🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
SHA3-384 hash: d74f1701a3fb729770708292e5c35f02fa31c27929be7d626e554754f0f19965267f8129d90d80923ab604e70e764f00
SHA1 hash: 266aa0ddc286a2482bf973d6bf3112b3ff10f29a
MD5 hash: 48733441a9b5b95e2387f087d3383898
humanhash: violet-quiet-quiet-eighteen
File name:49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
Download: download sample
Signature WannaCry
Create hunting rule
File size:5'267'459 bytes
First seen:2026-03-11 17:22:24 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2e5708ae5fed0403e8117c645fb23e5b (1'124 x WannaCry, 7 x Worm.Virut, 2 x Expiro)
ssdeep 49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdh:1GPoBhz1aRxcSUDk36SAEdh
Threatray 1'444 similar samples on MalwareBazaar
TLSH T19C360153905640BCD10D987090EE4B91E9772EA5396DB48AAF43FA1E3BF36D3F582903
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter enthec
Tags:dll WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57091/
Detection(s):
Win.Ransomware.Wanna-9769986-0
Create hunting rule

Win.Ransomware.Wanacryptor-9942127-1
Create hunting rule

Win.Ransomware.Wannacry-9982112-0
Create hunting rule

Win.Ransomware.WannaCry-10011460-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Ransomware.Wanna-6888027-0
Create hunting rule

Win.Ransomware.Wanna-6888334-0
Create hunting rule

Win.Malware.Djwy-6923377-0
Create hunting rule

BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2
Create hunting rule

Win.Exploit.Doublepulsar-7427328-0
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69b1a4e85a439615ccbf6ec1
Tags:
shellcode trojware eqtonex madi
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto microsoft_visual_cc overlay packed ransomware smb soft-404 wannacry wannacry
Link:
https://www.filescan.io/uploads/69b1a5212000fc76c3d42fdf/reports/ddea429b-3f50-47cd-95ca-108801180db7/overview
Verdict:
Malicious
Labled as:
CVE-2017-0147
Link:
https://www.hybrid-analysis.com/sample/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
Verdict:
Malicious
File Type:
dll x32
First seen:
2019-05-16T11:04:00Z UTC
Last seen:
2019-05-16T11:34:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Eb.a HEUR:Worm.Win32.Generic HEUR:Trojan-Ransom.Win32.Wanna.gen HEUR:Exploit.Win32.MS17-010.gen Trojan-Ransom.Wanna.UDP.C&C Trojan.Win32.EquationDrug.sb Trojan.Win32.Eb.b HEUR:Trojan.Win32.EquationDrug.gen Exploit.Win32.MS17-010.kpn Trojan-Ransom.Win32.Wanna.m
Link:
https://opentip.kaspersky.com/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65/results?tab=lookup
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3ab4d25c-6c39-4e4b-a23b-a211a6f2d8a8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65/
Verdict:
Malicious
Threat:
Family.WANNACRY
Link:
https://tip.neiki.dev/file/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2019-05-16 13:47:43 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
33 of 36 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhjbadmxntavgaltmerus2nyd6rewdurzfgzxxxqkkr4tshsvnsq._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
Similar samples:
06867ecdcfb797b6c7c507125cd1c9508e972cf30b2175e0f530262d45d78e15
WannaCry
222a7059f1845110a8050a900f7f98bb6ab4338c98093646d1d972bb120dc99c
WannaCry
2f582f668235ac1ab24776fde5bfbfafe2f4b79b57fdfeedf12ed07c42bec0a7
WannaCry
624b9e13f66d9e715c32747b8b2b332b89275d1c9ae0b74ac5a61f2a8e51549d
WannaCry
cb0740cfe3e218745b4d25ab6c12d942370596859536311f584a93723e676ea4
WannaCry
e1fe02b7aedd39d08211ebc47b5af21a05f8be7a6cc2de2b20835f37a5919d37
WannaCry
error
WannaCry
fade02b958b99c08787e13ba1117164bac6ba8ed27740cd590b5beed188fe540
WannaCry
+ 1'434 additional samples on MalwareBazaar
Result
Malware family:
wannacry
Create hunting rule
Score:
  10/10
Tags:
family:wannacry discovery ransomware worm
Link:
https://tria.ge/reports/260311-vydylaey5x/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Creates a large amount of network flows
Executes dropped EXE
Contacts a large (2678) amount of remote hosts
Wannacry
Wannacry family
Unpacked files
SH256 hash:
49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65
MD5 hash:
48733441a9b5b95e2387f087d3383898
SHA1 hash:
266aa0ddc286a2482bf973d6bf3112b3ff10f29a
Link:
https://www.unpac.me/results/ef71207d-f520-4892-96ba-3a7ed230d5b6/
SH256 hash:
1788eaad6b6ad8f5255ff2d7a73cfeabac5cccfc44af809f5aa64e75ef8cd773
MD5 hash:
231adcaa930ea07cb65ee93731bda6a4
SHA1 hash:
c4a2e8d94e55b358c1140bc43021028a7e58e18e
Detections:
WannaCry_Ransomware
Create hunting rule
WannaCry_Ransomware_Gen
Create hunting rule
Link:
https://www.unpac.me/results/ef71207d-f520-4892-96ba-3a7ed230d5b6/
SH256 hash:
d44ad1353920f11a4c0932efe720a58b5dd9fa11ef786261b4a41aa8133df2d4
MD5 hash:
b02bff40255a5d74aab810d9f49b4035
SHA1 hash:
7e92c1eba0f533d139adcb10d893ff8196716785
Link:
https://www.unpac.me/results/ef71207d-f520-4892-96ba-3a7ed230d5b6/
Malware family:
WannaCry
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/49d2100d976c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57091/

Comments