NUEVA VARIANTE DE RANSOMWARE MOLE

---

Anexado a un mail llega este ransomware que se presenta con el siguiente texto:

___________

INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT



" All your important files were encrypted on this computer.

You can verify this by click on see files an try open them.

Encryption was produced using unique public key RSA-1024 generated for this computer.

To decrypted files, you need to obtain private key.

The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet.

The server will destroy the key within 78 hours after encryption completed.

To retrieve the private key, you need to Contact us by email , send us an email your DECRYPT-ID-40c22288-8cee-42c5-abcd-d70445c0b91e number

and wait for further instructions.

For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form.

Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!

E-MAILS ADRESS:

AugustSteen@writeme.com

auguststeen@india.com"



__________



Características principales:



- NO queda residente. (es de accion directa)

- Codifica ficheros cambiandoles el nombre (respetanto %WinDir%), dejando los ficheros cifrados como ******.MOLE donde ****** es un nº hexadecimal de 32 cifras.



El preanalisis de virustotal ofrece el siguiente informe:



MD5 5eb8dd9a1e631ce98c64746e38599624

SHA1 bbb799beedff9bbfc568afe4bd20c6ceba0336d1

Tamaño del fichero 107.0 KB ( 109568 bytes )

SHA256:

71b688b3386ca6317b1c347f9069c1ed2f1f3c880d1c2bbd1934272bb2e35f9d

Nombre:

5eb8dd9a.exe

Detecciones:

15 / 56

Fecha de análisis:

2017-04-25 09:49:13 UTC ( hace 5 minutos )



El informe actual del virustotal es el siguiente:



A partir del ELISTARA 36.70 controlamos esta nueva variante, eliminando el malware, si bien queda "tonta" la clave de registro, que llamará a un fichero ya eliminado, con lo que ya será inútil.



Dicha versión del ELISTARA 36.70 que lo detecta y elimina, estará disponible en nuestra web a partir del 26-4 prox.



saludos



ms, 25-4-2017