Metadata Analysis Draws its Own Conclusions on WannaCry Authors

itman · Jun 15, 2017

Looks like it was North Korea after all. Or possibly someone from South Korea. In any case, the author was a native Korean speaker.

Sergio de los Santos, the labs leader at ElevenPaths, said the author overlooked how much information that metadata buried in the malware files could give away about their identity. For example, the author and operator fields in the RTF files used in the ransom note are set to Messi, a reference to footballer Lionel Messi. This reference was also found in the first version of WannaCry that surfaced in March. The author also types in Korean, the default language the author used in the EMEA version of Word that was used to create the RTF files. This lends weight to the theory that the broken Korean may have been intentional, de los Santos said.

“The broken Korean, for me, means he was trying to hide himself. That’s a hint he was from Korea,” de los Santos said. “He forgot to change his [default language in] Word. If you’re trying to hide yourself from being English and write in broken English, anyone could do that. But I would forget to change my default language. He made the mistake of forgetting to change the default language. He tried to force a broken Korean.”
Click to expand...

https://threatpost.com/metadata-analysis-draws-its-own-conclusions-on-wannacry-authors/126287/

Log in or Sign up

Metadata Analysis Draws its Own Conclusions on WannaCry Authors

itman Registered Member

Log in or Sign up

Metadata Analysis Draws its Own Conclusions on WannaCry Authors

itman Registered Member

Useful Searches