Undoing WannaCry, Part 1 – Finding the killswitch and unpacking the malware in #Ghidra

Undoing WannaCry, Part 1 – Finding the killswitch and unpacking the malware in #Ghidra

HomestacksmashingUndoing WannaCry, Part 1 – Finding the killswitch and unpacking the malware in #Ghidra
Undoing WannaCry, Part 1 – Finding the killswitch and unpacking the malware in #Ghidra
ChannelPublish DateThumbnail & View CountDownload Video
Channel AvatarPublish Date not found Thumbnail
0 Views
Part 2 is out! https://www.youtube.com/watch?v=Q90uZS3taG0

In this first video of the “Undoing WannaCry” series, we look at the infamous kill switch as well as the installation and unpacking procedure of WannaCry.

Twitter: https://twitter.com/ghidraninja

Left:
– Interview with MalwareTech: https://soundcloud.com/arrow-bandwidth/s3-episode-11-wannacry-interview-with-malware-tech-at-infosec-europe-2017
– MalwareTech's blog post on the kill switch: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html

further reading
– Wikipedia: https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
– LogRhythm Analysis: https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/
– Secureworks Analysis: https://www.secureworks.com/research/wcry-ransomware-analysis

Please take the opportunity to connect with your friends and family and share this video with them if you find it useful.