It seems very easy to implement, hardcode a URL in a function, and then run the function(every 12 hours for example). It checks the URL's provided version number, if theres a mismatch, it downloads the update from the URL(encrypted with a private key), then decrypts it with the public key(hardcoded) and applies it.

Why would authors of viruses such as WannaCry not implement such a mechanism?

  • Many do, or at least download a second stage to actually do something once an infection is successful. For malware like Wannacry 2 stage is usually the case - they don't need regular updates because once their encryption work is done then its over there's no need to keep updating. – Numeron Oct 6 '17 at 2:48

Malware that is made to persist on a machine (such as trojans, bots and similar) is mostly provided with update routines. Most of the cases the malware will enable the master to provide a link to another binary that will then be downloaded and executed.

Since every malware made to "herd" bots is provided with a "download & execute"-Function in some cases this is just an easy step. Download, execute and then kill the main binaries persistence.

It could e.g. look a little like this in the backend: (ignore the fact, that this gaudox is probably old and ugly as f.... ;) enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.