Analyzing Wiper Malware

---
name: analyzing-wiper-malware
description: 'Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite
  primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and
  distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify
  destructive disk-overwrite behavior, or tell a wiper apart from ransomware.'
domain: cybersecurity
subdomain: malware-analysis
tags:
  - malware-analysis
  - wiper
  - destructive
  - mbr
  - impact
version: 1.0.0
author: analyst-ai-pack
license: Apache-2.0
mitre_attack:
  - T1485
  - T1561.002
  - T1561.001
d3fend:
  - D3-PSA
  - D3-DA
references:
  - 'MITRE ATT&CK T1561 Disk Wipe — https://attack.mitre.org/techniques/T1561/'
  - 'MITRE ATT&CK T1485 Data Destruction — https://attack.mitre.org/techniques/T1485/'
---

# Analyzing Wiper Malware

## When to Use

- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
  tampering, and mass-deletion primitives.
- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).

**Do not use** this on a live host or by running the sample — destructive behavior is the threat.
Analyze statically in isolation.

## Prerequisites

- The sample, read inertly.

## Safety & Handling

- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.

## Workflow

### Step 1: Detect destructive primitives

```bash
python scripts/analyst.py scan sample.bin
```

Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.

### Step 2: Detect backup/recovery destruction

Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
`wevtutil cl` (log clearing) — common wiper recovery-denial steps.

### Step 3: Distinguish wiper vs ransomware

Weigh destruction-without-crypto and absence of a ransom note / key exchange against
encryption-and-extortion indicators to classify intent.

### Step 4: Document

Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.

## Validation

- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
- Recovery-denial commands are detected where present.
- The wiper-vs-ransomware classification cites concrete evidence.

## Pitfalls

- Disk utilities and secure-erase tools share these primitives — context is essential.
- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).

## References

- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
- ATT&CK T1561 and T1485 (linked in frontmatter).