HermeticWiperMalware
- driveslayer
- foxblade
- killdisk.ncv
- nearmiss
- trojan.killdisk
According to SentinelLabs, HermeticWiper is a custom-written application with very few standard functions. It abuses a signed driver called "empntdrv.sys" which is associated with the legitimate Software "EaseUS Partition Master Software" to enumerate the MBR and all partitions of all Physical Drives connected to the victims Windows Device and overwrite the first 512 Bytes of every MBR and…From MISP Galaxy
Last reported 8 months ago, by ESET WeLiveSecurity2 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping: LSASS Memory”
- T1003.001LSASS Memory
“T1003.001”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“T1053.005”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
DynoWiper update: Technical analysis and attribution“Over the years, Sandworm has deployed a wide range of destructive malware families, including, in roughly chronological order, HermeticWiper, HermeticRansom, CaddyWiper, DoubleZero, ARGUEPATCH, ORCSHRED, SOLOSHRED, AWFULSHRED, Prestige ransomware, RansomBoggs ransomware, SDelete-…”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“During the ongoing crisis, state-sponsored groups used at least seven different wipers (WhisperKill, WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, DoubleZero, and AcidRain) to target Ukrainian companies and infrastructure.”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
- elogin[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.