Skip to content

Instantly share code, notes, and snippets.

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

@gilliek
gilliek / ghmd.go
Last active August 29, 2015 14:00
Go CLI tool that renders GitHub Markdown files using the GitHub API.
// "THE BEER-WARE LICENSE" (Revision 42):
// <kevin.gillieron@gw-computing.net> wrote this file. As long as you retain
// this notice you can do whatever you want with this stuff. If we meet some
// day, and you think this stuff is worth it, you can buy me a beer in return
// Kevin Gillieron
package main
import (
"bytes"
@gilliek
gilliek / lay2act.rb
Last active August 29, 2015 13:58
Simple (and not very robust) script that maps the View items of an Android activity layout to an Activity class.
#!/usr/bin/env ruby
=begin
_ ____ _
| | __ _ _ _|___ \ __ _ ___| |_
| |/ _` | | | | __) / _` |/ __| __|
| | (_| | |_| |/ __/ (_| | (__| |_
|_|\__,_|\__, |_____\__,_|\___|\__|
|___/
lay2act aims to be a very simple (and not very robust) script that maps the View
@XVilka
XVilka / TrueColour.md
Last active April 8, 2024 14:02
True Colour (16 million colours) support in various terminal applications and terminals

THIS GIST WAS MOVED TO TERMSTANDARD/COLORS REPOSITORY.

PLEASE ASK YOUR QUESTIONS OR ADD ANY SUGGESTIONS AS A REPOSITORY ISSUES OR PULL REQUESTS INSTEAD!

@adharris
adharris / postgres_array.go
Created November 28, 2012 19:52
PostgreSQL demo of Array types using Golang
package main
import (
"database/sql"
"errors"
"fmt"
_ "github.com/bmizerany/pq"
"os"
"regexp"
"strings"
@MohamedAlaa
MohamedAlaa / tmux-cheatsheet.markdown
Last active April 15, 2024 11:43
tmux shortcuts & cheatsheet

tmux shortcuts & cheatsheet

start new:

tmux

start new with session name:

tmux new -s myname
@thom-nic
thom-nic / NumberPickerPreference.java
Created May 6, 2011 22:06
NumberPicker Preference Dialog for Android!
import android.content.Context;
import android.content.DialogInterface;
import android.content.res.TypedArray;
import android.preference.DialogPreference;
import android.util.AttributeSet;
import android.view.View;
import com.quietlycoding.android.picker.NumberPicker;
public class NumberPickerPreference extends DialogPreference {