WannaCry — The largest ransom-ware infection in History
Contents
More than 70 countries are reported to be infected.
Read More: Part 1âââPart 2âââPart 3âââPart 4âââ@msuiche (Twitter)
UPDATE** Links to Lazarus Group: Latest development (15May):
UPDATE2:âââDecrypting files
IMPORTANT NOTE: Microsoft released an emergency patch (KB4012598)for unsupported version of Windows (Windows XP, 2003, Vista, 2008). APPLY NOW!
NOTE2: On Sunday 14 May, We just stopped the second wave of attack by registering a second killswitch but this is temporary. Read more.
On Friday 12th May 2017, a ransom-ware called WannaCry infecting and spreading machines in 70+ countriesâââusing nation state grade offensive capabilities released last month by the ShadowBrowkersâââincluding telco companies like Telefonica in Spain, or healthcare authority like the NHS in Englandâââand the number of infected machines keeps growing.
This ransom-ware supports 28 different languages, encrypts 179 different type of files and requires victims to wire money ($300-$600) over bitcoins in order to get the control back of their machines.
Main dropper/encrypter: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Infection
It is believed the ransom-ware used an …
Read More: Part 1âââPart 2âââPart 3âââPart 4âââ@msuiche (Twitter)
UPDATE** Links to Lazarus Group: Latest development (15May):
UPDATE2:âââDecrypting files
IMPORTANT NOTE: Microsoft released an emergency patch (KB4012598)for unsupported version of Windows (Windows XP, 2003, Vista, 2008). APPLY NOW!
NOTE2: On Sunday 14 May, We just stopped the second wave of attack by registering a second killswitch but this is temporary. Read more.
On Friday 12th May 2017, a ransom-ware called WannaCry infecting and spreading machines in 70+ countriesâââusing nation state grade offensive capabilities released last month by the ShadowBrowkersâââincluding telco companies like Telefonica in Spain, or healthcare authority like the NHS in Englandâââand the number of infected machines keeps growing.
This ransom-ware supports 28 different languages, encrypts 179 different type of files and requires victims to wire money ($300-$600) over bitcoins in order to get the control back of their machines.
Main dropper/encrypter: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Infection
It is believed the ransom-ware used an …
IoC
055C7760512C98C8D51E4427227FE2A7EA3B34EE63178FE78631FA8AA6D15622
2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa