WORM: DistTrack Command and Control Traffic

This signature detects the Command and Control traffic for the DistTrack (aka "Shamoon") malware. The source IP host is infected and should be removed from the network for analysis. Like other malware, it steals information, taking data from the 'Users', 'Documents and Settings', and 'System32/Drivers' and 'System32/Config' folders on Windows computers. One unusual characteristic, however, is that it can overwrite the master boot record (MBR) on infected machines, effectively rendering them useless.

References

URL: http://www.zdnet.com/shamoon-malware-infects-computers-steals-data-then-wipes-them-7000002807/

Short Name

WORM:DISTTRACK-CNC

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: DistTrack Command and Control Traffic

References

Found a potential security threat?