DDOS_Madness_Continued.pdf (626 KB)

FireEye analyzed the July 2009 DDoS activity that disrupted major U.S. and South Korean websites and found destructive malware behavior after the DDoS phase ended. A service component named mstimer.dll triggered wversion.exe after July 10, causing the malware to overwrite disk sectors, erase the MBR, and search fixed and removable drives for common document types. The case shows the campaign combining public-facing DDoS disruption with host-level destructive payloads aimed at damaging infected systems.