WIN32/INDUSTROYER
A new threat forindustrial control systems
Anton Cherepanov, ESET
Version 2017-06-12

Win32/Industroyer

Contents
Win32/Industroyer: a new threat for industrial control systems  .  .  .  .  .  .  . 2Main backdoor  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 3Additional backdoor  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 4Launcher component  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 5101 payload component  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .6
104 payload component .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 761850 payload component  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 10
OPC DA payload component .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 12
Data wiper component .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 13
Additional tools: port scanner tool . .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 14
Additional tools: DoS tool .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 15
Conclusion .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 15
Indicators of Compromise (IoC) .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 15

1

Win32/Industroyer

Win32/Industroyer: a new threat forindustrial control systems
Win32/Industroyer is a sophisticated piece of malware designed to disrupt
the working processes of industrial control systems (ICS), specificallyindustrial control systems used in electrical substations.
Those behind the Win32/Industroyer malware have a deep knowledge
and understanding of industrial control systems and, specifically, theindustrial protocols used in electric power systems. Moreover, it seems very
unlikely anyone could write and test such malware without access to thespecialized equipment used in the specific, targeted industrial environment.

2

this malware could have been the tool used by attackers to cause thepower outage in Ukraine in December 2016, although at the time ofwriting, it is not confirmed, and the investigation is still ongoing. The
infection vector remains unknown.
The malware contains multiple modules, as analyzed and described in thenext sections of this whitepaper. However, before diving into those details,
the following simplified schematic shows the connections between thecomponents of the malware.

Support for four different industrial control protocols, specified in thestandards listed below, has been implemented by the malware authors:• IEC 60870-5-101 (aka IEC 101)
• IEC 60870-5-104 (aka IEC 104)
• IEC 61850• OLE for Process Control Data Access (OPC DA)
In addition to all that, the malware authors also wrote a tool that
implements a denial-of-service (DoS) attack against a particular family ofprotection relays, specifically the Siemens SIPROTEC range.
All this considered, the Win32/Industroyer malware authors show anintensive focus that suggests they are highly specialized in industrial
control systems.
The capabilities of this malware are significant. When compared to thetoolset used by threat actors in the 2015 attacks against the Ukrainian
power grid which culminated in a black out on December 23, 2015
(BlackEnergy, KillDisk, and other components, including legitimate
remote access software) the gang behind Industroyer are more advanced,
since they went to great lengths to create malware capable of directly
controlling switches and circuit breakers. We have seen indications that

Figure 1. Simplified schematic of Win32/Industroyer components.

While some components (e.g. Data wiper) are similar in concept to the 2015
BlackEnergy attacks against power grid companies in Ukraine, we don’t see
any link between those attacks and the code in this malware.

Win32/Industroyer

Main backdoor
We refer to the core component of Industroyer as the main backdoor. The
main backdoor is used by the attackers behind Industroyer to control allother components of the malware.
As backdoors go, this component is pretty straightforward, connecting
to its remote C&C server using HTTPS and receiving commands fromthe attackers. All analyzed samples are hardcoded to use the same proxyaddress, located in the local network. Thus, the backdoor is clearly designed
to work only in one specific organization. It is also worth mentioning thatmost of the C&C servers used by this backdoor are running Tor software.
Perhaps the most interesting feature of this backdoor is that attackers
can define a specific hour of the day when the backdoor will be active.
For example, the attackers can modify the backdoor in this way so it willcommunicate with its C&C server only outside working hours. This can makedetection based only on network traffic examination harder. However, all thesamples analyzed so far are set to work 24 hours round the clock.

Once connected to its remote C&C server, the main backdoor component
sends the following data in a POST-request:• the globally unique identifier (GUID) string for the current hardware
profile retrieved via GetCurrentHwProfile• the version of the malware: 1.1e

• the hardcoded ID of the sample• the result of any previously-received command
The hardcoded ID is used by the attacker as an identifier for the infected
machine. Across all analyzed samples we found the following hardcoded ID
values:• DEF• DEF-C• DEF-WS• DEF-EP• DC-2-TEMP• DC-2• CES-McA-TEMP• CES• SRV_WSUS• SRV_DC-2• SCE-WSUS01
The main backdoor component supports the following commands:
Command ID

Figure 2. The decompiled main backdoor code has a check for time-of-day.

