Shamoon Malware, cyber espionage tool, cyber weapon or …

Shamoon is a new threat that scares security experts, it can destroy files on a victim’s PC and overwrite the master boot record of its disks.

The cyberspace never rests: every time a malware or botnet is detected and neutralized, a new cyber threat arises. The latest to unsettle security experts is called Shamoon, a destructive agent capable of wiping files on the victim’s PC and overwriting the Master Boot Record.

Unlike the malware we’ve seen over recent months, which were mainly designed for espionage, Shamoon was explicitly developed to destroy data and render machines inoperable. It targets a wide range of Windows systems, including Windows 95, 98, XP, 2000, Vista, NT, ME, Windows 7, Windows Server 2003, and Windows Server 2008.

Some experts believe there is a connection between Shamoon and the earlier malware known as Wiper, although other researchers dispute this hypothesis.

The malware was first identified by Kaspersky Lab, which analyzed several samples and noted that one module included a string with the word “wiper.” This link suggests a possible relationship between the two threats.

However, this remains conjecture—some speculate that the “wiper” string may be a deliberate red herring. As one Kaspersky expert explained:

“Our opinion, based on researching several systems attacked by the original Wiper, is that it is not. The original “Wiper” was using certain service names (“RAHD…”) together with specific filenames for its drivers (“%temp%\~dxxx.tmp”) which do not appear to be present in this malware. Additionally, the original Wiper was using a certain pattern to wipe disks which again is not used by this malware,”

The researcher of Seculert who analyzed the malware have also discovered that it has also the ability to overwrite the machine’s MBR, what is interesting is that before Shamoon make unusable the PC it gathers data from the victim, it steals information, taking data from the ‘Users’, ‘Documents and Settings’, and ‘System32/Drivers’ and ‘System32/Config’ folders on Windows computers, and send them to another infected PC on the same internal network, the reason for this strange procedure is still a mystery.

Aviv Raff, Seculert CTO, declared:.

 “The attacker took control of an internal machine connected directly to the internet, and used that machine as a proxy to the external Command-and-Control (C2) server. Through the proxy, the attacker infected the other internal machines, which were probably not connected directly to the internet,”

Experts from cyber security firm Symantec wrote on their security response blog.

“Threats with such destructive payloads are unusual and are not typical of targeted attacks,” “Security response is continuing to analyze this threat and will post more information as it becomes available.”

Many hypotheses have been proposed, some experts are sure that Shamoon is a new state-sponsored malware for cyber espionage that is also able to destroy the victims maybe to hide its operations deleting every evidence that can link the clients to Command & Control servers, other researchers believe that we are facing with a true cyber weapon that has to be spread inside specific networks with the dual intent to gather information and destroy the enemy pcs.

Pierluigi Paganini

(Security Affairs – Shamoon, malware)