Unit 42 Shamoon3 2018

If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.

Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

Shamoon obtains the system time and will only activate if it is greater than a preset date.

Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.

Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.

Shamoon has an operational mode for encrypting data instead of overwriting it.

Shamoon will reboot the infected system once the wiping functionality has been completed.

Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.

Shamoon has been seen overwriting features of disk structure such as the MBR.