DistTrackMalware
- Shamoon
Shamoon is wiper malware that was first used by an Iranian group known as the "Cutting Sword of Justice" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. Shamoon has also been seen leveraging RawDisk and Filerase to carry out data wiping tasks. Analysis has linked Shamoon with Kwampirs based on multiple shared artifacts and coding patterns.From MITRE ATT&CK
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“Potential Credential Access via LSASS Memory Dump”
- T1053.005Scheduled Task
“Scheduled Task Execution”
- T1553.002Code Signing
“has revoked the code-signing certificate.”
- T1570Lateral Tool Transfer
“Lateral Tool Transfer (staging PE via file shares for remote execution)”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER“…ser mode component is quite similar to the driver that belongs to Eldos Rawdisk and has been leveraged previously by threat actors like Shamoon and Lazarus.”
Indicators in its reports
named in the reports above- 1bc44eef75779e3c…f6928d292591in 1 report
- 0385eeab00e946a3…450f5ece21dain 1 report
- 3c557727953a8f6b…dd02615b1767in 1 report
- 2c10b2ec0b995b88…6ecf53adf5bfin 1 report
- hxxps://opencorporates[.]com/companies/cy/HE419469in 1 report
- opencorporates[.]comin 1 report
- hxxps://www.easeus[.]com/partition-managerin 1 report
- www.easeus[.]comin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.