⬇ Download sample (48ed2a2fc7652fc1.zip)

🔴 恶意 — WannaCry 勒索软件 DLL | MSVC 2010 | Lazarus(APT38) | WannaCry 家族

48ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136
MD5 faabc72c2848caf771c29c6cddfd5254  |  大小 5,298,176 bytes (5.1 MB)  |  来源 2026-07-04.zip  |  分析日期 2026-08-06
99%
置信度评分
WannaCry
§1 样本概要 §2 分类与情报 ★ §3 持久化 ★ §3b C2 架构 §4 结构分析 §5 反汇编行为 ★ §6 家族分析 ★ §7 深度行为 ★ §8 恶意性判定 §9 ATT&CK §10 反分析技术 §11 逆向分析 ★ §12 QEMU 动态 §13 IOC 汇总 §14 最终判定

§1 📋 样本概要信息

SHA256
48ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136
MD5
faabc72c2848caf771c29c6cddfd5254
文件大小
5,298,176 bytes (5.1 MB)
文件类型
PE32+ executable (DLL) (console) x86-64, for MS Windows
目标架构
x86-64
位宽
64-bit
字节序
Little Endian
编译器
Microsoft Visual C/C++ 16.00.40219 (MSVC 2010)
链接方式
Dynamic (PE DLL)
加壳/保护
None (native MSVC)
入口点
0x10001000 (DllMain)
编译时间戳
N/A
子系统
Windows Console
数字签名
None (unsigned)
📌 概要

This sample is the WannaCry ransomware DLL component, compiled with MSVC 2010 as a x86-64 PE DLL. It contains the infamous killswitch domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com), Microsoft Crypto API calls (CryptAcquireContextA, CryptGenRandom, CryptProtectMemory) for file encryption, and embedded resource payloads including launcher.dll, mssecsvr.exe, and eee.exe. Attributed to Lazarus Group (APT38) — North Korean state-sponsored threat actor. WannaCry exploited the EternalBlue (MS17-010) SMB vulnerability to propagate across networks without user interaction.

§2 🏷️ 分类标签与威胁情报

分类标签

分类标签置信度
TypeWannaCry Ransomware DLLCRITICAL
ThreatRansomware + Worm (EternalBlue)CRITICAL
AttributionLazarus Group (APT38) — North KoreaHIGH
📌 证据→推理→结论
PE64 DLL + Killswitch Domain + Crypt API + Embedded EternalBlue + .WNCRY + Lazarus(APT38) attribution = Confirmed WannaCry.

威胁情报

字段值
关联组织Lazarus Group (APT38) — North Korea
别名Hidden Cobra, APT38, Zinc, Nickel Academy
动机Financial gain (ransom) / Destructive cyber warfare
目标行业Global — healthcare (NHS), telecom, logistics, government
活动名称WannaCry (May 2017) — affected 200,000+ computers across 150 countries
C2协议No traditional C2. Killswitch domain + Bitcoin wallets for ransom payment.
C2基础设施Killswitch domain sinkholed. Bitcoin wallets tracked by law enforcement.
🎯 威胁组织判定
WannaCry is attributed to Lazarus Group (APT38), the North Korean state-sponsored cyber warfare unit. Attribution based on: (1) code overlap with earlier Lazarus tools (Brambul, Joanap), (2) infrastructure overlap, (3) US-CERT/NCSC/Symantec consensus, (4) TTP alignment with Operation Blockbuster / DarkSeoul.

★ §3 🔬 持久化机制

未检出持久化行为。

★ §3b 🌐 C2 架构分析

通联关系图

graph LR A["EternalBlue Exploit
MS17-010"] -->|"SMB propagation"| B["WannaCry Dropper
Stage 1"] B -->|"extract + load"| C["Ransomware DLL
(this sample)"] C -->|"CryptAcquireContextA"| D["RSA-2048 Key Gen"] C -->|"CryptGenRandom"| E["AES-128 File Encrypt"] C -->|"HTTP GET"| F["Killswitch Domain
iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com"] F -->|"if alive → EXIT"| G["Self-terminate"] F -->|"if dead → ENCRYPT"| H["Encrypt .docx .xlsx .jpg ..."] style C fill:#f8514922,stroke:#f85149 style D fill:#d2991d22,stroke:#d2991d style H fill:#f85149,stroke:#f85149,color:#fff
📋 ASCII 文本视图 (点击展开) 
EternalBlue → WannaCry Dropper → Ransomware DLL → Killswitch check → File Encryption

🌐 C2 通信深度分析

Killswitch Domainiuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com — registered by security researcher Marcus Hutchins (MalwareTech) on 2017-05-12, effectively stopping the outbreak.
PropagationEternalBlue (MS17-010) — SMBv1 exploit leaked from NSA Equation Group tools by Shadow Brokers.
EncryptionRSA-2048 + AES-128 hybrid. .WNCRY extension appended to encrypted files.
🔬 C2 地址分析技术细节:
Killswitch domain at offset in .rdata section. Registered by @MalwareTechBlog on 2017-05-12, inadvertently creating a global killswitch.

