News for hackers. Stuff that matters.
Re:Another Ransomware Outbreak Is Going Global by hypervis0r on Tuesday June 27, 2017 @02:22PM (#14647859)
Not OP, but he is right. I just walked out of work, where I had to reverse the sample. It indeed uses EternalBlue (attacks by enumerating local network IPs with Windows APIs and randomly scanning the internet). Apart from that, it overwrites the MBR with a custom bootloader and schedules a restart ("shutdown /t /r") as SYSTEM in a random amount of time. After rebooting, it fakes a chkdsk and meanwhile, encrypts your files.

It is also true that it uses PsExec to spread.

TL;DR good old Petya ransomware (old as shit) with a copy/pasted EternalBlue-based spreading method. Nothing new.

Re:Another Ransomware Outbreak Is Going Global by fosco on Wednesday June 28, 2017 @11:03AM (#14654719)
can you share literature on what tools you used to reverse engineer and maybe other items worth reading if I am interested in this type of research?
Re:Another Ransomware Outbreak Is Going Global by hypervis0r on Sunday July 09, 2017 @03:58PM (#14731366)
Literature: sorry no, I didn't read anything; everything I know is from practice.

As for the tools: just IDA Pro, really, if you don't count the standard stuff: a VM to avoid getting the host infected (VirtualBox), Burp (to analyze malware HTTP traffic), etc. Nothing too fancy.