Threat Database Ransomware Wana Decrypt0r 3.0 Ransomware

Wana Decrypt0r 3.0 Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Ranking: 5,669
Threat Level: 100 % (High)
Infected Computers: 14,971
First Seen: May 12, 2017
Last Seen: April 19, 2024
OS(es) Affected: Windows

The Wana Decrypt0r 3.0 Ransomware is a ransomware Trojan that seems to be designed to attack computer users in Chinese speaking regions. The Wana Decrypt0r 3.0 Ransomware is being distributed using corrupted spam email attachments mainly. When victims open the email attachment, which may take the form of a corrupted Microsoft Office or PDF file with enabled scripts, the Wana Decrypt0r 3.0 Ransomware will be downloaded and installed on the victim's computer. The Wana Decrypt0r 3.0 Ransomware seems to take advantage of the notorious WannaCry Ransomware, which has appeared in the news in the last month repeatedly. This has led to various copycat ransomware Trojan tactics that try to leverage the name of this ransomware Trojan to carry out its attack. However, the Wana Decrypt0r 3.0 Ransomware is not related to WannaCry, despite that it uses a ransom notification window that is nearly identical to the one used by this notorious ransomware Trojan.

The Wana Decrypt0r 3.0 Ransomware isn’t Able to Execute an Attack!

Ransomware Trojans like the Wana Decrypt0r 3.0 Ransomware use a common online tactic that involves encrypting the victims' files and then demanding the payment of a ransom. The Wana Decrypt0r 3.0 Ransomware is not capable of carrying out a complete ransomware attack. The Wana Decrypt0r 3.0 Ransomware in its current form is not capable of encrypting the victims' data. Apparently, there are various issues in the Wana Decrypt0r 3.0 Ransomware's code that prevent it from carrying out its attack. There may be reasons for this: the Wana Decrypt0r 3.0 Ransomware may be, in its current form, an unfinished or test version of this ransomware Trojan, being released at this point merely as a test. In that case, it is possible that a new version capable of carrying out a full-fledged ransomware attack will be released shortly after. It also is possible that the people responsible for the Wana Decrypt0r 3.0 Ransomware attack are relying on the fame of WannaCry to scare computer users into paying the Wana Decrypt0r 3.0 Ransomware ransom, without posing a threat to the victim's data.

How the Wana Decrypt0r 3.0 Ransomware and Other Ransomware Trojans may Enter a PC

Most ransomware Trojans, like the one the Wana Decrypt0r 3.0 Ransomware is emulating, carry out a variation on the same basic attack strategy. The ransomware Trojan will encrypt the victims' files using a strong encryption algorithm. These ransomware Trojans will target certain file types, looking for user-generated files and leaving the victim's operating system intact. After the victim's files have been made inaccessible, the ransomware Trojan will display a ransom notification (the Wana Decrypt0r 3.0 Ransomware does this, but does not encrypt the files). The ransom notification threatens the victims with the prospect of losing their files permanently if a ransom is not paid in exchange for the decryption key or program needed to recover the encrypted files.

Dealing with the Wana Decrypt0r 3.0 Ransomware and Other Ransomware Trojans

In the case of the Wana Decrypt0r 3.0 Ransomware infection itself, this ransomware Trojan can be removed with the help of a reliable, fully updated anti-malware program. Once removed, the files should be intact, since the Wana Decrypt0r 3.0 Ransomware does not encrypt the victims' files. However, because legitimate ransomware Trojans are very active and pose a real threat currently, PC security researchers advise computer users to take steps to safeguard their data. The best protection against ransomware Trojans is to have reliable file backups on the cloud or an external memory device. Having the possibility to recover the affected files from an attack by restoring them from a backup copy undoes most ransomware attacks completely since it removes any leverage the attackers have over the victim. This, coupled with a reliable security program, can help protect computer users from most ransomware attacks.

