put.ex- genuine detection or packer flagged?

Viruses and worms
1

See: hxtps://www.virustotal.com/url/5307c64d60ae25f8ebfd72db3b4495dacb94fd4edad4746318f2e4403b55c27b/analysis/1337352519/
and htxp://vscan.urlvoid.com/analysis/306ee6aca88bd05fd8b4493838fe5a1f/cHV0LWV4ZQ==/
detected is TR/Crypt.XPACK.Gen - is this genuine malware or a false heuristical packer detection?
DrWeb’s online scan htxp://www.ozelgazihastanesi.com/puT.exe infected with Trojan.PWS.Panda.2260
Quttera detects as potentially suspicious: /wXw.ozelgazihastanesi.com/index.html error v*r hds[0] = 1; *=a (polonus)
info: [script] wXw.gazihastanesi.com.tr/stcode.js
info: [decodingLevel=1] found JavaScript
suspicious:
This detection is for new encryption ransomware,
reported to virus AT avast dot com,

polonus

2

Avast now flags it as win32:Malob-IF

thanks for reporting polonous

3

Hi true indian,

But here I cannot see any avast detection for puT.exe : htxps://www.virustotal.com/file/545cb208e45b5a27080d7cc5dc979a4eb32d272219a2e0c2deb77fabfd9239fb/analysis/1337352522/
Can you give me the scan URL where you found that good news? We want it checked, please?
ThreatExpert report: htxp://www.threatexpert.com/report.aspx?md5=04f8eb502f1cdf7e743450466032696c

polonus

4

Hi polonous this must have been a streaming update detection…When i went to the same URL i got avast warning on malob trojan

5

Jotti
http://virusscan.jotti.org/en/scanresult/6b37081e0ee52c93347673eaee78d36438b79b08

Metascan
http://metascan-online.com/results/5aoeadmsfw9gtpcpoda9a2ywgb38lv3z

Malwarebytes - Trojan.Zbot.Gen

Not detected by Superantispyware… uploaded to SAS lab