Spacial Spacial

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	#!/usr/bin/env python

	from lib.core.data import kb
	from lib.core.enums import PRIORITY
	import string

	__priority__ = PRIORITY.NORMAL

	def dependencies():
	pass

	# Description: Boxstarter Script
	# Author: Jess Frazelle <jess@linux.com>
	# Last Updated: 2017-09-11
	#
	# Install boxstarter:
	# . { iwr -useb http://boxstarter.org/bootstrapper.ps1 } \| iex; get-boxstarter -Force
	#
	# You might need to set: Set-ExecutionPolicy RemoteSigned
	#
	# Run this boxstarter by calling the following from an elevated command-prompt:

	#!/bin/bash

	###AUTHOR###
	#Harry Dove-Robinson 12/14/2017
	#harry@doverobinson.me
	#https://gist.github.com/hdoverobinson
	#https://github.com/hdoverobinson

	###CONTENTS OF TARGET_DIR WILL BE CLEARED AT EACH RUN###
	TARGET_DIR="/root/osp-build"

	#Laura Maia e Letícia Barreto
	import requests
	from bs4 import BeautifulSoup
	url='https://pt.wikipedia.org/wiki/Os_100_livros_do_s%C3%A9culo_segundo_Le_Monde'
	soup = BeautifulSoup(requests.get(url).text, 'html.parser')

	nome=[nome.string.strip()
	for nome in soup.findAll('i')]

	ranking=[rank.string

	"""
	A Processing implementation of Game of Life By Joan Soler-Adillon

	Press SPACE BAR to pause and change the cell's values with the mouse
	On pause, click to activate/deactivate cells
	Press R to randomly reset the cells' grid
	Press C to clear the cells' grid

	The original Game of Life was created by John Conway in 1970.
	"""

	https://gist.github.com/fmasanori/ee2b554ee6e05f298d5014bcbf730fd7
	Cats
	Abdul Abel Abelarda Abelardo Abelhinha Abigail Abner Abu Acacia Ace Acerola Adda Adonis Adrik Adry Afrodite Agapi Agostinho Agripina(o) Aiara Aícha Aika(o) Aiki Aila Aileen Aima Aimee Aislan Aiwa Akan Akaya Akenaton Akesa Alanis Alec Alecrim Aleetza Alef Alegria Aleluia Alemã Alemão Aleska Alex Alf Alfa Alface Algodão Alice Alicia Alika Alina Alisson Alita Alladim Alma Almôndega Aloha Alone Alpha Alphi Alvinha Amapola Amaral Amarula Amaya Ambar Amber Ameli Amendoim Amie Amiga(o) Amigão Amiguinha(o) Amin Amira Amon Amor Amora Amoreko Amoroso Amy Anakin Anda Andie Andora Andy Angel Angra Angus Anjinha Anjinho Anúbis Anukh Apache Apagão Aphou Apiá Apoena Apolo Apple April Aquiles Arã Arabi Aragon Aramis Aranha Arashi Archie Arena Aretha Argos Ariadne Ariel Ariela Arine Aristóteles Arkan Armani Aroeira Aron Arrepio Arteira Artemis Arthur Aruan Aruane Aruck Aruska Ashley Aska Asla Aslam Aspen Asrama Assombroso Aster Asterix Asthar Astolfo As

	achievement,achievement_code,additional_value,author,author_page_summary,category,department,destination,file_generation_date,file_generation_time,intervention,intervention_code,justification,location,number,proposed_wording,reference,total_page_summary,type,commitment_info_url,url
	Implantação/Aparelham/Adequação Unid Saúde/ Aquis Unid Móvel,552,5.343.000,3230 - Jaime Martins,1 de 13,Individual,Saúde,ESPELHO DE EMENDA DE APROPRIAÇÃO DE DESPESA,2013-12-02,22:03,Atenção Especializada:Hospitais/Policlínicas/Unid.Especializ,003,,3100000 - Minas Gerais,32300001,,,3497 de 8807,Apropriação - Inclusão,http://inteligenciadenegocios3.camara.gov.br/painel/redirectorcamento.jsp?urlbo=iDocID=79334%26sOutputFormat=P%26sRefresh=Y%26lsSANO=2009%26lsSMES=12%26lsSORGAO=%26lsSUO=55901%26lsSACAO=2B31%26lsSSUBTITULO=0031,http://www.camara.gov.br/internet/comissao/index/mista/orca/orcamento/or2009/emendas/despesa/DANIELRJ_AV_LOA_AUTOR2_3230.pdf
	Implantação/Aparelham/Adequação Unid Saúde/ Aquis Unid Móvel,552,2.000.000,3230 - Jaime