为了顺应当前形势和更好的发展,黑基网已于9月19日正式更名为【安基网】,域名更换为www.safebase.cn,请卸载旧的APP并安装新的APP,给您带来不便,敬请理解!谢谢

黑基Web安全攻防班
安基网 首页 资讯 安全报 查看内容

勒索软件“圣甲虫”再发新变种Scarabey 目标瞄准俄语用户

2018-2-5 11:54| 投稿: xiaotiger |来自: 互联网

摘要: 勒索软件“圣甲虫(Scarab)”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。最流行或传播最广泛的版本是通过僵尸网络Necurs分发的,最初是采用Visual C编写的。网络安全公司Malwarebytes却在去 ...

勒索软件“圣甲虫(Scarab)”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。最流行或传播最广泛的版本是通过僵尸网络Necurs分发的,最初是采用Visual C编写的。

网络安全公司Malwarebytes却在去年12月份发现了另一个独特的新变种,他们将其标识为“Scarabey”。它与Scarab存在多个区别,这包括采用了不同的分发方式、不同的编程语言以及不同的有效载荷代码。

像大多数勒索软件一样,Scarabey的目的是在加密系统上的文件之后,向受害者勒索比特币进行赎金支付。然而,Scarabey并没有像Scarab那样通过内部的垃圾电子邮件进行分发,而是通过远程桌面协议(RDP, Remote Desktop Protocol)手动安装到目标服务器和系统上的。

与Scarab不同,Scarabey的恶意代码是采用Delphi编写的,且没有Scarab的C ++包装,并且赎金票据的内容和语言各不相同。

Scarab的赎金票据通常是采用英文书写的,但它读起来就好像是将俄文一字一句翻译成的英文,而不是正确的英文语法。另一方面,Scarabey则是采用俄文书写的。有趣的是,当研究人员将Scarabey赎金票据的内容放入Google翻译时,他们发现,它包含了与Scarab赎金票据相同的语法错误。

更多的证据表明,Scarab的开发者很可能是俄语的使用者,他们使用自己的母语书写赎金票据,并通过翻译器翻译,然后加入到Scarab代码中。

Scarabey与Scarab还存在一个很明显的区别,Scarabrab不像Scarab那样警告受害者尽早与他们联系,这样赎金金额就会更小,否则赎金金额将会随时间而增加。Scarabey会告诉受害者,每24小时后就会有24个文件遭到删除,直到删完为止。

不过,即使存在这些区别,但Scarabey还是仍像Scarab一样,继续使用.scarab 扩展名来加密文件。

虽然,网络上另一些文章指出,Scarabey有能力作为后门,允许远程访问,也可以收集敏感数据,但Malwarebytes在经过深入分析后强调,除了简单地加密受害者计算机上的文件之外,Scarabey并不具备其他功能。

