| name | analyzing-wiper-malware |
| description | Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify destructive disk-overwrite behavior, or tell a wiper apart from ransomware. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["malware-analysis","wiper","destructive","mbr","impact"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1485","T1561.002","T1561.001"] |
| d3fend | ["D3-PSA","D3-DA"] |
| references | ["MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/","MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/"] |
Analyzing Wiper Malware
When to Use
- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
tampering, and mass-deletion primitives.
- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
Do not use this on a live host or by running the sample — destructive behavior is the threat.
Analyze statically in isolation.
Prerequisites
- The sample, read inertly.
Safety & Handling
- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
Workflow
Step 1: Detect destructive primitives
python scripts/analyst.py scan sample.bin
Flags raw-disk handles (\\.\PhysicalDrive, \\.\C:), DeviceIoControl, MBR/VBR write patterns,
CreateFileMapping over the boot sector, and bulk DeleteFile/overwrite loops.
Step 2: Detect backup/recovery destruction
Surface vssadmin delete shadows, wbadmin delete, bcdedit /set recoveryenabled no, and
wevtutil cl (log clearing) — common wiper recovery-denial steps.
Step 3: Distinguish wiper vs ransomware
Weigh destruction-without-crypto and absence of a ransom note / key exchange against
encryption-and-extortion indicators to classify intent.
Step 4: Document
Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
Validation
- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
- Recovery-denial commands are detected where present.
- The wiper-vs-ransomware classification cites concrete evidence.
Pitfalls
- Disk utilities and secure-erase tools share these primitives — context is essential.
- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
References
