黑基网 首页 资讯 安全圈 查看内容

勒索软件“圣甲虫”再发新变种Scarabey 目标瞄准俄语用户

2018-2-5 11:54| 投稿: xiaotiger |来自: 互联网

摘要: 勒索软件“圣甲虫(Scarab)”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。最流行或传播最广泛的版本是通过僵尸网络Necurs分发的,最初是采用Visual C编写的。网络安全公司Malwarebytes却在去 ...

勒索软件“圣甲虫(Scarab)”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。最流行或传播最广泛的版本是通过僵尸网络Necurs分发的,最初是采用Visual C编写的。

网络安全公司Malwarebytes却在去年12月份发现了另一个独特的新变种,他们将其标识为“Scarabey”。它与Scarab存在多个区别,这包括采用了不同的分发方式、不同的编程语言以及不同的有效载荷代码。

像大多数勒索软件一样,Scarabey的目的是在加密系统上的文件之后,向受害者勒索比特币进行赎金支付。然而,Scarabey并没有像Scarab那样通过内部的垃圾电子邮件进行分发,而是通过远程桌面协议(RDP, Remote Desktop Protocol)手动安装到目标服务器和系统上的。

与Scarab不同,Scarabey的恶意代码是采用Delphi编写的,且没有Scarab的C ++包装,并且赎金票据的内容和语言各不相同。

Scarab的赎金票据通常是采用英文书写的,但它读起来就好像是将俄文一字一句翻译成的英文,而不是正确的英文语法。另一方面,Scarabey则是采用俄文书写的。有趣的是,当研究人员将Scarabey赎金票据的内容放入Google翻译时,他们发现,它包含了与Scarab赎金票据相同的语法错误。

更多的证据表明,Scarab的开发者很可能是俄语的使用者,他们使用自己的母语书写赎金票据,并通过翻译器翻译,然后加入到Scarab代码中。

Scarabey与Scarab还存在一个很明显的区别,Scarabrab不像Scarab那样警告受害者尽早与他们联系,这样赎金金额就会更小,否则赎金金额将会随时间而增加。Scarabey会告诉受害者,每24小时后就会有24个文件遭到删除,直到删完为止。

不过,即使存在这些区别,但Scarabey还是仍像Scarab一样,继续使用.scarab 扩展名来加密文件。

虽然,网络上另一些文章指出,Scarabey有能力作为后门,允许远程访问,也可以收集敏感数据,但Malwarebytes在经过深入分析后强调,除了简单地加密受害者计算机上的文件之外,Scarabey并不具备其他功能。

