NUEVAS VARIANTE DE RANSOMWARE LOCKY QUE PASAMOS A CONTROLAR CON ELISTARA

---

A partir del ELISTARA 34.48 de hoy pasamos a controlar estas nuevas 5 variantes de LOCKY, cuyos hashes SHA1 son:





"D63650DD88485C5933CFD8CBF09128A27ED3442F" -> k4isfa.exe 167936

"FEAE65047D59E31BF562E12A198ABE2F009359F5" -> mys3ks.exe 179712

"0FA5D95C41B98CF9084525AD156C88C04D5E7095" -> e7urj.exe 218112

"736E336ACC017DAB31663BF099650810C2AC44A8" -> b6sida.exe 180224

"0E566E01FCACDB638B83E9D302CBC01F7E5989CA" -> 89yg7g87byi.exe 320719





El preanalisis de virustotal del último de ellos, ofrece el siguiente informe:







MD5 b81868c62aff2cce264471e18f773175

SHA1 0e566e01fcacdb638b83e9d302cbc01f7e5989ca

SHA256 ed8390885a6bcdda11cb51f8d3c2553625d1c567f221a490450f44d2ac3cec3a

ssdeep6144:7hEfcrpm3fc/jiTmmwatkbtBsoeGy0omcOTnRkonooN+MYqwo:7hkcrpef4smm2BsZGyo/nR5mzI

authentihash 750ce7d5293846c3829969cce778167a778b6019ac7824a2e8b2f8d555f3d9b0

imphash aa1af471ea4a3f46955de63cec15a5c2

File size 313.2 KB ( 320719 bytes )

SHA256: ed8390885a6bcdda11cb51f8d3c2553625d1c567f221a490450f44d2ac3cec3a

File name: 89yg7g87byi.txt.2588.dr

Detection ratio: 21 / 57

Analysis date: 2016-05-04 10:14:04 UTC ( 13 minutes ago )

0 8



Antivirus Result Update

ALYac Trojan.Ransom.LockyCrypt 20160504

Ad-Aware Trojan.GenericKD.3202585 20160504

Antiy-AVL Trojan/Generic.ASMalwS.184F190 20160504

Arcabit Trojan.Generic.D30DE19 20160504

Avira (no cloud) TR/AD.Locky.Y.fcoe 20160504

Baidu Win32.Trojan.WisdomEyes.151026.9950.9999 20160504

BitDefender Trojan.GenericKD.3202585 20160504

ESET-NOD32 Win32/Filecoder.Locky.B 20160504

F-Secure Trojan.GenericKD.3202585 20160504

Fortinet W32/Injector.CXSS!tr 20160504

GData Trojan.GenericKD.3202585 20160504

Ikarus Trojan.Win32.Filecoder 20160504

Kaspersky Trojan.Win32.Inject.wgpg 20160504

McAfee Artemis!B81868C62AFF 20160504

McAfee-GW-Edition BehavesLike.Win32.PWSZbot.fc 20160503

eScan Trojan.GenericKD.3202585 20160504

Panda Trj/Locky.A 20160503

Qihoo-360 HEUR/QVM10.1.Malware.Gen 20160504

Rising Trojan.Inject!8.103-6TzFQWLCfqN (Cloud) 20160504

Symantec Trojan.Cryptolocker.AF 20160504

Tencent Win32.Trojan.Inject.Auto 20160504





Dicha versión del ELISTARA 34.48 que lo detecta y elimina, estará disponible en nuestra web a partir de las 18 h CEST de hoy





saludos



ms, 4-5-2016