本文由 黑客视界 综合网络整理,图片源自网络;转载请注明“转自黑客视界”,并附上链接。

, groupId: 6518870049296482823, itemId: 6518870049296482823, type: 1, subInfo: { isOriginal: false, source: 黑客视界, time: 2018-02-05 09:05:10 }, tagInfo: { tags: [{"name":"网络安全"},{"name":"俄语"},{"name":"软件"},{"name":"Google翻译"},{"name":"黑客"}], groupId: 6518870049296482823, itemId: 6518870049296482823, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6518870049296482823, itemId: 6518870049296482823, comments_count: 0, ban_comment: 0 }, mediaInfo: { uid: 76207630046, name: 黑客视界, avatar: //p3.pstatp.com/large/46e80003c98b9bfd77be, openUrl: /c/user/76207630046/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/76207630046/","avatar_url":"https://p3.pstatp.com/large/46e80003c98b9bfd77be","media_id":1584317604543502,"name":"黑客视界","user_verified":false},"articles":[{"item_id":"6518870389899149832","url":"/item/6518870389899149832","title":"朝鲜黑客正利用新的Adobe Flash Player零日漏洞攻击韩国人"},{"item_id":"6518870263973544455","url":"/item/6518870263973544455","title":"JenX僵尸网络不仅提供DDoS攻击服务 还充当网游私服主机"},{"item_id":"6518870155567563278","url":"/item/6518870155567563278","title":"FBI怒了!网络欺诈者冒用其名义大量分发网络钓鱼电子邮件"},{"item_id":"6518870049296482823","url":"/item/6518870049296482823","title":"勒索软件“圣甲虫”再发新变种Scarabey 目标瞄准俄语用户"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":145,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"2月3号,蛇哥再发动态,表示不会自证了,会通过线下比赛证明自己,如何看待?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6518300366121992452/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5b000006b4700fa45659","group_id":"6518300366121992452"},{"comments_count":6,"media_avatar_url":"//p3.pstatp.com/large/5b4b0004cc4117c501ce","is_feed_ad":false,"is_diversion_page":false,"title":"SQL成为关系数据库的标准语言,大大减轻了用户的负担","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517107396123296270/","source":"科技巨头","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7900037099e8ae7a7f","group_id":"6517107396123296270","is_related":true,"media_url":"/c/user/86646636719/"},{"comments_count":44,"media_avatar_url":"//p3.pstatp.com/large/56850005f19663cd1e06","is_feed_ad":false,"is_diversion_page":false,"title":"这些老司机用烂的软件神器,你还没用过吗?","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517543148011389453/","source":"生活带点甜","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":92,"image_url":"//p3.pstatp.com/list/190x124/5e7800045021daf0ba5a","group_id":"6517543148011389453","is_related":true,"media_url":"/c/user/5432028358/"},{"comments_count":17,"media_avatar_url":"//p3.pstatp.com/large/5688000164046badbaeb","is_feed_ad":false,"is_diversion_page":false,"title":"Web系统大规模并发——电商秒杀与抢购","single_mode":true,"gallary_image_count":13,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518349596719055368/","source":"爱JAVA爱火影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":2,"image_url":"//p3.pstatp.com/list/190x124/5e800003a7ffbbbf317c","group_id":"6518349596719055368","is_related":true,"media_url":"/c/user/4142236051/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/2c640002496a93effe6f","is_feed_ad":false,"is_diversion_page":false,"title":"如何用Python自动登录路由器!获取信息!请勿用于非法用途!","single_mode":true,"gallary_image_count":10,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518693907792921096/","source":"sun菜菜","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":23,"image_url":"//p3.pstatp.com/list/190x124/5e82000149eb89681cbc","group_id":"6518693907792921096","is_related":true,"media_url":"/c/user/5838461924/"},{"comments_count":7,"media_avatar_url":"//p6.pstatp.com/large/5b4e000409e37d0d8e34","is_feed_ad":false,"is_diversion_page":false,"title":"在计算机中,把所有的软件分为两大类","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517102437642273284/","source":"VR科技嗅","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e76000352f75141d2c8","group_id":"6517102437642273284","is_related":true,"media_url":"/c/user/87069437693/"},{"comments_count":33,"media_avatar_url":"//p9.pstatp.com/large/434d0003c70af59ccaa5","is_feed_ad":false,"is_diversion_page":false,"title":"批量打印奖状/请柬/桌牌/工资条-单独打印同样格式不同内容的进来","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517141108663779843/","source":"小德EXCEL数据分析","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":34,"image_url":"//p3.pstatp.com/list/190x124/5e7a0000554058316294","group_id":"6517141108663779843","is_related":true,"media_url":"/c/user/50732800910/"},{"comments_count":69,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"为什么很多人用excel很熟练但不愿意去用python?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517509131715215630/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/5fed00006f7d58b24214","group_id":"6517509131715215630"},{"comments_count":146,"media_avatar_url":"//p8.pstatp.com/large/5ac50015311a1d00f5d5","is_feed_ad":false,"is_diversion_page":false,"title":"电脑运行越来越慢?10分钟学会电脑瘦身","single_mode":true,"gallary_image_count":9,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516302543860007431/","source":"程序媛进化论","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5e6f000157aa10544fcb","group_id":"6516302543860007431","is_related":true,"media_url":"/c/user/84275416965/"},{"comments_count":12,"media_avatar_url":"//p8.pstatp.com/large/50ae000404e87bb76f6b","is_feed_ad":false,"is_diversion_page":false,"title":"要了解计算机的工作原理,必须懂这三个工作原理","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516650900172308999/","source":"最IT","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5e720000b2c97104652a","group_id":"6516650900172308999","is_related":true,"media_url":"/c/user/74857862657/"},{"comments_count":42,"media_avatar_url":"//p10.pstatp.com/large/5d410008b59949353686","is_feed_ad":false,"is_diversion_page":false,"title":"果粉们告诉大家一个不愉快的消息!","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517959240919810564/","source":"爱折腾的小强","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7e000265183e6a692f","group_id":"6517959240919810564","is_related":true,"media_url":"/c/user/2888833977/"},{"comments_count":11,"media_avatar_url":"//p1.pstatp.com/large/2c5e000728a7c818a637","is_feed_ad":false,"is_diversion_page":false,"title":"这么炫酷的下拉框,简单到没有朋友!赶紧动手来制作吧!","single_mode":true,"gallary_image_count":4,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518557370556088840/","source":"小峰聊电影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":17,"image_url":"//p3.pstatp.com/list/190x124/5e860005a563b91b6f50","group_id":"6518557370556088840","is_related":true,"media_url":"/c/user/5750992551/"},{"comments_count":18,"media_avatar_url":"//p3.pstatp.com/large/59390000c31263dcefb0","is_feed_ad":false,"is_diversion_page":false,"title":"年薪500k大数据工程师:所有程序员做到以下几点,年薪百万不是梦","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6518547345691378190/","source":"大数据工程师阿福","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":24166,"image_url":"//p1.pstatp.com/list/190x124/5e890003632164c4f770","group_id":"6518547345691378190","is_related":true,"media_url":"/c/user/86127904863/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/5b4b0004cc4117c501ce","is_feed_ad":false,"is_diversion_page":false,"title":"自从计算机发明以来,数据处理就是它的基本功能和关键技术","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517105279203541518/","source":"科技巨头","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e77000444bd6273ea0f","group_id":"6517105279203541518","is_related":true,"media_url":"/c/user/86646636719/"},{"comments_count":53,"media_avatar_url":"//p3.pstatp.com/large/4e5f0004d829789ac63e","is_feed_ad":false,"is_diversion_page":false,"title":"如何提取CAD中各点的坐标","single_mode":true,"gallary_image_count":13,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517409715310297603/","source":"幻月独影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":22,"image_url":"//p3.pstatp.com/list/190x124/5e7c0001724cf5f77992","group_id":"6517409715310297603","is_related":true,"media_url":"/c/user/5766033862/"},{"comments_count":7,"media_avatar_url":"//p6.pstatp.com/large/5b4e000409e37d0d8e34","is_feed_ad":false,"is_diversion_page":false,"title":"任何厂家生产的计算机系统,只要遵守IP协议就能与因特网互连互通","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517103637087388164/","source":"VR科技嗅","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7900035aefacf2e360","group_id":"6517103637087388164","is_related":true,"media_url":"/c/user/87069437693/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/group/6518870049296482823/, abstract: 勒索软件“圣甲虫”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。网络安全公司Malwarebytes却在去年12月份发现了另一个独特的新变种,他们将其标识为“Scarabey”。

小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!



免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

发表评论

最新评论

最新

返回顶部