{"id":3226,"date":"2022-01-17T18:01:24","date_gmt":"2022-01-17T18:01:24","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/17\/ukraine-blames-belarus-for-pc-wiping-malware-attack-the-register\/"},"modified":"2022-01-17T18:01:24","modified_gmt":"2022-01-17T18:01:24","slug":"ukraine-blames-belarus-for-pc-wiping-malware-attack-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/17\/ukraine-blames-belarus-for-pc-wiping-malware-attack-the-register\/","title":{"rendered":"Ukraine blames Belarus for PC-wiping malware attack \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

After last week’s website defacements, Ukraine is now being targeted by boot record-wiping malware that looks like ransomware but with one crucial difference: there’s no recovery method. Officials have pointed the finger at Belarus.<\/p>\n

\"Church<\/a><\/p>\n

Fountain at Independence Square in Minsk, Belarus<\/p>\n<\/div>\n

Targets of this new malware wave “span multiple government, non-profit, and information technology organizations,” according to a Microsoft warning issued<\/a> over the weekend.<\/p>\n

The malware itself wipes the target Windows system’s master boot record, rendering it inoperable, and its main executable is “often” named stage1.exe, executed by Impacket<\/a>.<\/p>\n

The wiper’s second stage, stage2.exe, then rampages through the rest of your system, overwriting everything from Word files to web pages (.HTML and .PHP files), images and databases. It searches for a large list of file extensions and overwrites the file’s contents “with a fixed number of 0xCC bytes” totalling 1MB.<\/p>\n

Redmond’s Threat Intelligence Centre (MSTIC), part of its wider infosec operation, said the wiper was designed to look like ransomware and even drops a ransom note with a Bitcoin wallet address, urging victims to send $10k to it. On top of that, the ransom note also lists a Tox instant messaging address.<\/p>\n

\n