In early 2022, as tension around Ukraine escalated, several destructive tools appeared in quick succession. WhisperGate, a .NET wiper, came first, followed by new samples at the end of February. The sample later tagged as HermeticWiper, also called FoxBlade, reached public submission sites at the start of March.
What it touches
The malware starts several services whose job is to overwrite data in the usual user and system locations.
AppData
My Documents
Desktop
Windows
Program Files
Program Files (x86)
PerfLogs
Boot
It also decides what to wipe by comparing names against NTFS metadata strings such as the bitmap, the log file and the file system itself, which is how it goes beyond ordinary files to the structures that make a volume mountable.
Encryption and the end of the run
A 32-bit-key Blowfish routine is used on the data. Once finished, the program asks Windows for a shutdown through the standard shutdown API. After the restart the machine displays a boot failure message because the disk structures are gone.
Markers I used for identification
DeviceIoControl IOCTL and FSCTL requests (raw disk access)
\\.\PhysicalDrive%u direct physical drive handle
\\.\EPMNTDRV\%u driver device name
SeLoadDriverPrivilege required to install the helper driver
resources DRV_X64 DRV_X86 DRV_XP_X64 DRV_XP_X86
The driver variants are stored as resources and chosen according to the OS architecture, so the same wiper works on old and new Windows hosts.
Later builds
By the middle of March the samples had randomised names in place of normal Windows API references, while the logic stayed essentially the same as the first versions. Signatures that rely on API name strings therefore age quickly.
Sample
4aa186b5fdcc8248a9672bf21241f77dd395872ec4876c90af5d27ae565e4cb7