[–] skamoen 9y ago ↗ There seems to be a lot of confusion about versions without killswitches. This guy says he made a mistake: https://twitter.com/craiu/status/863718940870139904 [–] skamoen 9y ago ↗ To be more specific, all samples without killswitch were samples of just the ransomware, not the worm spreading it. [–] viraptor 9y ago ↗ Interesting for context:https://twitter.com/marksteward/status/863747839117201409New domains are just trivial modifications of the old one. Still hardcoded. That's unlikely to be a new version, but rather people playing around.
[–] skamoen 9y ago ↗ To be more specific, all samples without killswitch were samples of just the ransomware, not the worm spreading it.
[–] viraptor 9y ago ↗ Interesting for context:https://twitter.com/marksteward/status/863747839117201409New domains are just trivial modifications of the old one. Still hardcoded. That's unlikely to be a new version, but rather people playing around.
[–] ivanbakel 9y ago ↗ Was only a matter of time. What's it doing to detect anti-virus sandboxing now, if that was the original purpose of the fixed domain?
[–] emersonrsantos 9y ago ↗ This guy just found a new kill switch and registered the domain already:https://twitter.com/msuicheHe's talking about versions with nop'ed kill switches.EDIT: not nop, but with a jnz +2, still similar to a nop-nop.
5 comments
[ 3.0 ms ] story [ 21.6 ms ] threadhttps://twitter.com/marksteward/status/863747839117201409
New domains are just trivial modifications of the old one. Still hardcoded. That's unlikely to be a new version, but rather people playing around.
https://twitter.com/msuiche
He's talking about versions with nop'ed kill switches.
EDIT: not nop, but with a jnz +2, still similar to a nop-nop.