lazarusholic

Everyday is lazarus.dayβ

Lazarus group's Brambul worm of the former Wannacry - 1

2020-02-25, Swan
https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1
#Brambul #WannaCry

Contents

Malware researcher, Reverse engineer, Digital forensicator.
25 Feb 2020 | | 악성코드, 라자루스, 북한, 워너크라이, 웜, malware, wannacry, lazarus, worm, north korea, english
WannaCry is a ransomware of the North Korean Lazarus Group that hit the pandemic in May 2017. Attackers earned about $ 150,000 through this ransomware, and the damage from the attack is estimated at about billions of dollars. One of the features of WannaCry is that it replicates itself and distributes it to an accessible network, similar to a worm, and is distributed primarily through SMB vulnerabilities and email.
Prior to WannaCry, the Lazarus group deployed a worm that behaved in a similar way, one of which is the worm named Brambul. WannaCry is a mutation of the ransomware form of this worm called Brambul.
Brambul was created in 2009 and began to be distributed. After 10 years, it’s not dangerous compared to other malware, but it can still harm computers …