wannacry

General

Target

!All malware.zip
Size

6.4MB
Sample

240419-nw88dsag38
MD5

cdf646d5bfa6e006d61d9b2720e96341
SHA1

48a6f50b17b242f3abfeff00968960eeaa6e5ff9
SHA256

4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1
SHA512

bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30
SSDEEP

196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Targets

- Target
  
  !All malware.zip
- Size
  
  6.4MB
- MD5
  
  cdf646d5bfa6e006d61d9b2720e96341
- SHA1
  
  48a6f50b17b242f3abfeff00968960eeaa6e5ff9
- SHA256
  
  4392461d55c1d6c71b95d8b92b544c8c3260c3e9cfe76f56507b4ac15d8bcad1
- SHA512
  
  bdb8168b5160f255655b82b19c0cec9952a8714cdb6c09ad5b30cc47f23bd64091403621ac5ec6d00d0861e19144f17474108270cb8de8e1fe31c7ce6859cc30
- SSDEEP
  
  196608:Pjlmaezq3Z3rgRBgtmHmZMXQ/4LQH6TBAyigHRHu+MKiG:PYaImgRKt2O9/rH6T6yigHRHGxG
Score

10^/10

wannacry discovery ransomware worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies file permissions
  discovery
behavioral1