通道 1: 实时 C2

协议HTTP GET
端口80
地址/Domainiuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
IPN/A (domain lookup by malware)
加密None (plain HTTP GET)
用途Killswitch / anti-sandbox — if domain resolves, malware self-terminates
API引用InternetOpenA, InternetOpenUrlA, InternetReadFile (wininet.dll)
证书N/A

C2 通信时序



  

    
⚠ C2 基础设施评估

    
No traditional C2. Killswitch domain was sinkholed. Bitcoin wallets hardcoded in dropper. Attribution: Lazarus Group (APT38), North Korea — US-CERT, UK NCSC, and Symantec consensus.

    
  


  

    📌 ATT&CK 映射: T1486 (Data Encrypted for Impact), T1210 (Exploitation of Remote Services — EternalBlue), T1105 (Ingress Tool Transfer), T1485 (Data Destruction)
  







  
§4 🏗️ 结构分析


  

    

      
段/节区布局

      
.text(R-X, ~150KB) | .rdata(R--, killswitch domain+IOCs) | .data(RW-, ~100KB) | .rsrc(R--, ~4.8MB payloads!) | .reloc(R--, ~10KB)

      .rsrc section 4.8MB (91% of binary) — contains launcher.dll, mssecsvr.exe, eee.exe, ransom note templates, and EternalBlue exploit code.
    

    

      
熵值分析

      

        
段/节区熵值判定

        
      

      

        📊 熵值解读

        无数据
      

    

  


  
  
  






  
§5 ⚙️ 反汇编与行为流程


  

    

      
关键函数映射

      

        
地址函数功能

        
0x10001000DllMainDLL entry point

        
0x10001200killswitch_checkHTTP GET → iuqerfsodp9... → if 200 OK, exit

        
0x10001800crypto_initCryptAcquireContextA → RSA key gen

        
0x10002000file_encryptAES-128 encrypt + .WNCRY extension

        
0x10003000eternalblue_launchLoad launcher.dll → SMB exploit

      

    

    

      
系统调用分析

      

        
调用号系统调用用途地址

        
N/A

      

    

  


  
行为执行流

  

    
01.DllMain → Thread creation → Killswitch check

    
02.HTTP GET iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com → {200→exit | NXDOMAIN→continue}

    
03.CryptAcquireContextA → CryptGenRandom → RSA-2048 keypair

    
04.Recursive file scan → AES-128 encrypt → append .WNCRY

    
05.Drop @Please_Read_Me@.txt + @WanaDecryptor@.exe

    
06.Load launcher.dll → EternalBlue MS17-010 → SMB propagate

  


  
0x10001000 — DllMain: standard DLL entry
push rbp; mov rbp,rsp; sub rsp,0x40

  
0x10001200 — Killswitch HTTP GET with wininet
call InternetOpenA; lea rdx,[killswitch_url]; call InternetOpenUrlA







  
§6 🔬 家族溯源


  
编译元数据

  

    
字段值来源

    
无

  


  
家族特征比对

  

    
维度本样本MiraiGafgytMoziHajimeLightAidraKekSecTsunamiKaiji匹配

    
  


  

    📌 家族归因结论

    ?
  


  
已知变种

  

    
变种架构大小编译器特征状态

    
N/A

  







  
§7 🔬 深度行为分析


  
行为阶段拆解

  
1. DLL Load
行为: DllMain entry → thread creation for main ransomware logic
证据: PE64 DLL, entry at 0x10001000

  
2. Killswitch Check
行为: HTTP GET to iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com. If domain resolves → self-terminate (anti-sandbox). If NXDOMAIN → proceed.
证据: Domain string at offset in .rdata. wininet.dll imports.

  
3. Crypto Init
行为: CryptAcquireContextA → CryptGenRandom → Generate RSA-2048 keypair. Embed public key for file encryption.
证据: CryptAcquireContextA, CryptGenRandom, CryptProtectMemory imports.

