# MA-439.122014: MyCERT Alert - Targeted Destructive Malware

**Date:** 24 Dec 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-439.122014  
**Advisory ID:** MA-439.122014

---

#### **1.0     Introduction**
US-CERT have received an alert notified by a trusted third party of cyber threat actors using a Server Message Block (SMB) Worm Tool to conduct cyber exploitation activities recently targeting a major entertainment company. This SMB Worm Tool is equipped with a Listening Implant, Lightweight Backdoor, Proxy Tool, Destructive Hard Drive Tool, and Destructive Target Cleaning Tool.
**2.0     Impact**
These updates address about SMB worm propagates throughout an infected network via brute-force authentication attacks, and connects to a C2 infrastructure.
Due to the highly destructive functionality of this malware, an organization infected could experience operational impacts including loss of intellectual property and disruption of critical systems.
**3.0 Affected Products**
System affected:
- Microsoft Windows
**4.0 Recommendation**
Users and administrators are recommended to take the following preventive measures to protect their computer networks:
- Use and maintain anti-virus software – Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date. Please refer,
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
- Keep your operating system and application software up-to-date – Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Enable automatic updates, if this option is available.
- Review Security Tip [Handling Destructive Malware #ST13-003](https://www.us-cert.gov/ncas/tips/ST13-003) and evaluate their capabilities encompassing planning, preparation, detection, and response for such an event.
- Review Recommended Practices, please refer:
<https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/Defense_in_Depth_Oct09.pdf>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
- Targeted Destructive Malware;
<https://www.us-cert.gov/ncas/alerts/TA14-353A>
- Handling Destructive Malware;
<https://www.us-cert.gov/ncas/tips/ST13-003>