SYMBOLCOMMON_NAMEaka. SYNONYMS
win.isaacwiper (Back to overview)

IsaacWiper

aka: LASAINRAW

There is no description at this point.

References
2022-06-02MandiantMandiant
@online{mandiant:20220602:trending:0bcdbc4, author = {Mandiant}, title = {{TRENDING EVIL Q2 2022}}, date = {2022-06-02}, organization = {Mandiant}, url = {https://experience.mandiant.com/trending-evil-2/p/1}, language = {English}, urldate = {2022-06-07} } TRENDING EVIL Q2 2022
CloudEyE Cobalt Strike CryptBot Emotet IsaacWiper QakBot
2022-05-04Twitter (@ESETresearch)Twitter (@ESETresearch)
@online{esetresearch:20220504:twitter:48f1a89, author = {Twitter (@ESETresearch)}, title = {{Twitter thread on code similarity analysis, focussing on IsaacWiper and recent Cluster25 publication}}, date = {2022-05-04}, organization = {Twitter (@ESETresearch)}, url = {https://twitter.com/ESETresearch/status/1521910890072842240}, language = {English}, urldate = {2022-05-05} } Twitter thread on code similarity analysis, focussing on IsaacWiper and recent Cluster25 publication
IsaacWiper
2022-05-03Cluster25Cluster25
@online{cluster25:20220503:strange:1481afa, author = {Cluster25}, title = {{The Strange Link Between A Destructive Malware And A Ransomware-Gang Linked Custom Loader: IsaacWiper Vs Vatet}}, date = {2022-05-03}, organization = {Cluster25}, url = {https://cluster25.io/2022/05/03/a-strange-link-between-a-destructive-malware-and-the-loader-of-a-ransomware-group-isaacwiper-vs-vatet/}, language = {English}, urldate = {2022-05-04} } The Strange Link Between A Destructive Malware And A Ransomware-Gang Linked Custom Loader: IsaacWiper Vs Vatet
Cobalt Strike IsaacWiper PyXie
2022-05-02AT&TFernando Martinez
@online{martinez:20220502:analysis:e5d626b, author = {Fernando Martinez}, title = {{Analysis on recent wiper attacks: examples and how wiper malware works}}, date = {2022-05-02}, organization = {AT&T}, url = {https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works}, language = {English}, urldate = {2022-05-04} } Analysis on recent wiper attacks: examples and how wiper malware works
AcidRain CaddyWiper DoubleZero HermeticWiper INDUSTROYER2 IsaacWiper
2022-04-28FortinetGergely Revay
@online{revay:20220428:overview:0ac963f, author = {Gergely Revay}, title = {{An Overview of the Increasing Wiper Malware Threat}}, date = {2022-04-28}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat}, language = {English}, urldate = {2022-04-29} } An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare
2022-04-27MicrosoftMicrosoft Digital Security Unit (DSU)
@online{dsu:20220427:special:f1a2031, author = {Microsoft Digital Security Unit (DSU)}, title = {{Special Report: Ukraine An overview of Russia’s cyberattack activity in Ukraine}}, date = {2022-04-27}, organization = {Microsoft}, url = {https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd}, language = {English}, urldate = {2022-05-03} } Special Report: Ukraine An overview of Russia’s cyberattack activity in Ukraine
CaddyWiper DoubleZero HermeticWiper INDUSTROYER2 IsaacWiper PartyTicket WhisperGate
2022-03-25GOV.UAState Service of Special Communication and Information Protection of Ukraine (CIP)
@online{cip:20220325:who:e75f0ac, author = {State Service of Special Communication and Information Protection of Ukraine (CIP)}, title = {{Who is behind the Cyberattacks on Ukraine's Critical Information Infrastructure: Statistics for March 15-22}}, date = {2022-03-25}, organization = {GOV.UA}, url = {https://cip.gov.ua/en/news/khto-stoyit-za-kiberatakami-na-ukrayinsku-kritichnu-informaciinu-infrastrukturu-statistika-15-22-bereznya}, language = {English}, urldate = {2022-03-28} } Who is behind the Cyberattacks on Ukraine's Critical Information Infrastructure: Statistics for March 15-22
