I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out?


  • 1
    Does it need to do a DNS query? – schroeder May 26 '17 at 21:33
  • I found an alert which shows it did not the log is not on the host. I was thinking that it used a technique to not be seen locally but was seen on the DNS firewall / infoblox type of tool. which makes it hard to see the original process that called the DNS for kill switch – Jon_Little-Sec Engineer May 26 '17 at 21:35

I suppose it's best that I first answer the question. Then after, I'll elaborate a bit. Question: How does it call out? Answer: It calls out using DNS - as you did suspect. The WannaCry ransomware actually does multiple dns requests throughout its lifecycle. In the WinMAIN function of its code, it attempts to connect to the website with the url of iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com. The reason for that DNS request is suspected to be a "killswitch" for the author for use in either a sandbox test environment, or possibly a link to the CCS's (Command and Control Servers).

The other DNS request(s) are made to access the ToR network (aka Dark Web) so it can anonymously download the encryption program as well as access a bitcoin wallet to pay the $300 payment.

CITED SOURCES: WANNACRY CODE ANALYSIS - https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/

WANNACRY ATTACK ANALYSIS - https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.