DistTrack is an overwriting malware rumored to be behind destructive actions in the Middle East. Some report it to be used in targeted attacks against companies in the energy sector.
The initial executable is a 32-bit Windows executable, 989184 bytes long.
When run, it installs itself as a service using the name TRKSVR.EXE in the Windows system folder. This service extracts and installs other components from within itself. These components are stored within the original dropper executable as encoded resources amed PKCS12, PKCS7 and X509.
Spreading
The main DistTrack module enumerates the local IP range looking for machines with open ADMIN$, C$, D$ and E$ shares, and attempts to copy itself there using a list of available executable names:
caclsrv.exe
certutl.exe
clean.exe
ctrl.exe
dfrag.exe
dnslookup.exe
dvdquery.exe
event.exe
findfile.exe
gpget.exe
ipsecure.exe
iissrv.exe
msinit.exe
ntfrsutil.exe
ntdsutl.exe
power.exe
rdsadmin.exe
regsys.exe
sigver.exe
routeman.exe
rrasrv.exe
sacses.exe
sfmsc.exe
smbinit.exe
wcscript.exe
ntnw.exe
netx.exe
fsutl.exe
extract.exe
Reporter module [resource PKCS7, hex encoded x17xd4xbax00]
The first component to be extracted is the module responsible for data collection. In our tests, this was the 32-bit component called %SYSTEM%NETINIT.EXE, filesize 133120 bytes.
The reporter module connects back to an apparent internal IP, and posts status information on this form:
http://%HOMEIP%/ajax_modal/modal/data.asp?mydata=_0&uid=%INFECTEDIP%&state=%timertickcount%
Wiper module [resource PKCS12, hex encoded x7Fx25xFBx5D]
After a brief initial period TRKSVR.EXE extracts a new executable, file size 194048 bytes. This can have the same variation of executable names as during spreading. See table above.
This module is responsible for performing the most destructive actions on the infected computer, as well as some data collection tasks.
Destructivity
The “wiper” module enumerates folders, and overwrites files found with garbage data. The garbage is a repetitive looping of a piece of a JPG image, 1024 bytes long, which looks like this:
Most of the image is missing, thus the large gray area. The fragment is actually taken from a public image of the burning of the US flag.
In addition it extracts a low-level disk driver from within itself. This is stored in a resource and encoded with a static four-byte value (hex x15xafx52xf0).
This driver is placed in the %DRIVERS% folder under the name drdisk.sys. It is apparently taken from an innocent application, and just used opportunistically to enable raw disk access. DistTrack uses raw disk access to destroy the Master Boot Record (MBR) on the hard drive, resulting in this chilling message on bootup:
64-bit version [resource X509, hex encoded x5CxC2x1AxBB]
This resource contains a 64-bit version of the entire malware, complete with a 64-bit version of the drdisk.sys disk driver.
Whodunnit
The following project name is visible in decrypted portions of the wiper module:
C:ShamoonArabianGulfwiperreleasewiper.pdb
The name brings associations to the infamous “wiper” malware supposed to have been wreaking havoc on Middle East computers in April. However, as far as we can tell, this is a more recent creation (all executables have apparent creation date August 9th, 2012.).
It is somewhat more likely that DistTrack was the malware involved in the recent attack on Aramco. There is no public confirmation on this, but there are circumstances that indicate a possible connection. First of all, there’s the timing, and the already known references to “targeted attacks on the energy sector”. The there’s the “Arabian Gulf” reference in the code.
In the Aramco case we saw two differently named groups apparently claiming responsibility for the attacks:
“The Cutting Sword of Justice”: http://pastebin.com/HqAgaQRj
“Arab Youth Group“: http://pastebin.com/PUHqDQnd
Later, other pastebins seem to confirm the DistTrack connection with the Aramco attack, also detailing the IP ranges and machines affected:
http://pastebin.com/tztnRLQG
http://pastebin.com/cTJeeTat
HOWEVER: Pastebin dumps like these should always be taken for what they are – unconfirmed texts anybody could write. They can’t be relied on in any way, and can only be useful when backed up by other data. We still consider the DistTrack-Aramco connection unconfirmed.
Norman Shark is detecting this malware as W32/DistTrack.A.
