Cl Wiper

Description

(Check Point) How it works: cl.exe gets arguments from the command line and uses a legitimate driver by ElRawDisk, called rwdsk.sys. The use of ElRawDisk is relatively common among wipers and has been previously used by several wiper families, some of them associated with Iranian actors. Additionally, the license key used in the wiper is the same as the one used in the ZeroCleare wiper, which is known to be used by several actors with links to MOIS. ElRawDisk enables interaction with files, disks, and partitions, proxying the wiping procedures and allowing raw access to the disk.

Names

Name
Cl Wiper

Category

Malware

Type

• Wiper

Information

• https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a

Other Information

Uuid

4b8d6551-2aed-451d-adc9-7070a040f833

Last Card Change

2024-06-18