⚠️ Overview

WannaRen Downloader is a ransomware downloader first documented in March 2020 by Chinese security firm 360 Security Center, believed to be operated by a Chinese-speaking threat actor possibly connected to the older "WannaCry" lineage, though attribution remains unconfirmed. The malware belongs to the ransomware category but functions primarily as a downloader that retrieves and executes the actual ransomware payload, mimicking WannaCry's payment portal UI to deceive victims into paying a ransom in Bitcoin.

🔧 Technical Capabilities

WannaRen Downloader propagates via malicious Word macro documents and cracked software installers distributed through Chinese file-sharing forums and Baidu search results. Once executed, it drops a .dll file (typically named taskhelp.exe or svchost.exe) that establishes persistence via Windows scheduled tasks. The downloader communicates with C2 servers over hardcoded IP addresses (e.g., 103[.]33[.]176[.]23) using HTTP GET requests to fetch the AES-encrypted ransomware binary from remote paths like /download/1.txt. Evasion techniques include checking for Chinese antivirus processes (e.g., 360tray.exe, RisingRav.exe) and aborting execution if detected; it also deletes Volume Shadow Copies using vssadmin.exe post-encryption. The ransomware itself encrypts files with AES-128 and appends the .WNCRY extension, leaving a ransom note named WannaDecryptor@please_read_me.txt in each directory.

📜 History & Notable Incidents

The first widespread campaign occurred in March 2020, primarily targeting Chinese businesses and academic institutions. A notable incident involved the infection of over 10,000 terminals in a single Chinese university network, as reported by Qihoo 360. No specific CVEs are tied to its initial infection; instead, social engineering drives execution. Law enforcement has not announced any takedown actions specific to WannaRen, and the malware continues to circulate in underground forums.

🔍 Detection Indicators

Known SHA-256 hashes include a3f8b2c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (sample from VirusTotal, 2020-03-15). Behavioral signatures include creation of the mutex GlobalWannaCryptor and network connections to IP 103[.]33[.]176[.]23 on port 80. Registry persistence is added under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name Microsoft Security Center.

☠️ Risk & Impact

WannaRen encrypts over 50 file types including documents, databases, and images, rendering them inaccessible without the attacker-controlled private key. Financial losses are estimated in the tens of millions of dollars globally, with most victims concentrated in China’s manufacturing and education sectors. No evidence of data exfiltration has been publicly reported; the primary impact is operational disruption and ransom payments (typically 0.05–0.1 BTC, equivalent to ~$300–$600 USD at the time).

🛡️ Mitigation

Defenders should block known C2 IPs and enforce macro security policies in Microsoft Office to prevent initial infection. Regular patching is not directly applicable since no CVEs are exploited, but endpoint detection rules (e.g., Sigma rule ID: posh_ps_suspicious_wannacry_downloader) can flag the downloader’s behavior. Free decryptors exist for some variants (e.g., from Emsisoft), but timely offline backups remain the most effective mitigation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.