4

The media keeps updating us on the number of WannaCry infected PCs. Are they all using the information from MalwareTech? How does MalwareTech get this information?

7

He owns the most of kill switch domains (used to stop the malware execution). One of which I am know to is this where he says "Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which i promptly registered." The number of DNS requests he is getting, he notes that using some auto-script and represents here. He is also getting the ip geolocation on a real-time basis and hence he is able to represent it on a map.

Maybe he is using something more than this to detect if it is from a browser or not to get the actual data.

  • so unless there is a variant version of the ransonware, whatever number increasing in the malwaretech means that PC is infected but deactivated, assuming they are the same version of the original wannacry ransonware? – palazzo train May 15 '17 at 6:06
  • @palazzotrain Exactly. New sinkholes are detected for wannacry 2.0 and may be they updated in their db. This is what I can logically think. I don't own it but this is how he must be doing. :) Hope this satisfies your doubt. – m1lak0 May 15 '17 at 6:13
  • thanks. That also mean, ONLY the one who owns that url can know this infection statistics. If the domain owner chooses not to open the information publicly, no one else can have such statistics. And, it also means that all other media can do nothing but trust the statistics publishes by that owner. Correct? – palazzo train May 17 '17 at 1:49
  • @palazzotrain Yes, there you are. Totally agree. But media finds its way anyhow. They would then find another source like local surveys, cyber cell reports, etc. but they won't accurately get international stats for the obvious reason unless they follow and choose to believe others. – m1lak0 May 17 '17 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.