News for hackers. Stuff that matters.

A comment on Researcher Who Stopped WannaCry Ransomware Detained in US After Def Con. Parent comment

Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by Avery3R on Thursday August 03, 2017 @02:21PM (#14922233)
Pretty sure it was in disassembled machine code, not source code.
[ Parent | on HN ]
Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by jtl999 on Thursday August 03, 2017 @10:59PM (#14925997)
I have taken the liberty to download a sample of WannaCry and I can see the "killswitch" domain just running strings on the binary.

    $ strings Downloads/24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c.bin |grep .com
   __p__commode
   http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
[ Parent | on HN ]