View source for Shamoon the Wiper: further details (Part II)

{{Publication
|Link=http://www.securelist.com/en/blog/208193834/Shamoon_The_Wiper_further_details_Part_II
|Author=Dmitry Tarakanov
|NomRevue=Securelist
|Date=11 septembre 2012
|Editor=Kaspersky lab
|Year=2012
|Botnet=Shamoon
|Abstract=We leave the speculation up to others and concentrate strictly on sharing technical details. This is the continuation of our investigation into Shamoon:

NETINIT.EXE

The main Shamoon module has a resource PKCS7:113 that maintains an executable which is saved to disk as %WINDIR%\System32\NETINIT.EXE and this program poses a module to communicate with CNC. This program waits for parameters to be run with. The author was not too creative and coded a handling of just two argument values which can be “0” or “1”.
}}