New AcidPour wiper targets Linux x86 devices.

New AcidPour wiper targets Linux x86 devices. Is it a Russia’s weapon?

Pierluigi Paganini
March 19, 2024

A new variant of the Russia-linked wiper AcidRain, tracked as AcidPour, was spotted targeting Linux x86 devices.

A new variant of a data wiper AcidRain, tracked as AcidPour, is specifically designed for targeting Linux x86 devices has been detected in the wild.

Researchers at SentinelLabs first discovered the wiper AcidRain in March 2022. The malware that hit routers and modems and was suspected to be linked to the Viasat KA-SAT attack that occurred on February 24th, 2022.

AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. SentinelLabs assessed with medium-confidence that there are developmental similarities between AcidRain and the Russia-linked VPNFilter stage 3 destructive plugin.

AcidRain is the 7th wiper malware used by threat actors since the beginning of the Russian invasion of Ukraine. A sample of the AcidRain Wiper was uploaded to VirusTotal from Italy by a use with the name ‘ukrop.’  

Experts believe that the wiper is not complex and leverage bruteforce attacks to compromise the devices, the malicious code is able to wipe the device and storage device files.

Now SentinelOne researcher Juan Andres Guerrero-Saade announced the discovery of a new variant, named AcidPour, discovered by his colleague Tom Hegel. AcidPour has many similarities with AcidRain, such as the use of the same strings.

Guerrero-Saade explained that AcidRain was an ELF binary compiled for MIPS and acts as a generic and largely hamfisted wiper, iterating over common directories and device paths for most embedded linux distros.

“The new variant we are calling AcidPour is an ELF binary compiled for x86 (not MIPS) and while it refers to similar devices/strings, it’s a largely different codebase. Doing our best to compare across different architectures, we are looking at a rough < 30% similarity.” explained the researcher.

The sample analyzed by the researchers was was uploaded from Ukraine on 2024-03-16 14:42:53 UTC. It is unclear which is the target of the attack that employed this wiper.

Some code entries such as ‘/dev/ubiXX’ (refers to Unsorted Block Images (UBI)) and ‘/dev/dm-XX’ suggest the malware can target systems utilizing flash memory like IoT devices, networking devices, and possibly some ICS devices along with virtual block devices associated with LVM.

The expert also highlighted similarities between AcidPour IOCTL based wiping logic and VPNFilter ‘dstr’ plugin and AcidRain.