ZeroCleare (Malware Family)

ZeroCleare

Actor(s): OilRig

VTCollection

ZeroCleare is a destructive malware. It has been developed in order to wipe the master boot record section in order to damage a disk's partitioning. Attackers use the EldoS RawDisk driver to perform the malicious action, which is not a signed driver and would therefore not runnable by default. The attackers managed to install it by using a vulnerable version of VBoxDrv driver, which the DSE accepts and runs. Used to attack middle-east energy and industrial sectors.

References

2022-09-26 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 3: Input/Output Controls
CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper Meteor Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare

2022-09-08 ⋅ Microsoft ⋅ Microsoft Security Threat Intelligence
Microsoft investigates Iranian attacks against the Albanian government
ZeroCleare

2022-08-12 ⋅ CrowdStrike ⋅ Ioan Iacob, Iulian Madalin Ionita
The Anatomy of Wiper Malware, Part 1: Common Techniques
Apostle CaddyWiper DEADWOOD DistTrack DoubleZero DUSTMAN HermeticWiper IsaacWiper IsraBye KillDisk Meteor Olympic Destroyer Ordinypt Petya Sierra(Alfa,Bravo, ...) StoneDrill WhisperGate ZeroCleare

2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare

2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team

2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle

2019-12-09 ⋅ IBM Security ⋅ IBM IRIS
New Destructive Wiper “ZeroCleare” Targets Energy Sector in the Middle East
ZeroCleare

Yara Rules

[TLP:WHITE] win_zerocleare_auto (20260917 | Detects win.zerocleare.)

rule win_zerocleare_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.zerocleare."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 838518f8ffff08 c785dcf7ffff00000000 8985e0f7ffff eb19 8d85dcf7ffff 50 51 }
            // n = 7, score = 100
            //   838518f8ffff08       | add                 dword ptr [ebp - 0x7e8], 8
            //   c785dcf7ffff00000000     | mov    dword ptr [ebp - 0x824], 0
            //   8985e0f7ffff         | mov                 dword ptr [ebp - 0x820], eax
            //   eb19                 | jmp                 0x1b
            //   8d85dcf7ffff         | lea                 eax, [ebp - 0x824]
            //   50                   | push                eax
            //   51                   | push                ecx

        $sequence_1 = { 8b0c8d40fd4400 8a443928 a840 7508 }
            // n = 4, score = 100
            //   8b0c8d40fd4400       | mov                 ecx, dword ptr [ecx*4 + 0x44fd40]
            //   8a443928             | mov                 al, byte ptr [ecx + edi + 0x28]
            //   a840                 | test                al, 0x40
            //   7508                 | jne                 0xa

        $sequence_2 = { 741b 8bd0 c1fa06 8bf8 83e73f 6bdf38 031c9540fd4400 }
            // n = 7, score = 100
            //   741b                 | je                  0x1d
            //   8bd0                 | mov                 edx, eax
            //   c1fa06               | sar                 edx, 6
            //   8bf8                 | mov                 edi, eax
            //   83e73f               | and                 edi, 0x3f
            //   6bdf38               | imul                ebx, edi, 0x38
            //   031c9540fd4400       | add                 ebx, dword ptr [edx*4 + 0x44fd40]

        $sequence_3 = { 8b75e0 8975ec 56 c645fc03 }
            // n = 4, score = 100
            //   8b75e0               | mov                 esi, dword ptr [ebp - 0x20]
            //   8975ec               | mov                 dword ptr [ebp - 0x14], esi
            //   56                   | push                esi
            //   c645fc03             | mov                 byte ptr [ebp - 4], 3

        $sequence_4 = { 755d 83c008 3bc1 75f3 8b8d1cf8ffff }
            // n = 5, score = 100
            //   755d                 | jne                 0x5f
            //   83c008               | add                 eax, 8
            //   3bc1                 | cmp                 eax, ecx
            //   75f3                 | jne                 0xfffffff5
            //   8b8d1cf8ffff         | mov                 ecx, dword ptr [ebp - 0x7e4]

        $sequence_5 = { 5d c3 e9???????? 3b0d???????? f27502 f2c3 f2e920080000 }
            // n = 7, score = 100
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   e9????????           |                     
            //   3b0d????????         |                     
            //   f27502               | bnd jne             5
            //   f2c3                 | bnd ret             
            //   f2e920080000         | bnd jmp             0x826

        $sequence_6 = { c745e4ad184200 eb08 8d4dd8 e8???????? 837e1808 74f2 8bce }
            // n = 7, score = 100
            //   c745e4ad184200       | mov                 dword ptr [ebp - 0x1c], 0x4218ad
            //   eb08                 | jmp                 0xa
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]
            //   e8????????           |                     
            //   837e1808             | cmp                 dword ptr [esi + 0x18], 8
            //   74f2                 | je                  0xfffffff4
            //   8bce                 | mov                 ecx, esi

        $sequence_7 = { f7770c 83ee01 8bd8 7826 2bf3 33c9 }
            // n = 6, score = 100
            //   f7770c               | div                 dword ptr [edi + 0xc]
            //   83ee01               | sub                 esi, 1
            //   8bd8                 | mov                 ebx, eax
            //   7826                 | js                  0x28
            //   2bf3                 | sub                 esi, ebx
            //   33c9                 | xor                 ecx, ecx

        $sequence_8 = { 8d7801 2b0b b8abaaaa2a f7e9 b8aaaaaa0a }
            // n = 5, score = 100
            //   8d7801               | lea                 edi, [eax + 1]
            //   2b0b                 | sub                 ecx, dword ptr [ebx]
            //   b8abaaaa2a           | mov                 eax, 0x2aaaaaab
            //   f7e9                 | imul                ecx
            //   b8aaaaaa0a           | mov                 eax, 0xaaaaaaa

        $sequence_9 = { 83c8ff eb07 8b04cdd40a4400 5f 5e 5b }
            // n = 6, score = 100
            //   83c8ff               | or                  eax, 0xffffffff
            //   eb07                 | jmp                 9
            //   8b04cdd40a4400       | mov                 eax, dword ptr [ecx*8 + 0x440ad4]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

    condition:
        7 of them and filesize < 42670080
}

Download all Yara Rules

ZeroCleare Propose Change

References

Yara Rules

ZeroCleare