The media keeps updating us on the number of WannaCry infected PCs. Are they all using the information from MalwareTech? How does MalwareTech get this information?
Add a comment
|
1 Answer
He owns the most of kill switch domains (used to stop the malware execution). One of which I am know to is this where he says "Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which i promptly registered." The number of DNS requests he is getting, he notes that using some auto-script and represents here. He is also getting the ip geolocation on a real-time basis and hence he is able to represent it on a map.
Maybe he is using something more than this to detect if it is from a browser or not to get the actual data.
-
so unless there is a variant version of the ransonware, whatever number increasing in the malwaretech means that PC is infected but deactivated, assuming they are the same version of the original wannacry ransonware? May 15, 2017 at 6:06
-
@palazzotrain Exactly. New sinkholes are detected for wannacry 2.0 and may be they updated in their db. This is what I can logically think. I don't own it but this is how he must be doing. :) Hope this satisfies your doubt.– m1lak0May 15, 2017 at 6:13
-
thanks. That also mean, ONLY the one who owns that url can know this infection statistics. If the domain owner chooses not to open the information publicly, no one else can have such statistics. And, it also means that all other media can do nothing but trust the statistics publishes by that owner. Correct? May 17, 2017 at 1:49
-
@palazzotrain Yes, there you are. Totally agree. But media finds its way anyhow. They would then find another source like local surveys, cyber cell reports, etc. but they won't accurately get international stats for the obvious reason unless they follow and choose to believe others.– m1lak0May 17, 2017 at 1:56