WORM: DistTrack Malware Known Malicious User Agent

This signature detects a known malicious user agent of DistTrack (aka "Shamoon") malware. Like other malware, it steals information, taking data from the 'Users', 'Documents and Settings', and 'System32/Drivers' and 'System32/Config' folders on Windows computers. One unusual characteristic, however, is that it can overwrite the master boot record (MBR) on infected machines, effectively rendering them useless.

References

URL: http://www.zdnet.com/shamoon-malware-infects-computers-steals-data-then-wipes-them-7000002807/

Short Name

WORM:DISTTRACK-USER-AGENT

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: DistTrack Malware Known Malicious User Agent

References

Found a potential security threat?