{ "id": "b6256929-8d57-462c-ba6d-5ab9edded5c4", "created_at": "2026-04-06T00:11:54.523124Z", "updated_at": "2026-04-10T03:20:01.973489Z", "deleted_at": null, "sha1_hash": "e010faf53a95d29f46b4f42ab897610af2a251fb", "title": "New wiper malware used against Ukrainian organizations", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 53989, "plain_text": "New wiper malware used against Ukrainian organizations\r\nBy John Dwyer, Kevin Henson\r\nPublished: 2022-03-04 · Archived: 2026-04-05 21:59:08 UTC\r\nMarch 7, 2022 Update\r\nA correction has been applied to this blog, further analysis of the wiper malware revealed that the wiper leverages\r\nan implementation of the Mersenne Twister pseudorandom number generator (PRNG) and not ISAAC PRNG as\r\noriginally reported. This blog has been updated to changing references from ISAAC PRNG to Mersenne Twister\r\nPRNG.\r\nOn February 24, 2022, ESET reported another destructive wiper detected at a Ukrainian government organization\r\ndubbed as IsaacWiper. This is the third sample of malware IBM Security X-Force has analyzed which has been\r\nreportedly targeting systems belonging to Ukrainian organizations. IBM Security X-Force obtained a sample of\r\nthe IsaacWiper malware and has provided the following technical analysis, indicators of compromise and\r\ndetections.\r\nIsaacWiper is a destructive C++ malware that has been reported as being used in targeted campaigns against\r\nUkraine organizations. The original filename of the analyzed sample is “Cleaner.dll” and contains a compile date\r\nof February 25, 2022, 15:48:07 UTC.\r\nUpon execution, the function Start() is executed which begins by creating a log file within %ProgramData%.\r\nFollowing the creation of the log file, the wiper enumerates all physical drives on the target system by calling\r\nDeviceIoControl() with the control code IOCTL_STORAGE_GET_DEVICE_ NUMBER. IsaacWiper checks the\r\nresulting physical drive list for devices with type 7 (FILE_DEVICE_DISK) to identify disk volumes and physical\r\ndrives. With a list of disk objects, IsaacWiper leverages IOCTL_DISK_GET_DRIVE_GEOMETRY_EX and\r\nGetDiskFreeSpaceExW() to obtain the size and available free space of each disk.\r\nLogfile %ProgramData%\\log.txt generated by the IsaacWiper sample analyzed by IBM Security X-Force:\r\n getting drives...\r\n physical drives:\r\n -- system physical drive 0: PhysicalDrive0\r\n logical drives:\r\n -- system logical drive: C:\r\n -- logical drive: D:\r\n start erasing system physical drive...\r\n system physical drive -- FAILED\r\n start erasing system logical drive C:\r\n \r\nhttps://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/\r\nPage 1 of 4\n\nTo begin the wiping activity, IsaacWiper leverages CreateFileW() and DeviceIoControl() with control code\r\nFSCTL_LOCK_VOLUME to lock the drive. With the drive locked, the wiper function first targets the\r\nPhysicalDrive by generating data created with a Mersenne Twister pseudorandom number generator (PRNG) and\r\noverwriting the first 0x100000 bytes of the physical drive with the PRNG data.\r\nAfter overwriting the PhysicalDrive, the malware starts overwriting drives and files. If the wiper can’t open a file,\r\nthe file is renamed to a temporary file containing “Tmf” and a random four-character string\r\n(example:Tmf3360.tmp) and overwritten with Mersenne Twister PRNG data.\r\nIf a volume can’t be accessed, the wiper creates a hidden temporary directory and writes a file to it at the root of\r\nthe volume (ex: %SystemDrive%\\Tmd1234.tmp\\Tmf5432.tmp). The temporary file Tmf5432.tmp is then filled\r\nwith random data until the volume is out of space.