THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

THE DOZER (AKA 7.7 DDOS) ATTACK
The Dozer attack in July 2009 was one of the first attacks on South Korean targets that received international
attention. DDOS bots were distributed with lists of sites to attack – notably various Korean websites covering
government and bank functions, but also a great deal of US .gov, .mil and .com sites – including whitehouse.gov.
This also involved wiping of hard disks of the infected computers.
There is a known set of malware (7) connected with this incident.
Some of these samples appear to have been written specifically for the Dozer attack. However, the sample with the
sha256 hash 7dee2bd4e317d12c9a2923d0531526822cfd37eabfd7aecc74258bb4f2d3a643 shares code with
KorDllbots, as can be seen in the function below, which does network receipt with xor decoding.
KorDllbot (0075d16d8c86f132618c6365369ff1755525180f919eb5c103e7578be30391d6) vs Dozer
(7dee2bd4e317d12c9a2923d0531526822cfd37eabfd7aecc74258bb4f2d3a643).
The function is identical. This is just one out of several such functions in the sample.
We can say with reasonable confidence that the threat actors behind the Dozer attack also were involved in the
creation of the KorDllbot family or have had access to the source code.