{"id":6434,"date":"2017-01-30T12:44:35","date_gmt":"2017-01-30T20:44:35","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/30\/news-271\/"},"modified":"2017-01-30T12:44:35","modified_gmt":"2017-01-30T20:44:35","slug":"news-271","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/30\/news-271\/","title":{"rendered":"Saudi Organizations Targeted by Resurfaced Shamoon Disk-Wiping Malware"},"content":{"rendered":"
\n

FortiGuard is currently investigating a new wave of attacks targeting Kingdom of Saudi Arabia organizations that use an updated version of the Shamoon malware (also known as DistTrack.) We described this malware in detail a few months ago in a previous article<\/a>.<\/p>\n

The key features of that version remain the same, yet some voluntary changes are taking place:<\/p>\n

    \n
  1. Images used<\/strong>. Shamoon still overwrites files with an image of the drowned Syrian toddler Alan Kurdi, but this time the picture size is different. In November 2016 it was using a picture of 349×286 pixels. Now a larger image of 700×577 pixels is used. The headers of the images look different as well:<\/li>\n<\/ol>\n

    \"\" <\/em><\/p>\n

    Pic 1: The header of image file used in November 2016<\/em><\/p>\n

    \"\" <\/em><\/p>\n

    Pic 2: The header of image file used in January 2017.<\/em><\/p>\n

    Note: “Ducky” pattern is a legitimate string in Photoshop files.<\/p>\n

      \n
    1. Different compilation times<\/strong>. In November, attack samples contained a bogus compilation date of 2009-02-15. This time, two different dates are used. All new samples contain erroneous compilation dates of either 2011-06-06 or 2011-09-15.<\/li>\n<\/ol>\n

      \"\" <\/em><\/p>\n

      Pic 3: Bogus compilation timestamp used in January 2017.<\/em><\/p>\n

      The reasons why the criminals started to use different images and compilation times are currently unknown. One possible explanation is that there are several groups behind these attacks. A second possible scenario is that criminals want their samples to evade detection by popular antivirus applications.<\/p>\n

      3. Credentials.<\/strong> Shamoon tries to propagate itself with the use of static credentials hardcoded into the body of its code. In recent analyzed samples, we discovered several new default credentials from Huawei’s FusionCube virtualization products. Shamoon can now also target both physical and virtual machines.<\/p>\n

      \"\"<\/em><\/p>\n

      Pic 4: Part of hardcoded credentials used.<\/em><\/p>\n

      The biggest current mystery is how the developers initially obtained valid credentials that have been used in Shamoon attacks. FortiGuard will continue to investigate these attacks and provide updates as new information develops.<\/p>\n

      -= FortiGuard Lion Team =-<\/p>\n

       <\/p>\n

      Fortinet protections to date:<\/h3>\n

      Currently all found samples of DistTrack are detected by these AV signatures:<\/p>\n

