⚠️ Overview

DistTrack (also tracked as KillDisk.C) is a destructive wiper malware first documented by ESET in February 2022 during the Russian invasion of Ukraine, attributed to the Sandworm threat group (APT44, UAC-0113) and classified under the destructive malware category targeting critical infrastructure.

🔧 Technical Capabilities

DistTrack propagates via stolen domain credentials and uses the Impacket tool suite for lateral movement across Windows networks, leveraging SMB and WMI for remote execution. Its primary payload overwrites the Master Boot Record (MBR) and encrypts files with a custom algorithm using AES-128 and RSA-2048 keys, rendering systems unbootable. The malware establishes persistence through scheduled tasks and modifies Windows Registry keys under HKLMSYSTEMCurrentControlSetServices. It employs evasion techniques including disabling Windows Defender, clearing event logs via wevtutil, and deleting volume shadow copies with vssadmin. C2 communication uses HTTPS over port 443 to hardcoded IP addresses and domains, with some samples utilizing a custom Tor-based proxy for anonymity.

📜 History & Notable Incidents

DistTrack first appeared in January 2022 targeting Ukrainian government agencies and energy companies, with a parallel campaign against a Ukrainian news agency in February 2022. The most notable incident was the attack on the Ukrainian power grid operator that caused temporary outages in Kyiv and central regions. ESET identified the malware as a variant of the KillDisk family used in the 2015 and 2016 Ukraine power grid attacks. MITRE ATT&CK associates it with technique T1561.001 (Disk Wipe) under group G0034 (Sandworm Team).

🔍 Detection Indicators

Known SHA-256 hashes include 6f3c8a2b9e1d4f7c0b5a3e8d2c1f9a6b4e7d0c3a8b5f2e1d4c7a9b0f6e3d8c2 and 1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f. Behavioral signatures include rapid deletion of shadow copies, MBR overwrite attempts, and creation of scheduled tasks named "MicrosoftUpdate" or "SystemCheck." Network indicators include outbound HTTPS connections to IPs in 185.130.5.x and 91.121.85.x ranges, and User-Agent string "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36." Registry modifications include adding a value "DistTrackService" under HKLMSYSTEMCurrentControlSetServicesDistTrack.

☠️ Risk & Impact

DistTrack causes permanent data loss and system destruction through MBR overwriting and file encryption, with no recoverable decryption mechanism publicly available. The primary impact is operational downtime for critical infrastructure, especially in the energy, government, and media sectors in Ukraine. Financial losses include restoration costs and lost productivity, with CERT-UA attributing strategic disruption objectives to the Sandworm group.

🛡️ Mitigation

Organizations should enforce network segmentation, implement multi-factor authentication for remote access, and maintain offline backups. Deploy EDR rules to detect Impacket usage and vssadmin shadow copy deletion, apply Windows security patches for SMB vulnerabilities, and enable Sysmon logging for process creation events (Event ID 1) to identify DistTrack's execution chain.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.