SYMBOLCOMMON_NAMEaka. SYNONYMS
win.dustman (Back to overview)

DUSTMAN


In 2019, multiple destructive attacks were observed targeting entities within the Middle East. The National Cyber Security Centre (NCSC), a part of the National Cybersecurity Authority (NCA), detected a new malware named "DUSTMAN" that was detonated on December 29, 2019. Based on analyzed evidence and artifacts found on machines in a victim’s network that were not wiped by the malware. NCSC assess that the threat actor behind the attack had some kind of urgency on executing the files on the date of the attack due to multiple OPSEC failures observed on the infected network. NCSC is calling the malware used in this attack "DUSTMAN" after the filename and string embedded in the malware. "DUSTMAN" can be considered as a new variant of "ZeroCleare" malware,
published in December 2019.

References
2022-09-26CrowdStrikeIoan Iacob, Iulian Madalin Ionita
@online{iacob:20220926:anatomy:248e6ff, author = {Ioan Iacob and Iulian Madalin Ionita}, title = {{The Anatomy of Wiper Malware, Part 3: Input/Output Controls}}, date = {2022-09-26}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/}, language = {English}, urldate = {2022-09-29} } The Anatomy of Wiper Malware, Part 3: Input/Output Controls
CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper Meteor Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-08-12CrowdStrikeIoan Iacob, Iulian Madalin Ionita
@online{iacob:20220812:anatomy:b13ce32, author = {Ioan Iacob and Iulian Madalin Ionita}, title = {{The Anatomy of Wiper Malware, Part 1: Common Techniques}}, date = {2022-08-12}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/}, language = {English}, urldate = {2023-01-19} } The Anatomy of Wiper Malware, Part 1: Common Techniques
Apostle CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper IsraBye KillDisk Meteor Olympic Destroyer Ordinypt Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2021-02-28PWC UKPWC UK
@techreport{uk:20210228:cyber:bd780cd, author = {PWC UK}, title = {{Cyber Threats 2020: A Year in Retrospect}}, date = {2021-02-28}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf}, language = {English}, urldate = {2021-03-04} } Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2020-01-20The Vault Bloghfiref0x
@online{hfiref0x:20200120:dustman:70f16bf, author = {hfiref0x}, title = {{Dustman APT: Art of Copy-Paste}}, date = {2020-01-20}, organization = {The Vault Blog}, url = {https://swapcontext.blogspot.com/2020/01/dustman-apt-art-of-copy-paste.html}, language = {English}, urldate = {2020-01-22} } Dustman APT: Art of Copy-Paste
DUSTMAN
2020-01-04Twitter (@Irfan_Asrar)Irfan Asrar
@online{asrar:20200104:dustman:8df5168, author = {Irfan Asrar}, title = {{Tweet on Dustman}}, date = {2020-01-04}, organization = {Twitter (@Irfan_Asrar)}, url = {https://twitter.com/Irfan_Asrar/status/1213544175355908096}, language = {English}, urldate = {2020-01-09} } Tweet on Dustman
DUSTMAN
2019-01Saudi Arabia CNASaudi Arabia CNA
@online{cna:201901:destructive:38ed2c3, author = {Saudi Arabia CNA}, title = {{Destructive Attack “DUSTMAN” Technical Report}}, date = {2019-01}, organization = {Saudi Arabia CNA}, url = {https://www.scribd.com/document/442225568/Saudi-Arabia-CNA-report}, language = {English}, urldate = {2020-01-13} } Destructive Attack “DUSTMAN” Technical Report
DUSTMAN
2019-01LinkedIn Irfan AsrarIrfan Asrar
@online{asrar:201901:destructive:f4cc200, author = {Irfan Asrar}, title = {{Destructive Attack "Dustman" Technical Report}}, date = {2019-01}, organization = {LinkedIn Irfan Asrar}, url = {https://www.linkedin.com/posts/iasrar_dustman-report-in-english-activity-6619216346083393537-NV1z/}, language = {English}, urldate = {2020-01-13} } Destructive Attack "Dustman" Technical Report
DUSTMAN
Yara Rules
[TLP:WHITE] win_dustman_auto (20230715 | Detects win.dustman.)
rule win_dustman_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.dustman."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 488d1566a10000 488d0d57a10000 e8???????? 488b4308 833800 750e }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d1566a10000       | mov                 dword ptr [esp + 0x28], esi
            //   488d0d57a10000       | nop                 dword ptr [eax + eax]
            //   e8????????           |                     
            //   488b4308             | nop                 
            //   833800               | dec                 esp
            //   750e                 | mov                 ecx, edi

