Campaigns / Malware / Family

WannaCry

WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries.

8New IOCs · 24h

43New IOCs · 7 days

43Indicators tracked

2Independent feeds

2026-10-12 05:15Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash35
IP8
Malware43

MITRE ATT&CK lists this as malware WannaCry. Explore the ATT&CK matrix →

Where its infrastructure is hosted

🇳🇱 Netherlands2
🇩🇪 Germany1
🇨🇭 Switzerland1
🇳🇴 Norway1
🇺🇸 United States1
🇫🇷 France1
🇸🇪 Sweden1

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-12 05:15	SHA256	28d687a4db73fb62639e0942751238d87cbdcf6c8493fbfe132a4333407bd491	Malware sample	—
2026-10-12 05:00	SHA256	5facb4bca8b6a43fcf064b33c80c8727633fdc2532b2e66402b5cd954109cde0	Malware sample	—
2026-10-12 04:45	SHA256	f9058efc35c549e22a715ab2cbd8bbc408e41826a470dfdb812e8b37f3420fed	Malware sample	—
2026-10-12 04:16	SHA256	9213b83aa454f4c45e0d764042ac1a3d6f2f37d22aa95b660c81b8009e0d4b06	Malware sample	—
2026-10-11 22:16	SHA256	a5f0ad9e85500f92821f8c22cafa0e294ec514f876af0881f59a3891e63251d5	Malware sample	—
2026-10-11 21:15	SHA256	7e8209a4bad67901c826655b61e66c3d0569d3fdd85da77634050d3018b3dc29	Malware sample	—
2026-10-11 16:26	SHA256	e8cfa9a30a3a91265ef0c1854ccf055befacdb8370aebc166f111cc4f40c01ff	Malware sample	—
2026-10-11 09:16	SHA256	c77785269a54df0173e98b8a53a22594a104e701a5132bd53d03f4cb0f285c21	Malware sample	—
2026-10-11 04:35	SHA256	d2d8a0b88cdb89e87385a0afcc298bcac07a68cc3018d1b62b3ee4d9e58d45a4	Malware sample	—
2026-10-11 04:35	SHA256	d916523240c6b8cf371fd39b7eb000cc93410d0900d3f93e0395fb5cbc7cfb4d	Malware sample	—
2026-10-10 16:16	SHA256	e9f75925a4da2748957701e7a8b25b0b9e724fd86a7d603d099d918f3b34e19a	Malware sample	—
2026-10-10 15:16	SHA256	e58536bb0fb12bfe4253f44f46f4aedbdaa37d195c31d1976e8cb78e925f1d76	Malware sample	—
2026-10-10 14:41	SHA256	288586c2c61f0b8b978f9c32b1ce6b9faee8049c6e85d11ba30c7aad0622fad5	Malware sample	—
2026-10-10 14:41	IP	176.9.39[.]196	Contacted by malware	—
2026-10-10 14:26	SHA256	42390e97fedbcfacd1de3156ab182c470e3adca8d452e7cd767fb6d557157957	Malware sample	—
2026-10-10 14:26	IP	176.10.104[.]243	Contacted by malware	—
2026-10-10 14:26	IP	185.11.180[.]67	Contacted by malware	—
2026-10-10 14:26	IP	192.87.28[.]82	Contacted by malware	—
2026-10-10 14:26	IP	171.25.193[.]77	Contacted by malware	—
2026-10-10 14:16	SHA256	dec381ad98ee824cd95313883bc4a17244e8c3a4f37de3b0354fb9f636b2134b	Malware sample	—
2026-10-10 13:25	SHA256	2e791061bd94c494e8556eafc0d0d95b555fd7edb2321559aef4911e5391edef	Malware sample	—
2026-10-10 13:25	IP	212.83.154[.]33	Contacted by malware	—
2026-10-10 09:14	SHA256	e3b965a138459e545d75811d404a32824e61df868236e553b88b3daf9fee06f7	Malware sample	—
2026-10-09 16:16	SHA256	98971531c7c28a7bad8c88cf9822838af9969f3c9a222f1dcea8a0775d03050d	Malware sample	—
2026-10-09 12:16	SHA256	c23a5d89f60bc65b7bf92b6bcca9311d704611b7482f63befee64096f047ac32	Malware sample	—
2026-10-09 11:34	SHA256	b69cdbaf327bf600f6e0ccd230367d28ab5be6977d35d51f78ad7229d75fb7f6	Malware sample	—
2026-10-09 11:16	SHA256	b2c03ca07a9d844205f9c097e870fc3c54bfea34caef6ed6b907e7c887ba6665	Malware sample	—
2026-10-09 10:15	SHA256	83935392c7f2e7e66fa4300e00fe063d250890e4b116d55e03e255661d3aa612	Malware sample	—
2026-10-09 08:04	SHA256	f470fbf340e5ad8be24b29712f565eaff0c67564a4872e0cedb05a1876a838d0	Malware sample	—
2026-10-09 07:31	SHA256	a8d8a1cd516e1c4a20e9ff6ae4b933f55bf51d56728bb82adfce56f8864ea7f6	Malware sample	—
2026-10-09 07:31	IP	199.184.246[.]250	Contacted by malware	—
2026-10-09 07:31	IP	192.87.28[.]28	Contacted by malware	—
2026-10-08 10:44	SHA256	dfea9df27990128e1f9919ffbf3a4a9af256669c75e4d6271a3df0b6c931786d	Malware sample	—
2026-10-08 09:15	SHA256	365863cfdd112035bda3f239eeb69fe4239e8b28ae3fc5fd6ffaf2d3f2035894	Malware sample	—
2026-10-07 10:48	SHA256	96232068336fd27dd3ee457789801c81e8323673f4bd504afa63d4402de0eefe	Malware sample	—
2026-10-07 08:15	SHA256	01469b8a4aa195637983cc952ab5dac5e9b7b46091ac709f8819ef82fa4c8b26	Malware sample	—
2026-10-06 21:15	SHA256	5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704	Malware sample	—
2026-10-06 09:15	SHA256	7ef0b121f0059de02cea8c1280f4fdd0c440b057346984bfcf8606a2a66a8148	Malware sample	—
2026-10-06 08:16	SHA256	f08f76ee0bc11c6383b83b70fb86dccd7668b76e17450d42453942b8fc148dea	Malware sample	—
2026-10-06 06:16	SHA256	b9fcda5008f194cb1d90a7fc1c30ac6240b7ca3fe1dff8c6e7c42c802ba25abd	Malware sample	—
2026-10-06 05:16	SHA256	ae5ce4d540d6decaca5aa836d2e53b5b1067a53c61a6df88c5498c7b04f0827a	Malware sample	—
2026-10-05 23:18	SHA256	df4c8d227144d67603d1b6528e9d5d76d510e7e1fef18549553c383328c1a9c4	Malware sample	—
2026-10-05 23:18	SHA256	128a84a95534c6fa359c34d636a23926fb1679ba7e9586db1988185b8bbc4c07	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check