Nueva variante de Backdoor BIFROSE

Nos llega de Ecuador esta muestra cazada heuristicamente por el ELISTARA:

File name: SERVER.EXE.Muestra EliStartPage v22.03
Submission date: 2010-11-18 08:53:17 (UTC)

Result: 36 /43 (83.7%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.18.00 2010.11.17 Win-Trojan/Bifrose.409129
AntiVir 7.10.14.33 2010.11.17 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2010.11.18 Backdoor/Win32.Bifrose.gen
Avast 4.8.1351.0 2010.11.18 Win32:VB-PCQ
Avast5 5.0.594.0 2010.11.18 Win32:VB-PCQ
AVG 9.0.0.851 2010.11.17 Dropper.Generic2.FRX
BitDefender 7.2 2010.11.18 Gen:Trojan.Heur.ZGY.4
CAT-QuickHeal 11.00 2010.11.09 Win32.Worm.VBNA.b.4
ClamAV 0.96.4.0 2010.11.18 –
Command 5.2.11.5 2010.11.18 W32/VBTrojan.9!Maximus
Comodo 6757 2010.11.18 UnclassifiedMalware
DrWeb 5.0.2.03300 2010.11.18 Trojan.PWS.Dybalom
Emsisoft 5.0.0.50 2010.11.18 Virus.Win32.VBInject!IK
eSafe 7.0.17.0 2010.11.16 –
eTrust-Vet 36.1.7984 2010.11.18 –
F-Prot 4.6.2.117 2010.11.18 W32/VBTrojan.9!Maximus
F-Secure 9.0.16160.0 2010.11.18 Backdoor.Generic.330710
Fortinet 4.2.254.0 2010.11.17 W32/Refroso.BLC!tr
GData 21 2010.11.18 Backdoor.Generic.330710
Ikarus T3.1.1.90.0 2010.11.18 Virus.Win32.VBInject
Jiangmin 13.0.900 2010.11.18 Backdoor/Bifrose.xuj
K7AntiVirus 9.68.3011 2010.11.17 Backdoor
Kaspersky 7.0.0.125 2010.11.18 Backdoor.Win32.Bifrose.cohx
McAfee 5.400.0.1158 2010.11.18 Generic.dx!svf
McAfee-GW-Edition 2010.1C 2010.11.18 Heuristic.LooksLike.Win32.Suspicious.C!89
Microsoft 1.6402 2010.11.18 VirTool:Win32/VBInject.gen!DO
NOD32 5628 2010.11.18 a variant of Win32/Injector.CCE
Norman 6.06.10 2010.11.17 W32/Suspicious_Gen3.EGVN
nProtect 2010-11-18.02 2010.11.18 Backdoor.Generic.330710
Panda 10.0.2.7 2010.11.17 Bck/Bifrose.AKL
PCTools 7.0.3.5 2010.11.18 Spyware.Ardakey!rem
Prevx 3.0 2010.11.18 High Risk Cloaked Malware
Rising 22.74.02.06 2010.11.18 –
Sophos 4.59.0 2010.11.18 Mal/VBDrop-G
SUPERAntiSpyware 4.40.0.1006 2010.11.18 –
Symantec 20101.2.0.161 2010.11.18 Spyware.Ardakey
TheHacker 6.7.0.1.086 2010.11.18 Backdoor/Bifrose.cohx
TrendMicro 9.120.0.1004 2010.11.18 –
TrendMicro-HouseCall 9.120.0.1004 2010.11.18 –
VBA32 3.12.14.2 2010.11.17 Backdoor.Win32.Bifrose.cohx
VIPRE 7340 2010.11.18 Trojan.Win32.Generic!BT
ViRobot 2010.11.18.4154 2010.11.18 Backdoor.Win32.Bifrose.92201
VirusBuster 12.77.2.1 2010.11.18 VirTool.VBInject.AODT
Additional informationShow all 
MD5   : 75663c0f03823fc77ed2c43450df73cb
SHA1  : 53bb6cd5c151dd98bc896f8d7ca47f66498cbfa2

File size : 409129 bytes

publisher….:
copyright….: n/a
product……: YDN2
description..: n/a
original name: Deck.exe
internal name: Deck
file version.: 1.00
 
Lo pasamos a controlar a partir del ELITRIIP DE hoy  7.08

Pocos antivirus no lo detectan actualmente, entre ellos ERsafe, Etrust, SuperAntispyware y Trend

saludos

ms, 18-11-2010