Author of EternalRocks SMB Worm Calls It Quits After Intense Media Coverage

itman · May 25, 2017

The developer of the EternalRocks SMB worm appears to have shut down his operation, following the intense media coverage his malware has received in the past seven days.

Overhyped news about "doomsday worm" made the dev quit

This intense focus, from both news media and cyber-security firms, appears to have had an impact on the author of the EternalRocks worm, a person going by the nickname of "tmc."

Sometimes on Wednesday, May 24, Stampar noticed that the EternalRocks C&C server — a web panel hosted on the Dark Web — featured a new message on its frontpage.

Forum Inside! Registration is Open!
Why so scary, I only firewall SMB port for you.
It's not ransomware

EternalRocks now delivers dummy executable

Earlier today, Stampar confirmed a change in the SMB worm's mode of operation.

The first versions of the EternalRocks worm discovered last week works via a two-stage installation process. During the second stage of this process, which usually takes place after a waiting period of around 24 hours, EternalRocks would download a file named shadowbrokers.zip, containing the seven NSA hacking tools.

According to the Croatian researcher, the EternalRocks worm now downloads a dummy executable that features the following source code:

// nohost.exe.Program
private.static void Main(String[] args)
{
}

Without downloading the shadowbrokers.zip file, this means computers recently infected by EternalRocks won't be able to spread to other hosts.

Machines previously infected with EternalRocks will continue to scan for new victims, but as those devices are scanned and EternalRocks infections removed, the worm's network of infected devices will slowly die off. Of course, unless tmc decides to make a comeback. We can never be sure of what will happen
Click to expand...

https://www.bleepingcomputer.com/ne...-calls-it-quits-after-intense-media-coverage/

guest · May 25, 2017

Too many Cyber-police agencies will be on his trails...he freaks out

Peter2150 · May 25, 2017

Well he proved one thing. He's smart.

guest · May 25, 2017

Peter2150 said: ↑

Well he proved one thing. He's smart.
Click to expand...

Indeed. he just saved his life.

Log in or Sign up

Author of EternalRocks SMB Worm Calls It Quits After Intense Media Coverage

itman Registered Member

guest Guest

Peter2150 Global Moderator

guest Guest

Log in or Sign up

Author of EternalRocks SMB Worm Calls It Quits After Intense Media Coverage

itman Registered Member

guest Guest

Peter2150 Global Moderator

guest Guest

Useful Searches