Rombertik, a complex malware that also wipes hard drive to prevent analysis
Rombertik is the name of a high sophisticated strain of malware spotted by the researcher of the Cisco Talos Team, it wipes hard drive to prevent analysis.
Security experts have uncovered new strain of malware dubbed Rombertik malware that implements high sophisticated evasion detection technique and analysis, it also includes the ability to delete victimās hard drive data and making the computer unusable.
āThere is a new kid on the blockā and no one knows it, itās super secretive and takes measures to evade detection and analysis, and if needed will delete all the hard drive of the victim, and it is called Rombertik.ā
[adsense size='1']
Rombertik was discovered by the experts of the Cisco Talos Group, it is a very complex software that collects all the info about what the user is doing on the Web, with the aim of gathering login credentials and other sensitive data.
The attack chain is quite similar to the one of other malware, it is served via malicious emailsĀ as explained by the researchers.
Talos experts have reverse engineered the Rombertik agent and found out what the malware does, which includes multiple levels of obfuscation, anti-malware analysis, and as a last resort will self-destruct taking with it all the content of the hard drive.
Ā āOnce the unpacked version of Rombertik within the second copy of yfoye.exe begins executing, one last anti-analysis function is run ā which turns out to be particularly nasty if the check fails. The function computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. It first attempts to overwrite the Master Boot Record (MBR) of PhysicalDisk0, which renders the computer inoperable. If the malware does not have permissions to overwrite the MBR, it will instead destroy all files in the userās home folder (e.g. C:\Documents and Settings\Administrator\) by encrypting each file with a randomly generated RC4 key. After the MBR is overwritten, or the home folder has been encrypted, the computer is restarted.ā explained the Talos researchers Ben Baker and Alex Chiu.āThe Master Boot Record starts with code that is executed before the Operating System. The overwritten MBR contains code to print out āCarbon crack attempt, failedā, then enters an infinite loop preventing the system from continuing to boot.ā
The researchers verified that the MBR also contains data related the disk partition, this means that when the malware changes the MBR it will also set the bytes of the partition to Null making it difficult to a forensics expert to access data. When the PC is rebooted the victim will be stuck in the following screen.
āEffectively, Rombertik begins to behave like a wiper malware sample, trashing the userās computer if it detects itās being analyzed. While Talos has observed anti-analysis and anti-debugging techniques in malware samples in the past, Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis.ā
[adsense size='1']
This is for sure a complex malware, that will make the life of IT professionals even more difficult, but the best defense to prevent it is using good security practices, such as checking if the antivirus is up to date, not opening emails from people you donāt know, avoid checking or SPAM folder etc. etc., the normal advices that everyone should know.
The complete analysis published by the Talos Group is available here.
Security experts have uncovered new strain of malware dubbed Rombertik malware that implements high sophisticated evasion detection technique and analysis, it also includes the ability to delete victimās hard drive data and making the computer unusable.
āThere is a new kid on the blockā and no one knows it, itās super secretive and takes measures to evade detection and analysis, and if needed will delete all the hard drive of the victim, and it is called Rombertik.ā
[adsense size='1']
Rombertik was discovered by the experts of the Cisco Talos Group, it is a very complex software that collects all the info about what the user is doing on the Web, with the aim of gathering login credentials and other sensitive data.
The attack chain is quite similar to the one of other malware, it is served via malicious emailsĀ as explained by the researchers.
Talos experts have reverse engineered the Rombertik agent and found out what the malware does, which includes multiple levels of obfuscation, anti-malware analysis, and as a last resort will self-destruct taking with it all the content of the hard drive.
Ā āOnce the unpacked version of Rombertik within the second copy of
The researchers verified that the MBR also contains data related the disk partition, this means that when the malware changes the MBR it will also set the bytes of the partition to Null making it difficult to a forensics expert to access data. When the PC is rebooted the victim will be stuck in the following screen.
āEffectively, Rombertik begins to behave like a wiper malware sample, trashing the userās computer if it detects itās being analyzed. While Talos has observed anti-analysis and anti-debugging techniques in malware samples in the past, Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis.ā
[adsense size='1']
This is for sure a complex malware, that will make the life of IT professionals even more difficult, but the best defense to prevent it is using good security practices, such as checking if the antivirus is up to date, not opening emails from people you donāt know, avoid checking or SPAM folder etc. etc., the normal advices that everyone should know.
The complete analysis published by the Talos Group is available here
Gloss