Alerta de seguridad: Información para bloqueo de Ransomware Wannacry

Información relevante

Directorios a los que afecta el ransomware WannaCry:

%AppData% %Local% %LocalLow% %userprofile%\Desktop %windows% %homedrive%

Extensiones Afectadas por WannaCry:

123, .3DM, .3ds, .3g2, .3gp, .602, .7z, .aes, .ai, .ARC, .asc, .asf, .asp, .avi, .backup, .bak, .bmp, .brd, .c, .cgm, .class files, .cpp, .crt, .cs, .csr, .csv, .db, .dbf, .dch, .dif, .dip, .doc, .docb, .docm, .docx, .dot, .dotm file, .dotx, .dwg, .edb, .eml, .fla, .flv, .frm, .gif, .gpg, .gz, .hwps .ibd, .jar, .java, .jpeg, .jpg, .js, .jsp, .key file, .lay, .lay6, .ldf files, .m3u, .m4u, .max, .mdb, .mdf, .mid, .mkv, .TFL, .mov, .mp3, .mp4, .mpeg, .mpg, .MSG, .MYD, .MYI, .n, .nef, .odb, .odg, .odp, .ods, .odt, .ost, .otg, .otp, .ots, .ott, .p12, .PAQ .pas, .pdf, .pem, .php, .pl, .png, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .psd, .pst, .rar, .raw, .rm, .rtf, .sch, .sh, .no, .slk, .sql file, .sqlite3, .sqlitedb, .stc, .std, .stw, .suo, .swf, .sxc, .sxd, .sxm, .sxw, .tar, .tarbz2, .tbk, .tgz, .tif, .tiff, .txt, .uop, .OTU’s, .vb, .vdi .vmdk files, .vmx, .VOB, .vsd, .vsdx, .wav, .wb2, .WK1, .WKS, .wma, .wmv, .xlc, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .zip file.

URL´s recomendadas de bloquear: hxxp://ecoland.pro/ dcky6u1m8u6el.cloudfront[.]net hxxp://bs.yandex[.]ru/ hxxp://counter.rambler[.]ru hxxp://mc.yandex[.]ru/ hxxp://top-fwz1.mail[.]ru/ hxxp://www.leadhacker[.]ru/ IPs recomendadas de bloquear: 47.91.107.213 178.208.83.16 54.230.79.152 93.158.134.90 81.19.88.103 87.250.250.119 217.69.133.148 176.9.80.202 154.35.175.225 171.25.193.78 178.162.194.210 192.99.212.139 195.154.165.112 91.219.236.222 188.166.23.127 193.23.244.244 2.3.69.209 146.0.32.144 50.7.161.218 192.42.113.102 83.169.6.12 158.69.92.127 86.59.21.38 62.138.7.171 51.255.203.235 51.15.36.164 217.79.179.177 128.31.0.39 213.61.66.116 212.47.232.237 81.30.158.223 79.172.193.32 163.172.149.155 167.114.35.28 176.9.39.218 192.42.113.102 193.11.114.43 199.254.238.52 89.40.71.149

WIDEFENSE RECOMIENDA

1. Trate de utilizar un visor de PDF distinto a Acrobat
2. No instale programas Codecs para ver videos 
3. No instale componentes de ActiveX
4. Deshabilite o limite la ejecución de JavaScript en browsers
5. Configure la seguridad para Office de macros en HIGH

 

Widefense sigue trabajando para recopilar mayor información sobre esta amenaza y otras recomendaciones  para entregarle.