worm

worm

Read More

WannaCry Analysis

Thursday, 18 May 2017 04:07
Published in Security Testing

Ransomware is a malware that encrypts contents on infected systems and demands payment in bitcoins.

How is it Spreading? 

  1. WannaCry / WannaCrypt encrypts the files on infected Windows systems.
  2. There are two key components – a worm and a ransomware package
  3. It spreads laterally between computers on the same LAN by using a vulnerability in implementations of Server Message Block (SMB) in Windows systems.
  4. It also spreads through malicious email attachments.
  5. This exploit is named as ETERNALBLUE.
  6. Initial ransom was of $300 USD but the group is increasing the ransom demands upto $600 in Bitcoin.