Wiper
HermeticWiper
aka DriveSlayer · FoxBlade · KillDisk.NCV · NEARMISS
According to SentinelLabs, HermeticWiper is a custom-written application with very few standard functions.
HermeticWiper, also known as DriveSlayer, FoxBlade, KillDisk.NCV, NEARMISS, is a Windows wiper.
Background
SentinelLabs describes HermeticWiper as a bespoke application that relies on very few standard functions. It misuses a signed driver named "empntdrv.sys", tied to the legitimate "EaseUS Partition Master Software", to enumerate the MBR and every partition of all physical drives attached to the victim's Windows device, then overwrites the first 512 bytes of each MBR and partition it finds, leaving them unusable. The malware is linked to the destructive attacks on Ukraine during Russia's February 2022 invasion.
Source: Malpedia (Fraunhofer FKIE).