Endpoint Protection . The Shamoon Attacks . W32.Disttrack is a new threat that is being used in specific targeted attacks against at least one organization in the energy sector. It is a destructive malware that corrupts files on a compromised computer and overwrites the MBR (Master Boot Record) in an effort to render a computer unusable. The driver is used to overwrite the computer’s MBR but may be used for legitimate purposes. The file is digitally signed - %System%\drivers\drdisk.sys - The device driver is a clean disk driver that enables user-mode applications to read and write to disk sectors. The driver is used to overwrite the computer’s MBR but may be used for legitimate purposes. The file is digitally signed - Executes the following commands that collect file names, which will be overwritten and writes them to f1.inf and f2.inf: - Files from the f1.inf and f2.inf will be overwritten with the JPEG image shown below. Overwritten files are thus rendered useless