Recibimos diferentes mails que anexan fichero ZIP que descarga un SCR infectado con CTBLOCKERR

---

Recibimos diferentes mails con diferentes ficheros anexados, que resumimos con el mail tipico y los preanalisis del virustotal:







MAIL MALICIOSO TIPICO RECIBIDO POR VARIOS USUARIOS:



___________



Asunto: Your account #23917673354 has been blocked

De: "Terri Clampitt" <culmiferous@misnetwork.com>

Fecha: 27/04/2015 15:56

Para: <DESTINATARIO>



Your account #23917673354 was blocked for violation of our TOS.

Please see attached.







Anexo : fichero malicioso



____________





Los preanalisis de virustotal son los siguientes:





MD5 05d9372baf43fabccb22179314ed530e

SHA1 70821a23bba9cf7f161eef6d6237fa9fe8723175

File size 108.0 KB ( 110592 bytes )

SHA256: 7c584760b7349629df6e994dc81e925f87c8adff395ca85136eebcbaf71a9b33

File name: 72588799776.scr

Detection ratio: 5 / 54

Analysis date: 2015-04-27 14:43:10 UTC ( 11 minutes ago )



0 1





Antivirus Result Update

AVG Luhe.Fiha.A 20150427

ESET-NOD32 a variant of Win32/Kryptik.DGLV 20150427

Kaspersky UDS:DangerousObject.Multi.Generic 20150427

Norman Heur.I 20150427

Tencent Trojan.Win32.Qudamah.Gen.2 20150427







_________







OTRA VARIANTE DE CTBLOCKER:



MD5 66edf67332b24f3fa7ae26e7e3d53747

SHA1 922d609869aedec6badbc87bc0c11af01532a8cb

File size 108.0 KB ( 110592 bytes )

SHA256: 13246fe244b58317273c090c740e23118cfc9c9ac2733e92dcbf000559edd735

File name: 282850295223.scr

Detection ratio: 5 / 55

Analysis date: 2015-04-27 15:01:01 UTC ( 3 minutes ago )



0 1



Antivirus Result Update

AVG Luhe.Fiha.A 20150427

ESET-NOD32 a variant of Win32/Kryptik.DGLV 20150427

Kaspersky UDS:DangerousObject.Multi.Generic 20150427

Norman Heur.I 20150427

Tencent Trojan.Win32.Qudamah.Gen.2 20150427





__________





otra variante del ctblocker





MD5 571399ccd9206a26b8e3dc7d8a820df7

SHA1 aeb3f1bb3f2438fd44f02d468d7b29e2743c8e4e

File size 96.0 KB ( 98304 bytes )

SHA256: dbb284eeb4d1f3207e63dd6ae180a2d3a9ba29398c19d7dad8ff9f18acbc8239

File name: 712064227449.scr

Detection ratio: 6 / 54

Analysis date: 2015-04-27 15:07:23 UTC ( 3 minutes ago )



0 1



Antivirus Result Update

AVG Luhe.Fiha.A 20150427

AhnLab-V3 Win-Trojan/CTBLocker.Gen 20150427

ESET-NOD32 a variant of Win32/Kryptik.DGLV 20150427

Kaspersky UDS:DangerousObject.Multi.Generic 20150427

Norman Heur.I 20150427

Tencent Trojan.Win32.Qudamah.Gen.2 20150427





___________





MAS VARIANTES DEL CTBLOCKER



MD5 d3a7c3c500c62950a88e8ca3d83c2994

SHA1 12b3278815284e6c4376005bb2de68cc1101357a

File size 92.0 KB ( 94208 bytes )



SHA256: 50c7ee5e584038d51deaaf1c35864e43763aaa4ec66d8e36752c4fba0e263f51

File name: d3a7c3c500c62950a88e8ca3d83c2994

Detection ratio: 6 / 57

Analysis date: 2015-04-27 14:36:10 UTC ( 38 minutes ago )



0 1





Antivirus Result Update

AVG Luhe.Fiha.A 20150427

AhnLab-V3 Win-Trojan/CTBLocker.Gen 20150427

ESET-NOD32 a variant of Win32/Kryptik.DGLV 20150427

Kaspersky UDS:DangerousObject.Multi.Generic 20150427

Norman Heur.I 20150427

Tencent Trojan.Win32.Qudamah.Gen.2 20150427





___________







Todas ellas pasan a ser detectadas y eliminadas con el ELISTARA 32.17 que estará disponible en nuestra web a partir de las 19 h CEST de hoy.





saludos



ms, 27-4-2015