Nuevas variantes del Troyano ENIGMA

La heuristica del ELISTARA ha detectado dos ficheros sospechosos que una vez analizados han resultado ser variantes del troyano ENIGMA;
File name: S01.EXE.Muestra EliStartPage v22.09
Submission date: 2010-11-29 12:24:52 (UTC)
Current status: finished
Result: 36 /43 (83.7%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.29.03 2010.11.29 Trojan/Win32.Banker
AntiVir 7.10.14.130 2010.11.29 TR/Agent.ckn
Antiy-AVL 2.0.3.7 2010.11.29 Trojan/Win32.Banker.gen
Avast 4.8.1351.0 2010.11.29 Win32:PWStealer-C
Avast5 5.0.594.0 2010.11.29 Win32:PWStealer-C
AVG 9.0.0.851 2010.11.28 PSW.Banker5.BQSY
BitDefender 7.2 2010.11.29 Trojan.Generic.KDV.64975
CAT-QuickHeal 11.00 2010.11.29 TrojanBanker.Banker.bciu
ClamAV 0.96.4.0 2010.11.29 PUA.Packed.TeLock
Command 5.2.11.5 2010.11.29 –
Comodo 6884 2010.11.29 UnclassifiedMalware
DrWeb 5.0.2.03300 2010.11.29 Trojan.PWS.Banker.53258
Emsisoft 5.0.0.50 2010.11.29 Trojan-PWS.Banker5!IK
eSafe 7.0.17.0 2010.11.29 Win32.PSW.Delf.Oad
eTrust-Vet 36.1.8006 2010.11.29 –
F-Prot 4.6.2.117 2010.11.28 –
F-Secure 9.0.16160.0 2010.11.29 Trojan.Generic.KDV.64975
Fortinet 4.2.254.0 2010.11.29 W32/Banker.BCIU!tr
GData 21 2010.11.29 Trojan.Generic.KDV.64975
Ikarus T3.1.1.90.0 2010.11.29 Trojan-PWS.Banker5
Jiangmin 13.0.900 2010.11.29 –
K7AntiVirus 9.69.3103 2010.11.27 Trojan
Kaspersky 7.0.0.125 2010.11.29 Trojan-Banker.Win32.Banker.bciu
McAfee 5.400.0.1158 2010.11.29 Artemis!C30CD0761C9A
McAfee-GW-Edition 2010.1C 2010.11.29 Heuristic.LooksLike.Win32.Suspicious.C
Microsoft 1.6402 2010.11.29 –
NOD32 5657 2010.11.29 Win32/PSW.Delf.OAD
Norman 6.06.10 2010.11.28 W32/Banker.FMZN
nProtect 2010-11-29.01 2010.11.29 Trojan-Spy/W32.Banker.245248.E
Panda 10.0.2.7 2010.11.28 Generic Trojan
PCTools 7.0.3.5 2010.11.29 Trojan-PSW.Bancos!rem
Prevx 3.0 2010.11.29 –
Rising 22.75.06.00 2010.11.29 Trojan.Win32.Generic.5246BBB6
Sophos 4.60.0 2010.11.29 Sus/ComPack-C
SUPERAntiSpyware 4.40.0.1006 2010.11.29 –
Symantec 20101.2.0.161 2010.11.29 Infostealer.Bancos
TheHacker 6.7.0.1.092 2010.11.28 W32/Behav-Heuristic-066
TrendMicro 9.120.0.1004 2010.11.29 TSPY_BANKER.TEJ
TrendMicro-HouseCall 9.120.0.1004 2010.11.29 TSPY_BANKER.TEJ
VBA32 3.12.14.2 2010.11.29 TrojanBanker.Banker.bciu
VIPRE 7443 2010.11.29 Trojan.Win32.Generic!BT
ViRobot 2010.11.29.4175 2010.11.29 Trojan.Win32.Banker.245248.A
VirusBuster 13.6.64.0 2010.11.28 Trojan.PWS.Banker!XUcDQJUdthA
Additional informationShow all 
MD5   : c30cd0761c9ae5bb8a417fe7efc7e314
SHA1  : fb823abff6528b6f0bb23deccdf50b5dbd4f74c7
SHA256: fb07a4b8bf52ab495bda0351cb85921bd69d080cf42449b7994b4118cc20c689
ssdeep: 3072:tiS5sLlTJXq5Jq+ZsLxloy88+PRh4O7sQe1Hz58hhCkpSijxKV8ylqSieT6aHRzH:sPXan
8roy884RuBSXC0bjoJf6kN
File size : 245248 bytes

y otra variante que es generada por el mismo :

