Wednesday, February 21, 2024

Self-Destructive KillDisk Malware Overwrites then Deletes files and Force a Reboot

A new variant of disk-wiping KillDisk malware affecting Windows machine attempts to overwrite and deletes files. Security researchers from TrendMicro detected it as TROJ_KILLDISK.IUB.

The new variant found targetting Financial organizations in Latin America does not include a ransom note as like Petya or WannaCry. Recovering the scrambled files in question because it wipes out the disk and doesn’t store the encryption keys on disk or online.

KillDisk malware used in various cyber attacks against energy sector, banking, rail, and mining industries. TrendMicro published an Initial analysis of this threat.

Also Read Critical Flaw in Popular BitTorrent Transmission Client Leads to an Attacker Perform Remote Hack into Your PC

How it enters and delete files

Its file path is hardcoded and could be dropped intentionally by the attacker or any other process.The new variant goes through all the logical drives mounted(fixed and removable). With system directory, it exempted following files from deletion.

Program Files
Program Files (x86)
Recovery (case-sensitive check)
System Volume Information

“Before a file is deleted, it is first randomly renamed. KillDisk will overwrite the first 0x2800 bytes of the file and another block that’s 0x2800-bytes big with 0x00”.


Disk Wiping

The malware attempts to wipe \\.\PhysicalDrive0 to \\.\PhysicalDrive4 and then it reads the information available with the Master Boot Record (MBR) and does further damage to the partitions.

“If the partition it finds is not an extended one, it overwrites the first 0x10 and last sectors of the actual volume. If it finds an extended partition, it will overwrite the Extended Boot Record (EBR) along with the two extra partitions it points to” TrendMicro said.

Forcing a Reboot – KillDisk

It consists of a numeric parameter which indicates the number of minutes(15 minutes) it will wait before shutting down the affected machine.

And it certainly can be done by tricking the user into restarting the machine or forcing a restart.It also uses the ExitWindowsEx function to forcefully restart the machine.

It will terminate the following process to restart the machine.

Client/server run-time subsystem (csrss.exe)
Windows Start-Up Application (wininit.exe)
Windows Logon Application (winlogon.exe)
Local Security Authority Subsystem Service (lsass.exe)

IOC- Hash (SHA-256):

  • 8a81a1d0fae933862b51f63064069aa5af3854763f5edc29c997964de5e284e5 — TROJ_KILLDISK.IUB

Latest articles

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....

Google Chrome 122 Update Addresses Critical Security Vulnerabilities

Google has recently unveiled Chrome 122, a significant milestone for the widely used web...

New Malicious PyPI Packages Use DLL Sideloading In A Supply Chain Attack

Researchers have discovered that threat actors have been using open-source platforms and codes for...

New Mingo Malware Attacking Linux Redis Servers To Mine Cryptocurrency

The malware, termed Migo by the creators, attempts to infiltrate Redis servers to mine cryptocurrency on...

Security Onion 2.4.50 Released for Defenders With New Features

Security Onion Solutions has recently rolled out the latest version of its network security...

VMware Urges to Remove Enhanced EAP Plugin to Stop Auth & Session Hijack Attacks

VMware has issued an urgent advisory to administrators to remove a deprecated authentication plugin...

LockBit Ransomware Members Charged by Authorities, Free Decryptor Released

In a significant blow to one of the most prolific ransomware operations, authorities from...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles