Glass viper gui drivers#
Glass viper gui driver#
Glass viper gui 32 bit#
Glass viper gui code#

In a nutshell, this legitimatedriver lets the attackers bypass some windows security mechanisms which would ideally be forbidden from usermode such as writing to certain sectors of the raw disk.

Glass viper gui driver#

That means that, when different operations are requested to the driver from usermode, the real operation will be performed over the machine physical disks.Įxample of EaseUS driver handling IOCTL write operationsīy using FsContext2 field saved by a CreateFileoperation performed from usermode, this driver could be seen as a proxy driver where IRPs are handled by underlying devices.

These objects will be used later in read and write operations. To confirm that the lower device object is indeed the one we are looking for we check the ServiceKeyName of the object with 'Disk' which indicates that its looking for the disk.sys object as the ServiceKeyName for that object is 'Disk'. The DeviceObject pointer in getDeviceObject is used to find the disk.sys associated device object by traversing to the lowest device object leveraging IoGetLowerDeviceObject function. The DeviceObject pointer in getDeviceObject is used to find IRP_MJ_CREATE function will save a Device Object pointer for the hard disk in FsContext2 attribute (returned by getDeviceObject helper function). IRP_MJ_CREATE function will save a Device Object pointer for the hard disk in FsContext2 attribute, returned by getDeviceObject helper function. Parameter handling shown in a kernelmode live debugging session As told, this tool is legitimate so no one was detecting the sample in VirusTotal at the time of the attack:

Glass viper gui drivers#

The drivers leveraged by HermeticWiper are part of the Suite from EaseUS, a legitimate software that brings to the user disk functionalities like partitioning and resizing. Each of them comes with a Debug directory, including a PDB path. Probably they have been stolen by the attackers from an original, legitimate software bundle.

Glass viper gui code#

We can also make our own decoding tool, basing on the malware code ( example).Īs a result we get 4 versions of legitimate drivers from the EaseUS Partition Master – just as reported by ESET ( source). This format of compression is supported by a popular extraction tool, 7zip. It is not a cynical joke of the attackers, but just a standard icon for a Visual Studio GUI project.Ĭode responsible of decompress drivers compressed by LZMA algorithm and driver installation

Glass viper gui 32 bit#

Behavioral analysisįirst, what we see is a 32 bit Windows executable with an icon resembling a gift. We obtained samplesand in this post we will take apart this new malware.

In addition, the attackers wanted to fragment files on disk and overwrite them to make recovery impossible.Īs we were analyzing this data wiper, other researchhas come out detailing additional components were used in this campaign, including a worm and typical ransomware thankfully poorly implementedand decryptable. This wiper is remarkable for its ability to bypass Windows security features and gain write access to many low-level data-structures on the disk.

This malware was given the name 'HermeticWiper' based on a stolen digital certificate from a company called Hermetica Digital Ltd. The day before the invasion on Ukraine by Russian forces on February 24, a new data wiperwas found to be unleashed against a number of Ukrainian entities. The implementation and quality of those wipers vary, and may suggest different hired developers. This blog post was authored by Hasherezade, Ankur Saini and Roberto Santosĭisk wipers are one particular type of malware often used against Ukraine.