90 lines
2.9 KiB
Markdown
90 lines
2.9 KiB
Markdown
---
|
|
name: analyzing-wiper-malware
|
|
description: 'Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite
|
|
primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and
|
|
distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify
|
|
destructive disk-overwrite behavior, or tell a wiper apart from ransomware.'
|
|
domain: cybersecurity
|
|
subdomain: malware-analysis
|
|
tags:
|
|
- malware-analysis
|
|
- wiper
|
|
- destructive
|
|
- mbr
|
|
- impact
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1485
|
|
- T1561.002
|
|
- T1561.001
|
|
d3fend:
|
|
- D3-PSA
|
|
- D3-DA
|
|
references:
|
|
- 'MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/'
|
|
- 'MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/'
|
|
---
|
|
|
|
# Analyzing Wiper Malware
|
|
|
|
## When to Use
|
|
|
|
- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
|
|
tampering, and mass-deletion primitives.
|
|
- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
|
|
|
|
**Do not use** this on a live host or by running the sample — destructive behavior is the threat.
|
|
Analyze statically in isolation.
|
|
|
|
## Prerequisites
|
|
|
|
- The sample, read inertly.
|
|
|
|
## Safety & Handling
|
|
|
|
- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Detect destructive primitives
|
|
|
|
```bash
|
|
python scripts/analyst.py scan sample.bin
|
|
```
|
|
|
|
Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
|
|
`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.
|
|
|
|
### Step 2: Detect backup/recovery destruction
|
|
|
|
Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
|
|
`wevtutil cl` (log clearing) — common wiper recovery-denial steps.
|
|
|
|
### Step 3: Distinguish wiper vs ransomware
|
|
|
|
Weigh destruction-without-crypto and absence of a ransom note / key exchange against
|
|
encryption-and-extortion indicators to classify intent.
|
|
|
|
### Step 4: Document
|
|
|
|
Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
|
|
|
|
## Validation
|
|
|
|
- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
|
|
- Recovery-denial commands are detected where present.
|
|
- The wiper-vs-ransomware classification cites concrete evidence.
|
|
|
|
## Pitfalls
|
|
|
|
- Disk utilities and secure-erase tools share these primitives — context is essential.
|
|
- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
|
|
- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
|
|
- ATT&CK T1561 and T1485 (linked in frontmatter).
|