3

Purpose0

Execute a process

1

Execute a process under a specific user account.
Credentials for the account are supplied by theattacker

2

Download a file from C&C server

3

Copy a fileWin32/Industroyer

Command ID

4

Purpose4

Execute a shell command

5

Execute a shell command under a specific user
account. Credentials for the account are suppliedby the attacker

6

Quit

7

Stop a service

8

Stop a service under a specific user account.
Credentials for the account are supplied by
the attacker

9Start a service under a specific user account.
Credentials for the account are supplied by
the attacker

10

Replace "Image path" registry value for a service

Once the attackers obtain administrator privileges, they can upgrade
the installed backdoor to a more privileged version that is executed asa Windows service program. To do this they pick an existing, non-critical
Windows service and replace its ImagePath registry value with the path of
the new backdoor’s binary.
The functionality of the main backdoor that works as a Windows service
is the same as just described. However, there are two small differences:
first the backdoor’s version is 1.1s, instead of 1.1e, and second, there is code
obfuscation. The code of this version of the backdoor is mixed with junkassembly instructions.

Figure 3. The obfuscated assembly code of the main backdoor that works as
a Windows service.

Additional backdoor
The additional backdoor provides an alternative persistence mechanismthat allows the attackers to regain access to a targeted network in case themain backdoor is detected and/or disabled.
This backdoor is a trojanized version of the Windows Notepad application.
This is a fully functional version of the application, but the malware authors
have inserted malicious code that is executed each time the application islaunched. Once the attackers gain administrator privileges, they are able toreplace the legitimate Notepad manually.
The inserted malicious code is heavily obfuscated, but once the code is
decrypted it connects to a remote C&C server, which is different to the one
linked in the main backdoor, and downloads a payload. This is in the form

Win32/Industroyerof shellcode that is loaded directly into memory and executed. In addition,
the inserted code decrypts the original Windows Notepad code, whichis stored at the end of the file, and then passes execution to it. Thus, theNotepad application works as expected.

5

Launcher component
This component is a separate executable responsible for launching the
payloads and the Data wiper component.
The Launcher component contains a specific time and date. Analyzed
samples contained two dates, 17th December 2016 and 20th December 2016.
Once one of these dates is reached the component creates two threads.
The first thread makes attempts to load a payload DLL, while the second
thread waits one or two hours (it depends on the Launcher component
version) and then attempts to load the Data wiper component. The priority
for both threads is set to THREAD_PRIORITY_HIGHEST, which means thatthese two threads receive a higher than normal share of CPU resourcesfrom the operating system.
The name of the payload DLL is supplied by the attackers via a commandline parameter supplied in one of the main backdoor’s “execute a shellcommand” commands. The Data wiper component is always named
haslo.‌
dat. The expected command lines are of the form:

Figure 4. Comparison between original Notepad binary code (at the left)
and backdoored binary code.

%LAUNCHER%.exe %WORKING_DIRECTORY% %PAYLOAD%.dll%CONFIGURATION%.ini
Each argument on the command line represents the following:• %LAUNCHER%.exe is the filename of the Launcher component• %WORKING_DIRECTORY% is the directory where the payload DLL andconfiguration is stored• %PAYLOAD%.dll is the filename of the payload DLL• %CONFIGURATION%.ini is the file that stores configuration data for the
specified payload. The path to this file is supplied to the payload DLL by
the Launcher component
The payload and Data wiper components are standard Windows DLL files.
In order to be loaded by the Launcher component they must export afunction named Crash as seen in Figure 5.

Win32/Industroyer

Windows device names (usually COM ports), the number of Information
Object Address (IOA) ranges, and the beginning and ending IOA values
for the specified number of IOA ranges. IOA is a number that identifies
a particular data element in the device. Figure 6 illustrates a 101 payload
configuration file with two defined IOA ranges, 10-15 and 20-25.

Figure 5. Example payload DLL that has internal name Crash101.dll
and Crash export function.

101 payload component
This payload DLL has the filename 101.dll and is named after IEC 101 (aka
IEC 60870-5-101), an international standard that describes a protocol formonitoring and controlling electric power systems. The protocol is used forcommunication between industrial control systems and Remote Terminal
Units (RTUs). The actual communication is transmitted through a serial
connection.
The 101 payload component partly implements the protocol described in
the IEC 101 standard and is able to communicate with an RTU or any otherdevice with support for that protocol.
Once executed, the 101 payload component parses the configuration stored
in its INI file. The configuration may contain several entries: process name,Figure 6. An example of a 101 payload DLL configuration.

