Skip to content

Instantly share code, notes, and snippets.

@rain-1

rain-1/wcry.md

Forked from anonymous/wcry.md
Created May 12, 2017 20:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save rain-1/8ec5d7df901e897bdac4052d615d20f1 to your computer and use it in GitHub Desktop.
Save rain-1/8ec5d7df901e897bdac4052d615d20f1 to your computer and use it in GitHub Desktop.
Download ZIP
wcry.md
Raw
wcry.md

Ransomware attack hits UK NHS, Spain Telefonica, 74 countries affected.

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: Windows 7 is vulnerable. It uses EternalBlue MS17-010 to propagate.

Malware samples

Binary blob in PE crypted with pass 'WNcry@2ol7'

Informative Tweets

Cryptography details

  • encrypted via AES-128
  • AES key generated with a CSPRNG, CryptGenRandom
  • AES key is encrypted by RSA

Bitcoin ransom addresses

3 addresses hard coded into the malware.

C&C centers

  • gx7ekbenv2riucmf.onion
  • 57g7spgrzlojinas.onion
  • xxlvbrloxvriy2c5.onion
  • 76jdd2ir2embyv47.onion
  • cwwnhwhlz52ma.onion

Languages

m_bulgarian, m_chinese (simplified), m_chinese (traditional), m_croatian, m_czech, m_danish, m_dutch, m_english, m_filipino, m_finnish, m_french, m_german, m_greek, m_indonesian, m_italian, m_japanese, m_korean, m_latvian, m_norwegian, m_polish, m_portuguese, m_romanian, m_russian, m_slovak, m_spanish, m_swedish, m_turkish, m_vietnamese

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment