Shamoon/DistTrack affecting energy sectorDescription :
<p class="p1"]Today news broke that at least one organization in the energy sector was hit by malware named Shamoon or DistTrack. We’ve been looking at the related malware samples and can confirm that Websense products that have our
Advanced Classification Engine (ACE) have had proactive detection in place since <strong>13 December, 2010</strong>, more than 18 months prior to this attack.
<p class="p1"]
<p class="p1"]Once enabled, the malware is very aggressive and destructive, something that is rarely seen in attacks. Most attacks are designed to be persistent on a system for a long period of time. Shamoon/DistTrack does the opposite in that it overwrites files on the hard-drive, after which it overwrites the master boot record (MBR), rendering the computer un-bootable.
<p class="p1"]
<p class="p1"]The malware consists of three components:
<ul class="ul1"]
<li class="li2"]Dropper – This is the most essential component in that it installs the malware. It is also the file that ACE has been detecting.[/li][/list]
<li class="li2"]Wiper – This is the component that overwrites files and the MBR.[/li][/list]
<li class="li2"]Reporter – This module reports a list of found files to the C&C.[/li]
[/list]
<p class="p1"]
<p class="p1"]As mentioned earlier, the Dropper has been detected since 13 December, 2010. Detection for the Wiper and Reporter components was added this morning.
<p class="p1"]
<p class="p1"]When the Dropper executes, it installs several files on the system, including a signed driver (not malicious) that is used to interact with the file system. We are not sure how the malware writers were able to sign the file using a 3rd party organization’s certificate. Most likely it was stolen in a previous attack.
<p class="p1"]
<p class="p1"]
<img alt="" border="0" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/5672.disttrack_5F00_driver_5F00_certificate.png" /><p class="p1"]
<p class="p1"]Here are some MD5s of samples involved in this attack:
<p class="p1"]
<p class="p1"]41f13811fa2d4c41b8002bfb2554a286
<p class="p1"]3b740cca401715985f3a0c28f851b60e
<p class="p1"]d214c717a357fe3a455610b197c390aa
<p class="p1"]b14299fd4d1cbfb4cc7486d978398214
<p class="p1"]We're continuing to monitor the situation.
<div style="clear: both;"]</div>
Lien : http://community.websense.com/blogs/securitylabs/archive/2012/08/16/shamoon-disttrack-affecting-energy-sector.aspx