SpyHunter Detects & Remove Wana Decrypt0r 3.0 Ransomware

File System Details

Wana Decrypt0r 3.0 Ransomware may create the following file(s):
# File Name MD5 Detections
1. @WanaDecryptor@.exe.lnk 205aa5292a4afce1c4f334aefcaa75a2 63
2. @WanaDecryptor@.exe.lnk 6ab1ed45c558c94f6422c183bf3ac844 63
3. @WanaDecryptor@.exe.lnk 1950672eb3c783acd2b7d8f486a9c4a1 49
4. @WanaDecryptor@.exe.lnk a422d9b4b2ef6ad830eaa120f327804a 4
5. @WanaDecryptor@.exe d724ea744f9056565c1dc235b8a37d3a 3
6. tasksche.exe b8610560190833fc897d8bd425402cde 3
7. tasksche.exe 0c64bb0a96f555146e2d031be2368305 3
8. tasksche.exe b7e9fda158093ef31ba48ab731e991c4 2
9. @WanaDecryptor@.exe.lnk 5937e9bde4fe727a9d9ba2655f3bf0bf 2
10. tasksche.exe ca8a5a59e7b3d9518531beba68544370 2
11. @WanaDecryptor@.exe.lnk 53e70de220df3f2b4f9faf135072d276 1
12. @WanaDecryptor@.exe.lnk da694aa92d06c170e9bcebc540e3290f 1
13. tasksche.exe 43b85807b900680859230a43287f39fd 1
14. tasksche.exe 56aeedfe9dbcdbfe6470551e5dbde017 1
15. tasksche.exe ba315bad9185efd995355b2753487792 1
16. tasksche.exe 627699c6661752da27be73f51b745b4f 1
17. tasksche.exe ffa71e612521932ee898daed0a586f33 1
18. tasksche.exe b20d0abbbd33b151075934a547cdd66c 1
19. tasksche.exe 11b09e976815c41f4536967787d6c448 1
20. tasksche.exe 6ed419b84d61aa05e6b37a89190059fe 1
21. tasksche.exe c35fe0ae96e9462cd985ccc20a1a89fb 1
22. c4291ec3eacfd145bbe75d7e7991753f4ea141768f6701e4bef4ca902ed58554.exe aed6ed89e62f1cb059b5db200f30d203 0
23. e28f2ee59621e1d9269213e2b5557b5066945774392b16bde3df9ad077bff107.exe 03f75fc504c9845aaed29fdf66c13238 0
24. e498f936eb56fb1f4300d973c1c869fa65e0ae368c74285dfc2feae3ae1a4f4e.exe c1b5e18f78b644d5d59e8958fcfa8b0d 0
25. f5ea4c4f9a37bc84124a9ce114bb7b3dc7a35de498c6c50f457765cc7a3e7611.exe 823564f14cdac838c31bbae713ff1ff6 0
26. home.exe 4e259c5a7afe86eb08b45eead12d4af3 0
More files

Registry Details

Wana Decrypt0r 3.0 Ransomware may create the following registry entry or registry entries:
File name without path
!Please Read Me!.txt
!WannaCryptor!.bmp
!WannaDecryptor!.exe
!WannaDecryptor!.exe.lnk
@WanaDecryptor@.bmp
@WanaDecryptor@.exe
@WanaDecryptor@.exe.lnk
Please Read Me!.txt
Regexp file mask
%temp%\[NUMBERS].wcryt
%windir%\00000000.eky
%windir%\00000000.pky
%windir%\00000000.res
%windir%\b.wnry
%windir%\b.wry
%windir%\c.wnry
%windir%\c.wry
%windir%\f.wry
%windir%\m.wry
%windir%\msg\m_[RANDOM CHARACTERS].wnry
%WINDIR%\mssecsvc.exe
%WINDIR%\mssecsvr.exe
%windir%\r.wnry
%windir%\r.wry
%windir%\s.wnry
%windir%\t.wry
%windir%\u.wry
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler
SOFTWARE\WanaCrypt0r
SOFTWARE\WannaCryptor
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler
SOFTWARE\Wow6432Node\WanaCrypt0r
SOFTWARE\Wow6432Node\WannaCryptor

Directories

Wana Decrypt0r 3.0 Ransomware may create the following directory or directories:

%WINDIR%\taskhost
%userprofile%\desktop\WannaCry
%userprofile%\downloads\WannaCry

Trending

Most Viewed

Loading...