A disk wiping Shamoon malware performing destructive attack sample using an image of a burning US Dollar.
This malware was uploaded in virus total from France on December 23, 2018, and it signed with a digital certificate from Baidu.
Previous Attack destructive malware dubbed Shamoon V3 targeting European oil and gas company in the Middle East and Asia.
Shamoon destructive wiper using an image that burning American flag and the drowned Syrian refugee and child as part of targeted attacks.
It using powerful obfuscation technique utilizes the commercial packing tool Enigma version 4 .
“As observed in previous Shamoon samples the internal file name invokes a known PC tool, likely as a lure to allay initial user suspicion.”
In order to Shamoon malware look like an legitimate software, its distributed with the malicious file name as “Baidu PC Faster” and uses the description “Baidu WiFi Hotspot Setup” .
Detailed research reveals that its contain some similarities with
Shamoon V2 malware especially a resource called “GRANT” which is an indication of the malware complied based on the codebase that used by the second version.
Also, some of the other discovered sample timestamps show that it was created, 2011.
According to Anomali Labs, they are not confirmed that this sample has been used to target victims in the wild. However, historic Shamoon 2 attacks occurred in November 2016 and late January 2017. The possibility for targeted attacks occurring during western holidays exists.
This possibility is highlighted by the use of US currency in the political image that accompanies the destructive malware.
“Anomali Labs cannot confirm at this time that this sample has been created by the same actors responsible for the previous Shamoon attacks and is continuing its analysis on the malware. “
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…
Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated cybercriminals to achieve its strategic goals,…