfh 20160510
Panda Trj/WLT.B 20160509
Qihoo-360 Win32/Trojan.0f6 20160510
Rising Ransom.Locky!8.1CD4-GSmWcAOfyRJ (Cloud) 20160510
SUPERAntiSpyware Ransom.Locky/Variant 20160510
Sophos Mal/Ransom-EH 20160510
Symantec Trojan.Cryptolocker.AF 20160510
Tencent Win32.Trojan.Filecoder.Wpiu 20160510
TrendMicro Ransom_LOCKY.SMR1 20160510
TrendMicro-HouseCall Ransom_LOCKY.SMR1 20160510
VBA32 BScope.P2P-Worm.Palevo 20160510
VIPRE Trojan.Win32.Generic!BT 20160510
ViRobot Trojan.Win32.Locky.Gen.B[h] 20160510
Yandex Trojan.Locky! 20160508
Zillya Trojan.CryptGen.Win32.3 20160508
Zoner Trojan.Locky 20160510
nProtect Trojan/W32.Locky.212992.I 20160510

y el otro, tambien con icono atìpico:

MD5 5177b588ad21b683d2227bddd6c620b9
SHA1 d78f9a18c35bf1ed715694e08d9bf58dfc17f906
Tamaño del fichero 231.0 KB ( 236544 bytes )
SHA256: 01439d0f5ad369054bc448f65227a75ce1db9d2511390ea28082010aa5825663
Nombre: dsfg43gf.exe
Detecciones: 47 / 57
Fecha de análisis: 2016-05-10 12:08:59 UTC ( hace 2 minutos )
0 1

Antivirus Resultado Actualización
ALYac Trojan.Ransom.LockyCrypt 20160510
AVG Crypt5.ARSB 20160510
AVware Trojan.Win32.Generic!BT 20160510
Ad-Aware Trojan.GenericKD.3113774 20160510
AhnLab-V3 Win-Trojan/Lockycrypt.Gen 20160509
Antiy-AVL Trojan/Win32.TSGeneric 20160510
Arcabit Trojan.Generic.D2F832E 20160510
Avast Win32:Trojan-gen 20160510
Avira (no cloud) TR/FileCoder.Locky.66478 20160510
BitDefender Trojan.GenericKD.3113774 20160510
Bkav W32.Clod042.Trojan.c4a2 20160509
CAT-QuickHeal Ransomware.Locky.MUE.G5 20160510
Comodo UnclassifiedMalware 20160510
Cyren W32/Locky.G.gen!Eldorado 20160510
DrWeb Trojan.Encoder.4232 20160510
ESET-NOD32 a variant of Win32/Kryptik.ERXQ 20160510
Emsisoft Trojan.GenericKD.3113774 (B) 20160510
F-Prot W32/Locky.G.gen!Eldorado 20160510
F-Secure Trojan.GenericKD.3113774 20160510
Fortinet W32/Kryptik.ESRE!tr 20160510
GData Trojan.GenericKD.3113774 20160510
Ikarus Trojan-Ransom.Locky 20160510
Jiangmin Trojan.Locky.et 20160510
K7AntiVirus Trojan ( 004e114a1 ) 20160510
K7GW Trojan ( 004e114a1 ) 20160510
Kaspersky Trojan-Ransom.Win32.Locky.jw 20160510
Malwarebytes Ransom.Locky 20160510
McAfee Ransomware-FHB!5177B588AD21 20160510
McAfee-GW-Edition BehavesLike.Win32.Ransomware.dh 20160510
eScan Trojan.GenericKD.3113774 20160510
Microsoft Ransom:Win32/Locky.A 20160510
NANO-Antivirus Trojan.Win32.FileCoder.ebdlhk 20160510
Panda Trj/GdSda.A 20160509
Qihoo-360 HEUR/QVM20.1.Malware.Gen 20160510
Rising Malware.XPACK-HIE/Heur!1.9C48-sGbvYWOfBdK (Cloud) 20160510
SUPERAntiSpyware Ransom.Locky/Variant 20160510
Sophos Mal/Ransom-EH 20160510
Symantec Trojan.Gen 20160510
Tencent Win32.Trojan.Locky.Stud 20160510
TrendMicro Ransom_LOCKY.SMM 20160510
TrendMicro-HouseCall Ransom_LOCKY.SMA1 20160510
VBA32 Hoax.Locky 20160510
VIPRE Trojan.Win32.Generic!BT 20160510
ViRobot Trojan.Win32.Locky.Gen.B[h] 20160510
Yandex Trojan.Locky! 20160508
Zillya Trojan.CryptGen.Win32.3 20160508
nProtect Trojan/W32.Locky.236544 20160510

Ambos, como el resto de la mayoría, indican en su decripción, los siguientes datos:

LegalCopyrightCopyright Southsoftware.com, 2002-2015
FileVersion4.1.0.612
TimeStamp2016:03:21 15:24:31+01:00
FileTypeWin32 EXE
PETypePE32
InternalNameBdvanced Task Scheduler 32-bit Edition

Dicha versión del ELISTARA 34.52 que los detectan y eliminan, estará disponible en nuestra web a partir de las 18 h CEST de hoy

saludos

ms, 10-5-2016