Network component
network_component:wannacry_kill_switch_domain
Also: kill switch
Unregistered domain embedded in WannaCry that caused the malware to stop when the domain became active.
Unregistered domain embedded in WannaCry that caused the malware to stop when the domain became active.
“this unregistered domain in the WannaCry code”
“the domain was a kill switch”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Marcus Hutchins | Explicit | 158 |
| incoming | USES | WannaCry | Explicit | 158 |
WannaCry USES WannaCry kill switch domain
WannaCry checked a domain in its code, and the domain's activation functioned as a kill switch that stopped the malware from spreading.
Explicit Confidence 99% · Malwaretech EP 158 Details
“the domain was a kill switch”
“the malware stops everything it’s doing”
WannaCry kill switch domain DISCOVERED_BY Marcus Hutchins
Marcus Hutchins found the unregistered domain in the WannaCry code and registered it.
Explicit Direction flagged Confidence 99% · Malwaretech EP 158 Details
“When I saw this unregistered domain in the WannaCry code, I was like, nice”
“So, I registered it”