On 30th October, Security Joes Incident Response team discovered a new Linux Wiper named “BiBi-Linux” Wiper been deployed by Pro-Hamas Hacktivist group to destroy their infrastructure.
And then on November 1 2023, ESET Research tweeted about a Windows version of the Bibi Wiper deployed by BiBiGun, a Hamas-backed hacktivist group that initially debuted during the 2023 Israel-Hamas conflict.
In this post, we will look at the Windows version of the BiBi Wiper known as the “BiBi-Windows Wiper”
Upon execution, the BiBi-Windows Wiper checks to see if any arguments have been passed to the BiBi Wiper. The arguments here is the directory to be destroyed – bibi.exe <directory_to_destroyed>
.
If no argument is provided, it performs the following routine for fetching the target drives
GetLogicalDrives()
where the return value is the bitmask, then it iterates through the A-Z (26) drives. It next does a bittest with the retrieved bitmask to determine the accessible drives on the system and appends “:\” to the drive name.i != 2
where 2 is the bitmask position for C driveGetDriveTypeA()
which retrives the drive type, The BiBi-Windows Wiper here only targets the following drive types: Therefore the BiBi-Windows Wiper targets
Further it prints the target directories on the console and retrieves the NumberOfProcessors from GetNativeSystemInfo()
and based on the numberofprocessors it calculates the threads and then prints it onto the console.
Further it creates a new thread which reads the commands stored in reverse, & then creates a new process using CreateProcessA
to execute those commands. Following are the commands
Furthermore it creates another thread which executes of the Main Wiper routines. The Wiper routines perform the following actions
Now lets understand how BiBi-Windows Wiper destroys the data on the machine.
Mersenne Twister PseudoRandom Number Generator Algorithm
which generates random numbers as shown below.sub_140008BF0()
then performs modulus (%) with the value “0xFF + 1 = 100” and the output (remainder) of the modulus operation is the byte which is been overwritten in the target file byte by byte.Example below against a file consisting of the data “hello” and is been overwritten by these 5 random bytes in a loop.
ogfile_val -> rand_num % (hardcoded_val + 1) -> overwrite_val
h - 0xDD9B40A5 % 0x100 -> 0xA5
e - 0x37905317 % 0x100 -> 0x17
l - 0x54B7A20C % 0x100 -> 0x0C
l - 0xDBD10533 % 0x100 -> 0x33
o - 0x18ED3C42 % 0x100 -> 0x42
File Overwritten with Random bytes – Destroyed!
Now once the data in the file is overwritten with random bytes and the file is been destroyed, the BiBi Wiper changes the name of the file in the following manner:
rand_no = twisterfunc()
remainder_output = rand_no % (0x3D + 1)
wide_string = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
filename_byte = wide_string[remainder_output * 2]
Thus,
if random num = 0xC6D15D79
mod_out = 0xC6D15D79 % 0x3E => 0x31
offset = 0x31 × 0x2 = 0x62
so the 62nd indexed value in the wide string becomes one of the character for the filename. In this case the value is "n"
The same routine is been executed 0xA (10) times and all the indexed values are appended together forming the random file name eg. 1wnRvB6teT and then the extension “.BiBi” (Bibi is a nickname used for Israel’s Prime Minister, Benjamin Netanyahu) is added along the round number at the end in the following manner – <rand_filename>.BiBi
Therefore in the following manner the BiBi-Windows Wiper would destroy all the files in the target directories by overwriting the data in the files with random bytes, now as the loop
i.e the rounds are till infinity the Wiper will keep on overwriting the files multiple time recursively with random bytes till infinity and wont stop thus destroying the files on the machine completely!
BiBi-Windows Wiper execution showcasing the Target directory, CPU Cores, Threads, Round Number, Stats, and destroyed file with .BiBi extension
An innovative tool designed to revolutionize the testing, evaluation, and security of LLM applications. This…
A sophisticated tool designed for exploiting vulnerabilities in Android devices. This article dives into the…
SeamlessPass is a tool designed to obtain Microsoft 365 access tokens using on-premises Active Directory…
Comprehensive guide to the tools and resources pivotal in the world of forensic analysis. From…
An advanced Nmap script designed to detect potential vulnerabilities in network services. This article delves…
A powerful tool designed to tunnel TCP connections through a file. Ideal for circumventing firewalls…