Xloader Agent Tesla CaddyWiper Cobalt Strike DoubleZero GraphSteel GrimPlant HeaderTip HermeticWiper IsaacWiper MicroBackdoor Pandora
2022-03-24Recorded FutureInsikt Group®
@online{group:20220324:isaacwiper:ee6aace, author = {Insikt Group®}, title = {{IsaacWiper Continues Trend of Wiper Attacks Against Ukraine}}, date = {2022-03-24}, organization = {Recorded Future}, url = {https://www.recordedfuture.com/isaacwiper-continues-trend-wiper-attacks-against-ukraine/}, language = {English}, urldate = {2022-03-25} } IsaacWiper Continues Trend of Wiper Attacks Against Ukraine
IsaacWiper
2022-03-24NextGovBrandi Vincent
@online{vincent:20220324:ukrainian:74b1566, author = {Brandi Vincent}, title = {{Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid}}, date = {2022-03-24}, organization = {NextGov}, url = {https://www.nextgov.com/cybersecurity/2022/03/ukrainian-cyber-lead-least-4-types-malware-are-targeting-ukrainian-institutions/363558/}, language = {English}, urldate = {2022-03-25} } Ukrainian Cyber Lead Says ‘At Least 4 Types of Malware’ in Use to Target Critical Infrastructure and Humanitarian Aid
CaddyWiper DoubleZero HermeticWiper IsaacWiper
2022-03-24Recorded FutureInsikt Group
@techreport{group:20220324:isaacwiper:82f3d6d, author = {Insikt Group}, title = {{IsaacWiper Continues Trend of Wiper Attacks Against Ukraine}}, date = {2022-03-24}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/mtp-2022-0324.pdf}, language = {English}, urldate = {2022-03-25} } IsaacWiper Continues Trend of Wiper Attacks Against Ukraine
IsaacWiper
2022-03-18MalwarebytesThreat Intelligence Team
@online{team:20220318:double:fde615f, author = {Threat Intelligence Team}, title = {{Double header: IsaacWiper and CaddyWiper}}, date = {2022-03-18}, organization = {Malwarebytes}, url = {https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/}, language = {English}, urldate = {2022-03-28} } Double header: IsaacWiper and CaddyWiper
CaddyWiper IsaacWiper
2022-03-14KasperskyGReAT
@online{great:20220314:webinar:f6bfb3c, author = {GReAT}, title = {{Webinar on cyberattacks in Ukraine – summary and Q&A}}, date = {2022-03-14}, organization = {Kaspersky}, url = {https://securelist.com/webinar-on-cyberattacks-in-ukraine-summary-and-qa/106075/}, language = {English}, urldate = {2022-04-05} } Webinar on cyberattacks in Ukraine – summary and Q&A
HermeticWiper HermeticWizard IsaacWiper PartyTicket WhisperGate
2022-03-11Security BoulevardTeri Robinson
@online{robinson:20220311:isaacwiper:1c63641, author = {Teri Robinson}, title = {{IsaacWiper Followed HermeticWiper Attack on Ukraine Orgs}}, date = {2022-03-11}, organization = {Security Boulevard}, url = {https://securityboulevard.com/2022/03/isaacwiper-followed-hermeticwiper-attack-on-ukraine-orgs/}, language = {English}, urldate = {2022-03-14} } IsaacWiper Followed HermeticWiper Attack on Ukraine Orgs
HermeticWiper IsaacWiper
2022-03-10BrightTALK (Kaspersky GReAT)Costin Raiu, Marco Preuss, Kurt Baumgartner, Dan Demeter, Ivan Kwiatkowski
@online{raiu:20220310:brighttalk:a3d9072, author = {Costin Raiu and Marco Preuss and Kurt Baumgartner and Dan Demeter and Ivan Kwiatkowski}, title = {{BrightTALK: A look at current cyberattacks in Ukraine}}, date = {2022-03-10}, organization = {BrightTALK (Kaspersky GReAT)}, url = {https://www.brighttalk.com/webcast/15591/534324}, language = {English}, urldate = {2022-04-05} } BrightTALK: A look at current cyberattacks in Ukraine
