DistTrack, [ 1 ] is a modular computer virus that was discovered in , targeting then-recent bit NT kernel versions of Microsoft Windows. The virus was notable due to the destructive nature of the attack and the cost of recovery. Shamoon can spread from an infected machine to other computers on the network. Once a system is infected, the virus continues to compile a list of files from specific locations on the system, upload them to the attacker, and erase them. Finally the virus overwrites the master boot record of the infected computer, making it unusable.
Symantec , Kaspersky Lab , [ 10 ] and Seculert announced discovery of the malware on 16 August Shamoon was designed to erase and overwrite hard drive data with a corrupted image and report the addresses of infected computers back to the computer inside the company's network. The attack occurred during the month of Ramadan in It would appear that the attack was timed to occur after most staff had gone on holiday reducing the chance of discovery before maximum damage could be caused, hampering recovery.
The virus consisted of three components, the Dropper, the Wiper and the Reporter. The Dropper, the source of the infection, creates a service with the name 'NtsSrv' that enables it to remain persistent on the infected computer.
The Dropper was built in bit and bit versions. If the bit dropper detects a bit architecture , it drops the bit version. This component drops the Wiper and the Reporter onto the infected computer and executes itself.
It spreads across a local network by copying itself to network shares and on to other computers. It identifies the locations of all files on the infected computers and erases them. It sends information about the files destroyed to the attacker and then overwrites the erased files with corrupted data so they cannot be recovered. The component used portions of an image. In the attack it used an image of a burning U. The malware was unique, used to target the Saudi government by causing destruction to the state-owned national oil company Saudi Aramco.
