reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: analyzing-wiper-malware
+description: 'Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite
+  primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and
+  distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify
+  destructive disk-overwrite behavior, or tell a wiper apart from ransomware.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - wiper
+  - destructive
+  - mbr
+  - impact
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1485
+  - T1561.002
+  - T1561.001
+d3fend:
+  - D3-PSA
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/'
+  - 'MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/'
+---
+
+# Analyzing Wiper Malware
+
+## When to Use
+
+- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
+  tampering, and mass-deletion primitives.
+- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
+
+**Do not use** this on a live host or by running the sample — destructive behavior is the threat.
+Analyze statically in isolation.
+
+## Prerequisites
+
+- The sample, read inertly.
+
+## Safety & Handling
+
+- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
+
+## Workflow
+
+### Step 1: Detect destructive primitives
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
+`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.
+
+### Step 2: Detect backup/recovery destruction
+
+Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
+`wevtutil cl` (log clearing) — common wiper recovery-denial steps.
+
+### Step 3: Distinguish wiper vs ransomware
+
+Weigh destruction-without-crypto and absence of a ransom note / key exchange against
+encryption-and-extortion indicators to classify intent.
+
+### Step 4: Document
+
+Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
+
+## Validation
+
+- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
+- Recovery-denial commands are detected where present.
+- The wiper-vs-ransomware classification cites concrete evidence.
+
+## Pitfalls
+
+- Disk utilities and secure-erase tools share these primitives — context is essential.
+- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
+- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
+- ATT&CK T1561 and T1485 (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Analyzing Wiper Malware
+
+## Overview
+
+`scripts/analyst.py` scans a sample for destructive wiper primitives (raw-disk/MBR overwrite,
+recovery denial, mass deletion) and weighs them against ransomware indicators to classify intent
+as wiper, ransomware, or a destructive-with-ransom-facade hybrid. It reads bytes statically
+(ASCII + UTF-16LE) and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+
+## Core functions
+
+### `scan(path)`
+Returns destructive primitive groups, ransomware indicators, the two scores, and a classification.
+
+## Classification logic
+
+- `destructive_score` ≥ 3 and `ransomware_score` ≤ 1 → **likely_wiper**.
+- `ransomware_score` ≥ 3 → **likely_ransomware**.
+- Both present → **destructive_with_ransom_facade** (pseudo-ransomware wiper).
+
+## Indicators
+
+- Raw disk: `\\.\PhysicalDrive`, `DeviceIoControl`, `IOCTL_DISK`.
+- Recovery denial: `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`,
+  `wevtutil cl`.
+
+## Usage
+
+```bash
+python scripts/analyst.py scan sample.bin
+```
+
+## Sources
+
+- MITRE ATT&CK T1561 Disk Wipe; T1485 Data Destruction — https://attack.mitre.org/
+- Raw-disk/boot-record APIs from Windows storage documentation
+- Wiper recovery-denial command patterns from public destructive-malware analyses

vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/scripts/analyst.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Scan a sample for destructive wiper primitives and classify wiper vs ransomware.
+
+Detects raw-disk/MBR overwrite primitives, backup/recovery destruction commands, and weighs them
+against ransomware (encryption/extortion) indicators to classify intent. Reads bytes statically;
+executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+
+ASCII_RE = re.compile(rb"[\x20-\x7e]{4,}")
+UTF16_RE = re.compile(rb"(?:[\x20-\x7e]\x00){4,}")
+
+RAW_DISK = ["\\\\.\\physicaldrive", "\\\\.\\c:", "deviceiocontrol", "ioctl_disk",
+            "createfilemapping", "setfilepointer", "\\device\\harddisk"]
+BOOT_TAMPER = ["this program cannot be run", "mbr", "\\\\.\\physicaldrive0", "bootmgr is missing"]
+RECOVERY_DENIAL = ["vssadmin delete shadows", "vssadmin.exe delete", "wbadmin delete",
+                   "bcdedit /set", "recoveryenabled no", "wevtutil cl", "delete catalog",
+                   "shadowcopy delete"]
+MASS_DELETE = ["deletefile", "removedirectory", "shfileoperation", "writefile", "f0 fill",
+               "overwrite"]
+RANSOM_INDICATORS = ["cryptencrypt", "cryptdecrypt", "bcryptencrypt", "readme.txt", "decrypt",
+                     ".onion", "bitcoin", "ransom", "your files have been encrypted",
+                     "aes", "rsa public key"]
+
+
+def _strings(data: bytes) -> str:
+    parts = [m.decode("ascii", "ignore") for m in ASCII_RE.findall(data)]
+    parts += [m.decode("utf-16-le", "ignore") for m in UTF16_RE.findall(data)]
+    return "\n".join(parts).lower()
+
+
+def scan(path: str) -> dict:
+    blob = _strings(Path(path).read_bytes())
+    raw = sorted({r for r in RAW_DISK if r in blob})
+    boot = sorted({b for b in BOOT_TAMPER if b in blob})
+    recovery = sorted({r for r in RECOVERY_DENIAL if r in blob})
+    deletion = sorted({d for d in MASS_DELETE if d in blob})
+    ransom = sorted({r for r in RANSOM_INDICATORS if r in blob})
+    destructive_score = len(raw) * 2 + len(boot) * 2 + len(recovery) + len(deletion)
+    ransom_score = len(ransom)
+    if destructive_score >= 3 and ransom_score <= 1:
+        classification = "likely_wiper"
+    elif ransom_score >= 3:
+        classification = "likely_ransomware"
+    elif destructive_score and ransom_score:
+        classification = "destructive_with_ransom_facade"
+    else:
+        classification = "inconclusive"
+    return {
+        "raw_disk_primitives": raw,
+        "boot_record_tampering": boot,
+        "recovery_denial": recovery,
+        "mass_deletion": deletion,
+        "ransomware_indicators": ransom,
+        "destructive_score": destructive_score,
+        "ransomware_score": ransom_score,
+        "classification": classification,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Analyze wiper malware")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("scan")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(scan(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())