<p>IIRC WannaCry requires you to contact the malware authors (via their built in chat system thing) and then tell them the address that you used to send the payment. Then they will manually decrypt your files for you. Otherwise there is no way for them to track who sent what payment. This of course is fraught with issues and is very unreliable. I have heard some people say that their files were decrypted even without paying, and others say that they have paid but their files were not decrypted.</p>

CC BY-SA 3.0
2017-06-13T16:39:35.713Z
Aha. This was in news reports?
LJ Jones
CC BY-SA 3.0
2017-06-13T16:45:32.130Z
I believe so. At the very least, people have mentioned this on Reddit. I'll try to find a link.
Ava Chow
CC BY-SA 3.0
2017-06-13T16:57:46.287Z
Here's a link to a tweet by a malware researcher about the manual decryption thing: https://twitter.com/hackerfantastic/status/863833239475171329. Here's an (overly dramatized) story about someone who didn't pay but got their files decrypted: https://qz.com/985093/inside-the-digital-heist-that-terrorized-the-world-and-made-less-than-100k/
Ava Chow
CC BY-SA 3.0
2017-06-13T16:34:54.410Z
2017-06-13T16:34:54.410Z
Ava Chow
<p>Here are the three addresses which the payments were sent to for Wanacry:
<a href="https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" rel="nofollow noreferrer">https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94</a>
<a href="https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw" rel="nofollow noreferrer">https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw</a>
<a href="https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" rel="nofollow noreferrer">https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn</a></p>

<p>Judging by the differing amounts for nearly all of the payments, I thought it would be the amount which differentiates them, although there does seem to be some duplicate amounts, so I'm not entirely sure this is the case.</p>

CC BY-SA 3.0
2017-06-13T16:22:28.517Z
2017-06-13T16:22:28.517Z
Ed Harrod
<p>There are two ways that I can think of:</p>

<ul>
<li><p>Ask for a signed message from the address of the sender of the Bitcoin. </p>

<p>After the payment is sent, ask them to sign a message with a unique ID to establish a connection between the payment and the computer.</p></li>
<li><p>Have everyone pay slightly different amounts of Bitcoin.</p></li>
</ul>

CC BY-SA 3.0
2017-05-18T02:28:46.913Z
Aha. Second one seems more​ plausible as it's easier to expect a non Bitcoin user to get an amount right than to figure out signing.
LJ Jones
CC BY-SA 3.0
2017-05-18T02:33:01.307Z
I'm more familiar with vanilla Stack Overflow - where it's more clear whether an answer solves a problem. If I'm not the expert, how do I judge marking something as correct?
LJ Jones
CC BY-SA 3.0
2017-05-18T02:36:12.897Z
@LeifSegen My rule of thumb is that I mark as accepted if I know the answer is correct, or if it helps me. The above is just an informed guess.
Nick ODell
CC BY-SA 3.0
2017-05-17T23:25:39.180Z
2017-05-17T23:25:39.180Z
Nick ODell
<p><a href="https://www.redsocks.eu/news/ransomware-wannacry/" rel="noreferrer">Reports</a> indicate that there are three default addresses to which victims of Wanna Cry are asked to send funds. </p>

<p>Assuming that Wanna Cry actually does decrypt once payment is verified, how can the software know that the specific computer is the one that should be decrypted in association with the victim's payment?</p>

CC BY-SA 3.0
2017-05-17T20:21:06.223Z
Just an opinion, but I don't think it really can. In order to do so a single payment address should be assigned to every victim, or a digital signature over a message using the private key that belongs to the same key pair as the public key used to derive the Bitcoin address from where the payment has been performed should be requested by the attacker. Long story short, it seems that the WannaCry was not that well developed, and no victim-payment match can be performed.
sr_gi
<ransomware>
How does Wanna Cry verify payment
LJ Jones
# How does Wanna Cry verify payment

(Asked by: username_0 on 2017-05-17)

[Reports](https://www.redsocks.eu/news/ransomware-wannacry/) indicate that there are three default addresses to which victims of Wanna Cry are asked to send funds.

Assuming that Wanna Cry actually does decrypt once payment is verified, how can the software know that the specific computer is the one that should be decrypted in association with the victim's payment?

**Tags:** ransomware

> **Comments:**
> **username_1**: Just an opinion, but I don't think it really can. In order to do so a single payment address should be assigned to every victim, or a digital signature over a message using the private key that belongs to the same key pair as the public key used to derive the Bitcoin address from where the payment has been performed should be requested by the attacker. Long story short, it seems that the WannaCry was not that well developed, and no victim-payment match can be performed.  

---

## 3 answers

### Answer by username_2 on 2017-06-13. Score: 2 | Accepted answer

IIRC WannaCry requires you to contact the malware authors (via their built in chat system thing) and then tell them the address that you used to send the payment. Then they will manually decrypt your files for you. Otherwise there is no way for them to track who sent what payment. This of course is fraught with issues and is very unreliable. I have heard some people say that their files were decrypted even without paying, and others say that they have paid but their files were not decrypted.

> **Comments:**
> **username_0**: Aha. This was in news reports?  
> **username_2**: I believe so. At the very least, people have mentioned this on Reddit. I'll try to find a link.  
> **username_2**: Here's a link to a tweet by a malware researcher about the manual decryption thing: https://twitter.com/hackerfantastic/status/863833239475171329. Here's an (overly dramatized) story about someone who didn't pay but got their files decrypted: https://qz.com/985093/inside-the-digital-heist-that-terrorized-the-world-and-made-less-than-100k/  

---

### Answer by username_3 on 2017-06-13. Score: 0

Here are the three addresses which the payments were sent to for Wanacry:
<https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94>
<https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw>
<https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn>

Judging by the differing amounts for nearly all of the payments, I thought it would be the amount which differentiates them, although there does seem to be some duplicate amounts, so I'm not entirely sure this is the case.


---

### Answer by username_4 on 2017-05-17. Score: 0

There are two ways that I can think of:

* Ask for a signed message from the address of the sender of the Bitcoin.

  After the payment is sent, ask them to sign a message with a unique ID to establish a connection between the payment and the computer.
* Have everyone pay slightly different amounts of Bitcoin.

> **Comments:**
> **username_0**: Aha. Second one seems more​ plausible as it's easier to expect a non Bitcoin user to get an amount right than to figure out signing.  
> **username_0**: I'm more familiar with vanilla Stack Overflow - where it's more clear whether an answer solves a problem. If I'm not the expert, how do I judge marking something as correct?  
> **username_4**: @LeifSegen My rule of thumb is that I mark as accepted if I know the answer is correct, or if it helps me. The above is just an informed guess.  

---

