Threat Database Ransomware Wana Decrypt0r 3.0 Ransomware

Wana Decrypt0r 3.0 Ransomware

By GoldSparrow in Ransomware
Translate To:

Threat Scorecard

Popularity Rank: 9,966
Threat Level: 100 % (High)
Infected Computers: 15,193
First Seen: May 12, 2017
Last Seen: February 1, 2026
OS(es) Affected: Windows

The Wana Decrypt0r 3.0 Ransomware is a ransomware Trojan that seems to be designed to attack computer users in Chinese speaking regions. The Wana Decrypt0r 3.0 Ransomware is being distributed using corrupted spam email attachments mainly. When victims open the email attachment, which may take the form of a corrupted Microsoft Office or PDF file with enabled scripts, the Wana Decrypt0r 3.0 Ransomware will be downloaded and installed on the victim's computer. The Wana Decrypt0r 3.0 Ransomware seems to take advantage of the notorious WannaCry Ransomware, which has appeared in the news in the last month repeatedly. This has led to various copycat ransomware Trojan tactics that try to leverage the name of this ransomware Trojan to carry out its attack. However, the Wana Decrypt0r 3.0 Ransomware is not related to WannaCry, despite that it uses a ransom notification window that is nearly identical to the one used by this notorious ransomware Trojan.

The Wana Decrypt0r 3.0 Ransomware isn’t Able to Execute an Attack!

Ransomware Trojans like the Wana Decrypt0r 3.0 Ransomware use a common online tactic that involves encrypting the victims' files and then demanding the payment of a ransom. The Wana Decrypt0r 3.0 Ransomware is not capable of carrying out a complete ransomware attack. The Wana Decrypt0r 3.0 Ransomware in its current form is not capable of encrypting the victims' data. Apparently, there are various issues in the Wana Decrypt0r 3.0 Ransomware's code that prevent it from carrying out its attack. There may be reasons for this: the Wana Decrypt0r 3.0 Ransomware may be, in its current form, an unfinished or test version of this ransomware Trojan, being released at this point merely as a test. In that case, it is possible that a new version capable of carrying out a full-fledged ransomware attack will be released shortly after. It also is possible that the people responsible for the Wana Decrypt0r 3.0 Ransomware attack are relying on the fame of WannaCry to scare computer users into paying the Wana Decrypt0r 3.0 Ransomware ransom, without posing a threat to the victim's data.

How the Wana Decrypt0r 3.0 Ransomware and Other Ransomware Trojans may Enter a PC

Most ransomware Trojans, like the one the Wana Decrypt0r 3.0 Ransomware is emulating, carry out a variation on the same basic attack strategy. The ransomware Trojan will encrypt the victims' files using a strong encryption algorithm. These ransomware Trojans will target certain file types, looking for user-generated files and leaving the victim's operating system intact. After the victim's files have been made inaccessible, the ransomware Trojan will display a ransom notification (the Wana Decrypt0r 3.0 Ransomware does this, but does not encrypt the files). The ransom notification threatens the victims with the prospect of losing their files permanently if a ransom is not paid in exchange for the decryption key or program needed to recover the encrypted files.

Dealing with the Wana Decrypt0r 3.0 Ransomware and Other Ransomware Trojans

In the case of the Wana Decrypt0r 3.0 Ransomware infection itself, this ransomware Trojan can be removed with the help of a reliable, fully updated anti-malware program. Once removed, the files should be intact, since the Wana Decrypt0r 3.0 Ransomware does not encrypt the victims' files. However, because legitimate ransomware Trojans are very active and pose a real threat currently, PC security researchers advise computer users to take steps to safeguard their data. The best protection against ransomware Trojans is to have reliable file backups on the cloud or an external memory device. Having the possibility to recover the affected files from an attack by restoring them from a backup copy undoes most ransomware attacks completely since it removes any leverage the attackers have over the victim. This, coupled with a reliable security program, can help protect computer users from most ransomware attacks.

