malware family

WannaCry

unknownentity:malware_familyransomware · 1 source

According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages. The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security res

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: wannacry
kind: malware family
status: unknown
aliases: WanaCry · WanaCrypt · WanaCrypt0r · WannaCrypt · WCry · WCRY · WCrypt
jurisdictions: —
claims naming it: 510 · 0 attributions · 1 relations · 0 events

Identifiers

attack S0366via mitre-attack
misp-galaxy d62ab8d5-4ba1-4c45-8a63-13fdb099b33cvia misp-galaxy-ransomware

Relations

MITRE ATT&CK Enterpriserecords thatLazarus GroupusesWannaCry
fetch —sha256 dc1639caa5501d72
rel_547btcintel:relations:547@v1 sha256:b2ddc83b5d0a2f6e
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 510

WannaCryransomwarepayment
subjecttransaction9155bcf44d…7ea2b893da
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 20,551,302 sat · time 2017-05-02 11:54 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21469btcintel:annotations:21469@v3 sha256:679cd274017740d8
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction399e5eab64…b329e14bed
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 20,230,000 sat · time 2017-05-04 10:14 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21468btcintel:annotations:21468@v3 sha256:3b7f7cf1718de39d
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction892a21c26b…16433552c8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 19,342,015 sat · time 2017-05-06 14:38 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21467btcintel:annotations:21467@v3 sha256:9f14bf67d29d7b46
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactionf3bafa5bc0…c02e69de93
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 32,553,000 sat · time 2017-05-12 15:25 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21466btcintel:annotations:21466@v3 sha256:498fc4b73aae2377
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction85acfa8a3f…1d3e726c70
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 16,793,400 sat · time 2017-05-13 06:43 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21465btcintel:annotations:21465@v3 sha256:e6a2a95776fd6e2e
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactiondf9e38ce95…87848d57d4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 22,313,376 sat · time 2017-06-13 00:22 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21464btcintel:annotations:21464@v3 sha256:3ad96ea09bd59076
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction1a7e5a3e1c…4911c24f57
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 12,056,100 sat · time 2017-07-03 09:40 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21463btcintel:annotations:21463@v3 sha256:a19bcb476fbfac5f
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction96f367d6f6…bfbb379227
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 10,540,000 sat · time 2017-07-19 09:32 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21462btcintel:annotations:21462@v3 sha256:1e3fa3f1662fc699
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction35393ee386…f0261b24b6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 5,264,895 sat · time 2017-10-29 00:51 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21461btcintel:annotations:21461@v3 sha256:838d9e787d80ac06
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction627f3485ad…43d929493b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 3,712,036 sat · time 2017-11-21 10:29 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21460btcintel:annotations:21460@v3 sha256:a2fe1a02cbcc3360
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction13a0157307…aec53f231c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 4,000,000 sat · time 2017-11-23 09:16 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21459btcintel:annotations:21459@v3 sha256:4f05facf1fd11b44
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction69e5e61b04…ca4f6097d0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 1,818,305 sat · time 2017-12-11 23:52 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21458btcintel:annotations:21458@v3 sha256:45b7642e56995f46
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction4e9fb3a428…59cc48504e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 200,418 sat · time 2017-12-12 15:42 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21457btcintel:annotations:21457@v3 sha256:83205c0a7392ea48
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction93843f1bb8…34c74020fb
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 2,537,195 sat · time 2020-08-01 21:29 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21456btcintel:annotations:21456@v3 sha256:30352462406eac8a
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactionf57b8cb65c…be8b0f15f0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 · 44,083 sat · time 2020-08-11 21:02 UTC · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21455btcintel:annotations:21455@v3 sha256:b21917bd261c071a
confidencetrusted provider · 50
WannaCryransomwarepayment address
subjectaddress15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw WannaCry · url https://ransomwhe.re/#address/15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_21454btcintel:annotations:21454@v2 sha256:ef905388db5f298b
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactione1da77d00f…8aaf691a59
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY · 19,000,000 sat · time 2017-03-31 12:17 UTC · url https://ransomwhe.re/#address/1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21171btcintel:annotations:21171@v3 sha256:cc6c6601c15b25c5
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactiona84cd211a0…f6716e5dec
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY · 17,583,018 sat · time 2017-03-31 16:04 UTC · url https://ransomwhe.re/#address/1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21170btcintel:annotations:21170@v3 sha256:d2e106651bc53a52
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransaction226374d736…94ad31306e
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY · 18,331,800 sat · time 2017-04-01 09:31 UTC · url https://ransomwhe.re/#address/1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21169btcintel:annotations:21169@v3 sha256:740b1d3e22825ff5
confidencetrusted provider · 50
WannaCryransomwarepayment
subjecttransactionfb7a6c1760…aa8fe187d5
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY · 18,600,000 sat · time 2017-04-02 07:44 UTC · url https://ransomwhe.re/#address/1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_21168btcintel:annotations:21168@v3 sha256:883550a427090b47
confidencetrusted provider · 50

Subjects510 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.