KillDisk (Malware Family)
By Fraunhofer FKIE
Archived: 2026-04-05 16:38:49 UTC
KillDisk is a generic detection name used by ESET to refer to destructive malware with disk wiping capabilities,
such as damaging boot sectors and overwriting then deleting (system) files, followed by a reboot to render the
machine unusable. Although all KillDisk malware has similar functionality, as a generic detection, individual
samples do not necessarily have strong code similarities or relationships. Such generic malware detections usually
have many “sub-families”, distinguished by the detection suffix (e.g. KillDisk.NBO, KillDisk.NCV, and
KillDisk.NCX). Sub-family variants that do have strong code similarities, are sometimes seen in separate
cyberattacks and thus can help researchers make connections between them.
[TLP:WHITE] win_killdisk_auto (20251219 | Detects win.killdisk.)
Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk
https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk
Page 1 of 1