Trusted Design

From Shamoon to StoneDrill

概要

Beginning in November 2016, Kaspersky Lab observed a new wave of wiper attacks directed at multiple targets in the Middle East. The malware used in the new attacks was a variant of the infamous Shamoon worm that targeted Saudi Aramco and Rasgas back in 2012. Also known as Disttrack, Shamoon is a highly destructive malware family that effectively wipes the victim machine. A group known as the Cutting Sword of Justice took credit for the Saudi Aramco attack by posting a Pastebin message on the day of the attack (back in 2012), and justified the attack as a measure against the Saudi monarchy.

Created: 2026-02-23

Indicators

• FileHash-MD5 - 8e67f4c98754a2373a49eaf53425d79a -
• FileHash-MD5 - af053352fe1a02ba8010ec7524670ed9 -
• FileHash-MD5 - 940cee0d5985960b4ed265a859a7c169 -
• hostname - service1.chrome-up.date -
• hostname - www.securityupdated.com -
• FileHash-MD5 - c843046e54b755ec63ccb09d0a689674 -
• FileHash-MD5 - dc79867623b7929fd055d94456be8ba0 -
• FileHash-MD5 - 5446f46d89124462ae7aca4fce420423 -
• FileHash-MD5 - 7edd88dd4511a7d5bcb91f2ff177d29d -
• hostname - www.chrome-up.date -
• FileHash-MD5 - 38f3bed2635857dc385c5d569bbc88ac -
• YARA - 04ca83fa6c16b42b300f6140abb5133dbfd3fe66 -
• FileHash-MD5 - efab909e4d089b8f5a73e0b363f471c1 -
• FileHash-MD5 - 7772ce23c23f28596145656855fd02fc -
• hostname - www.eservic.com -
• FileHash-MD5 - 271554cff73c3843b9282951f2ea7509 -
• FileHash-MD5 - 8405aa3d86a22301ae62057d818b6b68 -
• FileHash-MD5 - d30cfa003ebfcd4d7c659a73a8dce11e -
• FileHash-MD5 - 9d40d04d64f26a30da893b7a30da04eb -
• FileHash-MD5 - 7f399a3362c4a33b5a58e94b8631a3d5 -
• FileHash-MD5 - 63443027d7b30ef0582778f1c11f36f3 -
• FileHash-MD5 - 8fbe990c2d493f58a2afa2b746e49c86 -
• FileHash-MD5 - aae531a922d9cca9ddca3d98be09f9df -
• FileHash-MD5 - 33a63f09e0962313285c0f0fb654ae11 -
• FileHash-MD5 - baa9862b027abd61b3e19941e40b1b2d -
• FileHash-MD5 - fb21f3cea1aa051ba2a45e75d46b98b8 -
• FileHash-MD5 - 41f8cd9ac3fb6b1771177e5770537518 -
• hostname - www.serveirc.com -
• FileHash-MD5 - 00c417425a73db5a315d23fac8cb353f -
• FileHash-MD5 - 6a7bff614a1c2fd2901a5bd1d878be59 -
• FileHash-MD5 - 548f6b23799f9265c01feefc6d86a5d3 -
• FileHash-MD5 - 2cd0a5f1e9bcce6807e57ec8477d222a -
• FileHash-MD5 - 6bebb161bc45080200a204f0a1d6fc08 -
• hostname - www.chromup.com -
• FileHash-MD5 - da3d900f8b090c705e8256e1193a18ec -
• hostname - service.chrome-up.date -
• FileHash-MD5 - ac3c25534c076623192b9381f926ba0d -
• FileHash-MD5 - ec010868e3e4c47239bf720738e058e3 -
• hostname - www.actdire.com -
• FileHash-MD5 - b4ddab362a20578dc6ca0bc8cc8ab986 -
• FileHash-MD5 - 8712cea8b5e3ce0073330fd425d34416 -
• FileHash-MD5 - 7946788b175e299415ad9059da03b1b2 -
• FileHash-MD5 - 0ccc9ec82f1d44c243329014b82d3125 -
• FileHash-MD5 - ac8636b6ad8f946e1d756cd4b1ed866d -

類似Pulses

• Shamoon is back (score: 0.81)
• Greenbug cyberespionage group targeting Middle East, possible links to Shamoon (score: 0.70)
• OilRig Campaign Attack on Saudi Arabia Deliver Helminth Backdoor (score: 0.62)
• Greenbugs DNS-isms (score: 0.61)
• Exploring Bergard: Old Malware with New Tricks (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る