4 ms·
I still can't understand how the malware authors could be so smart (or, if not smart, at least competent enough to build ransomware from scratch, make it wormab
by meowface 10y ago
I still can't understand how the malware authors could be so smart (or, if not smart, at least competent enough to build ransomware from scratch, make it wormable with ETERNALBLUE, and launch a massive and effective spam campaign) and yet so stupid.
They could've achieved the same sandbox detection effect by just registering the domain and pointing it at 1.1.1.1 or whatever. The non-sandboxed connections would still fail, and no one else could take the domain.
- BoorishBears 10y agoI don't think the creator would be too keen to create anything unnecessary that could be linked back to them through a paper trail.
- Avalyst 10y agoI find it interesting that they didn't randomize a couple of long strings and tried to resolve those instead like the article mentioned has been done in the past
- iainmerrick 10y agoThey could've achieved the same sandbox detection effect by just registering the domain That would leave a paper trail, potentially revealing who's behind the malware.