\r\nMersenne Twister pseudorandom number generator (PRNG) data generation in the IsaacWiper sample analyzed\r\nby IBM Security X-Force.\r\nIBM Security X-Force has developed the following Yara signature to help identify instances of the IsaacWiper\r\nmalware:\r\n import \"pe\"\r\n rule XFTI_IsaacWiper : IsaacWiper\r\n {\r\n meta:\r\n author = \"IBM X-Force Threat Intelligence Malware Team\"\r\n description = \"Detects the IsaacWiper destructive malware based the debug messages and imports.\"\r\n threat_type = \"Malware\"\r\n rule_category = \"Malware Family\"\r\n usage = \"Hunting and Identification\"\r\n hash = \"13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033\"\r\n yara_version = \"4.0.2\"\r\n date_created = \"3 Mar 22\"\r\n date_updated = \"\"\r\n reference = \"\"\r\n strings:\r\n $log_s6 = \"getting drives\" ascii wide nocase\r\n $log_s7 = \"start erasing physical drives\" ascii wide nocase\r\n $log_s8 = \"start erasing logical drive\" ascii wide nocase\r\n $log_s9 = \"start erasing system physical drive\" ascii wide nocase\r\n $log_s10 = \"system physical drive\" ascii wide nocase\r\n $log_s11 = \"start erasing system logical drive\" ascii wide nocase\r\n condition:\r\n 3 of ($log*) and (pe.dll_name == \"Cleaner.dll\" or\r\n (pe.imports(\"kernel32.dll\", \"GetTickCount\") and\r\n pe.imports(\"kernel32.dll\", \"DeviceIoControl\")))\r\nhttps://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/\r\nPage 2 of 4\n\n}\r\n \r\n Tmd\u003c4 char\u003e.tmp\r\n Tmf\u003c4 char\u003e.tmp\r\n%ProgramData%\\log.txt\r\n PhysicalDrive\r\n \\\\.\\\r\n *.*\r\n C:\\ProgramData\\log.txt\r\n getting drives...\r\n physical drives:\r\n -- system physical drive\r\n -- physical drive\r\n logical drives:\r\n -- system logical drive:\r\n -- logical drive:\r\n start erasing physical drives...\r\n -- FAILED\r\n physical drive\r\n -- start erasing logical drive\r\n start erasing system physical drive...\r\n system physical drive -- FAILED\r\n start erasing system logical drive\r\n Cleaner.dll\r\n _Start@4\r\nAt this time, X-Force recommends organizations consider implementing the indicators listed in this report into\r\ntheir security operations. Additionally, global businesses should seek to establish sound insight into their\r\nrespective networks, supply chains, third parties and partnerships that are based in, or serve in, region institutions.\r\nIt is also advised that organizations open lines of communication between relevant information sharing entities to\r\nensure the receipt and exchange of actionable indicators.\r\nIf you have questions and want a deeper discussion about the malware and prevention techniques, you can\r\nschedule a briefing here. Get the latest updates as more information develops on the IBM Security X-Force\r\nExchange and the IBM PSIRT blog.\r\nIf you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 |\r\nGlobal hotline (+001) 312-212-8034.\r\nMore cybersecurity threat resources are available here.\r\nhttps://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/\r\nPage 3 of 4\n\nSource: https://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/\r\nhttps://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "ETDA" ], "references": [ "https://securityintelligence.com/posts/new-wiper-malware-used-against-ukranian-organizations/" ], "report_names": [ "new-wiper-malware-used-against-ukranian-organizations" ], "threat_actors": [], "ts_created_at": 1775434314, "ts_updated_at": 1775791201, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/e010faf53a95d29f46b4f42ab897610af2a251fb.pdf", "text": "https://archive.orkl.eu/e010faf53a95d29f46b4f42ab897610af2a251fb.txt", "img": "https://archive.orkl.eu/e010faf53a95d29f46b4f42ab897610af2a251fb.jpg" } }