analyzing-wiper-malware

Name: analyzing-wiper-malware
Author: meltedinhex

18stars5forks

How to install analyzing-wiper-malware?

meltedinhex/analyst-ai-pack/analyzing-wiper-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-wiper-malware

Installs into the current project.

Summary

Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Wiper Malware
2
3	## When to Use
4
5	- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
6	tampering, and mass-deletion primitives.
7	- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
8
9	Do not use this on a live host or by running the sample — destructive behavior is the threat.
10	Analyze statically in isolation.
11
12	## Prerequisites
13
14	- The sample, read inertly.
15
16	## Safety & Handling
17
18	- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
19
20	## Workflow
21
22	### Step 1: Detect destructive primitives
23
24	```bash
25	python scripts/analyst.py scan sample.bin
26	```
27
28	Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
29	`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.
30
31	### Step 2: Detect backup/recovery destruction
32
33	Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
34	`wevtutil cl` (log clearing) — common wiper recovery-denial steps.
35
36	### Step 3: Distinguish wiper vs ransomware
37
38	Weigh destruction-without-crypto and absence of a ransom note / key exchange against
39	encryption-and-extortion indicators to classify intent.
40
41	### Step 4: Document
42
43	Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
44
45	## Validation
46
47	- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
48	- Recovery-denial commands are detected where present.
49	- The wiper-vs-ransomware classification cites concrete evidence.
50
51	## Pitfalls
52
53	- Disk utilities and secure-erase tools share these primitives — context is essential.
54	- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
55	- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
60	- ATT&CK T1561 and T1485 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-wiper-malware

18stars5forks

View on GitHub

How to install analyzing-wiper-malware?

meltedinhex/analyst-ai-pack/analyzing-wiper-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-wiper-malware

Installs into the current project.

Summary

Analyzes destructive wiper malware by identifying raw-disk and MBR/VBR overwrite

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Wiper Malware
2
3	## When to Use
4
5	- You have a sample suspected of destructive intent and need to identify disk-overwrite, MBR/VBR
6	tampering, and mass-deletion primitives.
7	- You must distinguish a wiper (irreversible destruction) from ransomware (encryption for ransom).
8
9	Do not use this on a live host or by running the sample — destructive behavior is the threat.
10	Analyze statically in isolation.
11
12	## Prerequisites
13
14	- The sample, read inertly.
15
16	## Safety & Handling
17
18	- Read bytes statically; never execute. A wiper run is unrecoverable — isolation is mandatory.
19
20	## Workflow
21
22	### Step 1: Detect destructive primitives
23
24	```bash
25	python scripts/analyst.py scan sample.bin
26	```
27
28	Flags raw-disk handles (`\\.\PhysicalDrive`, `\\.\C:`), `DeviceIoControl`, MBR/VBR write patterns,
29	`CreateFileMapping` over the boot sector, and bulk `DeleteFile`/overwrite loops.
30
31	### Step 2: Detect backup/recovery destruction
32
33	Surface `vssadmin delete shadows`, `wbadmin delete`, `bcdedit /set recoveryenabled no`, and
34	`wevtutil cl` (log clearing) — common wiper recovery-denial steps.
35
36	### Step 3: Distinguish wiper vs ransomware
37
38	Weigh destruction-without-crypto and absence of a ransom note / key exchange against
39	encryption-and-extortion indicators to classify intent.
40
41	### Step 4: Document
42
43	Record the destruction method (overwrite pattern, MBR vs file-level) and recovery-denial steps.
44
45	## Validation
46
47	- Destructive primitives reference real raw-disk/boot-record APIs, not generic file IO.
48	- Recovery-denial commands are detected where present.
49	- The wiper-vs-ransomware classification cites concrete evidence.
50
51	## Pitfalls
52
53	- Disk utilities and secure-erase tools share these primitives — context is essential.
54	- Pseudo-ransomware wipers that display a note but cannot decrypt (intent is destruction).
55	- Bootloader-only wipers needing boot-sector analysis (pair with the rootkit/bootkit skill).
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
60	- ATT&CK T1561 and T1485 (linked in frontmatter).

People who liked this also viewed

6 picks

Type