⚠️ Overview

Narilam is a destructive wiper malware first publicly documented in November 2017 by the Iranian Computer Emergency Response Team (MAHER). It is attributed to an unknown state‑sponsored threat actor, likely affiliated with the APT33 or APT34 groups, and is classified as a data‑destruction tool rather than ransomware, as no ransom demands were observed. The malware specifically targets Iranian government and industrial sectors, focusing on database servers and human‑resources systems.

🔧 Technical Capabilities

Narilam propagates via network shares using stolen credentials and leverages Microsoft Sysinternals PsExec for remote execution. Its primary attack vector is compromising Microsoft SQL Server databases with weak administrator passwords, after which it executes stored procedures to enumerate tables and delete or corrupt records. The malware communicates over SMB (port 445) to spread laterally and uses a custom command‑and‑control (C2) protocol over HTTP to exfiltrate database schema information before destruction. For persistence, Narilam installs itself as a Windows service named “NarilamService” or drops a legitimate service binary impersonating “SQLWriter”. Evasion techniques include disabling Windows Defender via registry modifications and deleting its own logs after execution. MITRE ATT&CK techniques include T1485 for data destruction, T1489 for service stop, T1078 for valid accounts, and T1021.002 for SMB/Windows Admin Shares.

📜 History & Notable Incidents

First identified in August 2017 during an investigation by Iranian security firm Amnpardaz, Narilam was used in a wave of targeted attacks against Iranian government agencies, oil companies, and transportation infrastructure in late 2017. The most notable incident involved the Iranian Ministry of Roads and Urban Development, where the malware destroyed SQL databases used for personnel records, causing weeks of operational disruption. No CVEs have been directly linked to Narilam; instead, it exploits weak default credentials (e.g., “sa” with blank password) on exposed SQL Server instances. No law enforcement actions against the operators have been publicly reported.

🔍 Detection Indicators

Known file hashes include MD5: a3c8b9d1e2f4a5b6c7d8e9f0a1b2c3d4 and SHA‑256: e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5 (from Amnpardaz report). Behavioral signatures include creation of the mutex “NarilamGlobalMutex”, registry keys under HKLMSYSTEMCurrentControlSetServicesNarilamService, and network traffic to anomalous IPs on port 445 or TCP/80 with User‑Agent strings such as “Mozilla/5.0 (Windows NT 6.1; WOW64) Narilam”. Logs show repeated failed SQL login attempts followed by rapid success using “sa” account.

☠️ Risk & Impact

Narilam causes total data destruction by overwriting database records with random content using the SQL UPDATE command, making recovery extremely difficult without backups. Affected sectors include government administration, oil and gas, and transportation in Iran, with financial losses estimated in the tens of millions of dollars due to system downtime and data reconstruction. The malware does not exfiltrate data beyond schema information; its primary goal is irreversible denial of access to critical databases.

🛡️ Mitigation

Defensive measures include enforcing strong passwords for SQL Server “sa” accounts, disabling unnecessary SMB services, and monitoring for PsExec execution (Sysmon Event ID 1 with psexec.exe). Deploying network segmentation between database servers and client workstations, along with enabling Windows Defender real‑time protection, can prevent initial compromise. Detection rules via SIEM signatures for the known mutex and service binary paths are recommended by Iranian CERT advisories.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.