HermeticWiper HermeticWizard IsaacWiper PartyTicket WhisperGate
2022-03-04IBMJohn Dwyer, Kevin Henson
@online{dwyer:20220304:new:c661960, author = {John Dwyer and Kevin Henson}, title = {{New Wiper Malware Used Against Ukranian Organizations}}, date = {2022-03-04}, organization = {IBM}, url = {https://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/}, language = {English}, urldate = {2022-03-07} } New Wiper Malware Used Against Ukranian Organizations
IsaacWiper
2022-03-03LIFARSLIFARS
@online{lifars:20220303:closer:f29cc25, author = {LIFARS}, title = {{A Closer Look at the Russian Actors Targeting Organizations in Ukraine}}, date = {2022-03-03}, organization = {LIFARS}, url = {https://lifars.com/2022/03/a-closer-look-at-the-russian-actors-targeting-organizations-in-ukraine/}, language = {English}, urldate = {2022-03-04} } A Closer Look at the Russian Actors Targeting Organizations in Ukraine
HermeticWiper IsaacWiper Saint Bot WhisperGate
2022-03-01ESET ResearchESET Research
@online{research:20220301:isaacwiper:a2ff019, author = {ESET Research}, title = {{IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine}}, date = {2022-03-01}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/}, language = {English}, urldate = {2022-03-02} } IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine
HermeticWiper IsaacWiper PartyTicket
2022-03-01The Hacker NewsRavie Lakshmanan
@online{lakshmanan:20220301:second:994dc73, author = {Ravie Lakshmanan}, title = {{Second New 'IsaacWiper' Data Wiper Targets Ukraine After Russian Invasion}}, date = {2022-03-01}, organization = {The Hacker News}, url = {https://thehackernews.com/2022/03/second-new-isaacwiper-data-wiper.html}, language = {English}, urldate = {2022-03-07} } Second New 'IsaacWiper' Data Wiper Targets Ukraine After Russian Invasion
IsaacWiper
2022-02-28MicrosoftMSRC Team
@online{team:20220228:cyber:8ef46fd, author = {MSRC Team}, title = {{Cyber threat activity in Ukraine: analysis and resources}}, date = {2022-02-28}, organization = {Microsoft}, url = {https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine}, language = {English}, urldate = {2022-03-07} } Cyber threat activity in Ukraine: analysis and resources
HermeticWiper IsaacWiper PartyTicket WhisperGate
Yara Rules
[TLP:WHITE] win_isaacwiper_auto (20220516 | Detects win.isaacwiper.)
rule win_isaacwiper_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.isaacwiper."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { d1f8 8d044502000000 50 8bc1 8bce 50 e8???????? }
            // n = 7, score = 100
            //   d1f8                 | sar                 eax, 1
            //   8d044502000000       | lea                 eax, [eax*2 + 2]
            //   50                   | push                eax
            //   8bc1                 | mov                 eax, ecx
            //   8bce                 | mov                 ecx, esi
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 894514 c7422000000000 c7422400000000 e8???????? 8b942484000000 83c430 }
            // n = 6, score = 100
            //   894514               | mov                 dword ptr [ebp + 0x14], eax
            //   c7422000000000       | mov                 dword ptr [edx + 0x20], 0
            //   c7422400000000       | mov                 dword ptr [edx + 0x24], 0
            //   e8????????           |                     
            //   8b942484000000       | mov                 edx, dword ptr [esp + 0x84]
            //   83c430               | add                 esp, 0x30

