Analysis of a killer malware (XHOPLESS)

Summary

1. The killer malware is perfoming highly malicious activities
2. It is using Anti — VM techniques
3. The sample gives out the whole process and ther phases in which the whole killer is working
4. It also performs a lot of registry modifications.
5. It directly shutsdown after performing the last phase of the killer chain

Anaslysis of the killer malware

Fig 1 — destructive wiper/bricking malware

Based on function names and behavior visible in the decompilation:

• BrickFirmware() is the main orchestrator, calling a sequence of destructive routines then declaring "SYSTEM IS BRICKED PERMANENTLY."
• _BrickUEFI() writes garbage/spam GUID variables into UEFI NVRAM to corrupt firmware variables.
• _KillSPI() tries multiple methods (WMI, vendor-specific BIOS tools, third-party flash utilities like AFUWIN/FPTW/H2OFFT) to corrupt or reflash BIOS/SPI flash directly.
• _BrickCMOS() overwrites CMOS/RTC and also disables Windows Update/firmware-update mechanisms via registry.
• _BrickDisks() issues diskpart clean all and multi-pass GPT/partition destruction plus "ATA Secure Erase" across all drives.
• DestroyDriveGPTMultiPass() overwrites the GPT/partition table repeatedly with random and fixed data.
• AntiVM() checks for VirtualBox/VMware artifacts and debuggers (OllyDbg, IDA, x64dbg, Wireshark, procmon) to evade analysis.
• SelfDelete() removes its own binary after execution.
• ShowRedBanner() pops a fullscreen window reading "HOPELESS" / "zdn2pwn" — a taunting banner, suggesting this is meant to look like a branded attack (possibly a CTF sample, red-team proof-of-concept, or genuine malware sample).

Fig 2 — persistence, anti-recovery, system paralysis, and OEM-specific firmware attacks.

• eap() — enables a broad set of Windows privileges (SeDebug, SeBackup, SeRestore, SeTakeOwnership, SeLoadDriver, SeShutdown, SeSystemEnvironment) needed to tamper with firmware, kill protected processes, and modify boot config.
• Debugger-hijack persistence — registers taskmgr.exe, regedit.exe, cmd.exe, powershell.exe, procexp.exe, ProcessHacker.exe, and various admin MMC consoles (gpedit.msc, services.msc, eventvwr.msc, etc.) under Image File Execution Options "Debugger" keys — redirecting them to the malware or blocking their use, plus disables Windows Error Reporting for silent crashes.
• Winlogon hijack — overwrites the Shell and Userinit registry values so its own payload launches at every logon, and deletes GPO extension keys.
• ExecIndirectW — randomly picks between mshta, wmic process call create, or rundll32 shell32.dll,ShellExec_RunDLL to launch commands indirectly, evading simple parent-process monitoring.
• Scheduled task persistence — creates multiple SYSTEM-level scheduled tasks disguised as MicrosoftEdgeUpdateTask, OneDrive Update Task, WindowsLicenseUpdate etc. to keep relaunching itself, plus Run/RunOnce registry keys under a XHopelessV1 name.
• Anti-recovery — deletes Windows recovery folders (Minidump, LiveKernelReports), corrupts boot files (winload.efi, bootmgr, ntoskrnl.exe, etc.) and deletes WinSxS boot-component backups so they can't be restored.
• GetOEM() / OEMBrick() — fingerprints the motherboard vendor (HP, Dell, Lenovo, ASUS, MSI, Gigabyte) from a temp file and runs vendor-specific firmware-corruption commands (HP/Dell/Lenovo WMI BIOS setting corruption, vendor flash tools).
• p8e()/p9b()/p9c() — disables Windows Recovery Environment, deletes pagefile/hibernation/swap files, disables managed pagefile, and clears all Windows event logs (anti-forensics).
• p9d() — deletes SoftwareDistribution and Windows.old, deletes volume shadow copies (vssadmin delete shadows /all), disables last-access tracking — killing most built-in recovery/rollback paths.
• ParalyzeSystem() — kills explorer.exe, disables Task Manager via registry, blocks all keyboard/mouse input, and disables Ctrl+Alt+Del — a deliberate multi-phase system lockout.
• _KillBCD() — exports then deletes the boot configuration data store (all boot entries), strips protective attributes from BCD files in multiple locations, deletes BCD logs, and sets recovery to disabled with bootstatuspolicy ignoreallfailures.

This is a fuller picture of a wiper designed for maximum, hard-to-recover damage — combining boot/firmware destruction with system lockout, anti-forensics, and persistence to survive reinfection attempts.

