WhisperGateMalware
- paywipe
Destructive malware deployed against targets in Ukraine in January 2022.From MISP Galaxy
Last reported 3 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 - Obfuscated Files or Information”
- T1036Masquerading
“Malicious Behaviour Prevention Alert - Binary Masquerading via Untrusted Path”
- T1047Windows Management Instrumentation
“T1047 - Windows Management Instrumentation”
- T1055Process Injection
“T1055 - Process Injection”
- T1055.012Process Hollowing
“Techniques observed include process hollowing, tampering with Windows Defender, using a Master Boot Record (MBR) wiper, and file corruptor component”
- T1102Web Service
“T1102 - Web Service”
What the reports say
2 reports, newest first · the exact sentence from each-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“During the ongoing crisis, state-sponsored groups used at least seven different wipers (WhisperKill, WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, DoubleZero, and AcidRain) to target Ukrainian companies and infrastructure.”
-
Operation Bleeding Bear“In a multi-staged attack, one malware component known as WhisperGate utilizes a wiping capability on the Master Boot Record (MBR), making any machine impacted inoperable after boot-up.”
Indicators in its reports
named in the reports above- process[.]pein 1 report
- 111.111.111[.]111in 1 report
- a196c6b8ffcb97ff…f56f36a38e92in 1 report
- dcbbae5a1c61dbbb…9384081c9b78in 1 report
- 34ca75a8c190f20b…5b61ac7ea907in 1 report
- 923eb77b3c9e11d6…eeb73d1accd6in 1 report
- 9ef7dbd3da51332a…a07d716d892din 1 report
- elogin[.]comin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.