Brian A. Teller bateller

I hereby claim:

To claim this, I am signing this object:

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

This gist assumes:

you have a local git repo
with an online remote repository (github / bitbucket etc)
and a cloud server (Rackspace cloud / Amazon EC2 etc)
- your (PHP) scripts are served from /var/www/html/
- your webpages are executed by apache
apache's home directory is /var/www/

http://www.xminder.com/number.check.php?number=<10digitnumber>

'nuff said

Also, npm module for node.js:

	# Doxyfile 1.8.7

	# This file describes the settings to be used by the documentation system
	# doxygen (www.doxygen.org) for a project.
	#
	# All text after a double hash (##) is considered a comment and is placed in
	# front of the TAG it is preceding.
	#
	# All text after a single hash (#) is considered a comment and will be ignored.
	# The format is:

	#!/bin/sh

	#
	# Copyright: 2017-2019 - B. Teller
	# Created by: Brian Teller
	# Description: Help non-shell or AWS experts create easy + quick AMIs for use within AutoScaling Groups
	#

	upSeconds="$(tail /proc/uptime \| grep -o '^[0-9]\+')"
	upMins=$((upSeconds / 60))

	<?php

	// Load the XML source
	$xml = new DOMDocument;
	$xml->load('XML_SOURCE_LINK_HERE');

	// Load XSLT stylesheet
	$xsl = new DOMDocument;
	$xsl->load('XSL_STYLESHEET_PAGE_LINK_HERE');

	# Nginx - logrotate & upload to S3
	0 0 * * * /usr/sbin/logrotate /etc/logrotate.d/nginx
	15 0 * * * s3cmd put /var/log/nginx/access.log-`date +"\%Y\%m\%d"`.gz s3://$LOGS_BUCKET_NAME/nginx-access/`date +"dt=\%Y\%m\%d"`/`hostname -s`.access.log-`date +"\%Y\%m\%d"`.gz