Abacwaningi bezokuphepha be-IBM basanda kumemezela ukutholakala komndeni omusha we-malware obizwa ngokuthi "i-ZeroClear ," owadalwa yiqembu lase-Iran eliqamba amanga i-APT34 ngokubambisana ne-xHunt . Le malware ihlose imikhakha yezimboni kanye namandla eMpumalanga Ephakathi. Abacwaningi abazange badalule amagama ezinkampani ezihlukunyeziwe kodwa bashicilele umbiko onemininingwane wamakhasi angu-28 ohlaziya i-malware .
I-ZeroClear ithinta i-Windows kuphela ngoba, njengoba igama layo lichaza, indlela yedathabheyisi yohlelo (i-PDB) yefayela layo eliyi-binary isetshenziselwa ukwenza ukuhlasela okubhubhisayo okubhala ngaphezulu irekhodi eliyinhloko lokuqalisa (i-MBR) kanye nokwahlukaniswa emishinini ye-Windows eyonakele.
I-ZeroClear ihlukaniswe njenge-malware enokuziphatha okufana kancane nokwe-“Shamoon” (i-malware eyayixoxwa kabanzi ngoba yayisetshenziselwa ukuhlaselwa kwezinkampani zikawoyela kusukela ngo-2012). Nakuba i-Shamoon ne-ZeroClear zinamakhono nokuziphatha okufanayo, abacwaningi bathi lokhu kokubili kuyizingxenye ezihlukene nezihlukile ze-malware.
Njenge-malware ye-Shamoon, i-ZeroClear isebenzisa nesilawuli se-hard drive esisemthethweni esibizwa ngokuthi “i-RawDisk by ElDos” ukuze ibhale kabusha i-master boot record (MBR) kanye nezingxenye zediski zamakhompyutha aqondiwe asebenzisa i-Windows.
Nakuba umshayeli we -ElDos engasayiniwe, i-malware iyakwazi ukuyisebenzisa ngokulayisha umshayeli we-VirtualBox osengozini kodwa ongasayiniwe , iwusebenzise ukuze idlule indlela yokuqinisekisa isiginesha bese ilayisha umshayeli we-ElDos ongasayiniwe.
Le malware isetshenziswa ngokuhlasela okunamandla ukuze ifinyelele ezinhlelweni zenethiwekhi ezingavikelekile kahle. Uma abahlaseli sebethelele idivayisi eqondiwe, basakaza i-malware kunethiwekhi yenkampani njengesinyathelo sokugcina enkambisweni yokutheleleka.
“I-ZeroCleare cleaner iyingxenye yesigaba sokugcina sokuhlasela konke. Idizayinelwe ukusebenzisa amafomu amabili ahlukene, aguqulelwe kumasistimu angama-32-bit no-64-bit.
Ukuhamba okujwayelekile kwemicimbi emishinini engama-64-bit kufaka ukusebenzisa umshayeli osayiniwe osengozini bese eyixhaphaza kudivayisi ekhonjiwe ukuvumela iZeroCleare ukudlula ungqimba lwe-Windows hardware abstraction futhi idlule ezinye izivikelo zohlelo lokusebenza ezivimbela abashayeli Abangasayini ukuthi basebenze ngama-64-bit imishini ', ufunda umbiko we-IBM.
Isilawuli sokuqala kulolu chungechunge sibizwa ngokuthi i-soy.exe futhi siyinguqulo eguquliwe yesilayishi somshayeli we-Turla.
Lo mshayeli usetshenziselwa ukulayisha inguqulo esengozini yomshayeli we-VirtualBox , abahlaseli abayisebenzisayo ukulayisha umshayeli we-EldoS RawDisk. I-RawDisk iyithuluzi elisemthethweni elisetshenziselwa ukusebenzisana namafayela kanye nokuhlukanisa, futhi lisetshenziswe abahlaseli be-Shamoon ukufinyelela i-MBR.
Ukuthola ukufinyelela komongo wedivayisi, iZeroCleare isebenzisa umshayeli osengozini ngamabomu nemibhalo ye-PowerShell / Batch enonya ukudlula izilawuli zeWindows. Ngokwengeza la macebo, iZeroCleare isabalale kumadivayisi amaningi kunethiwekhi ethintekile, yahlwanyela imbewu yokuhlasela okubhubhisayo okungathinta izinkulungwane zamadivayisi futhi kubangele ukuvaleka okungathatha izinyanga ukuthi zilulame ngokuphelele, "
Nakuba imikhankaso eminingi ye-APT abacwaningi abayiveza igxile ekuhloleni kwe-inthanethi, amanye amaqembu afanayo nawo enza imisebenzi ebhubhisayo. Ngokomlando, eminingi yale misebenzi yenzeke eMpumalanga Ephakathi futhi ihlose izinkampani zamandla nezindawo zokukhiqiza, okuyizinto ezibalulekile zezwe.
Nakuba abacwaningi bengakayitholi ngokusobala inhlangano ethile ebangela le malware, ekuqaleni basikisele ukuthi i-APT33 yayihilelekile ekudalweni kwe-ZeroClear.
Ngemuva kwalokho i-IBM yathi i-APT33 ne-APT34 zakha i-ZeroCleare, kepha ngemuva nje kokukhishwa kombhalo, isichasiso sashintsha saba yi-xHunt ne-APT34, futhi abacwaningi bavuma ukuthi babengaqiniseki ngamaphesenti ayi-XNUMX.
Ngokusho kwabacwaningi, ukuhlaselwa kweZeroClear akulona ithuba futhi kubonakala sengathi kuyimisebenzi eqondiswe emikhakheni ethile kanye nezinhlangano.