The name of the process specified in the configuration belongs to an
application the attackers suspect is running on the victim machine. It
should be the application the victim machine uses to communicate
through serial connection with the RTU. The 101 payload attempts toterminate the specified process and starts to communicate with thespecified device, using the CreateFile, WriteFile and ReadFile
Windows API functions. The first COM port from the configuration file isused for the actual communication and the two other COM ports are justopened to prevent other processes accessing them. Thus, the 101 payload
component is able to take over and maintain control of the RTU device.
This component iterates through all IOAs in the defined IOA ranges.
For each such IOA it constructs two “select and execute” packets, onewith a single command (C_SC_NA_1) and one with a double command(C_DC_NA_1) and sends these to the RTU device. The main goal of thecomponent is to change the On/Off state of single command type IOA

6

Win32/Industroyerand double command type IOA. Specifically, the 101 payload has threestages: in the first stage this component attempts to switch IOAs to their
Off state, in the second stage it attempts to invert IOA states to On, andin the final stage the component switches IOA states to Off again.

7

104 payload component
This payload DLL has the filename 104.dll and is named after IEC 104 (aka
IEC 60870-5-104), an international standard. The IEC 104 protocol extends
IEC 101, so the protocol can be transmitted over a TCP/IP network.
Due to its highly configurable nature, this payload can be customizedby the attackers for different infrastructures. Figure 8 shows what a
configuration file may look like.

Figure 8. An example of 104 payload DLL configuration.

Once executed, the 104 payload DLL attempts to read its configuration file.
As described above, the path for the configuration file is supplied by the
Launcher component.
The configuration contains a STATION section followed by properties
that configure how the 104 payload should work. The configuration may
contain multiple STATION entries.
Figure 7. An example of a 101 payload packet, after being dissected in Kaitai Struct WebIDE.

Win32/Industroyer

Our analysis of this component reveals the following possible
configuration properties:

Property

Expected value

Purposeoperation

range orsequence or shift

Specifies iteration type forInformation Object Addresses(IOA)

Property

Expected value

Purposetarget_ip

IP address

The IP address that will be used
for the communication using IEC
104 protocol standard

range

Specific format of Specifies range of Information
IOAs
Object Addresses (IOA)

target_port

Port number

Self-explanatory

sequenceuselog1 or 0

Enables or disables logging
to a fileSpecific format of Specifies sequence of Information
IOAs
Object Addresses (IOA)

shift

logfileFilename

Specifies the filename for the log,
if enabled

Specific formatof
IOAs

stop_comm_service1 or 0

Enables or disables termination of
the process

stop_comm_service_name

Process nameSpecifies the process name thatwill be terminatedtimeout

Timeout inmilliseconds

Specifies timeout between send
and recv calls. Default value:
15000

socket_timeout

Timeout inmilliseconds

Specify the receiving timeout.
Default value: 15000

silence1 or 0

Enables or disables console output

asdu

Integer

Specifies ASDU (Application
Service Data Unit) address also
known as sector

first_action

on or off

Specifies the Switch value in ASDU
packet for first iteration

change1 or 0Specifies that the Switch value in
ASDU packet should be inverted
during iterationscommand_type

def or shortor long or persist

Specifies command pulse duration
for qualifier of command (QOC)

8Specifies shift of Information
Object Addresses (IOA)

Once the configuration file is read, the 104 payload creates a thread foreach STATION section defined in the configuration file. In each suchthread, the 104 payload will attempt to communicate with the specified
IP address using the protocol described in the IEC 104 standard. Before theconnection is made, the 104 payload attempts to terminate the legitimate
process that is normally responsible for IEC 104 communication with thedevice. It does so only if the stop_comm_service property is specified
in its configuration. By default, the 104 payload terminates the process
named D2MultiCommService.exe, or the process name specified in its
configuration.
The main idea behind the 104 payload is relatively simple. It connects tothe specified IP address and starts to send packets with the ASDU addressthat was defined in its configuration. The goal of this communication is tointeract with an IOA of a single command type.
In the configuration file, the attacker can define the operation property to
specify exactly how single command type IOAs will be iterated.
The first such operation mode is the range mode. The attackers use
this mode in order to discover possible IOAs in the targeted device. The
attackers have to take this approach because the protocol described in
the IEC 104 standard does not provide a specific method to obtain suchinformation.