        $sequence_1 = { 884824 488b4d28 0fb60c01 884825 488b4d30 }
            // n = 5, score = 100
            //   884824               | xor                 eax, eax
            //   488b4d28             | dec                 eax
            //   0fb60c01             | mov                 edi, ebx
            //   884825               | dec                 eax
            //   488b4d30             | sub                 esp, 0x40

        $sequence_2 = { 4903cb 48898df0000000 488bca 492bca 4c8d9ddf010000 }
            // n = 5, score = 100
            //   4903cb               | mov                 ecx, dword ptr [ebp + 0x128]
            //   48898df0000000       | movzx               ecx, byte ptr [ecx + eax]
            //   488bca               | mov                 byte ptr [eax + 0x45], cl
            //   492bca               | movzx               ecx, byte ptr [ecx + eax]
            //   4c8d9ddf010000       | mov                 byte ptr [eax + 0x45], cl

        $sequence_3 = { 4c8d0df1820000 488bd9 488d15e7820000 b916000000 4c8d05d3820000 e8???????? }
            // n = 6, score = 100
            //   4c8d0df1820000       | lea                 ecx, [eax + edx]
            //   488bd9               | inc                 sp
            //   488d15e7820000       | mov                 dword ptr [ebp + 0x180], esi
            //   b916000000           | inc                 ebp
            //   4c8d05d3820000       | lea                 eax, [esi + 6]
            //   e8????????           |                     

        $sequence_4 = { c5f1eb0d???????? 4c8d0d36850000 c5f35cca c4c173590cc1 4c8d0d05750000 }
            // n = 5, score = 100
            //   c5f1eb0d????????     |                     
            //   4c8d0d36850000       | lea                 ebx, [ebp + 0x1c9]
            //   c5f35cca             | dec                 ecx
            //   c4c173590cc1         | add                 ecx, ebx
            //   4c8d0d05750000       | dec                 eax

        $sequence_5 = { 782e 3b0d???????? 7326 4863c9 488d153cde0000 488bc1 83e13f }
            // n = 7, score = 100
            //   782e                 | mov                 ecx, edi
            //   3b0d????????         |                     
            //   7326                 | mov                 ecx, eax
            //   4863c9               | xor                 edx, edx
            //   488d153cde0000       | mov                 eax, 0x1400000
            //   488bc1               | dec                 esp
            //   83e13f               | mov                 esp, ecx

        $sequence_6 = { 48898d18010000 488bca 492bca 4c8d9de4010000 4903cb 48898d20010000 488bca }
            // n = 7, score = 100
            //   48898d18010000       | dec                 eax
            //   488bca               | mov                 ecx, dword ptr [ebp + 0x78]
            //   492bca               | movzx               ecx, byte ptr [ecx + eax]
            //   4c8d9de4010000       | mov                 byte ptr [eax + 0x2f], cl
            //   4903cb               | dec                 eax
            //   48898d20010000       | mov                 ecx, dword ptr [ebp + 0x80]
            //   488bca               | movzx               ecx, byte ptr [ecx + eax]

        $sequence_7 = { 4156 4157 4883ec20 488b6918 4d8bf0 488bf9 4c3bc5 }
            // n = 7, score = 100
            //   4156                 | mov                 ecx, edx
            //   4157                 | dec                 ecx
            //   4883ec20             | sub                 ecx, edx
            //   488b6918             | dec                 eax
            //   4d8bf0               | lea                 esi, [ebp + 0x1a2]
            //   488bf9               | dec                 eax
            //   4c3bc5               | add                 esi, ecx

        $sequence_8 = { 4c8d9db3010000 4903cb 48894d98 488bca 492bca }
            // n = 5, score = 100
            //   4c8d9db3010000       | inc                 esp
            //   4903cb               | lea                 eax, [edx + 0x28]
            //   48894d98             | dec                 ecx
            //   488bca               | add                 ecx, eax
            //   492bca               | dec                 eax

        $sequence_9 = { e8???????? 85c0 0f8403010000 488d0586e10000 4a8b04e8 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   85c0                 | mov                 ebx, ecx
            //   0f8403010000         | dec                 eax
            //   488d0586e10000       | lea                 edi, [0xfffef87c]
            //   4a8b04e8             | dec                 eax

    condition:
        7 of them and filesize < 368640
}
Download all Yara Rules