SpyHunter Detects & Remove Wana Decrypt0r 3.0 Ransomware

File System Details

Wana Decrypt0r 3.0 Ransomware may create the following file(s):
# File Name MD5 Detections
1. taskhcst.exe 5c7fb0927db37372da25f270708103a2 108
2. @WanaDecryptor@.exe d724ea744f9056565c1dc235b8a37d3a 3
3. @WanaDecryptor@.exe.lnk da694aa92d06c170e9bcebc540e3290f 1
4. 002f660b2867c78d57fa887549dd4df9ced41fc4e738f8d4a70e3cf555bd17c0.exe 26b716a0017ea59f4a7e10f4045f8de6 0
5. 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894.exe d5c0caf39de29dc769204d33e76c21fc 0
6. 0fc245e8a1134e31b7687fb7501faa05628813c87b9561ee26f2092cb76e5a36.exe eac0133cec98c1338d721c6dff14128e 0
7. bb829a0394fb865eed381eb77ac9de039ad19e0f2318baaf9483b4f817250021.exe cf7d967cf7f37075b74ae1956609f33b 0
8. bbf16aa9e9c3b697c1f4008a9087e2b3ed4298dbf62a607900d3b95324100327.exe d2f5b8921d8b0ec80ca9d12a4628f4a0 0
9. bc8136b40b4164afcbcb4e14f6fd54ca02275ff75b674eb6fd0a8f436f9b1181.exe 05480f5a3237cb12416459c2660367b0 0
10. c26e5eb8ec5b72e2c6368156f112f78906a57b393845233e727a8b2e3df790a4.exe 0590e4be096701e650797f8969e3c2cf 0
11. c4291ec3eacfd145bbe75d7e7991753f4ea141768f6701e4bef4ca902ed58554.exe aed6ed89e62f1cb059b5db200f30d203 0
12. ca29de1dc8817868c93e54b09f557fe14e40083c0955294df5bd91f52ba469c8.exe b0ad5902366f860f85b892867e5b1e87 0
13. cd049fa3d5c193b82b13bc5c141696e7f862b448b9008a21c3c84030d5b00597.exe d539b514ca46f0b33838a67778a4c92c 0
14. cd53771c1aa9d8b91d362feec69a03a02fbfcc8c922e2ed538854b77f9d806f2.exe 994cfca9f4a14921684bd6a65997e22c 0
15. d849067bf9365d99088cbb935a98477cd38519e3ab8ac1bfe662588f8177d22d.exe ae72a3d3b9ee295436ba281171c50538 0
16. e28f2ee59621e1d9269213e2b5557b5066945774392b16bde3df9ad077bff107.exe 03f75fc504c9845aaed29fdf66c13238 0
17. e498f936eb56fb1f4300d973c1c869fa65e0ae368c74285dfc2feae3ae1a4f4e.exe c1b5e18f78b644d5d59e8958fcfa8b0d 0
18. e5b9bfe333ee11538ae62cd9f34023d23e943970e771f74e088166e7c471166f.exe 1eba841f8cb1d7703cecd5112bb2a3ea 0
19. e7a39735ee8777473c7405a70f470a0e00d6266d3126d3af59660e6a78dab2cf.exe e8d2d6925c5581cff64670c829e5a473 0
20. ea428033152445a507f4c1afb7734c8f801f27a687d8cb62bd8f393a2b0c466c.exe 38a92fa34353ecb8777a8044248f56f2 0
21. ea7974484b788d4c91044f32130159e1542bf079329179f4b1d42e93168dfdde.exe 9873afd7cf2e1eb9e94bcbfc2dd74f40 0
22. ec82b602d6389c4586730bd45302acf3366132ed63667cf8cfb24c7e72419fac.exe b881c16467d6c3dbcb0b5a4db4d283ad 0
23. ed2e2be93f0dd70da08e6440521069931c0a9bbcaa1f64e88a6dd8b8953a72d7.exe d38d30ed1bba3b9f76758eafcce71601 0
24. f029548806c8074a36435241d5f5586cd7b37fc651dd2a9178e915d2cef27bae.exe ac29e5bbe740c883baf1e83ba99eba85 0
25. f5ea4c4f9a37bc84124a9ce114bb7b3dc7a35de498c6c50f457765cc7a3e7611.exe 823564f14cdac838c31bbae713ff1ff6 0
26. fecfd70406cbcd17fd17ccf4c635172249df13383d7f02fc9f0d3173da04a209.exe a2592f41e67f1d0b9b795a3f4c71ad14 0
27. home.exe 4e259c5a7afe86eb08b45eead12d4af3 0
More files

Registry Details

Wana Decrypt0r 3.0 Ransomware may create the following registry entry or registry entries:
File name without path
!Please Read Me!.txt
!WannaCryptor!.bmp
!WannaDecryptor!.exe
!WannaDecryptor!.exe.lnk
@WanaDecryptor@.bmp
@WanaDecryptor@.exe
@WanaDecryptor@.exe.lnk
Please Read Me!.txt
Regexp file mask
%temp%\[NUMBERS].wcryt
%windir%\00000000.eky
%windir%\00000000.pky
%windir%\00000000.res
%windir%\b.wnry
%windir%\b.wry
%windir%\c.wnry
%windir%\c.wry
%windir%\f.wry
%windir%\m.wry
%windir%\msg\m_[RANDOM CHARACTERS].wnry
%WINDIR%\mssecsvc.exe
%WINDIR%\mssecsvr.exe
%windir%\r.wnry
%windir%\r.wry
%windir%\s.wnry
%windir%\t.wry
%windir%\u.wry
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler
SOFTWARE\WanaCrypt0r
SOFTWARE\WannaCryptor
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler
SOFTWARE\Wow6432Node\WanaCrypt0r
SOFTWARE\Wow6432Node\WannaCryptor

Directories

Wana Decrypt0r 3.0 Ransomware may create the following directory or directories:

%WINDIR%\taskhost
%userprofile%\desktop\WannaCry
%userprofile%\downloads\WannaCry

Analysis Report

General information

Family Name: Wana Decrypt0r Ransomware
Signature status: No Signature

Known Samples

MD5: 27bb6e665f203c1614daab07a64a5fe5
SHA1: f292c121b8be5aaf22c2d31d675b0396e9263d0c
SHA256: A2ECC681C8A95A83E80E165A55E9E1D32DAFBB0A8D17534BEDA12FCDB3AC4C1F
File Size: 3.78 MB, 3778886 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • big overlay
  • HighEntropy
  • No Version Info
  • x86

Block Information

Total Blocks: 270
Potentially Malicious Blocks: 134
Whitelisted Blocks: 136
Unknown Blocks: 0

Visual Map

x x x 0 x x x 0 0 0 x 0 0 x x x x x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 0 0 0 x x x 0 x x x x x x 0 0 0 0 x x x x x 0 0 x x x x x 0 0 x x x 0 x x x 0 x x x x x x x 0 0 0 0 0 0 0 0 0 x x 0 0 x 0 0 x x x x x x x 0 x x 0 x 0 0 x 0 x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x 0 0 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Wana Decrypt0r.A

Files Modified

File Attributes
c:\windows\tasksche.exe Generic Write,Read Attributes

Windows API Usage

Category API
Network Wininet
  • InternetOpen
  • InternetOpenUrl
Service Control
  • OpenSCManager
  • StartService
Process Shell Execute
  • CreateProcess

Shell Command Execution

C:\WINDOWS\tasksche.exe /i

Trending

Most Viewed

Loading...