Where can I go to verify whether or not Webroot detects the current Wannacry malware?
I've tried checking the kb and blog but no info. You'd think with this being a global news story, Webroot would have published something specifically on this by now?
Is WSA updated to detect the current Wannacry ransomeware
This topic has been closed for comments
Can you please provide more information on how we are protected? I get that we need to ensure patching is up to date and our team has identified where servers/workstations need patching but I'm curious to know if there are ways to verify if wannacry is detected and quarantined.
Ben
Ben
Today, Microsoft has released emergency security patches to defend against the malware for unsupported versions of Windows, including XP and Server 2003. Overnight and today, it has become clear that a kill switch was included in the code. When it detects a specific web domain exists—created earlier today—it halts the spread of malware.
More information on WannaCry from a Webroot perspective can be found here.
More information on WannaCry from a Webroot perspective can be found here.
We can't disclose our detections rules as it would compromise the security they provide if they were made public. However, I can share that these are the top 25 variants of Wannacry that we've seen blocked. Some of these individual MD5s have been seen on hundreds of PCs - mostly in Russia.
4BB0DB7B5DEA5A5F7215CABE8F7155AF (W32.Ransom.Wannacry)
F94429CC043169462D34EDD14117DDD2 (W32.Ransom.Wannacry)
F107A717F76F4F910AE9CB4DC5290594 (W32.Ransom.Wanacryptor)
54A116FF80DF6E6031059FC3036464DF (W32.Ransom.Wannacry)
3C6375F586A49FC12A4DE9328174F0C1 (W32.Ransom.Wannacry)
246C2781B88F58BC6B0DA24EC71DD028 (W32.Ransom.Wannacry)
5BEF35496FCBDBE841C82F4D1AB8B7C2 (W32.Ransom.Wannacry)
D937086367935BB125F1AD49B2CAE2C4 (W32.Ransom.Wannacry)
9A29404FACEC04347E7A74691B61039B (W32.Ransom.Wannacry)
27CB59DB5793FEBD7D20748FD2F589B2 (W32.Ransom.Wannacry)
AA776B1233C2D33DED9DFA0FE17FC48F (W32.Ransom.Wannacry)
80A2AF99FD990567869E9CF4039EDF73 (W32.Ransom.Wannacry)
05A00C320754934782EC5DEC1D5C0476 (W32.Ransom.Wannacry)
638F9235D038A0A001D5EA7F5C5DC4AE (W32.Ransom.Wannacry)
C39ED6F52AAA31AE0301C591802DA24B (W32.Ransom.Wannacry)
7F2BC30723E437C150C00538671B3580 (W32.Ransom.Wannacry)
31DAB68B11824153B4C975399DF0354F (W32.Ransom.Wannacry)
FF81D72A277FF5A3D2E5A4777EB28B7B (W32.Ransom.Wannacry)
8621727CDE2817D62209726034ABD9D3 (W32.Ransom.Wannacry)
DB349B97C37D22F5EA1D1841E3C89EB4 (W32.Ransom.Wanacryptor)
46D140A0EB13582852B5F778BB20CF0E (W32.Ransom.Wannacry)
5D0B6584A6D508DF278315C0CAC2F5C7 (W32.Ransom.Wannacry)
97C5205C3CBD1840B26A97D8935E6FC1 (W32.Ransom.Wannacry)
BEC0B7AFF4B107EDD5B9276721137651 (W32.Ransom.Wannacry)
EB87BBB7E22FF067D303B745599FB4B7 (W32.Ransom.Wannacry)
4BB0DB7B5DEA5A5F7215CABE8F7155AF (W32.Ransom.Wannacry)
F94429CC043169462D34EDD14117DDD2 (W32.Ransom.Wannacry)
F107A717F76F4F910AE9CB4DC5290594 (W32.Ransom.Wanacryptor)
54A116FF80DF6E6031059FC3036464DF (W32.Ransom.Wannacry)
3C6375F586A49FC12A4DE9328174F0C1 (W32.Ransom.Wannacry)
246C2781B88F58BC6B0DA24EC71DD028 (W32.Ransom.Wannacry)
5BEF35496FCBDBE841C82F4D1AB8B7C2 (W32.Ransom.Wannacry)
D937086367935BB125F1AD49B2CAE2C4 (W32.Ransom.Wannacry)
9A29404FACEC04347E7A74691B61039B (W32.Ransom.Wannacry)
27CB59DB5793FEBD7D20748FD2F589B2 (W32.Ransom.Wannacry)
AA776B1233C2D33DED9DFA0FE17FC48F (W32.Ransom.Wannacry)
80A2AF99FD990567869E9CF4039EDF73 (W32.Ransom.Wannacry)
05A00C320754934782EC5DEC1D5C0476 (W32.Ransom.Wannacry)
638F9235D038A0A001D5EA7F5C5DC4AE (W32.Ransom.Wannacry)
C39ED6F52AAA31AE0301C591802DA24B (W32.Ransom.Wannacry)
7F2BC30723E437C150C00538671B3580 (W32.Ransom.Wannacry)
31DAB68B11824153B4C975399DF0354F (W32.Ransom.Wannacry)
FF81D72A277FF5A3D2E5A4777EB28B7B (W32.Ransom.Wannacry)
8621727CDE2817D62209726034ABD9D3 (W32.Ransom.Wannacry)
DB349B97C37D22F5EA1D1841E3C89EB4 (W32.Ransom.Wanacryptor)
46D140A0EB13582852B5F778BB20CF0E (W32.Ransom.Wannacry)
5D0B6584A6D508DF278315C0CAC2F5C7 (W32.Ransom.Wannacry)
97C5205C3CBD1840B26A97D8935E6FC1 (W32.Ransom.Wannacry)
BEC0B7AFF4B107EDD5B9276721137651 (W32.Ransom.Wannacry)
EB87BBB7E22FF067D303B745599FB4B7 (W32.Ransom.Wannacry)
Just a friendly reminder to be sure to keep your OS up to date.
