# What is Ransomware?
------------------------------------
Ransomware is a malicious software that encrypts the files and locks device, such as computer, tablet or smartphone and then demands a ransom to unlock it. Recently, a dangerous ransomware named 'Wannacry' has been affecting the computers worldwide creating the biggest ransomware attack the world has ever seen. This has affected computers in India also.

# What is WannaCry Ransomware?
--------------------------------------------------
WannaCry ransomware attacks windows based machines. It also goes by the name WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY.It leverages SMB exploit in Windows machines called EternalBlue to attack and inject the malware. All versions of windows before Windows 10 are vulneable to this attack if not patched for MS-17-010.

After a system is affected, it encrypts the files and shows a pop up with a countdown and instructions on how to pay the 300$ in bitcoins to decrypt and get back the original files. If the ransom is not paid in 3 days, the ransom amount increases to 600$ and threatens the user to wipe off all the data. It also installs DOUBLEPULSAR backdoor in the machine.

# What can you do to prevent infection?
------------------------------------------------------
Ø Microsoft has released a Windows security patch MS17-010 for Winodws machines. This needs to be applied immediately and urgently.

Ø Remove Windows NT4, Windows 2000 and Windows XP-2003 from production environments.

Ø Block ports 139, 445 and 3389 in firewall.

Ø Avoid clicking on links or opening attachments or emails from people you don't know or companies you don't do business with.

Ø SMB is enabled by default on Windows. Disable smb service on the machine by going to Settings > uncheck the settings > OK

Ø Make sure your software is up-to-date.

Ø Have a pop-up blocker running on your web browser.

Ø Regularly backup your files.

Ø Install a good antivirus and a good antiransomware product for better security.

# Suspicious File Names to be Careful of !!
---------------------------------------------------------
• @Please_Read_Me@.txt
• @WanaDecryptor@.exe
• @WanaDecryptor@.exe.lnk
• Please Read Me!.txt (Older variant)
• C:\WINDOWS\tasksche.exe
• C:\WINDOWS\qeriuwjhrf
• 131181494299235.bat
• 176641494574290.bat
• 217201494590800.bat
• [0-9]{15}.bat #regex
• !WannaDecryptor!.exe.lnk
• 00000000.pky
• 00000000.eky
• 00000000.res
• C:\WINDOWS\system32\taskdl.exe

~ Culled

.

Ok

.

sleepyeyez:
.

. = fullstop spacebooker chairman .. Protect your devices..

Where is mynd44 and lalasticlala? Ransomware is trending... Push this thread to the front page immediately to prevent Nigerians from being affected..

dingbang:
Where is mynd44 and lalasticlala? Ransomware is trending... Push this thread to the front page immediately to prevent Nigerians from being affected..

U they mind them, infact i done tire for them and their nairaland.. Important topics like this them no go ever push go front page but if na topics wey go make nairalanders they bash and call themselves demeaning names like developers/Igbos and afonia, the topic go reach front page with the speed of light.. Nairaland is becoming irrelevant by the day.. Na Oga Seun and him mods them sabi sha.. Nothing lasts forever..

Internal memos has even been sent warning Nigerian banks of an impending and imminent attack on banking/financial sectors..

I love hacking
but not holding the world hostage

dingbang:
Where is mynd44 and lalasticlala? Ransomware is trending... Push this thread to the front page immediately to prevent Nigerians from being affected..

U dey mind dem? If na story about snake, tonto dikeh or BBN,dem go rush put am for front page.


Wey d computer mods, skydancer and Maleeq ? Una no see dis one?

sleepyeyez:


U dey mind dem? If na story about snake, tonto dikeh or BBN,dem go rush put am for front page.


Wey d computer mods, skydancer and Maleeq ? Una no see dis one?

lol na so na.. Nigerian mentality go finish us for this country. If they were sensible enough, this would have been on front page since yesterday.

Amgreat70:
I love hacking
but not holding the world hostage

*dials number*
Hello...yea, inspector well done o. I think iv found one of the ransomware suspects....yes he said he's a hacker...Amgreat70 is his moniker.....ehn, jus to be sure....ok,ill forward d details but shey dis one fall under whistleblower things, so how far?

Denko2721987:


. = fullstop spacebooker chairman .. Protect your devices..

Baba, all na part of d hustle!

sleepyeyez:


*dials number*
Hello...yea, inspector well done o. I think iv found one of the ransomware suspects....yes he said he's a hacker...Amgreat70 is his moniker.....ehn, jus to be sure....ok,ill forward d details but shey dis one fall under whistleblower things, so how far?

Lols they should come and pay for me to learn hacking o

sleepyeyez:


Baba, all na part of d hustle!

Hustle when oga Seun and him boys no they pay person?? I salute u Baba and hope say u bam...