      \n

      Generik.DTOJYVZ!tr<\/p>\n

      Generik.DUPYZDJ!tr<\/p>\n

      Generik.MIPWJAV!tr<\/p>\n

      W32\/Agent.AVCX!tr<\/p>\n

      W32\/DISTTRACK.C!tr<\/p>\n

      W32\/Generic!tr<\/p>\n

      W32\/Generic.A!tr<\/p>\n

      W32\/Generic.AC.3AD326!tr<\/p>\n

      W32\/Generic.AUMG!tr<\/p>\n

      W32\/Generic.BQYIIWO!tr<\/p>\n

      W32\/Generic.C!tr<\/p>\n

      W32\/Generic.SM!tr<\/p>\n

      W32\/Mdrop.ELD!tr<\/p>\n

      W64\/DistTrack.C!tr<\/p>\n

      W64\/DistTrack.D!tr<\/p>\n<\/blockquote>\n

      Application Control signature:         <\/p>\n

      \n

      DistTrack.Botnet<\/p>\n<\/blockquote>\n

      Indicators of Compromise:<\/strong><\/h3>\n

      Malicious Components:<\/p>\n

      \n

      010d4517c81bcdc438cb36fdf612274498d08db19bba174462ecbede7d9ce6bb<\/p>\n

      128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd<\/p>\n

      25a3497d69604baf4be4d80b6824c06f1b7120144f98eeb0a13d57d6f72eb8e9<\/p>\n

      394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b<\/p>\n

      448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237<\/p>\n

      47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34<\/p>\n

      4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400<\/p>\n

      5902a246ea00defd6371126b352bc3e13432cee18fef427f2ee40a6e0ba995eb<\/p>\n

      61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842<\/p>\n

      6e9a5681ed0e2683407e4bfcd05553207fa94a301cfc341de810b71be56bb700<\/p>\n

      7709da093dd9722e80c7c552a0935876b8d17ccf9ecc4784cffb1c1bc38dd9c0<\/p>\n

      7b589d45825c096d42bdf341193d3fd8fd9a0bd612a6ebd7466c26a753304df9<\/p>\n

      8829c244fbe049e0910571a16828cad2fb68e4ba7bfcf2f21d169484a676213b<\/p>\n

      8cccb478de2c92b548f9976799f1b4da1bd8d6f1c821e7b0479b914939560310<\/p>\n

      b30b4b73be304b773e04d8b2a46d1a1d43b4b3ec6c8c847b8ddc007dcc40d6e4<\/p>\n

      c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a<\/p>\n

      cd3d50629f0ed6b0ffeddd98b8cde57a6d00ec4b7f930f12ae7c0a980a9e9a00<\/p>\n

      cebdf768721473789ebe2fe79ffec7c6de0c52433b40fd02e57747f194fe0e80<\/p>\n

      dbdea08e7b970d395236b8e0aada6fc07fb23e6181485d86f65da1e73ab2ba2e<\/p>\n

      f9d94c5de86aa170384f1e2e71d95ec373536899cb7985633d3ecfdb67af0f72<\/p>\n<\/blockquote>\n

       <\/p>\n

      EldoS RawDisk Components:<\/p>\n

      \n

      4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6<\/p>\n

      5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a<\/p>\n<\/blockquote>\n

      Possible names of the malware in %SYSTEMROOT%<\/em>System32<\/em> folder:   <\/p>\n

      \n

      _mvscdsc.exe<\/p>\n

      _s3wcap32.exe<\/p>\n

      briaw002.exe<\/p>\n

      briaw004.exe<\/p>\n

      briaw005.exe<\/p>\n

      briaw006.exe<\/p>\n

      briaw007.exe<\/p>\n

      briaw008.exe<\/p>\n

      briaw009.exe<\/p>\n

      briaw00a.exe<\/p>\n

      caiaw00a.exe<\/p>\n

      caiaw00b.exe<\/p>\n

      caiaw00c.exe<\/p>\n

      caiaw00d.exe<\/p>\n

      caiaw00e.exe<\/p>\n

      caiaw00f.exe<\/p>\n

      caiaw00i.exe<\/p>\n

      cniaw001.exe<\/p>\n

      dmwa_usb.exe<\/p>\n

      dmwaudio.exe<\/p>\n

      epiaw002.exe<\/p>\n

      epiaw003.exe<\/p>\n

      fpwwlwf.exe<\/p>\n

      hdvmp32.exe<\/p>\n

      hpiaw001.exe<\/p>\n

      kyiaw002.exe<\/p>\n

      lwiawf.exe<\/p>\n

      lxiaw002.exe<\/p>\n

      lxiaw003.exe<\/p>\n

      lxiaw004.exe<\/p>\n

      lxiaw005.exe<\/p>\n

      lxiaw006.exe<\/p>\n

      miWApRpl.exe<\/p>\n

      newtvsc.exe<\/p>\n

      olvsnap.exe<\/p>\n

      olvume.exe<\/p>\n

      pdwcomp.exe<\/p>\n

      pdwfs24.exe<\/p>\n

      pdwmt.exe<\/p>\n

      pdwmtp.exe<\/p>\n

      pdwmtphw.exe<\/p>\n

      saiaw002.exe<\/p>\n

      sbuvideo.exe<\/p>\n

      sdwprint.exe<\/p>\n

      sdwscdrv.exe<\/p>\n

      smvraid.exe<\/p>\n

      usinwb2.exe<\/p>\n

      xxiaw002.exe<\/p>\n

       <\/p>\n<\/blockquote>\n<\/div
      https:\/\/blog.fortinet.com\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"


      FortiGuard is currently investigating a new wave of attacks targeting kingdom of Saudi Arabia organizations that use an updated version of the Shamoon malware (also known as DistTrack.) We described this malware in detail a few months ago in a previous article. The key features of that version remain the same, yet some voluntary changes are taking place: \tImages used. Shamoon still overwrites files with an image of the drowned Syrian toddler Alan Kurdi, but this time the picture size is different. In November 2016 it was using a picture…<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378],"tags":[],"class_list":["post-6434","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6434"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6434\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6434"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}