From the Labs: YARA Rule for Detecting Malware Wipers

As new cyber threats appear, our team of threat analysts are constantly working to respond and provide our customers - and the security community - with information and tools to defend their systems from attacks. Open source YARA rules for newly identified threats are a big part of this effort. Written by our threat analysts, our high-quality YARA rules are intended for threat hunters, incident responders, security analysts, and other defenders.

Our detection rules are high fidelity. As opposed to hunting rules, these detection rules must satisfy certain criteria to be eligible for deployment, namely: they must be as precise as possible, without losing detection quality. Also, our YARA rules aim to provide zero false-positive detections.

Below, you will find descriptions and links to our team’s newly published YARA rules. To understand more about the prerequisites for using them and also how to best deploy these, consult our Github page.

Detecting Weapons of Cyber Warfare

After the deployment of several cyber attacks on Ukraine’s institutions, our team responded with three new YARA rules, each of them containing conditions to detect these malicious threats.

HermeticWiper

HermeticWiper is a trojan malware that has been the primary cyber weapon currently being used on Ukraine’s government and financial institutions. First discovered by researchers at ESET, HermeticWiper was delivered in a coordinated campaign against pre-determined and localized targets in Ukraine. Analysis at SentinelLabs shows that the wiper malware specifically targets Windows devices, manipulating the master boot record (MBR) to cause boot failure. Though detected in Ukraine, HermeticWiper is capable of spreading beyond the country’s borders.

Link: Win32.Trojan.HermeticWiper.yara

IsaacWiper

Similar to HermeticWiper, IsaacWiper is also a trojan malware that wipes data on the systems it infects, making them inoperable. It was also discovered by ESET researchers, on the same day (February 24) that Russia began its invasion of Ukraine.To spread the IsaacWiper malware within their victims’ environments, attackers used RemCom, a remote access tool, and possibly Impacket, according to ESET. While it’s been used against similar targets as HermeticWiper, it is less sophisticated. For example, unlike HermeticWiper, IsaacWiper does not feature a signed executable and has a less advanced feature set.Link: