1

It seems very easy to implement, hardcode a URL in a function, and then run the function(every 12 hours for example). It checks the URL's provided version number, if theres a mismatch, it downloads the update from the URL(encrypted with a private key), then decrypts it with the public key(hardcoded) and applies it.

Why would authors of viruses such as WannaCry not implement such a mechanism?

Improve this question
1
  • Many do, or at least download a second stage to actually do something once an infection is successful. For malware like Wannacry 2 stage is usually the case - they don't need regular updates because once their encryption work is done then its over there's no need to keep updating.
    – Numeron
    Oct 6, 2017 at 2:48

1 Answer 1

Reset to default
1

Malware that is made to persist on a machine (such as trojans, bots and similar) is mostly provided with update routines. Most of the cases the malware will enable the master to provide a link to another binary that will then be downloaded and executed.

Since every malware made to "herd" bots is provided with a "download & execute"-Function in some cases this is just an easy step. Download, execute and then kill the main binaries persistence.

It could e.g. look a little like this in the backend: (ignore the fact, that this gaudox is probably old and ugly as f.... ;) enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .