WannaCry DISCOVERED_BY Marcus Hutchins
Marcus Hutchins discovered the kill-switch URL and its behavior while analyzing WannaCry.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“when Marcus Hutchins found this URL in the code”
Person
person:marcus_hutchins
Also: MalwareTech, Marcus
Security researcher who registered the first WannaCry kill-switch domain.
Security researcher who registered the first WannaCry kill-switch domain.
“Another security researcher named Marcus Hutchins was looking at the malware”
Developer associated in the episode with malware known as Kronos.
“he developed malware which became known as Kronos”
Person cited as an example of someone arrested after creating malware.
“With people like Marcus Hutchins being arrested three years after creating some malware”
Security researcher formerly known online as MalwareTech, known in the episode for analyzing WannaCry and later facing US federal charges related to Kronos.
“I’m MalwareTech and I’m an anonymous security researcher.”
“I’m now Marcus Hutchins”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | malware reverse engineering | Explicit | 158 |
| outgoing | USES | cyber threat intelligence | Explicit | 158 |
| incoming | DISCOVERED_BY | WannaCry | Explicit | 73 |
| incoming | DEVELOPED_BY | Kronos | Explicit | 114 |
| incoming | DEVELOPED_BY | Kronos | Explicit | 158 |
| incoming | SAME_AS | Malwaretech | Explicit | 158 |
| incoming | DISCOVERED_BY | WannaCry kill switch domain | Explicit | 158 |
| incoming | DEVELOPED_BY | rootkit | Explicit | 158 |
WannaCry DISCOVERED_BY Marcus Hutchins
Marcus Hutchins discovered the kill-switch URL and its behavior while analyzing WannaCry.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“when Marcus Hutchins found this URL in the code”
Kronos DEVELOPED_BY Marcus Hutchins
The episode says Marcus Hutchins developed malware that became known as Kronos.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“he developed malware which became known as Kronos”
Malwaretech SAME_AS Marcus Hutchins
MalwareTech is identified as Marcus Hutchins; the speaker says that after his identity was exposed, he was no longer the anonymous MalwareTech and was now Marcus Hutchins.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I’m now Marcus Hutchins”
“I’m MalwareTech and I’m an anonymous security researcher.”
Marcus Hutchins USES malware reverse engineering
Marcus Hutchins says his cybersecurity work specialized in malware reverse engineering.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
Marcus Hutchins USES cyber threat intelligence
Marcus Hutchins says his cybersecurity work specialized in cyber threat intelligence, including monitoring botnet infrastructure and identifying victims.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
“our goal was to be on the bad guy’s network and be able to see all the victims of the malware”
WannaCry kill switch domain DISCOVERED_BY Marcus Hutchins
Marcus Hutchins found the unregistered domain in the WannaCry code and registered it.
Explicit Direction flagged Confidence 99% · Malwaretech EP 158 Details
“When I saw this unregistered domain in the WannaCry code, I was like, nice”
“So, I registered it”
Kronos DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he wrote malware code that was combined with banking code to create the Kronos banking malware.
Explicit Confidence 96% · Malwaretech EP 158 Details
“I would write the malware for him and then he would sell it.”
“he had combined it with the banking malware”
rootkit DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he started as a malware writer specializing in rootkits.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I started out as a malware writer. I specialized in writing rootkits.”