In case you're looking for them, here's a list of direct links to download the MS patch for the most common OS's:
Windows XP SP3 http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe
Windows Vista x86 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.0-kb4012598-x86_13e9b3d77ba5599764c296075a796c16a85c745c.msu
Windows Vista x64 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.0-kb4012598-x64_6a186ba2b2b98b2144b50f88baf33a5fa53b5d76.msu
Windows 7 x64 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x64_2decefaa02e2058dcd965702509a992d8c4e92b3.msu
Windows 7 x86 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x86_6bb04d3971bb58ae4bac44219e7169812914df3f.msu
Windows 8 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu
Windows 8.1 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu
Windows 10 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows10.0-kb4012606-x64_e805b81ee08c3bb0a8ab2c5ce6be5b35127f8773.msu
Windows 2012 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8-rt-kb4012214-x64_b14951d29cb4fd880948f5204d54721e64c9942b.msu
Windows 2012R2 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu
Windows 2016 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu
In case you're looking for them, here's a list of direct links to download the MS patch for the most common OS's:
Windows XP SP3 http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe
Windows Vista x86 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.0-kb4012598-x86_13e9b3d77ba5599764c296075a796c16a85c745c.msu
Windows Vista x64 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.0-kb4012598-x64_6a186ba2b2b98b2144b50f88baf33a5fa53b5d76.msu
Windows 7 x64 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x64_2decefaa02e2058dcd965702509a992d8c4e92b3.msu
Windows 7 x86 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x86_6bb04d3971bb58ae4bac44219e7169812914df3f.msu
Windows 8 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu
Windows 8.1 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu
Windows 10 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows10.0-kb4012606-x64_e805b81ee08c3bb0a8ab2c5ce6be5b35127f8773.msu
Windows 2012 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8-rt-kb4012214-x64_b14951d29cb4fd880948f5204d54721e64c9942b.msu
Windows 2012R2 http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu
Windows 2016 http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/03/windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu
As the second wave of WannaCry spreads across the globe, the latest estimate from the leading European police agency Europol suggests the malware has hit over 200,000 victims over 150 countries. You can catch up on some of the latest news here.
Although a second kill switch has been identified and registered today, there is no certainty that this second kill switch will address all malware variants. Europol continues to recommend that one of the best defenses is to take advantage of the patches released by Microsoft.
Webroot currently has strong protection in place for WannaCry, and has already reviewed and fortified its protection and detection routines to protect its users against future variants that may appear. As Webroot sees every new executable file introduced on systems where Webroot SecureAnywhere is installed, we get rapid insight into all types of new malware.
This allows us to quickly create and/or improve upon our best-in-class detection mechanisms for zero day threats.
More information on our blog here.
Although a second kill switch has been identified and registered today, there is no certainty that this second kill switch will address all malware variants. Europol continues to recommend that one of the best defenses is to take advantage of the patches released by Microsoft.
Webroot currently has strong protection in place for WannaCry, and has already reviewed and fortified its protection and detection routines to protect its users against future variants that may appear. As Webroot sees every new executable file introduced on systems where Webroot SecureAnywhere is installed, we get rapid insight into all types of new malware.
This allows us to quickly create and/or improve upon our best-in-class detection mechanisms for zero day threats.
More information on our blog here.
Userlevel 1
That's great - but wish you would fix this problem with the same speed - https://community.webroot.com/t5/Product-Questions/Update-on-Winlogin-4005-amp-Terminal-Servers-November-22-2016/td-p/276406
Becuase of this we still cannot run Webroot on terminal servers with full protection enabled - a critical end point in most businesses.
Becuase of this we still cannot run Webroot on terminal servers with full protection enabled - a critical end point in most businesses.
Over the past couple of days I've seen a few questions coming in from the community about WannaCry and wanted to share with the rest of you:
As a reminder, to prevent this threat from propagating within your environment, in any way, please review our Ransomware Prevention Guide and implement the suggestions listed.
4. At what point in time did Webroot detect this new version of WannaCry?
Our threat intelligence platform encountered it at 8:30 a.m. UTC. Shortly thereafter, we blocked it for customers.
- How does Webroot detect and prevent infection by Wannacry or other Trojans?
- Does this mean that no customer running Webroot has been, or indeed will be, affected by WannaCry?
As a reminder, to prevent this threat from propagating within your environment, in any way, please review our Ransomware Prevention Guide and implement the suggestions listed.
- Do you have evidence that the initial infection vector was email?
4. At what point in time did Webroot detect this new version of WannaCry?
Our threat intelligence platform encountered it at 8:30 a.m. UTC. Shortly thereafter, we blocked it for customers.
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.