44 lines
1.4 KiB
Markdown
44 lines
1.4 KiB
Markdown
# API Reference: Analyzing Wiper Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` scans a sample for destructive wiper primitives (raw-disk/MBR overwrite,
|
|
recovery denial, mass deletion) and weighs them against ransomware indicators to classify intent
|
|
as wiper, ransomware, or a destructive-with-ransom-facade hybrid. It reads bytes statically
|
|
(ASCII + UTF-16LE) and executes nothing.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | regex, JSON, file IO |
|
|
|
|
## Core functions
|
|
|
|
### `scan(path)`
|
|
Returns destructive primitive groups, ransomware indicators, the two scores, and a classification.
|
|
|
|
## Classification logic
|
|
|
|
- `destructive_score` ≥ 3 and `ransomware_score` ≤ 1 → **likely_wiper**.
|
|
- `ransomware_score` ≥ 3 → **likely_ransomware**.
|
|
- Both present → **destructive_with_ransom_facade** (pseudo-ransomware wiper).
|
|
|
|
## Indicators
|
|
|
|
- Raw disk: `\\.\PhysicalDrive`, `DeviceIoControl`, `IOCTL_DISK`.
|
|
- Recovery denial: `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`,
|
|
`wevtutil cl`.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py scan sample.bin
|
|
```
|
|
|
|
## Sources
|
|
|
|
- MITRE ATT&CK T1561 Disk Wipe; T1485 Data Destruction — https://attack.mitre.org/
|
|
- Raw-disk/boot-record APIs from Windows storage documentation
|
|
- Wiper recovery-denial command patterns from public destructive-malware analyses
|