coreonyx

brew install dnscrypt-proxy

nano /opt/homebrew/etc/dnscrypt-proxy.toml

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	/ipv6 firewall filter
	add action=accept chain=input comment="Allow established connections" connection-state=established disabled=no
	add action=accept chain=input comment="Allow related connections" connection-state=related disabled=no
	add action=accept chain=input comment="Allow limited ICMP" disabled=no limit=50/5s,5 protocol=icmpv6
	add action=accept chain=input comment="Allow UDP" disabled=no protocol=udp
	add action=drop chain=input comment="" disabled=no
	add action=accept chain=forward comment="Allow any to internet" disabled=no out-interface=sit1
	add action=accept chain=forward comment="Allow established connections" connection-state=established disabled=no
	add action=accept chain=forward comment="Allow related connections" connection-state=related disabled=no
	add action=drop chain=forward comment="" disabled=no

	#!/usr/bin/env python

	import sys
	import socket

	hex = ""
	for line in sys.stdin.readlines():
	first_space = line.index(' ')
	if first_space > 2:
	line = line[first_space:]