Analysis by: Jennifer Gumban
ALIASES:

Trojan:Win32/KillDisk.M (Microsoft), Trojan.SystemKiller (Malwarebytes), Win32/KillDisk.NBD (ESET-NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This malware is related to the recent BlackEnergy targeted attacks that affected industries in Ukraine.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 98,304 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 01 Jan 2016
Payload: Terminates processes, Corrupts hard disk, Restarts system, Deletes files

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

  • .crt
  • .bin
  • .exe
  • .db
  • .dbf
  • .pdf
  • .djvu
  • .doc
  • .docx
  • .xls
  • .xlsx
  • .jar
  • .ppt
  • .pptx
  • .tib
  • .vhd
  • .iso
  • .lib
  • .mdb
  • .accdb
  • .sql
  • .mdf
  • .xml
  • .rtf
  • .ini
  • .cfg
  • .boot
  • .txt
  • .rar
  • .msi
  • .zip
  • .jpg
  • .bmp
  • .jpeg
  • .tiff

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

  • komut.exe
  • sec_service.exe

Other Details

This Trojan does the following:

  • Modify Account Control
  • Wipe Master Boot Record Data
  • Destroy the affected system by corrupting critical system files
  • Reboot the system

  SOLUTION

Minimum Scan Engine: 9.800
FIRST VSAPI PATTERN FILE: 12.246.02
FIRST VSAPI PATTERN DATE: 01 Jan 2016
VSAPI OPR PATTERN File: 12.247.00
VSAPI OPR PATTERN Date: 02 Jan 2016

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

NOTES:

Restore the system from backup or reinstalling the operating system.


Did this description help? Tell us how we did.