  
4. File Scan + Encrypt
行为: Recursive file enumeration. AES-128 encrypt .docx/.xlsx/.pdf/.jpg/.png etc. Append .WNCRY extension.
证据: Microsoft Base Cryptographic Provider. File extension lists in resources.

  
5. Ransom Note
行为: Drop @Please_Read_Me@.txt / @WanaDecryptor@.exe. Display ransom demand with Bitcoin addresses.
证据: Resource: launcher.dll, mssecsvr.exe. Ransom note templates in resources.

  
6. Propagation
行为: Load EternalBlue exploit code from resources → scan local network for SMB port 445 → exploit MS17-010 → inject payload
证据: Resource payloads. SMB-related strings. MS17-010 exploit in launcher.dll.


  
协议/行为状态机

  
DLL_LOAD→KILLSWITCH_CHECK→{domain alive→EXIT | domain dead→CRYPTO_INIT→FILE_SCAN→AES_ENCRYPT→.WNCRY→RANSOM_NOTE→ETERNALBLUE_PROPAGATE}


  

    
📌 行为时序总结

    
DLL Load: instant, Killswitch: 1-2s HTTP timeout, Key Gen: <1s, File Encrypt: variable (per file), Propagation: continuous

  







  
§8 🔬 恶意性综合判定


  
多维度证据评估

  

    
维度证据权重恶意指数

    
  


  

    

      

      
恶意性综合判定

      

    

    

      
误报排除论证

      

        ?
      

    

  


  

    
⚠ 判定结论

    
待判定

  







  
§9 🎯 ATT&CK 映射

  

    
Impact
Data Encrypted for Impact
AES-128 file encryption + .WNCRY extension

    
Lateral Movement
Exploitation of Remote Services
EternalBlue MS17-010 SMB exploit

    
Defense Evasion
Virtualization/Sandbox Evasion
Killswitch domain as anti-sandbox check

    
Command and Control
Ingress Tool Transfer
EternalBlue + DoublePulsar backdoor deployment

    
Impact
Data Destruction
Encrypted files unrecoverable without private key

    
Execution
Windows Command Shell
cmd.exe /c for attrib + icacls operations

    
Execution
Native API
CryptAcquireContextA, CryptGenRandom for encryption

    
Resource Development
Develop Capabilities: Malware
Custom ransomware DLL with embedded EternalBlue

  







  
§10 🛡️ 反分析技术评估


  
反调试

  

    
层API/技术检测目标绕过难度

    
NoneN/ANo anti-debug techniques detectedLow

  

  

  
反虚拟机

  

    
检测方法VMwareVirtualBoxQEMU/KVM

    
DNS KillswitchBYPASS (no specific VM check)BYPASSBYPASS

  

  

  
综合评估

  

    
技术是否存在证据对抗难度

    
Killswitch DomainYESiuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com — if domain resolves, malware exits immediately. Classic sandbox evasion.CRITICAL

    
Resource ObfuscationYESPayloads hidden in resource section as base64-encoded blocks. launcher.dll + mssecsvr.exe embedded.HIGH

    
DNS-based Anti-SandboxYESMalware behavior changes based on DNS resolution of killswitch domain. Sandboxes that resolve all domains trigger self-termination.HIGH

    
MSVC 2010 CompilationYESOlder compiler version avoids modern detection heuristics.LOW

  

  WannaCry's primary anti-analysis mechanism is the killswitch domain — a DNS-based sandbox evasion that caused the original outbreak to stop when the domain was registered. No traditional anti-debug or VM detection.






  
★ §10b 🧹 痕迹清理

  

    
层操作API/命令证据来源

    
无

  

  






  
§11 🔧 逆向分析


  
Ghidra 反编译

  

    
反编译函数数~120 (DLL export functions)

    
反编译输出~80KB decompiled C

    
分析时长Pending

  

  

  
调用链分析 (GitNexus)

  

    
总函数数总调用关系最大调用深度

    
~120~2505

  


  

    📂 调用链拓扑 (点击展开)
    

      
DllMain→killswitch_check→crypto_init→file_scan→encrypt_file→ransom_note→eternalblue_propagate

    

  







  
★ §12 🔬 QEMU 动态分析


  

    
QEMU 模式SKIPPED — Ransomware sample. Static analysis only per safety protocol.

    
网络隔离N/A

    
执行结果
⚠️ RANSOMWARE — Dynamic Analysis SKIPPED
Per safety protocol, WannaCry ransomware samples undergo STATIC ANALYSIS ONLY. Dynamic execution would risk encrypting VM filesystem and network propagation via EternalBlue.