        $sequence_2 = { 8bf0 6a01 e8???????? 894604 8d5f24 897734 8d4708 }
            // n = 7, score = 100
            //   8bf0                 | mov                 esi, eax
            //   6a01                 | push                1
            //   e8????????           |                     
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   8d5f24               | lea                 ebx, [edi + 0x24]
            //   897734               | mov                 dword ptr [edi + 0x34], esi
            //   8d4708               | lea                 eax, [edi + 8]

        $sequence_3 = { 8b06 83c404 8bce ff5004 8d4df8 8935???????? e8???????? }
            // n = 7, score = 100
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   83c404               | add                 esp, 4
            //   8bce                 | mov                 ecx, esi
            //   ff5004               | call                dword ptr [eax + 4]
            //   8d4df8               | lea                 ecx, [ebp - 8]
            //   8935????????         |                     
            //   e8????????           |                     

        $sequence_4 = { 03fb 13c8 0faccf03 c1e903 8bc7 0bc1 894dfc }
            // n = 7, score = 100
            //   03fb                 | add                 edi, ebx
            //   13c8                 | adc                 ecx, eax
            //   0faccf03             | shrd                edi, ecx, 3
            //   c1e903               | shr                 ecx, 3
            //   8bc7                 | mov                 eax, edi
            //   0bc1                 | or                  eax, ecx
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

        $sequence_5 = { 0f94c1 fec9 8b1485e8670310 80e102 8a44172d 24fd 0ac8 }
            // n = 7, score = 100
            //   0f94c1               | sete                cl
            //   fec9                 | dec                 cl
            //   8b1485e8670310       | mov                 edx, dword ptr [eax*4 + 0x100367e8]
            //   80e102               | and                 cl, 2
            //   8a44172d             | mov                 al, byte ptr [edi + edx + 0x2d]
            //   24fd                 | and                 al, 0xfd
            //   0ac8                 | or                  cl, al

        $sequence_6 = { 52 51 e8???????? 83c408 33ff 39bc24181a0000 }
            // n = 6, score = 100
            //   52                   | push                edx
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   33ff                 | xor                 edi, edi
            //   39bc24181a0000       | cmp                 dword ptr [esp + 0x1a18], edi

        $sequence_7 = { 7436 2bd7 8d8c2498010000 8b7c242c 03cf 6bc268 ba900a0000 }
            // n = 7, score = 100
            //   7436                 | je                  0x38
            //   2bd7                 | sub                 edx, edi
            //   8d8c2498010000       | lea                 ecx, [esp + 0x198]
            //   8b7c242c             | mov                 edi, dword ptr [esp + 0x2c]
            //   03cf                 | add                 ecx, edi
            //   6bc268               | imul                eax, edx, 0x68
            //   ba900a0000           | mov                 edx, 0xa90

        $sequence_8 = { 8b5dfc 8bd3 8b4de0 6a01 e8???????? 8b7df4 8ac8 }
            // n = 7, score = 100
            //   8b5dfc               | mov                 ebx, dword ptr [ebp - 4]
            //   8bd3                 | mov                 edx, ebx
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   6a01                 | push                1
            //   e8????????           |                     
            //   8b7df4               | mov                 edi, dword ptr [ebp - 0xc]
            //   8ac8                 | mov                 cl, al

        $sequence_9 = { baffffff7f 8bc2 56 8b7508 8b4b10 2bc1 894dfc }
            // n = 7, score = 100
            //   baffffff7f           | mov                 edx, 0x7fffffff
            //   8bc2                 | mov                 eax, edx
            //   56                   | push                esi
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8b4b10               | mov                 ecx, dword ptr [ebx + 0x10]
            //   2bc1                 | sub                 eax, ecx
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

    condition:
        7 of them and filesize < 467968
}
Download all Yara Rules