Accéder au contenu principal

Pcap Of Wannacry Spreading Using EthernalBlue

Par
Saw that a lot of people were looking for a pcap with WannaCry spreading Using EthernalBlue.

I have put together a little "petri dish" test environment and started looking for a sample that has the exploit. Some samples out there simply do not have the exploit code, and even tough they will encrypt the files locally, sometimes the mounted shares too, they would not spread.

Luckily, I have found this nice blog post from McAfee Labs: https://securingtomorrow.mcafee.com/mcafee-labs/analysis-wannacry-ransomware/ with the reference to the sample SHA256: 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c (they keep referring to samples with MD5, which is still a very-very bad practice, but the hash is MD5: DB349B97C37D22F5EA1D1841E3C89EB4)

Once I got the sample from the VxStream Sandbox site, dropped it in the test environment, and monitored it with Security Onion. I was super happy to see it spreading, despite the fact that for the first run my Windows 7 x64 VM went to BSOD as the EthernalBlue exploit failed.

But the second run was a full success, all my Windows 7 VMs got infected. Brad was so kind and made a guest blog post at one of my favorite sites, www.malware-traffic-analysis.net so you can find the pcap, description of the test environment and some screenshots here: http://malware-traffic-analysis.net/2017/05/18/index2.html

More information


  1. Pentest Book
  2. Pentest Tools For Windows
  3. Hacking Jailbreak
  4. Hacking Online Games
  5. Pentest Firewall
  6. Hacking Online Games
  7. Hacker Types
  8. Pentest Box
  9. Hacking To The Gate
  10. Pentesting
  11. Pentest Active Directory
  12. Hacking Jacket
  13. Hacking Forums
  14. Pentest +
  15. Hacking Jailbreak
  16. Pentest Nmap
  17. Pentesterlab

Commentaires

Enregistrer un commentaire

Posts les plus consultés de ce blog

Abdominal pain after a motor vehicle accident

Par
CASE A 22-year-old man was brought to the ED complaining of abdominal pain after a rollover motor vehicle accident. He was the front seat passenger and was wearing a seat belt. Although he was trapped in the vehicle and it caught on fire, he did not suffer any cutaneous burns. History  The patient's past medical history was significant for attention-deficit hyperactivity disorder. He admitted to using tobacco and alcohol socially, but denied illicit drug use. He denied any medication use or drug allergies. A review of systems was positive for complaints of abdominal pain and anxiety. Physical examination  The patient's vital signs were: BP, 112/51 mm Hg; heart rate, 110 beats/minute; respirations, 23; SpO 2 , 95% on room air; and temperature, 37.4° C (99.3° F). On ED arrival, he was awake, alert, and oriented but appeared anxious and agitated. His pupils were equal, round, and reactive to light. His head was normocephalic with a 2-cm laceration on the left ear. The pati...
Enregistrer un commentaire
Lire la suite

HTML5 Games On Android

Par
On my last hollidays, I made two HTML5 games, and published on android market. Nowadays javascript has powerful libraries for doing almost everything, and also there are several compilers from java or c code to javascript, converting opengl c code to html5 canvas, but definitely, javascript execution is slower than dalvik applications, and of course much slower than arm c libs. For improving the speed of sounds and images loader, I have used javascript asynchronous execution and scheduling priority has been controlled with setTimeout/setInterval which deprioritize or priorize a code block. This games are published on the android market here: Android Planets and here: Far Planet Related news Hacker Hardware Tools Pentest Tools Port Scanner Hacker Tools For Mac Tools Used For Hacking Hacker Techniques Tools And Incident Handling Easy Hack Tools Hacking Tools Kit Hacking Tools Usb Hacker Hardware Tools Hacker Tools Hardware Hack Tools For Windows Hacking Tools For G...
Enregistrer un commentaire
Lire la suite

"Abre Las Puertas A La Inclusión": La Campaña De Donativos De ASCM Para Hacer Su Sede Más Accesible

Par
La Asociación Sociocultural ASCM lanza la campaña de recaudación de fondos: "Abre las puertas a la inclusión", con el objetivo de dotar su sede de una puerta automática.                                                       Campaña "Abre las puertas a la inclusión": Vídeo promocional.  La Asociación Sociocultural ASCM lanza, hoy, una campaña de recaudación de fondos para mejorar la accesibilidad de su sede de Ferrol y adaptarse a las medidas de seguridad y prevención que exige la nueva normalidad. "Abre las puertas a la inclusión" es el slogan de esta campaña de donativos, que se extenderá hasta el 24 de julio, y que busca la colaboración de la ciudadanía para lograr reunir los 3.599 euros necesarios para dotar su local de una puerta automática. ASCM lleva, desde su fundación en 1987, reivindicando la necesidad de pensar en clave de accesibilidad un...
Enregistrer un commentaire
Lire la suite