News for hackers. Stuff that matters.

A comment on Another Ransomware Outbreak Is Going Global. Parent comment

Re:Another Ransomware Outbreak Is Going Global by carvalho on Tuesday June 27, 2017 @12:03PM (#14646632)
It is basically WannaCry without the kill switch. It is using the same exploits (EternalBlue). Not some recent zero-day, but sloppy patching.
[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by guilhermetk on Tuesday June 27, 2017 @03:56PM (#14648802)
Seems like there is a kill switch: https://twitter.com/PTsecurity_UK/status/879779707075665922
[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by pritambaral on Tuesday June 27, 2017 @05:07PM (#14649458)
Originally found by: https://twitter.com/0xAmit/status/879768194545836032
[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by celticninja on Tuesday June 27, 2017 @02:00PM (#14647654)
Do you have a source for that?
[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by hypervis0r on Tuesday June 27, 2017 @02:22PM (#14647859)
Not OP, but he is right. I just walked out of work, where I had to reverse the sample. It indeed uses EternalBlue (attacks by enumerating local network IPs with Windows APIs and randomly scanning the internet). Apart from that, it overwrites the MBR with a custom bootloader and schedules a restart ("shutdown /t /r") as SYSTEM in a random amount of time. After rebooting, it fakes a chkdsk and meanwhile, encrypts your files.

It is also true that it uses PsExec to spread.

TL;DR good old Petya ransomware (old as shit) with a copy/pasted EternalBlue-based spreading method. Nothing new.

[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by fosco on Wednesday June 28, 2017 @11:03AM (#14654719)
can you share literature on what tools you used to reverse engineer and maybe other items worth reading if I am interested in this type of research?
[ Parent | on HN ]
Re:Another Ransomware Outbreak Is Going Global by hypervis0r on Sunday July 09, 2017 @03:58PM (#14731366)
Literature: sorry no, I didn't read anything; everything I know is from practice.

As for the tools: just IDA Pro, really, if you don't count the standard stuff: a VM to avoid getting the host infected (VirtualBox), Burp (to analyze malware HTTP traffic), etc. Nothing too fancy.

[ Parent | on HN ]