{"id":8212,"date":"2017-06-30T10:12:38","date_gmt":"2017-06-30T18:12:38","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/06\/30\/news-1987\/"},"modified":"2017-06-30T10:12:38","modified_gmt":"2017-06-30T18:12:38","slug":"news-1987","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/06\/30\/news-1987\/","title":{"rendered":"EternalPetya – yet another stolen piece in the package?"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Fri, 30 Jun 2017 16:53:36 +0000<\/strong><\/p>\n

Since\u00a0June 27th we have been\u00a0investigating the outbreak of the new Petya-like malware<\/a> armed with an infector similar to\u00a0WannaCry. Since day one, various contradicting theories started popping up. Some believed that this malware is a rip-off of the original Petya, while others think\u00a0that it is another step in Petya’s\u00a0evolution. However, those were just different opinions and none of them were\u00a0backed up with enough evidence to hold solid. In this post, we will try to fill this gap by making step-by-step comparisons of the current kernel and the one on which it is based (Goldeneye Petya<\/a>).<\/p>\n

Why is it important to know whether or not the code was recompiled?<\/h3>\n

Answering this question and collecting enough evidence is crucial for further discussions on attribution. The source code of the original Petya has never been leaked publicly, so in case it was recompiled\u00a0it proves that the original Petya’s author, Janus, is somehow linked to the current outbreak (either this is his work or he has sold the code to another actor).<\/p>\n

In this analysis, we hope to identify if this malware could have\u00a0been the work of anyone with the appropriate skills to modify the compiled binary or not. Doing so would not entirely disprove\u00a0Janus as the creator, but his involvement\u00a0becomes less likely.<\/p>\n

Anyways, let’s take a look at the code.<\/p>\n

Sectors<\/h3>\n

Looking at the sectors, we can find that the layout of EternalPetya is identical to Goldeneye. Full comparison:<\/p>\n

Petya kernel:<\/strong><\/p>\n