Fig 3 — malware’s phased execution structure and additional destructive/anti-recovery capabilities

The malware runs as a numbered phase sequence (p0 through p9-something), each phase escalating destruction:

• p0() — "PHASE 0: Disable Defenses" — calls eap() (privilege escalation from before), then attempts to kill/disable a long list of AV and EDR processes by name (Defender, MBAM, Avast, AVG, Norton, McAfee, Kaspersky, Bitdefender, ESET, Webroot, etc.) and stops/disables their services along with core Windows security services (WinDefend, wscsvc/Security Health, Sense (Defender ATP), WdNisSvc, BITS, TrustedInstaller). It also sets registry policies to disable Defender real-time/behavior monitoring and mutes security notification popups.
• p1() — "PHASE 1: Kill System" — enumerates and kills admin/diagnostic tools (taskmgr, regedit, msconfig, cmd, powershell, procexp, ProcessHacker, perfmon, resmon, mmc, dllhost).
• p2() — "PHASE 2: Corrupt Boot" — opens \\.\PhysicalDrive0 and \\.\C: directly and overwrites raw bytes, then runs bootsect /nt60 ALL /force /mbr, exports then deletes the BCD store, deletes bootmgr/bootmgfw.efi/boot.ini/ntldr, renames winload.efi, strips protective attributes first.
• p3() — "PHASE 3: Mount EFI+Delete" — mounts the hidden EFI system partition as X:, grants itself full permissions via cacls, deletes everything on it, removes the X:\EFI directory, reformats the partition as FAT, and additionally runs diskpart clean all against disk 0 — a second, more thorough disk-wipe path.
• p4() — "PHASE 4: Disable Recovery" — disables Windows RE, deletes all shadow copies, shrinks shadow storage to 1MB (preventing new ones), sets boot status policy to ignore all failures, disables recovery/bootux, sets AutoReboot=False in wmic recoveros so BSODs display rather than auto-restart, disables last-access tracking and delete notifications, forces a fsutil repair.
• p5() — "PHASE 5: Scramble Registry" — exports (reg save) then presumably corrupts core registry hives (SOFTWARE, SYSTEM, SAM, SECURITY) and deletes ProfileList, Run, RunOnce keys — destroying user-profile and startup configuration.

Other notable routines

• _KillBCD() (continued) — adds registry keys disabling Startup Repair and Boot Repair, then reg delete HKLM\BCD00000000 to wipe the live in-memory BCD hive entirely.
• _KillRecoveryExtreme() — deletes shadow copies, shrinks shadow storage, disables System Restore via PowerShell and registry policy, disables Windows RE, deletes C:\Recovery, System32\Recovery, WinSxS\Backup, recovery.efi, disables Windows Update repair mechanisms, and clears event logs — going further than the earlier recovery-killing function.
• _KillNetworkPermanent() — deletes registry entries for network adapters (SYSTEM\...\Control\Network\{GUID}), stops/disables a long list of networking services (DHCP, DNS cache, LanmanServer/Workstation, TCP/IP, NDIS, NetBT, WLAN, NlaSvc, RasMan, WinHTTP proxy, Shared Access, WinRM, Bluetooth), resets the IP stack (netsh int ip reset, ipv6 reset), locks the firewall to block all inbound/outbound traffic, and disables devices via devcon.exe disable *DEV_* — essentially permanent air-gapping of the machine.
• SaveInfectionState() / IsInfected() / GetInfectionStart() — writes/reads a registry marker at HKLM\SOFTWARE\...\Hopeless tracking infection start time, file count, and an "Infected" flag — used for tracking state across reboots/re-execution (possibly to know which phase to resume, or to avoid re-encrypting).
• p6ef() — appears to be a file-enumeration/encryption-counting routine (references g_EncryptedCount, hash-like rolling computation ror.d), suggesting a file-encryption component exists elsewhere in the binary in addition to the wiping — i.e., this may function partly as ransomware with an encryption phase, despite the "Hopeless" branding suggesting no real recovery path is intended.

