Security-X

Forum Security-X => News => Discussion démarrée par: SX-News le août 23, 2012, 21:41:14

Titre: [websense] Shamoon/DistTrack affecting energy sector
Posté par: SX-News le août 23, 2012, 21:41:14

Shamoon/DistTrack affecting energy sector

Description :  
<p class="p1"]Today news broke that at least one organization in the energy sector was hit by malware named Shamoon or DistTrack. We&rsquo;ve been looking at the related malware samples and can confirm that Websense products that have our Advanced Classification Engine (http://"http://www.websense.com/content/websense-advanced-classification-engine.aspx?cmpid=slblog" target="_blank") (ACE) have had proactive detection in place since <strong>13 December, 2010</strong>, more than 18 months prior to this attack.
<p class="p1"]&nbsp;
<p class="p1"]Once enabled, the malware is very aggressive and destructive, something that is rarely seen in attacks. Most attacks are designed to&nbsp;be persistent on a system for a long period of time. Shamoon/DistTrack does the opposite in that it overwrites files on the hard-drive, after which it overwrites the master boot record (MBR), rendering the computer un-bootable.
<p class="p1"]&nbsp;
<p class="p1"]The malware consists of three components:
<ul class="ul1"]
<li class="li2"]Dropper &ndash; This is the most essential component in that it installs the malware. It is also the file that ACE has been detecting.[/li][/list]
<li class="li2"]Wiper &ndash;&nbsp;This is the component that overwrites files and the MBR.[/li][/list]
<li class="li2"]Reporter &ndash; This module reports a list of found files to the C&amp;C.[/li]
[/list]
<p class="p1"]&nbsp;
<p class="p1"]As mentioned earlier, the Dropper has been detected since 13 December, 2010. Detection for the Wiper and Reporter components was added this morning.
<p class="p1"]&nbsp;
<p class="p1"]When the Dropper executes, it installs several files on the system, including a signed driver (not malicious) that is used to interact with the file system. We are not sure how the malware writers were able to sign the file using a 3rd party organization&rsquo;s certificate. Most likely it was stolen in a previous attack.
<p class="p1"]&nbsp;
<p class="p1"]<img alt="" border="0" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/5672.disttrack_5F00_driver_5F00_certificate.png" /> (http://"http://community.websense.com/cfs-file.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/5672.disttrack_5F00_driver_5F00_certificate.png")
<p class="p1"]&nbsp;
<p class="p1"]Here are some MD5s of samples involved in this attack:
<p class="p1"]&nbsp;
<p class="p1"]41f13811fa2d4c41b8002bfb2554a286
<p class="p1"]3b740cca401715985f3a0c28f851b60e
<p class="p1"]d214c717a357fe3a455610b197c390aa&nbsp;
<p class="p1"]b14299fd4d1cbfb4cc7486d978398214&nbsp;
&nbsp;
<p class="p1"]We're continuing to monitor the situation.
&nbsp;<div style="clear: both;"]</div>

Lien : http://community.websense.com/blogs/securitylabs/archive/2012/08/16/shamoon-disttrack-affecting-energy-sector.aspx