Pierluigi Paganini
May 05, 2015
Security experts have uncovered new strain of malware dubbed Rombertik malware that implements high sophisticated evasion detection technique and analysis, it also includes the ability to delete victim’s hard drive data and making the computer unusable.
“There is a new kid on the block” and no one knows it, it’s super secretive and takes measures to evade detection and analysis, and if needed will delete all the hard drive of the victim, and it is called Rombertik.”
Rombertik was discovered by the experts of the Cisco Talos Group, it is a very complex software that collects all the info about what the user is doing on the Web, with the aim of gathering login credentials and other sensitive data.
The attack chain is quite similar to the one of other malware, it is served via malicious emails as explained by the researchers.
Talos experts have reverse engineered the Rombertik agent and found out what the malware does, which includes multiple levels of obfuscation, anti-malware analysis, and as a last resort will self-destruct taking with it all the content of the hard drive.
“Once the unpacked version of Rombertik within the second copy of yfoye.exe begins executing, one last anti-analysis function is run — which turns out to be particularly nasty if the check fails. The function computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. It first attempts to overwrite the Master Boot Record (MBR) of PhysicalDisk0, which renders the computer inoperable. If the malware does not have permissions to overwrite the MBR, it will instead destroy all files in the user’s home folder (e.g. C:\Documents and Settings\Administrator\) by encrypting each file with a randomly generated RC4 key. After the MBR is overwritten, or the home folder has been encrypted, the computer is restarted.” explained the Talos researchers Ben Baker and Alex Chiu.“The Master Boot Record starts with code that is executed before the Operating System. The overwritten MBR contains code to print out “Carbon crack attempt, failed”, then enters an infinite loop preventing the system from continuing to boot.”
The researchers verified that the MBR also contains data related the disk partition, this means that when the malware changes the MBR it will also set the bytes of the partition to Null making it difficult to a forensics expert to access data. When the PC is rebooted the victim will be stuck in the following screen.
“Effectively, Rombertik begins to behave like a wiper malware sample, trashing the user’s computer if it detects it’s being analyzed. While Talos has observed anti-analysis and anti-debugging techniques in malware samples in the past, Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis.”
This is for sure a complex malware, that will make the life of IT professionals even more difficult, but the best defense to prevent it is using good security practices, such as checking if the antivirus is up to date, not opening emails from people you don’t know, avoid checking or SPAM folder etc. etc., the normal advices that everyone should know.
The complete analysis published by the Talos Group is available here.
About the Author Elsio Pinto
Edited by Pierluigi Paganini
(Security Affairs – Rombertik , malware)
