An engrossing read from an anonymous British security researcher, MalwareTech, who with lots of skill (and maybe a little luck) managed to stop the advance of a ransomware outbreak.
… NHS systems all across the country being hit, which was what tipped me off to the fact this was something big. Although ransomware on a public sector system isn’t even newsworthy, systems being hit simultaneously across the country is … I was quickly able to get a sample of the malware with the help of Kafeine, a good friend and fellow researcher. Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which I promptly registered.
Apparently one of the ways in which malware avoids detection is by attempting to ping an a known IP address before commencing its attack on the system, this is a subtle check to ensure that researchers are not monitoring the malware from within a controlled environment.
I believe the malware creators were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox and the malware exits to prevent further analysis. This technique isn’t unprecedented: the Necurs trojan queries five totally random domains, and if they all return the same IP it exits…
However, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample.
This is a fascinating tale, and you can read the whole thing over at Ars Technica.
Comments are closed.