Slashdot Mirror

← Back to Stories (view on slashdot.org)

FBI: Wiper Malware Has Korean Language Packs, Hard Coded Targets

Posted by Soulskill on from the brace-for-cyber-impact dept.

chicksdaddy sends news that the FBI has issued a warning to U.S. businesses over a "destructive" malware campaign using advanced tools. They don't name specific targets, but the information fits with the details from last week's attack on Sony Pictures, which led to the leak of several unreleased movies. A copy of the FBI's recent five-page FLASH alert reveals that the malware alleged to have wiped out systems at Sony Pictures Entertainment deployed a number of malicious modules, including a version of a commercial disk wiping tool on target systems. Samples of the malware obtained by the FBI were also found to contain configuration files created on systems configured with Korean language packs. The use of Korean could strengthen theories that the destructive cyber attacks have links to North Korea, though it is hardly conclusive. It does appear that the attack was targeted at a specific organization. The malware analyzed by the FBI contained a hard coded list of IP addresses and computer host names.

4 of 81 comments (clear)

  1. As a malware analyst... by xxxJonBoyxxx · · Score: 1, Informative

    >> The use of Korean could strengthen theories that the destructive cyber attacks have links to North Korea

    Are you f***ing kidding me? It's just as likely that it was written by an English-speaking American using a pirated copy of Windows he got from a SOUTH Korean warez site.

  2. Malware? Sony? by TechyImmigrant · · Score: 5, Informative

    Is the irony of Sony being hit by malware lost on people?

    http://en.wikipedia.org/wiki/S...

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  3. Re:And it was signed Kim Jong Un by DougOtto · · Score: 5, Informative

    The analysis doesn't blame Korea or anyone else, it's the media taking that route. The analysis just lists the file targets and the information you'd want to see if you have a match; e.g.

    File: igfxtrayex.exe
    Size: 249856 bytes (244.0 KB)
    MD5: 760c35a80d758f032d02cf4db12d3e55
    PE Compile Time: 2014-11-24 04:11:08
    Language pack of resource section: Korean
    It seems sans-bullshit to me.

    --
    Solving Unix problems since 1989...
  4. Ha, NORTH Korea? by Anonymous Coward · · Score: 2, Informative

    They have threatened repercussions if Sony releases "The Interview." https://en.wikipedia.org/wiki/The_Interview_(2014_film)