New Kill-Switch, New Sinkhole

Check Point Threat Intelligence and Research team has just registered a brand new kill-switch domain used by a fresh sample of the WannaCry Ransomware.

In the last few hours we witnessed a stunning hit rate of 1 connection per second.

Registering the domain activated the kill-switch, and these thousands of to-be victims are safe from the ransomware’s damage.

Our research shows that the kill-switch works the same as in earlier versions, and the rest of the code is similar to the older versions.

New kill-switch: ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf[.]com 

MD5: 4287E15AF6191F5CAB1C92FF7BE8DCC3