reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-wiper-malware/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-wiper-malware	Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify destructive disk-overwrite behavior, or tell a wiper apart from ransomware.	cybersecurity	malware-analysis	malware-analysis wiper destructive mbr impact	1.0.0	analyst-ai-pack	Apache-2.0	T1485 T1561.002 T1561.001	D3-PSA D3-DA	MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/ MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/

Analyzing Wiper Malware

When to Use

• You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR tampering, and mass-deletion primitives.
• You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).

Do not use this on a live host or by running the sample — destructive behavior is the threat. Analyze statically in isolation.

Prerequisites

• The sample, read inertly.

Safety & Handling

• Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.

Workflow

Step 1: Detect destructive primitives

python scripts/analyst.py scan sample.bin

Flags raw-disk handles (\\.\PhysicalDrive, \\.\C:), DeviceIoControl, MBR/VBR write patterns, CreateFileMapping over the boot sector, and bulk DeleteFile/overwrite loops.

Step 2: Detect backup/recovery destruction

Surface vssadmin delete shadows, wbadmin delete, bcdedit /set recoveryenabled no, and wevtutil cl (log clearing) — common wiper recovery-denial steps.

Step 3: Distinguish wiper vs ransomware

Weigh destruction-without-crypto and absence of a ransom note / key exchange against encryption-and-extortion indicators to classify intent.

Step 4: Document

Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.

Validation

• Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
• Recovery-denial commands are detected where present.
• The wiper-vs-ransomware classification cites concrete evidence.

Pitfalls

• Disk utilities and secure-erase tools share these primitives — context is essential.
• Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
• Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).

References

• See references/api-reference.md for the scanner.
• ATT&CK T1561 and T1485 (linked in frontmatter).