Fig 4 — full picture and gives the finish line

• p7() — "PHASE 7: File Destruction" — enumerates all logical drives (GetLogicalDrives), and for each drive letter spins up a thread (p7e) per volume to destroy files in parallel — a multi-threaded mass file-destruction routine across every drive on the system.
• p8() — "PHASE 8: Persistence" — launches three parallel threads (p8a, p8b, p8c) simultaneously — these correspond to the debugger-hijack/IFEO persistence, the boot-execute registry persistence, and the Winlogon shell hijack shown in earlier screenshots. Running them concurrently as threads rather than sequentially.
• p9() — "PHASE 9: Cleanup" — again spins up parallel threads (p9a–p9d) corresponding to the recovery-artifact deletion, minidump/kernel-report removal, pagefile deletion, and shadow-copy/SoftwareDistribution cleanup routines shown earlier — anti-forensics run in parallel for speed.
• p10() — "PHASE 10: BSOD" — the finale. Prints "XHOPELESS v1.0 -- DONE" and "BSOD in 10s...", then calls NtRaiseHardError from ntdll.dll with flags forcing a deliberate kernel panic / blue screen, followed by ExitWindowsEx with EWX_REBOOT | EWX_FORCEIFHUNG, blocks input, and issues a shutdown /r /t 0 /f as a fallback — guaranteeing the machine crashes and reboots into the now-destroyed boot chain.
• ExecuteAllPhases() — the top-level driver: prints "INITIALIZING FIRMWARE DESTRUCTION PHASE 0a...", calls BrickFirmware(), then SelfDelete(), then two more shutdown/reboot calls with BlockInput in between — ensuring the payload is gone from disk and the machine is forced down before anyone can intervene.
• WinMain() — the entry point. Hides its console window, seeds the RNG, sets itself to HIGH_PRIORITY_CLASS, and creates a named mutex "XHOPELESS_v1_Mutex_ZDNPWN_2026" to ensure only one instance runs at a time.
• Startup logic: prints a banner — “XHOPELESS v1.0 — Instant Destruction Edition, Copyright © 2026 Zdn2Pwn. All rights reserved. Author: zdn2pwn”* — then checks IsInfected(). If the machine was already infected (i.e., this is a reboot after a prior run), it immediately calls ExecuteAllPhases() again ("RESTART DETECTED – IMMEDIATE FULL DESTRUCTION"). Otherwise it calls SaveInfectionState() and runs ExecuteAllPhases() for the first time.
• .rdata strings confirm the UEFI NVRAM GUID-spam strings seen earlier, plus what looks like unrelated floating-point error-message strings (overflow/underflow/loss-of-significance), likely from a statically linked math/CRT library rather than part of the malicious logic.

Summary

This is now a complete picture: a self-identified wiper called “XHOPELESS v1.0”, attributed to an author calling themselves “zdn2pwn,” dated 2026, designed to run all destruction phases (defense evasion → process killing → boot/firmware/disk destruction → recovery elimination → registry corruption → network kill → file destruction → persistence → cleanup) largely in parallel via threads, self-delete, and force a BSOD/reboot loop — and critically, it re-triggers full destruction automatically on every subsequent boot via the infection-state registry marker, making the damage self-reinforcing even if a user tries to recover and reboot.

Get Shubho57’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Conclusion

This binary is a self-contained Windows wiper — internally named “XHOPELESS v1.0” — that goes well beyond typical ransomware. Rather than holding data for ransom, it systematically disables security tooling, kills recovery mechanisms three different ways (BCD deletion, raw disk overwrite, EFI partition wipe), corrupts firmware/UEFI NVRAM and vendor BIOS settings, destroys the registry, permanently disables networking, and finally forces a BSOD/reboot loop. A registry-based infection marker makes destruction self-reinforcing: if the machine somehow reboots into a working OS, the malware detects the prior infection and immediately re-executes full destruction. Combined with self-deletion and anti-VM/anti-debug checks, this is built to leave no viable recovery path and to resist analysis — consistent with a destructive/wiper tool rather than a financially motivated ransomware family, despite superficially ransomware-like naming (“HOPELESS,” a ransom-note-style banner).

MITRE ATT&CK

IOCs

YARA Rule

rule Wiper_XHOPELESS_v1
{
meta:
description = “Detects XHOPELESS v1.0 destructive wiper (attributed zdn2pwn, 2026)”
author = “Subhankar H.”
threat_type = “Wiper / Destructive Malware”
reference = “Internal decompilation analysis”

strings:
$mutex = “XHOPELESS_v1_Mutex_ZDNPWN_2026” wide ascii
$banner1 = “XHOPELESS v1.0 — Instant Destruction Edition” wide ascii
$banner2 = “Copyright © 2026 Zdn2Pwn” wide ascii
$author = “Author: zdn2pwn” wide ascii
$regkey = “SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Hopeless” wide ascii
$winclass = “XHOPELESS_BANNER” wide ascii
$bricktext = “FIRMWARE DESTRUCTION COMPLETE — SYSTEM IS BRICKED PERMANENTLY” wide ascii
$fakeguid1 = “{DEADBEEF-CAFE-BABE-FACE-864201234567}” wide ascii
$fakeguid2 = “{12345678–1234–1234–1234–123456789ABC}” wide ascii
$task1 = “XHOPELESS_MONITOR” wide ascii
$exe_name = “xhopeless.exe” wide ascii
$phase_str = “PHASE 10: BSOD” wide ascii

condition:
uint16(0) == 0x5A4D and
(
$mutex or $banner1 or $author or
2 of ($regkey, $winclass, $bricktext, $fakeguid1, $fakeguid2, $task1, $exe_name, $phase_str)
)
}

Happy Reading!!!