New Variant of Shamoon Malware Uploaded to VirusTotal

guest · Dec 13, 2018

New Variant of Shamoon Malware Uploaded to VirusTotal
December 12, 2018
https://www.securityweek.com/new-variant-shamoon-malware-uploaded-virustotal

Also referred to as DistTrack, the sophisticated malware was initially observed in attacks against Saudi Arabian and other oil companies in 2012, when it destroyed data on over 30,000 systems.

Shamoon typically uses a set of hard-coded domain credentials specific to the target organization to steal credentials, but a malware variant uploaded to VirusTotal on Monday doesn’t contain the credentials necessary for distribution.

In a report shared with SecurityWeek, security researchers at Chronicle, one of Google's newest sister companies, say there’s no evidence that the new Shamoon variant is linked to a specific attack. Moreover, they aren’t sure who created the sample or who uploaded it to the online scanner.
The sample, however, closely matches historic versions of the malware, although it contains elements that set it apart from the previously observed variants.
Click to expand...

guest · Dec 14, 2018

Shamoon disk wiper attack on Saipem signals new affront against energy sector, Middle Eastern interests
December 13, 2018
https://www.scmagazine.com/home/sec...-against-energy-sector-middle-east-interests/

Saipem identified Shamoon as the culprit in a Dec. 12 news release that updated its previously vague disclosure of the incident.
These sample could very well be related to the Dec. 10 attack on Saipem, considering that two of them were uploaded to VirusTotal on the very same day from an IP address in Italy, where Saipem is headquartered.

These two samples, plus an additional related module were also uploaded on Dec. 11 from India, where Saipem has operations that were affected by the attack, Chronicle informed SC Media.
Click to expand...

guest · Dec 27, 2018

New Shamoon Sample from France Signed with Baidu Certificate
December 27, 2018
https://www.bleepingcomputer.com/ne...le-from-france-signed-with-baidu-certificate/

This new Shamoon variant was uploaded on December 23, 2018, and is signed with a digital certificate from Baidu, issued on March 25, 2015. The signature is no longer valid, as it expired on March 26, 2016.
Superficial obfuscation tactics
Malware analysts also found that the malware was packed using version 4 of the commercial packing tool Enigma Protector, which had its major release in March 2014; further iterations of the branch followed until February 2015. Enigma Protector is currently at revision 6.40.

Research from Anomali Labs shows more attempts to disguise the malware as legitimate software. For instance, adversary gave the internal file name "Baidu PC Faster," and uses "Baidu WiFi Hotspot Setup" in its description.
APT33 group likely involved
In a blog post last week, McAfee says that after analyzing three Shamoon samples seen this year they reached the conclusion that the attacker is likely the Iranian hacker group known in the infosec space as APT33, or a threat actor trying to look like APT33.
Click to expand...

Log in or Sign up

New Variant of Shamoon Malware Uploaded to VirusTotal

guest Guest

guest Guest

guest Guest

Log in or Sign up

New Variant of Shamoon Malware Uploaded to VirusTotal

guest Guest

guest Guest

guest Guest

Useful Searches