November 20, 2023
Severity Medium Analysis Summary Agent Tesla is a very popular spyware Trojan built for the.NET framework. Since its initial appearance in 2014, this has been deployed […]
Rewterz Threat Advisory – CVE-2018-12882 – updates for IBM Lotus Protector for Mail Security PHP DoS Vulnerability
December 27, 2018Rewterz Threat Alert – Financial sector hit by malicious email campaign that abuses Google Cloud Storage
December 27, 2018Rewterz Threat Advisory – CVE-2018-12882 – updates for IBM Lotus Protector for Mail Security PHP DoS Vulnerability
December 27, 2018Rewterz Threat Alert – Financial sector hit by malicious email campaign that abuses Google Cloud Storage
December 27, 2018
SEVERITY: LOW
CATEGORY: INFORMATIVE UPDATES
ANALYSIS SUMMARY:
Eighteen months after the initial outburst, WannaCry ransomware still lurks on hundreds of infected computers and continues towards infecting more computers.
When the WannaCry was first unleashed, Kryptos Logic security researcher Marcus Hutchins registered a domain that acted as a killswitch for the ransomware component of the infection. If the infection would connect to this killswitch domain, the ransomware component would not activate. The infection however, silently runs in the background and keeps on checking the killswitch routinely to check whether the domain is still live.
The initial outburst of WannaCry in 2017 was just a beginning, as many security analysts predicted higher levels of attack. Here’s one of such alerts.
As they predicted, the espionage continues till date. The WannaCry domain is observed to be receiving 17 million
connections coming from 630 unique IP addresses from 194 different countries in a week.
The WannaCry ransomware has multiple components. It arrives on the infected machine in form of a dropper. It’s a self contained program which extracts the other application components embedded within itself.
Those components are:
- An application that encrypts and decrypts data
- Files containing encryption keys
- A copy of Tor
Once it is launched, WannaCry tries to access a hard coded URL (Killswitch), and if it can’t, it searches for and encrypts files in a slew of important formats ranging from MS Office to MP3s, leaving them inaccessible to the user and displays a ransom notice to the user, demanding bitcoins to decrypt the files.
Below is the graph showing countries that are still infected with WannaCry.
All it needs is an Internet outage to occur and for the kill switch domain to no longer be accessible for the ransomware to kick in.
REMEDIATION:
It is recommended to monitor your range of IP addresses for all known infections, including WannaCry and similar malware families.