Security News Wana Decrypt0r Ransomware Using NSA Exploit Leaked by Shadow Brokers Is on a Rampage

[XhenEd]

Hehehe... I was just looking for this because I had no chance to watch yesterday. Did you delete the video? I couldn't find the one you posted yesterday.

But then boom you just posted the video. So thanks!

 

[509322]

Hehehe... I was just looking for this because I had no chance to watch yesterday. Did you delete the video? I couldn't find the one you posted yesterday.

But then boom you just posted the video. So thanks!

You already knew the end result... you just wanna watch a video for its "entertainment value."

 

[DarkJoney]

So, which HIPS blocks Wannacry and other ransoms right now most efficiently?

 

[DarkJoney]

You already knew the end result... you just wanna watch a video for its "entertainment value."

Hmm, Is your AppGuard is a one more HIPS system?

 

[509322]

Hmm, Is your AppGuard is a one more HIPS system?

AppGuard is in a security software category known as "software restriction policy"; it is not HIPS.

 

[DarkJoney]

AppGuard is in a security software category known as "software restriction policy"; it is not HIPS.

Will check it out. Thanks.

 

[XhenEd]

You already knew the end result... you just wanna watch a video for its "entertainment value."

Yeah, I already expected the result. I just wanted to know how AppGuard handles this ransomware. I expected the User Space block, which is a bit boring because it's just a block, no-frills, no thrills (/s) .

What I want to see now is how AppGuard operates if WannaCry is digitally signed.

 

[509322]

What I want to see now is how AppGuard operates if WannaCry is digitally signed.

If it executes, then it will encrypt files in User Space except those in Private Folders.

Guarded protections do not prevent file encryption.

You already know this...

 

[XhenEd]

If it executes, then it will encrypt files in User Space except those in Private Folders.

Guarded protections do not prevent file encryption.

You already know this...

Yes, I know. But I just want to know how exactly AppGuard operates with WannaCry running. I just want to know with my own eyes.

 

[509322]

Yes, I know. But I just want to know how exactly AppGuard operates with WannaCry running. I just want to know with my own eyes.

Grab a WannaCry sample from Hybrid-Analysis.com and run it Guarded from the desktop...

Inside a VM of course.

 

[XhenEd]

Grab a WannaCry sample from Hybrid-Analysis.com and run it Guarded from the desktop...

hehehe.. I won't.

I'll just wait. Maybe someone will test when a WannaCry sample acquires a digital signature.

But if WannaCry never acquires a digital sig, then the better for all because it would be easier to detect and block.

 

[509322]

hehehe.. I won't.

I'll just wait. Maybe someone will test when a WannaCry sample acquires a digital signature.

But if WannaCry never acquires a digital sig, then the better for all because it would be easier to detect and block.

Why would they even bother to sign WannaCry when they are already in the "chah-ching !"

Besides... most of you dedicated AppGuard users are running it in Locked Down mode, so it doesn't matter if WannaCry is ever digitally signed as it will be blocked whether it is signed or unsigned.

 

[GuruNot]

Looks like the malware drops the DoublePulsar backdoor, there is an nmap script for scanning you networks for any instances: smb-double-pulsar-backdoor NSE Script

 

[brambedkar59]

"If the domain was not registered, the ransomware would start its encryption process, if it was registered, it would not encrypt any files. To protect victims, the researcher registered the domain, effectively preventing WannaCry from making new victims."
I don't understand how domain affects the working of Ransomware. Can anyone explain this in layman's terms?

 

[DarkJoney]

"If the domain was not registered, the ransomware would start its encryption process, if it was registered, it would not encrypt any files. To protect victims, the researcher registered the domain, effectively preventing WannaCry from making new victims."
I don't understand how domain affects the working of Ransomware. Can anyone explain this in layman's terms?

It checks if the domain responds to the request.
If not - encrypts files.
If yes - doesn't start at all

 

[brambedkar59]

It checks if the domain responds to the request.
If not - encrypts files.
If yes - doesn't start at all

Thanks for the reply.
Sorry, I am a noob but why it checks with the domain and why not just start encrypting the files on the PCs it gets activated?
Does it have to do with the decryption keys?

 

[Arequire]

Thanks for the reply.
Sorry, I am a noob but why it checks with the domain and why not just start encrypting the files on the PCs it gets activated?
Does it have to do with the decryption keys?

As far as anyone can tell the domain was designed to be a killswitch. It would have afforded the author the ability to register the domain and stop the ransomware from continuing to encrypt files on systems that it spread to.
Since then another variant has been released with the domain killswitch removed.

 

[brambedkar59]

As far as anyone can tell the domain was designed to be a killswitch. It allowed the author the ability to stop the ransomware from continuing to encrypt files on systems that it spread to.
Since then another variant has been released with the domain killswitch removed.

Thanks for explaining that. I think I got it.

 

[MBYX]

Is there a sample i can have a look at please?
Preferably kill switch removed version but happy for either. Can just pm me off the side.

 

[Orion]

The only reason this malware is on a rampage because there are computers that are not patched for MS-17-010 even after the patch was released in march this year.

It wouldn't have been so deadly if it wasn't eternalblue being used.Yet again it stresses the importance of doing your windows updates.