Malware descriptions

Narilam: A ‘New’ Destructive Malware Used In the Middle East

Several days ago, our colleagues from Symantec published an analysis of a new destructive malware reported in the Middle East. Dubbed Narilam, the malware appears to be designed to corrupt databases. The database structure naming indicates that targets are probably in Iran.

We have identified several samples related to this threat. All of them are ~1.5MB Windows PE executables, compiled with Borland C++ Builder. If we are to trust the compilation headers, they appear to have been created in 2009-2010, which means it might have been in the wild for a while:

The earliest known sample has a timestamp of Thu Sep 03 19:21:05 2009.

According to Kaspersky Security Network, there are very few reports of this malware at the moment, which means its probably almost extinct. The earliest report of the malware is from August 2010; in total about 80 incidents have been recorded during past two years.

Several versions of this Trojan are detected by Kaspersky products as Trojan.Win32.Scar.cvcw and Trojan.Win32.Scar.dlvc. Some newer versions of the malware are detected heuristically by Kaspersky products, as HEUR:Trojan.Win32.Generic.

Similarities with Wiper, Stuxnet, Duqu or Flame

According to some reports, the malware could be related to a chain of attacks which have targeted Iran during the past two years, and which our readers are probably aware of.

Weve analyzed the sample and found no obvious connection with these. Duqu, Stuxnet, Flame and Gauss have all been compiled with versions of Microsoft Visual C, while Narilam was built with Borland C++ Builder 6 (and not Delphi, as other articles seem to suggest), a completely different programming tool.

How old is it really?

As usual, compilation timestamps can be faked, so we were wondering if we could find other proof of this malware being ItW for a while. We were indeed able to find a CERT alert from June 2010 which appears to relate to this malware.

The alert references a malware with slightly different size, but the same payload: The malware changes in the database tables, integrated systems Amin, Maliran, Shahd. An alternative name for it is Trojan.AKK.

In addition to this, yesterday (Sunday Nov 25th, 2012) the Iranian Maher CERT team published an alert about the malware in which they say it was ‘previously detected and reported online in 2010’.

Targeted software

As mentioned in Symantecs report, the malware appears to target databases with some very specific names: maliran, shahd and amin. It works by randomly deleting records from several tables named A_Sellers, Koll or Moein:

Could these be specific to a certain company or software used by the targeted companies?

Earlier today, an Iranian company named TarrahSystem put out an alert about W32.Narilam targeting some of their software:

A rough translation of the alert recommends users to prepare backups because of new malware (W32.Narilam) targeting financial software.

Both maliran and amin appear to be products from TarrahSystem:

Maliran Integrated Financial and Industrial Applications

Amin Banking and Loans Software

Shahd (Nectar) Integrated Financial / Commercial Software

Could it be that Narilam targets these 3 products from TarrahSystem? Unfortunately, we do not have these three programs to check, but its quite likely.

Summary and conclusions

Considering compilation timestamps and early reports, Narilam is a rather old threat that was probably deployed during late 2009 and mid-2010. Its purpose was to corrupt databases of three financial applications from TarrahSystem, namely Maliran, Amin and Shahd. Several variants appear to have been created, but all of them have the same functionality and method of replication.

Reports from Kaspersky Security Network indicate that the malware was found mostly in Iran (~60%) and Afghanistan (~40%).

At the moment, we do not see any direct connection with other recent destructive malware (such as Shamoon or Wiper). Unlike Duqu or Flame, there is no apparent cyberespionage function.

The malware is currently almost extinct during the past month, we have observed just six instances of this threat.

We will continue to monitor the situation and update this post as needed.

Narilam: A ‘New’ Destructive Malware Used In the Middle East

Your email address will not be published. Required fields are marked *

 

Reports

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

What did DeathStalker hide between two ferns?

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Subscribe to our weekly e-mails

The hottest research right in your inbox