File name: W01.EXE.Muestra EliStartPage v22.09
Submission date: 2010-11-29 12:28:01 (UTC)
Current status: finished
Result: 31 /43 (72.1%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.29.03 2010.11.29 Spyware/Win32.Suspicious
AntiVir 7.10.14.131 2010.11.29 TR/Agent.ckn
Antiy-AVL 2.0.3.7 2010.11.29 –
Avast 4.8.1351.0 2010.11.29 Win32:Spyware-gen
Avast5 5.0.594.0 2010.11.29 Win32:Spyware-gen
AVG 9.0.0.851 2010.11.28 PSW.Banker5.BQSZ
BitDefender 7.2 2010.11.29 Trojan.Generic.KDV.64973
CAT-QuickHeal 11.00 2010.11.29 Spyware.Keylogger (Not a Virus)
ClamAV 0.96.4.0 2010.11.29 PUA.Packed.TeLock
Command 5.2.11.5 2010.11.29 –
Comodo 6884 2010.11.29 UnclassifiedMalware
DrWeb 5.0.2.03300 2010.11.29 –
Emsisoft 5.0.0.50 2010.11.29 Trojan-PWS.Banker5!IK
eSafe 7.0.17.0 2010.11.29 Win32.Spy.Delf.Nzk
eTrust-Vet 36.1.8006 2010.11.29 –
F-Prot 4.6.2.117 2010.11.28 –
F-Secure 9.0.16160.0 2010.11.29 Trojan.Generic.KDV.64973
Fortinet 4.2.254.0 2010.11.29 W32/BQSZ.A!tr
GData 21 2010.11.29 Trojan.Generic.KDV.64973
Ikarus T3.1.1.90.0 2010.11.29 Trojan-PWS.Banker5
Jiangmin 13.0.900 2010.11.29 –
K7AntiVirus 9.69.3103 2010.11.27 Riskware
Kaspersky 7.0.0.125 2010.11.29 –
McAfee 5.400.0.1158 2010.11.29 Generic.dx!upz
McAfee-GW-Edition 2010.1C 2010.11.29 Heuristic.LooksLike.Win32.Suspicious.C
Microsoft 1.6402 2010.11.29 –
NOD32 5657 2010.11.29 a variant of Win32/Spy.Delf.NZK
Norman 6.06.10 2010.11.28 W32/Banker.FMZO
nProtect 2010-11-29.01 2010.11.29 Trojan.Generic.KDV.64973
Panda 10.0.2.7 2010.11.28 Generic Trojan
PCTools 7.0.3.5 2010.11.29 Spyware.Keylogger!rem
Prevx 3.0 2010.11.29 –
Rising 22.75.06.00 2010.11.29 –
Sophos 4.60.0 2010.11.29 Mal/Generic-L
SUPERAntiSpyware 4.40.0.1006 2010.11.29 –
Symantec 20101.2.0.161 2010.11.29 Spyware.Keylogger
TheHacker 6.7.0.1.092 2010.11.28 W32/Behav-Heuristic-066
TrendMicro 9.120.0.1004 2010.11.29 TSPY_BQSZ.A
TrendMicro-HouseCall 9.120.0.1004 2010.11.29 TSPY_BQSZ.A
VBA32 3.12.14.2 2010.11.29 Trojan.JBmini.x
VIPRE 7443 2010.11.29 Trojan.Win32.Generic!BT
ViRobot 2010.11.29.4175 2010.11.29 –
VirusBuster 13.6.64.0 2010.11.28 TrojanSpy.Delf!omPkgp7QPm4
Additional informationShow all 
MD5   : 498d89a9acf255b9bdaa2f6bfec2ebf3
SHA1  : 9e2d1d1d852e66ae6e1fd585c8beccdca292eaf6
File size : 249856 bytes

Ambos son controlados a partir de la versión 22.11 del ELISTARA de hoy

saludos

ms, 29-11-2010