SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zerocleare (Back to overview)

ZeroCleare

Actor(s): OilRig


ZeroCleare is a destructive malware. It has been developed in order to wipe the master boot record section in order to damage a disk's partitioning. Attackers use the EldoS RawDisk driver to perform the malicious action, which is not a signed driver and would therefore not runnable by default. The attackers managed to install it by using a vulnerable version of VBoxDrv driver, which the DSE accepts and runs. Used to attack middle-east energy and industrial sectors.

References
2022-09-26CrowdStrikeIoan Iacob, Iulian Madalin Ionita
@online{iacob:20220926:anatomy:248e6ff, author = {Ioan Iacob and Iulian Madalin Ionita}, title = {{The Anatomy of Wiper Malware, Part 3: Input/Output Controls}}, date = {2022-09-26}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/}, language = {English}, urldate = {2022-09-29} } The Anatomy of Wiper Malware, Part 3: Input/Output Controls
CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper Meteor Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-09-08MicrosoftMicrosoft Security Threat Intelligence
@online{intelligence:20220908:microsoft:66fa6e4, author = {Microsoft Security Threat Intelligence}, title = {{Microsoft investigates Iranian attacks against the Albanian government}}, date = {2022-09-08}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government}, language = {English}, urldate = {2022-09-13} } Microsoft investigates Iranian attacks against the Albanian government
ZeroCleare
2022-08-12CrowdStrikeIoan Iacob, Iulian Madalin Ionita
@online{iacob:20220812:anatomy:b13ce32, author = {Ioan Iacob and Iulian Madalin Ionita}, title = {{The Anatomy of Wiper Malware, Part 1: Common Techniques}}, date = {2022-08-12}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/}, language = {English}, urldate = {2023-01-19} } The Anatomy of Wiper Malware, Part 1: Common Techniques
Apostle CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper IsraBye KillDisk Meteor Olympic Destroyer Ordinypt Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare
2022-04-28FortinetGergely Revay
@online{revay:20220428:overview:0ac963f, author = {Gergely Revay}, title = {{An Overview of the Increasing Wiper Malware Threat}}, date = {2022-04-28}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/the-increasing-wiper-malware-threat}, language = {English}, urldate = {2022-04-29} } An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare
2021-02-28PWC UKPWC UK
@techreport{uk:20210228:cyber:bd780cd, author = {PWC UK}, title = {{Cyber Threats 2020: A Year in Retrospect}}, date = {2021-02-28}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf}, language = {English}, urldate = {2021-03-04} } Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Tonto Team
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA
2019-12-09IBM SecurityIBM IRIS
@online{iris:20191209:new:cc73a24, author = {IBM IRIS}, title = {{New Destructive Wiper “ZeroCleare” Targets Energy Sector in the Middle East}}, date = {2019-12-09}, organization = {IBM Security}, url = {https://www.ibm.com/downloads/cas/OAJ4VZNJ}, language = {English}, urldate = {2020-01-09} } New Destructive Wiper “ZeroCleare” Targets Energy Sector in the Middle East
ZeroCleare
Yara Rules
[TLP:WHITE] win_zerocleare_auto (20230125 | Detects win.zerocleare.)
rule win_zerocleare_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.zerocleare."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 394508 7c1f 3934bd40fd4400 7531 e8???????? }
            // n = 5, score = 100
            //   394508               | cmp                 dword ptr [ebp + 8], eax
            //   7c1f                 | jl                  0x21
            //   3934bd40fd4400       | cmp                 dword ptr [edi*4 + 0x44fd40], esi
            //   7531                 | jne                 0x33
            //   e8????????           |                     

        $sequence_1 = { 0f8480000000 8b08 8d5208 894af8 }
            // n = 4, score = 100
            //   0f8480000000         | je                  0x86
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   8d5208               | lea                 edx, [edx + 8]
            //   894af8               | mov                 dword ptr [edx - 8], ecx

        $sequence_2 = { c9 0400 6c c9 0400 }
            // n = 5, score = 100
            //   c9                   | leave               
            //   0400                 | add                 al, 0
            //   6c                   | insb                byte ptr es:[edi], dx
            //   c9                   | leave               
            //   0400                 | add                 al, 0

        $sequence_3 = { 3b0cc5b0da4300 7427 40 83f82d }
            // n = 4, score = 100
            //   3b0cc5b0da4300       | cmp                 ecx, dword ptr [eax*8 + 0x43dab0]
            //   7427                 | je                  0x29
            //   40                   | inc                 eax
            //   83f82d               | cmp                 eax, 0x2d

        $sequence_4 = { 83c414 85f6 79dd 8b4d08 8b45f8 83c118 }
            // n = 6, score = 100
            //   83c414               | add                 esp, 0x14
            //   85f6                 | test                esi, esi
            //   79dd                 | jns                 0xffffffdf
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   83c118               | add                 ecx, 0x18

        $sequence_5 = { 8b049540fd4400 8b440818 83f8ff 7409 }
            // n = 4, score = 100
            //   8b049540fd4400       | mov                 eax, dword ptr [edx*4 + 0x44fd40]
            //   8b440818             | mov                 eax, dword ptr [eax + ecx + 0x18]
            //   83f8ff               | cmp                 eax, -1
            //   7409                 | je                  0xb

        $sequence_6 = { 83c40c 85c0 744a 6a00 8d4c2418 }
            // n = 5, score = 100
            //   83c40c               | add                 esp, 0xc
            //   85c0                 | test                eax, eax
            //   744a                 | je                  0x4c
            //   6a00                 | push                0
            //   8d4c2418             | lea                 ecx, [esp + 0x18]

        $sequence_7 = { e8???????? 660fbe06 83c40c 0f57c0 c745e800000000 0f1145b8 6a00 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   660fbe06             | movsx               ax, byte ptr [esi]
            //   83c40c               | add                 esp, 0xc
            //   0f57c0               | xorps               xmm0, xmm0
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   0f1145b8             | movups              xmmword ptr [ebp - 0x48], xmm0
            //   6a00                 | push                0

        $sequence_8 = { 83c410 8b0c8d40fd4400 89440f20 8b45f8 89540f24 8bd6 8b4df4 }
            // n = 7, score = 100
            //   83c410               | add                 esp, 0x10
            //   8b0c8d40fd4400       | mov                 ecx, dword ptr [ecx*4 + 0x44fd40]
            //   89440f20             | mov                 dword ptr [edi + ecx + 0x20], eax
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   89540f24             | mov                 dword ptr [edi + ecx + 0x24], edx
            //   8bd6                 | mov                 edx, esi
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]

        $sequence_9 = { 46 3b35???????? 0f8ce1fdffff 8bbd14f8ffff 8b8518f8ffff }
            // n = 5, score = 100
            //   46                   | inc                 esi
            //   3b35????????         |                     
            //   0f8ce1fdffff         | jl                  0xfffffde7
            //   8bbd14f8ffff         | mov                 edi, dword ptr [ebp - 0x7ec]
            //   8b8518f8ffff         | mov                 eax, dword ptr [ebp - 0x7e8]

    condition:
        7 of them and filesize < 42670080
}
Download all Yara Rules