DoubleZeroMalware
- fiberlake
A wiper identified by CERT-UA on March 17th, written in C#.From MISP Galaxy
Last reported 8 months ago, by ESET WeLiveSecurity2 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
DynoWiper update: Technical analysis and attribution“…ed a wide range of destructive malware families, including, in roughly chronological order, HermeticWiper, HermeticRansom, CaddyWiper, DoubleZero, ARGUEPATCH, ORCSHRED, SOLOSHRED, AWFULSHRED, Prestige ransomware, RansomBoggs ransomware, SDelete-based wipers, BidSwipe, ROARBAT, Sw…”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“… crisis, state-sponsored groups used at least seven different wipers (WhisperKill, WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, DoubleZero, and AcidRain) to target Ukrainian companies and infrastructure.”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
- elogin[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.