New ransomware with Whatsapp icon, calls itself "Bansomqare Wanna", uses WannaCry design. Appends .bitcoin extension. Email: MildredRLewis@teleworm.uspic.twitter.com/AvIrUSwVBe
Show this thread
Sandbox results:
@anyrun_app crashes: https://app.any.run/tasks/cba6b77d-bb2b-4786-99bf-7c55c6938778 …
CAPE: https://cape.contextis.com/analysis/6520/
Payload: https://www.reverse.it/sample/fbe54141fb79aa5f69a99f107155ad995494f5ce5e70279aa45fca6b5856bc4e/5aba8f0f7ca3e164f516e336 …
IOCs:https://otx.alienvault.com/pulse/5aba8f9f58c1a16d90f55503 …
-
-
Requires Administrator privs, crashes otherwisehttps://app.any.run/tasks/0f0d7c12-59ba-4226-8409-faf297b2579e …
-
Weird - wasn't needed on my VM. Could you double-check please? :)
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.