Discussion:
The worm that spreads WanaCrypt0r
Add Reply
Real Troll
2017-05-15 01:59:00 UTC
Reply
Permalink
Raw Message
The snippet code is here:

<https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/>

Use your brains to get it work for you in your test labs.

No Jesus needed here.
Chris M. Thomasson
2017-05-15 04:57:35 UTC
Reply
Permalink
Raw Message
Post by Real Troll
<https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/>
Use your brains to get it work for you in your test labs.
No Jesus needed here.
Thank you for posting this.
Chris M. Thomasson
2017-05-15 05:18:02 UTC
Reply
Permalink
Raw Message
Post by Chris M. Thomasson
Post by Real Troll
<https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/>
Use your brains to get it work for you in your test labs.
No Jesus needed here.
Thank you for posting this.
The one point that has me thinking is the missing leading underscore to
the _beginthreadex function:

https://msdn.microsoft.com/en-us/library/kdzttdcb.aspx

It should not link? Weird. Also, that function is used to create threads
along with an initialization of the CRT for said thread. So, the virus is C.

Creating code on Windows that does not use the CRT can make use of
CreateThread. Strange that a virus is not written in assembly language.
Cholo Lennon
2017-05-15 13:33:48 UTC
Reply
Permalink
Raw Message
Post by Chris M. Thomasson
Strange that a virus is not written in assembly language.
Well, nowadays it's very unusual for a virus/malware to be written in
assembler, it has no sense (IMO)
--
Cholo Lennon
Bs.As.
ARG
Chris M. Thomasson
2017-05-15 17:32:27 UTC
Reply
Permalink
Raw Message
Post by Cholo Lennon
Post by Chris M. Thomasson
Strange that a virus is not written in assembly language.
Well, nowadays it's very unusual for a virus/malware to be written in
assembler, it has no sense (IMO)
Okay. I have not been keeping up.

Rick C. Hodgin
2017-05-15 07:23:04 UTC
Reply
Permalink
Raw Message
Post by Real Troll
No Jesus needed here.
This belief will seem to work well until you leave this world and are
summoned by name to give an account of your life and it's realized
your sin is still with you, God is real, judgment for sin is real, and
Hellfire is real.

It's why God warns you in advance ... to give you space and time
to repent, and to come to Jesus asking forgiveness.

You must do this today, because none of us are promised tomorrow.

Thank you,
Rick C. Hodgin
Loading...