MAIL MASIVO MALICIOSO QUE ANEXA FICHERO ZIP QUE CONTIENE UN FICHERO .JSE QUE INSTALA UN RANSOMWARE TIPO LOCKY

---

LLega un mail masivo conteniendo un e-mail de este tipo:







MAIL MASIVO MALICIOSO:

______________________





Asunto: Scan from a Samsung MFP

De: "CHRIS CARDNO" <chris.cardno.2518@edgerety.com>

Fecha: 08/12/2016 6:04

Para: <destinatario>





Regards



Chris



-----Original Message-----



Please open the attached document. It was scanned and sent to you using a

Samsung MFP. For more information on Samsung products and solutions, please

visit http://www.samsungprinter.com.





This message has been scanned for malware by Websense. http://www.websense.com



ANEXADO : Untitled_08122016_06848.zip (CONTIENE N636891163.jse descargador del Locky)







_________________

FIN MAIL MALICIOSO







El preanalisis de virustotal del fichero .jse , ofrece el siguiente informe:



MD5 ba95997dff727446ca4417033ccb9a0d

SHA1 fbaec4d0a82cb8fb894c4a95174eb96906637b06

File size 27.1 KB ( 27791 bytes )

SHA256: 6bfa6625eb0e4610cee62b0e046bf73b633476bbee0e4583b320fa4018e6a615

File name: N636891163.jse

Detection ratio: 31 / 52

Analysis date: 2016-12-09 13:44:00 UTC ( 4 minutes ago )

0

1



Antivirus Result Update

AVG JS/Downloader.Agent.65_I 20161209

AVware Trojan-Downloader.JS.Nemucod.bbp (v) 20161209

Ad-Aware Trojan.Ransom.Locky.BY 20161209

AegisLab Troj.Downloader.Script!c 20161209

Antiy-AVL Trojan/Generic.ASVCS3S.3E9 20161209

Arcabit Trojan.Ransom.Locky.BY 20161209

BitDefender Trojan.Ransom.Locky.BY 20161209

CAT-QuickHeal JS.Locky.JX 20161209

Cyren JS/Nemucod.CA2!Eldorado 20161209

DrWeb JS.DownLoader.2948 20161209

ESET-NOD32 JS/TrojanDownloader.Nemucod.BDA 20161209

Emsisoft Trojan.Ransom.Locky.BY (B) 20161209

F-Prot JS/Nemucod.CA2!Eldorado 20161209

F-Secure Trojan.Ransom.Locky.BY 20161209

Fortinet JS/Nemucod.BDA!tr.dldr 20161209

GData Trojan.Ransom.Locky.BY 20161209

Ikarus Win32.Outbreak 20161209

Kaspersky Trojan-Downloader.JS.Small.xq 20161209

McAfee JS/Nemucod.jg 20161209

McAfee-GW-Edition BehavesLike.JS.IFrame.mm 20161209

eScan Trojan.Ransom.Locky.BY 20161209

Microsoft TrojanDownloader:JS/Nemucod.AAW 20161209

NANO-Antivirus Trojan.Script.Heuristic-js.iacgm 20161209

Qihoo-360 virus.js.gen.1 20161209

Rising Trojan.DL.Nemucod!1.A702 (classic) 20161209

Sophos Troj/JsDldr-VJ 20161209

Symantec JS.Downloader.D 20161209

TrendMicro JS_NEMUCOD.SMK14 20161209

TrendMicro-HouseCall JS_NEMUCOD.SMK14 20161209

VIPRE Trojan-Downloader.JS.Nemucod.bbp (v) 20161209

ViRobot JS.Downloader.26253 20161209









Lo pasaremos a controlar a partir del próximo ELISTARA 35.78





saludos



ms, 9-12-2016