wannacry

General

Target

aa.jpg
Size

91KB
Sample

240418-m1q2yacc7s
MD5

ebb0041d79a4459d0b8821e7a7d797d6
SHA1

d46a758da82b233cccfc7ee1dd2fa5cef9a02779
SHA256

28358e4aabf4a4f1d0fd93badb9325f2a9b7586ef2db60106550c0ac459c9e0d
SHA512

d90786bbff170a792ea6da0bca4b68eaa80238b1b9eb4b83e0036760e978bb2bdcb0264e44094015ca69319a4c8d6c305706330999fca6d4ccf48b2c0dcc9537
SSDEEP

1536:1dDF/5o2URzdYigpFz3zlNeucEXh/Gj8l99fBYH8wT3ZAepD4rhhzn2QD:1z/5o26g3XlNe1EXhr99Zk8HepD4rPD

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Targets

- Target
  
  aa.jpg
- Size
  
  91KB
- MD5
  
  ebb0041d79a4459d0b8821e7a7d797d6
- SHA1
  
  d46a758da82b233cccfc7ee1dd2fa5cef9a02779
- SHA256
  
  28358e4aabf4a4f1d0fd93badb9325f2a9b7586ef2db60106550c0ac459c9e0d
- SHA512
  
  d90786bbff170a792ea6da0bca4b68eaa80238b1b9eb4b83e0036760e978bb2bdcb0264e44094015ca69319a4c8d6c305706330999fca6d4ccf48b2c0dcc9537
- SSDEEP
  
  1536:1dDF/5o2URzdYigpFz3zlNeucEXh/Gj8l99fBYH8wT3ZAepD4rhhzn2QD:1z/5o26g3XlNe1EXhr99Zk8HepD4rPD
Score

10^/10

wannacry persistence ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1