wannacry

Resubmissions

16/03/2025, 11:14

250316-nb82wsspy4 3

16/03/2025, 10:39

250316-mp3xcssks8 10

16/03/2025, 10:38

250316-mpmkdasks3 10

Sharing

Copy URL

Twitter E-mail

General

Target

WannaCry2.0-main.zip
Size

3.4MB
Sample

250316-mp3xcssks8
MD5

8df4da9f105c1efe0312277681ab7657
SHA1

2f59ed04ceaca4a13e84edd6d176b2a6e6d6b2ff
SHA256

a80032c76c5b96b652ad059098578b5afa4539c665650f2ae073b76657e889e0
SHA512

7c012c8b0e123a568631777bfc87cb2f92209d3aa221ed63ef7a07ae38a039f2d63f051190043d0acddd42b75ae2d718e81ea094253fdcf7d638bc52cf767c7d
SSDEEP

98304:Phvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRTA:Phvq7Bu6EZnZN5EyBS6

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  WannaCry2.0-main.zip
- Size
  
  3.4MB
- MD5
  
  8df4da9f105c1efe0312277681ab7657
- SHA1
  
  2f59ed04ceaca4a13e84edd6d176b2a6e6d6b2ff
- SHA256
  
  a80032c76c5b96b652ad059098578b5afa4539c665650f2ae073b76657e889e0
- SHA512
  
  7c012c8b0e123a568631777bfc87cb2f92209d3aa221ed63ef7a07ae38a039f2d63f051190043d0acddd42b75ae2d718e81ea094253fdcf7d638bc52cf767c7d
- SSDEEP
  
  98304:Phvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRTA:Phvq7Bu6EZnZN5EyBS6
Score

1^/10
behavioral1
- Target
  
  WannaCry2.0-main/.gitignore
- Size
  
  430B
- MD5
  
  97a40190cf692d26a40878c675a54049
- SHA1
  
  12ac538031aa43ebb2fa6c7c7db3ecec528fdad1
- SHA256
  
  29a3db423bf9d10e68f8950af557ddb891f407d262a8286511fb22df48ef458f
- SHA512
  
  546326d29f96daad767190d05485c3358272f62423ccf5ceb27dbce605ff376ab66875aff138caf7a1699cbc1123121b8ab8c9da2d22183f39305231dd3f4308
Score

3^/10
behavioral2
- Target
  
  WannaCry2.0-main/.vscode/c_cpp_properties.json
- Size
  
  303B
- MD5
  
  e457639b6442de3a6b199e0bcf48ca61
- SHA1
  
  925fbb2a12c11dc8a5cb139ed9f7148bb342c5e7
- SHA256
  
  fdcb102f4856235745e6f824410eb411ca58681485420bd1eacb6d8f4f1b7304
- SHA512
  
  2ae1460488f1046c964c2c30ff0dacc554ea1de3c53fabbdf0a7b892ecef532df2af6f1f9a97a373a7da521d87148fd0ea010ec005cfe75d0008e3b73ed477fe
Score

3^/10
behavioral3
- Target
  
  WannaCry2.0-main/LICENSE
- Size
  
  1KB
- MD5
  
  c2d2538a4f6b21f5ad34f1b39131fce0
- SHA1
  
  03565b3c7f761defd3a05968a99518e5f27b40d7
- SHA256
  
  45c7b18777805e5847461265e89c910065901cfb4a628aa931e574d8ad97fb3d
- SHA512
  
  f3a0fb7e1f032ee88ccd2e54e17941c3aac8d8b79f8f9d1b0c49eaec0d69538902e3832c793645fbfa355f4764b30325ecdc968a4efd1e4de3f77009f4044b21
Score

1^/10
behavioral4
- Target
  
  WannaCry2.0-main/README.md
- Size
  
  3KB
- MD5
  
  7c8506983be827acefcc993d95e01e79
- SHA1
  
  5243bf14955851d323c8e7b82c587bd88a8afc15
- SHA256
  
  efa3bb1124ed953195ff07e4f8081478063be577e240b0762dfc25c8eb05fd94
- SHA512
  
  5ae5219f0af319274be5886efe0198791a0c68e22f26a13d5baa54b80c15091d3a34fcf42a858d12b555a8568f350f4b9ba800d7f3c69f3475faf06ad46e0b44
Score

3^/10
behavioral5
- Target
  
  WannaCry2.0-main/Ransomware.WannaCry.zip
- Size
  
  3.3MB
- MD5
  
  efe76bf09daba2c594d2bc173d9b5cf0
- SHA1
  
  ba5de52939cb809eae10fdbb7fac47095a9599a7
- SHA256
  
  707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
- SHA512
  
  4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
- SSDEEP
  
  98304:vhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRT:vhvq7Bu6EZnZN5EyBSN
Score

1^/10
behavioral6
- Target
  
  ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
- Size
  
  3.4MB
- MD5
  
  84c82835a5d21bbcf75a61706d8ab549
- SHA1
  
  5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
- SHA256
  
  ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- SHA512
  
  90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
- SSDEEP
  
  98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
Score

10^/10

wannacry defense_evasion discovery execution impact ransomware spyware stealer worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Wannacry family
  wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral7
- Target
  
  WannaCry2.0-main/WannaCry.c
- Size
  
  560KB
- MD5
  
  0382eb93cc232c460995c50e8abd4a27
- SHA1
  
  a9e2a40f8f6c748f4f548e5dce3a2ee93c7d923a
- SHA256
  
  c65c31e80a61833efcff9da579a82e52f4a4286be2790e875acfd07cb89f1349
- SHA512
  
  9184513150d3c9292edeba4df9570bdff82416d5cf6eaea6b7503d00049686463a03a235e3793c18d2b2aff8503d052dd790125e399ed862c02113c06c745924
- SSDEEP
  
  6144:SxPiam1KCILCw40qCbiWjEtHvJ+wCXCqPGlV2OwUJfa:S2KL40vbY+wCXJPSV2OpJfa
Score

3^/10
behavioral8