Skip to content

Malware

ZeroCleare

ZeroCleare is a destructive malware. It has been developed in order to wipe the master boot record section in order to damage a disk's partitioning.

ZeroCleare is a Windows malware family operated by OilRig.

Background

ZeroCleare is destructive wiper malware engineered to overwrite the master boot record and thereby corrupt a disk's partitioning. It carries out this damage through the EldoS RawDisk driver, which is unsigned and therefore would not normally run. The attackers sidestep this by abusing a vulnerable build of the VBoxDrv driver that DSE accepts and loads. It was deployed against energy and industrial targets in the Middle East.


Source: Malpedia (Fraunhofer FKIE).