Win32/Industroyer

The range mode has two stages. During the first stage, once the range of
IOAs is obtained from the configuration file, the 104 payload connects tothe target IP address and starts to iterate through the specified IOAs. To
each such IOA the 104 payload sends “select and execute” packets in orderto switch the state and to confirm whether the IOA belongs to the single
command type.

9

enabled, so between loop iterations the payload flipped the switch value
from On to Off and wrote it to the log.

Figure 9. An example of a 104 payload packet, after being dissected by Wireshark.

Once all possible IOAs from the specified range are iterated, the 104
payload switches to the second stage of range mode. If logging is enabled,
the payload writes Starting only success to the log. The rest of thissecond stage is an infinite loop that uses the previously discovered IOAs of
single command type. In the loop the payload constantly sends “select andexecute” packets. In addition, if the option change is defined, the payload
flips the On/Off state between loop steps.
Figure 10 demonstrates the log file that was produced by the 104 payload
during our analysis. It shows the payload iterated IOAs from 10 to 15, andonce IOAs of the single command type were discovered, the payload
started to use them in the loop. The configuration had the change option

Figure 10. Example log file produced by the 104 payload

The second operation mode is the shift mode. This is very similar to
the range mode. The attacker defines, in the configuration file, a range of
IOAs and shift values. Once the 104 payload is activated it does everything
the same way as in range mode; however, once all IOAs in the defined
range are iterated, it starts to iterate over the new range. The new range iscalculated by adding the shift values to the default range values.
The third operation mode is the sequence mode. It can be used byattackers once they know the values of all IOAs of the single command
type that are supported by the connected device. This payload immediately

Win32/Industroyer

executes an infinite loop, sending “select and execute” packets to the IOAs
defined in the configuration file.
Aside from its logging capability, the 104 payload can output debug
information to the console, as seen in Figure 11.

1061850 payload component
Unlike the 101 and 104 payloads, this payload component exists as astandalone malicious tool comprising an executable named 61850.exe
and the DLL 61850.dll. It is named after the IEC 61850 standard. This
standard describes a protocol used for multivendor communication amongdevices that perform protection, automation, metering, monitoring, andcontrol of electrical substation automation systems. The protocol is very
complex and robust, but the 61850 payload uses only a small subset of the
protocol to produce its disruptive effect.
Once executed, the 61850 payload DLL attempts to read the configuration
file, the path to which is supplied by the Launcher component. The
standalone version defaults to reading its configuration from i.ini. The
configuration file is expected to contain a list of IP addresses of devices
capable of communicating via the protocol described in the IEC 61850
standard.

Figure 11. The console output of the 104 payload.

If the configuration file is not present, then this component enumerates allconnected network adaptors to determine their TCP/IP subnet masks. The
61850 payload then enumerates all possible IP addresses for each of thesesubnet masks, and tries to connect to port 102 on each of those addresses.
Therefore, this component has the ability to discover relevant devices in the
network automatically.
Otherwise, if a configuration file is present and it contains target IP
addresses, this component connects to port 102 on those IP addresses andon IP addresses that were discovered automatically.
Once this component connects to a target host, it sends a Connection
Request packet using the Connection Oriented Transport Protocol, as seenin Figure 12.

Win32/Industroyer

Figure 12. A Connection Request packet, after dissection by Wireshark.

Figure 13. The dissected MMS getNameList request in Wireshark.

If the target device responds appropriately, the 61850 payload then sends
an InitiateRequest packet using the Manufacturing Message Specification(MMS). If the expected answer is received, it continues, sending an MMS
getNameList request. Thereby, the component compiles a list of object
names in a Virtual Manufacturing Device (VMD).

Afterwards, the 61850 payload parses data received in response to theserequests, searching for variables that contain following combinations ofstrings:

Next, this component enumerates the objects discovered in the previous
step and sends the device domain-specific getNameList requests witheach object name. This enumerates named variables in a specific domain.