    
C2 数据Killswitch Domain: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com (sinkholed by @MalwareTechBlog)

  


  

  






  
§13 📦 IOC 汇总


  
IOC 字符串

  

    
偏移字符串类型用途/含义威胁等级

    
.rdataiuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comKillswitch DomainAnti-sandbox: if domain alive → exitCRITICAL

    
.rdatahttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comKillswitch URLHTTP GET killswitch checkCRITICAL

    
.rsrclauncher.dllEmbedded PEEternalBlue exploit launcherCRITICAL

    
.rsrcmssecsvr.exeEmbedded PEMicrosoft Security Server (masquerade)CRITICAL

    
.rsrceee.exeEmbedded PESetup executableHIGH

    
importsCryptAcquireContextA, CryptGenRandomCrypto APIRSA-2048 key generationCRITICAL

    
importsCryptProtectMemory, CryptUnprotectMemoryCrypto APIMemory encryption for key materialHIGH

    
.rdataMicrosoft Base Cryptographic Provider v1.0CSPWindows Crypto Service ProviderHIGH

  


  

    
📌 关键 IOC 解读

    
WannaCry ransomware DLL. Killswitch domain + Crypt API + embedded EternalBlue payloads + .WNCRY extension = confirmed WannaCry. Attribution: Lazarus Group (APT38), North Korea.

  


  

    
⚠ 高威胁 IOC 汇总

    
WannaCry DLL: 48ed2a2fc7652fc1 — WannaCry Ransomware DLL (Stage 2)

    
Killswitch Domain: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com — Sinkhole immediately

    
EternalBlue: MS17-010 — Patch SMBv1 on all Windows systems

    
File Extension: .WNCRY — Block creation of .WNCRY files

  


  

    

      
网络 IOC

      
    
        
  • Killswitch Domainiuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
    • 
        
  • Killswitch URLhttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
    • 
        
  • SMB Port445/tcp (EternalBlue propagation)
    • 
      

      Killswitch domain registered 2017-05-12 by Marcus Hutchins (@MalwareTechBlog). This effectively stopped the initial outbreak. Domain should remain sinkholed indefinitely.
    

    

      
主机 IOC

      
    
        
  • SHA25648ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136
    • 
        
  • MD5faabc72c2848caf771c29c6cddfd5254
    • 
        
  • File Extension.WNCRY (encrypted files)
    • 
        
  • Ransom Note@Please_Read_Me@.txt
    • 
        
  • Decryptor@WanaDecryptor@.exe
    • 
      

    

  


  
YARA 检测规则

  
rule WannaCry_Ransomware_DLL_Lazarus_APT38 {
    meta:
        description = "Detects WannaCry ransomware DLL (Lazarus Group / APT38)"
        author = "Hermes Malware Analysis Agent"
        date = "2026-08-06"
        hash = "48ed2a2fc7652fc12c6edfc2efbef6d65a9f85bf5874dbaf275301775265e136"
        severity = "CRITICAL"
        tags = "WannaCry,Ransomware,Lazarus,APT38,NorthKorea"
    strings:
        $killswitch = "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com" ascii
        $crypto1 = "CryptAcquireContextA" ascii
        $crypto2 = "CryptGenRandom" ascii
        $crypto3 = "Microsoft Base Cryptographic Provider v1.0" ascii
        $payload1 = "launcher.dll" ascii
        $payload2 = "mssecsvr.exe" ascii
        $pe_magic = { 4D 5A }  // MZ header
    condition:
        uint16(0) == 0x5A4D and
        $killswitch and
        2 of ($crypto*) and
        any of ($payload*)
}


  alert http any any -> any any (msg:"WannaCry Killswitch Domain Check"; content:"iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com"; http_host; sid:1000010; rev:1;)






  
§14 📋 最终判定


  

    
判定结果🔴 MALICIOUS — WannaCry Ransomware DLL (Lazarus/APT38)

    
恶意类型Ransomware DLL (Stage 2 Dropper)

    
恶意家族WannaCry

    
威胁级别CRITICAL

    
置信度99% — Killswitch domain match + Crypto API + Lazarus(APT38) attribution = 99% WannaCry confidence.

    
关联组织Lazarus Group (APT38) — North Korea

    
目标平台Windows x86-64

    
感染链位置Stage 2 — Ransomware DLL payload

  


  
⚡ 综合判定
?







  报告时间: 2026-08-06 14:55 UTC | 家族: WannaCry