A forum for reverse engineering, OS internals and malware analysis 

Petya malware

Forum for analysis and discussion about malware.

Re: Petya malware

 #30509  by maddog4012
 Wed Jun 28, 2017 7:20 pm
Damian9303 wrote:Is this the one that struck out yesterday that infected computers via Network?
yes it is :D

Re: Petya malware

 #30511  by Peior Crustulum
 Wed Jun 28, 2017 11:11 pm
maddog4012 wrote:
Damian9303 wrote:Is this the one that struck out yesterday that infected computers via Network?
yes it is :D
At the risk of sounding like a complete idiot, I was unable to execute the sample.
Am I missing something?

Re: Petya malware

 #30516  by waffles2.0
 Thu Jun 29, 2017 11:45 am
The sample provided by the original comment is an older sample, the new one doesn't have the skull and crossbones. Attached is the sample that struck out hitting lots of companies over the past few days.

Use the command line to execute:
Code: Select all
rundll32.exe 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll, #1
You should also know that it schedules a shutdown /sleeps for about an hour after infection so you have to wait a while but once you boot up after shutdown it should take you to a screen like this:
Image
then shortly after this:
Image
Attachments
Password: infected
(306.76 KiB) Downloaded 139 times

Peya / NotPeya / WannaCry sample

 #30716  by ausl
 Fri Aug 11, 2017 12:07 am
Peya:e8fb95ebb7e0db4c68a32947a74b5ff9
NotPeya:71b6a493388e7d0b40c83ce903bc6b04
WanaCry:db349b97c37d22f5ea1d1841e3c89eb4

Contribute to all those who share the malware samples so generously before!
Attachments
(3.43 MiB) Downloaded 195 times
(318.11 KiB) Downloaded 96 times
(305.9 KiB) Downloaded 88 times
 Return to “Malware”