#gigawiper

Modular malware isn’t precisely new. In fact, it’s something I covered last year when I was still finding my footing with this blog nearly a year ago. It’s an evolution towards versatility, combining disparate tactics in one place, allowing threat actors to pick and choose how they want to deploy a tool kit. Some create backdoors in combination with ransomware. Some are scanners or keyloggers using Trojan capabilities to maintain persistence. Some are wipers, destructive malware with no other purpose than to delete files.

Some are all three.

Last October the Microsoft Threat Intelligence team began analyzing an emerging modular malware using a Golang based backdoor combined with a destructive wiper. Analysis takes time, especially when determining the infrastructure and architecture of a particular malware family, never mind more than one. And tracking what happened when the compromise involves deletion is difficult; the files are gone, after all. They’ve called this GigaWiper, an amalgamation of at least three malware families that were folded together as on-demand backdoor commands.

It contains a standalone wiper that operates at the physical disk level, overwriting raw disk content and removing partition metadata, a destructive command that derives from Crucio ransomware and encrypts files with randomly generated keys that are never saved, making decryption impossible, and a wiping command that reimplements the logic of FlockWiper, a C-based malware reimplemented in Golang with additional multi-pass secure wiping. The article goes into further detail, breaking down the anatomy of GigaWiper. But the key points are these: it uses two forms to execute, a single binary capable of deleting entire physical drives and a larger binary in concert with a backdoor. It also has two forms of communication back to the command-and-control server: RabbitMQ over AMQP for receiving commands from the C2 server, and Redis server for updating command status and output.

As if the wiper itself is not catastrophic enough for a system, the commands issues through the C2 compound it. The team identified twenty of them. Among them are, Command One which runs WipeMain, a command that’s effectively identical to the binary wiper. Command Two triggers a bluescreen error (BSOD), and prevents booting. Command Three runs a file encryption process that imitates ransomware through RanMain and BigBangExtortMain. It also drops an image file that replaces the existing wallpaper, a way to tell the user they’ve been hacked presumably. Command Four uses MinIO Client (mc) to upload a file to a remote storage. Other commands cover such things as file encryption, shell commands, taking periodic screenshots of the victim’s monitor, recording activity by the victim, data scraping, deleting security logs, and running remote control over the keyboard and mouse. Lastly, the malware creates rules to allow inbound and outbound traffic to its own program over a port provided in the command arguments. As several commands overlap each other (the wipers), the team determined that at least three separate malware families have been integrated into this module infection based on code analysis, shared execution flow, function naming, and unique strings.

A wiper attack is frankly terrifying, but defending against it isn’t that hard. It requires hardening of a system in the first place and some basic online safety. Tamper protection features prevent attackers from shutting down existing security. Microsoft included this tutorial in the article. Block access to known C2 infrastructure where possible. Turn on cloud-delivered protection in one’s antivirus software, since one of the vectors of intrusion is through OneDrive. Use endpoint detection and response in block mode, which will block malicious artifacts even when other forms of security are running passively or failed to detect the intrusion. Trojans are very good at evasion; that’s how they function. Keep offline backups of important or sensitive data (external hard drives are still a thing and enterprises should be using them instead of reliance solely upon the cloud).

And above all, be aware. The admonition against clicking untrusted links stands. Look at source codes in URL’s, don’t download things from third parties, be mindful of phishing. And remember that your friendly neighborhood WISP is here to help.