A disk wiping Shamoon malware performing destructive attack sample using an image of a burning US Dollar.
This malware was uploaded in virus total from France on December 23, 2018, and it signed with a digital certificate from Baidu.
Previous Attack destructive malware dubbed Shamoon V3 targeting European oil and gas company in the Middle East and Asia.
Shamoon destructive wiper using an image that burning American flag and the drowned Syrian refugee and child as part of targeted attacks.
It using powerful obfuscation technique utilizes the commercial packing tool Enigma version 4 .
“As observed in previous Shamoon samples the internal file name invokes a known PC tool, likely as a lure to allay initial user suspicion.”
In order to Shamoon malware look like an legitimate software, its distributed with the malicious file name as “Baidu PC Faster” and uses the description “Baidu WiFi Hotspot Setup” .
Detailed research reveals that its contain some similarities with
Shamoon V2 malware especially a resource called “GRANT” which is an indication of the malware complied based on the codebase that used by the second version.
Also, some of the other discovered sample timestamps show that it was created, 2011.
According to Anomali Labs, they are not confirmed that this sample has been used to target victims in the wild. However, historic Shamoon 2 attacks occurred in November 2016 and late January 2017. The possibility for targeted attacks occurring during western holidays exists.
This possibility is highlighted by the use of US currency in the political image that accompanies the destructive malware.
“Anomali Labs cannot confirm at this time that this sample has been created by the same actors responsible for the previous Shamoon attacks and is continuing its analysis on the malware. “
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
In the ever-evolving cybersecurity landscape, Google is continually striving to protect user data from malicious actors. In a recent blog…
In a startling revelation, nearly 20% of Docker Hub repositories have been identified as conduits for malware and phishing scams,…
Kubernetes (K8s) is an open-source container orchestration platform designed to automate application container deployment, scaling, and running. Containers are isolated…
Microsoft's Azure platform is a highly acclaimed and widely recognized solution that organizations worldwide are leveraging. It is regarded as…
The first instance of Redline using such a method is in a new variant of Redline Stealer malware that McAfee…
A threat actor reportedly sells a database containing 49 million user records from Dell, one of the world's leading technology…