• CSW, CO, Pos, Oper, but not $T• CSW, CF, Pos, and Model• CSW, ST, Pos, and stVal• CSW, CO, Pos, SBO, but not $T
The string CSW is a name for logical nodes, which are used to control
circuit breakers and switches.
For variables that contain the Model or stVal string the 61850 payload sends
an additional MMS Read request. For some of the variables this component
may also issue an MMS Write request that will change its state.

11

Win32/Industroyer

The 61850 payload produces a log file of its operations that contains the IP
addresses, MMS domains, named variables and the node states (open or
closed) of its targets.

OPC DA payload component
The OPC DA payload component implements a client for the protocol
described in the OPC Data Access specification. OPC (OLE for Process
Control) is a software standard and specification that is based on Microsoft
technologies such as OLE, COM, and DCOM. The Data Access (DA) part of
the OPC specification allows real-time data exchange between distributed
components, based on a client–server model.
This component exists as a standalone malicious tool with the filename
OPC.exe and a DLL, which implement both 61850 and OPC DA
payload functionalities. This DLL is named, internally in PE export table,
OPCClientDemo.dll, suggesting that the code of this component may bebased on the open source project OPC Client.

Next the component uses the IOPCBrowseServerAddressSpace
interface to enumerate all OPC items on the server. Specifically, it looks foritems that contain the following strings in their name:• ctlSelOn• ctlOperOn• ctlSelOff• ctlOperOff• \Pos and stVal
The names of these items may suggest that attackers are interested in
OPC items provided by OPC servers that belong to solutions from ABB,
such as their MicroSCADA range. Figure 15 demonstrates an example list of
OPC items that contain names with similar strings. This list of OPC items isreceived by the OPC Process Objects List Tool from ABB.

Figure 14. The PE export reveals the internal DLL name of the OPC DA payload.

The OPC DA payload does not require any kind of configuration file.
Once executed by the attacker, it enumerates all OPC servers using the
ICatInformation::EnumClassesOfCategories method with CATID_OPCDAServer20 category identifier and IOPCServer::GetStatus to
identify the ones running.

12

Figure 15. An example of OPC items names in IN field received using
OPC Process Objects List Tool.

Win32/Industroyer

The attackers use the string Abdul when they add a new OPC group.
Possibly this string is used by the attackers as a slang term when referringto the ABB solutions.

13

The component writes the OPC server name, OPC item name state, quality
code and value to the log file. The logged values are separated with thefollowing headers:• [*ServerName: %SERVERNAME%] [State: Before]• [*ServerName: %SERVERNAME%] [State: After ON]• [*ServerName: %SERVERNAME%] [State: After OFF]

Data wiper component
The data wiper component is a destructive module that is used in the final
stage of an attack. The attackers are using this component to hide theirtracks and to make recovery difficult.

Figure 16. The disassembled code of the OPC DA component that uses the Abdul string.

On the final step, the OPC DA payload attempts to change the state ofdiscovered OPC items using the IOPCSyncIO interface by writing the 0x01
value twice.

This component has the filename haslo.dat or haslo.exe and canbe executed by the Launcher component or used as a standalone
malicious tool.
Once executed it attempts to enumerate all keys in the registry that list
Windows services:• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
It attempts to set the registry value ImagePath with an empty string ineach of the entries found. This operation will make the operating system
unbootable.
The next step is actual deletion of file contents. The component
enumerates files with specific file extensions on all drives connected tocomputer, from C:\ to Z:\. It should be noted that during enumeration
the component skips files that are located in subdirectory that contains
Windows in its name.

Figure 17. Disassembled code of OPC DA payload that uses IOPCSyncIO interface.

The component rewrites file content with meaningless data obtained fromnewly allocated memory. In order to perform this operation thoroughly thecomponent attempts to rewrite files twice. The first attempt happens once
the file is found on a drive. If the first attempt is unsuccessful then the wiper
malware makes a second attempt, but before that the malware terminates

Win32/Industroyer

all processes except those included in a list of critical system processes. The
list of these processes is displayed in Figure 18.
To speed up the wiping operation this component rewrites only partial filecontent at the beginning of the file. The amount of data to be rewritten
depends on file size: the smallest amount of data will be rewritten for files
less than or equal to 1Mb (4096 bytes); the largest amount of data will be
rewritten for files less than or equal to 10Mb (32768 bytes).
Finally, this component attempts to terminate all processes (including
system processes) except its own. This will result in the system becoming
unresponsive and eventually crashing.

