7b71764236f244ae971742ee1bc6b098

Disk wiper 'cl.exe' MD5 published in Appendix A of CISA AA22-264A on the July 2022 HomeLand Justice destructive attack against the Government of Albania. Pairs with the 'rwdsk.sys' RawDisk driver (MD5 8f6e7653807ebb57ecc549cef991d505) to wipe raw disk drives. Mandiant tracks the same payload as a ZEROCLEAR variant.

family

Cl Wiper

first seen

Jul 14, 2022

publisher

CISA