SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-wiper-malware
0
Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite primitives, boot-record tampering, mass-deletion and backup-destruction behavior, and distinguishing wipers from ransomware. Activates for requests to analyze a wiper, identify destructive disk-overwrite behavior, or tell a wiper apart from ransomware.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Wiper Malware ## When to Use - You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR tampering, and mass-deletion primitives. - You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom). **Do not use** this on a live host or by running the sample — destructive behavior is the threat. Analyze statically in isolation. ## Prerequisites - The sample, read inertly. ## Safety & Handling - Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory. ## Workflow ### Step 1: Detect destructive primitives ```bash python scripts/analyst.py scan sample.bin ``` Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns, `CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops. ### Step 2: Detect backup/recovery destruction Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and `wevtutil cl` (log clearing) — common wiper recovery-denial steps. ### Step 3: Distinguish wiper vs ransomware Weigh destruction-without-crypto and absence of a ransom note / key exchange against encryption-and-extortion indicators to classify intent. ### Step 4: Document Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps. ## Validation - Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO. - Recovery-denial commands are detected where present. - The wiper-vs-ransomware classification cites concrete evidence. ## Pitfalls - Disk utilities and secure-erase tools share these primitives — context is essential. - Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction). - Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill). ## References - See [`references/api-reference.md`](references/api-reference.md) for the scanner. - ATT&CK T1561 and T1485 (linked in frontmatter).