Skip to content

Instantly share code, notes, and snippets.

/wcry.md

Created May 12, 2017 19:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save anonymous/c9255b639565361d43ca3c1780ddc077 to your computer and use it in GitHub Desktop.
Save anonymous/c9255b639565361d43ca3c1780ddc077 to your computer and use it in GitHub Desktop.
Download ZIP
wcry.md
Raw
wcry.md

Ransomware attack hits UK NHS, Spain Telefonica and many other countries

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: Windows 7 is vulnerable. It uses EternalBlue MS17-010 to propagate.

Malware samples

Binary blob in PE crypted with pass 'WNcry@2ol7'

Informative Tweets

Cryptography details

  • encrypted via AES
  • AES key generated with a CSPRNG
  • AES key is encrypted by RSA

Bitcoin ransom addresses

C&C centers

  • gx7ekbenv2riucmf.onion
  • 57g7spgrzlojinas.onion
  • xxlvbrloxvriy2c5.onion
  • 76jdd2ir2embyv47.onion
  • cwwnhwhlz52ma.onion

Languages

m_bulgarian, m_chinese (simplified), m_chinese (traditional), m_croatian, m_czech, m_danish, m_dutch, m_english, m_filipino, m_finnish, m_french, m_german, m_greek, m_indonesian, m_italian, m_japanese, m_korean, m_latvian, m_norwegian, m_polish, m_portuguese, m_romanian, m_russian, m_slovak, m_spanish, m_swedish, m_turkish, m_vietnamese

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment