Andrea Jonus Jei

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	#!/bin/bash

	CONTAINER="/var/www/html"
	DOMAIN="kopiro.it"

	PUBLIC_DIR="$CONTAINER/public"
	BACKUP_DIR="$CONTAINER/conf/backup/$(date +%s)"

	mkdir -p "$BACKUP_DIR"
	cp -v $CONTAINER/conf/*.pem "$BACKUP_DIR/"

	import android.arch.lifecycle.LiveData
	import android.content.SharedPreferences

	abstract class SharedPreferenceLiveData<T>(val sharedPrefs: SharedPreferences,
	val key: String,
	val defValue: T) : LiveData<T>() {

	private val preferenceChangeListener = SharedPreferences.OnSharedPreferenceChangeListener { sharedPreferences, key ->
	if (key == this.key) {
	value = getValueFromPreferences(key, defValue)

	function NestedScrollViewManager (parent_view)
	{
	// Appcelerator Titanium code for managing scrollviews inside of scrollviews (not true Android
	// NestedScrollViews, but just a horizontal scrollview inside of a vertical scrollview).
	//
	// If you want to put a horizontal scrollview inside a vertical scrollview (like the Netflix app UI),
	// it seems to work reasonably well on iOS. But on android, the user experience is very janky.
	// Unless the user's drag movements are nearly exactly horizontal, there will be some movement of
	// the parent scrollview, and then it becomes very difficult to scroll the child view. Flinging is
	// almost impossible.