*.SCL

*.cxm

*.7z

*.bak

*.elb

*.exe
*.dll

*.cid

*.epl

*.scd

*.mdf

*.pcmp*.ldf

14This list contains filename extensions that are used in a standard
environment, such as Windows binaries (.exe/.dll), archives (.7z /.tar/.rar/.
zip), backup files (.bak/.bk/.bkp), Microsoft SQL server files (.mdf/.ldf),
and various configuration files (.ini/.xml). In addition, the component also
wipes files that may be used in industrial control systems, such as files
written using Substation Configuration description Language (.scl/.cid/.scd) andthere are many files and file extensions that are used by various products
from ABB. For example, a file named SYS_BASCON.COM is used by ABB
solutions for storing configuration data, and files with the .paf (Product
Authorization File) filename extension are used to store license data
for ABB MicroSCADA products.

Additional tools: port scanner tool
Figure 18. List of processes that are not terminated on second rewriting attempt.

The filename masks targeted by the data wiper component to be
overwritten are:
SYS_BASCON.COM*.pcmi*.bk*.v*.pcmt

*.bkp

*.PL

*.ini

*.log

*.paf

*.xml

*.zip

*.XRF

*.CIN

*.rar

*.trc

*.prj

*.tar

The attackers’ arsenal includes a port scanner that can be used to map
the network and to find computers relevant to their attack. Interestingly,
instead of using software already existing, the attackers built their own
custom-made port scanner. As is evident from Figure 19, the attacker candefine a range of IP addresses and a range of network ports that are to bescanned by this tool.

Figure 19. The port scanner tool usage example.

Win32/Industroyer

Additional tools: DoS tool
Another tool from the attackers’ arsenal is a Denial-of-Service (DoS) toolthat can be used against Siemens SIPROTEC devices. This tool leverages
the CVE-2015-5374 vulnerability in order to render a device unresponsive.
Once this vulnerability is successfully exploited, the target device stops
responding to any commands until it is rebooted manually.
To exploit this vulnerability the attackers hardcoded the device IP addresses
into this tool. Once the tool is executed it sends specifically crafted packets
to port 50,000 of the target IP addresses using UDP. The UDP packet
contains only 18 bytes.

Figure 20. Content of UDP packet used during exploitation of CVE-2015-5374.

Conclusion

The commonly-used industrial control protocols used in this malware
were designed decades ago without taking security into consideration.
Therefore, any intrusion into an industrial network with systems using
these protocols should be considered as “game over”.

Indicators of Compromise (IoC)
SHA-1 hashes:
F6C21F8189CED6AE150F9EF2E82A3A57843B587D
CCCCE62996D578B984984426A024D9B250237533
8E39ECA1E48240C01EE570631AE8F0C9A9637187
2CB8230281B86FA944D3043AE906016C8B5984D9
79CA89711CDAEDB16B0CCCCFDCFBD6AA7E57120A
94488F214B165512D2FC0438A581F5C9E3BD4D4C
5A5FAFBC3FEC8D36FD57B075EBF34119BA3BFF04
B92149F046F00BB69DE329B8457D32C24726EE00
B335163E6EB854DF5E08E85026B2C3518891EDA8

The investigation behind the Ukrainian power outage last December is stillongoing and it is currently not confirmed that the malware analyzed here
was the direct cause. Nevertheless, we believe that to be a very probableexplanation, as the malware is able to directly control switches and circuit
breakers at power grid substations using four ICS protocols and contains anactivation timestamp for December 17, 2016, the day of the power outage.

IP addresses of C&C servers:

We can definitely say that the Win32/Industroyer malware family is anadvanced and sophisticated piece of malware that is used against industrial
control systems. However, it should be noted that the malware itself is justa tool in the hands of an even more advanced and very capable malicious
actor. Using logs produced by the toolset and highly configurable payloads,
the attackers could adapt the malware to any comparable environment.

Warning! Most of the servers with these IP addresses were part of Tor
network which means that the use of these indicators could result in a
false positive match.

195.16.88[.]646.28.200[.]132
188.42.253[.]43
5.39.218[.]152
93.115.27[.]57

15