Sunday, February 9, 2025
HomeComputer SecurityShamoon Disk Wiping Malware Destructive attack via an Image of a Burning...

Shamoon Disk Wiping Malware Destructive attack via an Image of a Burning US Dollar

Published on

SIEM as a Service

Follow Us on Google News

A disk wiping Shamoon malware performing destructive attack sample using an image of a burning US Dollar.

This malware was uploaded in virus total from France on December 23, 2018, and it signed with a digital certificate from Baidu.

Previous Attack destructive malware dubbed Shamoon V3 targeting European oil and gas company in the Middle East and Asia.

Shamoon destructive wiper using an image that burning American flag and the drowned Syrian refugee and child as part of targeted attacks.

It using powerful obfuscation technique utilizes the commercial packing tool Enigma version 4 .

“As observed in previous Shamoon samples the internal file name invokes a known PC tool, likely as a lure to allay initial user suspicion.”

Shamoon Malware Distribution

In order to Shamoon malware look like an legitimate software, its distributed with the malicious file name as “Baidu PC Faster” and uses the description “Baidu WiFi Hotspot Setup” .

Detailed research reveals that its contain some similarities with
Shamoon V2 malware especially a resource called “GRANT” which is an indication of the malware complied based on the codebase that used by the second version.

Also, some of the other discovered sample timestamps show that it was created, 2011.

According to Anomali Labs, they are not confirmed that this sample has been used to target victims in the wild. However, historic Shamoon 2 attacks occurred in November 2016 and late January 2017. The possibility for targeted attacks occurring during western holidays exists.

This possibility is highlighted by the use of US currency in the political image that accompanies the destructive malware.

Anomali Labs cannot confirm at this time that this sample has been created by the same actors responsible for the previous Shamoon attacks and is continuing its analysis on the malware. “

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...