WannaCrypt ransomware has resumed spreading

Posted by rbanffy on Sunday May 14, 2017 @07:55AM
from the motherboard.vice.com dept.

( 5 comments | 56 points | on HN )

Re:WannaCrypt ransomware has resumed spreading by skamoen on Sunday May 14, 2017 @09:31AM (#14335537)

There seems to be a lot of confusion about versions without killswitches. This guy says he made a mistake: https://twitter.com/craiu/status/863718940870139904

[ Parent | on HN ]

Re:WannaCrypt ransomware has resumed spreading by viraptor on Sunday May 14, 2017 @09:57AM (#14335632)

Interesting for context:

New domains are just trivial modifications of the old one. Still hardcoded. That's unlikely to be a new version, but rather people playing around.

[ Parent | on HN ]

Re:WannaCrypt ransomware has resumed spreading by skamoen on Sunday May 14, 2017 @09:45AM (#14335584)

To be more specific, all samples without killswitch were samples of just the ransomware, not the worm spreading it.

[ Parent | on HN ]

Re:WannaCrypt ransomware has resumed spreading by emersonrsantos on Sunday May 14, 2017 @11:56AM (#14336087)

This guy just found a new kill switch and registered the domain already:

He's talking about versions with nop'ed kill switches.

EDIT: not nop, but with a jnz +2, still similar to a nop-nop.

[ Parent | on HN ]

Re:WannaCrypt ransomware has resumed spreading by ivanbakel on Sunday May 14, 2017 @09:34AM (#14335549)

Was only a matter of time. What's it doing to detect anti-virus sandboxing now, if that was the original purpose of the fixed domain?

[ Parent | on HN ]