本文由 黑客视界 综合网络整理,图片源自网络;转载请注明“转自黑客视界”,并附上链接。

, groupId: 6518870049296482823, itemId: 6518870049296482823, type: 1, subInfo: { isOriginal: false, source: 黑客视界, time: 2018-02-05 09:05:10 }, tagInfo: { tags: [{"name":"网络安全"},{"name":"俄语"},{"name":"软件"},{"name":"Google翻译"},{"name":"黑客"}], groupId: 6518870049296482823, itemId: 6518870049296482823, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6518870049296482823, itemId: 6518870049296482823, comments_count: 0, ban_comment: 0 }, mediaInfo: { uid: 76207630046, name: 黑客视界, avatar: //p3.pstatp.com/large/46e80003c98b9bfd77be, openUrl: /c/user/76207630046/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/76207630046/","avatar_url":"https://p3.pstatp.com/large/46e80003c98b9bfd77be","media_id":1584317604543502,"name":"黑客视界","user_verified":false},"articles":[{"item_id":"6518870389899149832","url":"/item/6518870389899149832","title":"朝鲜黑客正利用新的Adobe Flash Player零日漏洞攻击韩国人"},{"item_id":"6518870263973544455","url":"/item/6518870263973544455","title":"JenX僵尸网络不仅提供DDoS攻击服务 还充当网游私服主机"},{"item_id":"6518870155567563278","url":"/item/6518870155567563278","title":"FBI怒了!网络欺诈者冒用其名义大量分发网络钓鱼电子邮件"},{"item_id":"6518870049296482823","url":"/item/6518870049296482823","title":"勒索软件“圣甲虫”再发新变种Scarabey 目标瞄准俄语用户"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":145,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"2月3号,蛇哥再发动态,表示不会自证了,会通过线下比赛证明自己,如何看待?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6518300366121992452/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5b000006b4700fa45659","group_id":"6518300366121992452"},{"comments_count":6,"media_avatar_url":"//p3.pstatp.com/large/5b4b0004cc4117c501ce","is_feed_ad":false,"is_diversion_page":false,"title":"SQL成为关系数据库的标准语言,大大减轻了用户的负担","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517107396123296270/","source":"科技巨头","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7900037099e8ae7a7f","group_id":"6517107396123296270","is_related":true,"media_url":"/c/user/86646636719/"},{"comments_count":44,"media_avatar_url":"//p3.pstatp.com/large/56850005f19663cd1e06","is_feed_ad":false,"is_diversion_page":false,"title":"这些老司机用烂的软件神器,你还没用过吗?","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517543148011389453/","source":"生活带点甜","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":92,"image_url":"//p3.pstatp.com/list/190x124/5e7800045021daf0ba5a","group_id":"6517543148011389453","is_related":true,"media_url":"/c/user/5432028358/"},{"comments_count":17,"media_avatar_url":"//p3.pstatp.com/large/5688000164046badbaeb","is_feed_ad":false,"is_diversion_page":false,"title":"Web系统大规模并发——电商秒杀与抢购","single_mode":true,"gallary_image_count":13,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518349596719055368/","source":"爱JAVA爱火影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":2,"image_url":"//p3.pstatp.com/list/190x124/5e800003a7ffbbbf317c","group_id":"6518349596719055368","is_related":true,"media_url":"/c/user/4142236051/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/2c640002496a93effe6f","is_feed_ad":false,"is_diversion_page":false,"title":"如何用Python自动登录路由器!获取信息!请勿用于非法用途!","single_mode":true,"gallary_image_count":10,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518693907792921096/","source":"sun菜菜","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":23,"image_url":"//p3.pstatp.com/list/190x124/5e82000149eb89681cbc","group_id":"6518693907792921096","is_related":true,"media_url":"/c/user/5838461924/"},{"comments_count":7,"media_avatar_url":"//p6.pstatp.com/large/5b4e000409e37d0d8e34","is_feed_ad":false,"is_diversion_page":false,"title":"在计算机中,把所有的软件分为两大类","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517102437642273284/","source":"VR科技嗅","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e76000352f75141d2c8","group_id":"6517102437642273284","is_related":true,"media_url":"/c/user/87069437693/"},{"comments_count":33,"media_avatar_url":"//p9.pstatp.com/large/434d0003c70af59ccaa5","is_feed_ad":false,"is_diversion_page":false,"title":"批量打印奖状/请柬/桌牌/工资条-单独打印同样格式不同内容的进来","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517141108663779843/","source":"小德EXCEL数据分析","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":34,"image_url":"//p3.pstatp.com/list/190x124/5e7a0000554058316294","group_id":"6517141108663779843","is_related":true,"media_url":"/c/user/50732800910/"},{"comments_count":69,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"为什么很多人用excel很熟练但不愿意去用python?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517509131715215630/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/5fed00006f7d58b24214","group_id":"6517509131715215630"},{"comments_count":146,"media_avatar_url":"//p8.pstatp.com/large/5ac50015311a1d00f5d5","is_feed_ad":false,"is_diversion_page":false,"title":"电脑运行越来越慢?10分钟学会电脑瘦身","single_mode":true,"gallary_image_count":9,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516302543860007431/","source":"程序媛进化论","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5e6f000157aa10544fcb","group_id":"6516302543860007431","is_related":true,"media_url":"/c/user/84275416965/"},{"comments_count":12,"media_avatar_url":"//p8.pstatp.com/large/50ae000404e87bb76f6b","is_feed_ad":false,"is_diversion_page":false,"title":"要了解计算机的工作原理,必须懂这三个工作原理","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516650900172308999/","source":"最IT","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5e720000b2c97104652a","group_id":"6516650900172308999","is_related":true,"media_url":"/c/user/74857862657/"},{"comments_count":42,"media_avatar_url":"//p10.pstatp.com/large/5d410008b59949353686","is_feed_ad":false,"is_diversion_page":false,"title":"果粉们告诉大家一个不愉快的消息!","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517959240919810564/","source":"爱折腾的小强","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7e000265183e6a692f","group_id":"6517959240919810564","is_related":true,"media_url":"/c/user/2888833977/"},{"comments_count":11,"media_avatar_url":"//p1.pstatp.com/large/2c5e000728a7c818a637","is_feed_ad":false,"is_diversion_page":false,"title":"这么炫酷的下拉框,简单到没有朋友!赶紧动手来制作吧!","single_mode":true,"gallary_image_count":4,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6518557370556088840/","source":"小峰聊电影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":17,"image_url":"//p3.pstatp.com/list/190x124/5e860005a563b91b6f50","group_id":"6518557370556088840","is_related":true,"media_url":"/c/user/5750992551/"},{"comments_count":18,"media_avatar_url":"//p3.pstatp.com/large/59390000c31263dcefb0","is_feed_ad":false,"is_diversion_page":false,"title":"年薪500k大数据工程师:所有程序员做到以下几点,年薪百万不是梦","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6518547345691378190/","source":"大数据工程师阿福","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":24166,"image_url":"//p1.pstatp.com/list/190x124/5e890003632164c4f770","group_id":"6518547345691378190","is_related":true,"media_url":"/c/user/86127904863/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/5b4b0004cc4117c501ce","is_feed_ad":false,"is_diversion_page":false,"title":"自从计算机发明以来,数据处理就是它的基本功能和关键技术","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6517105279203541518/","source":"科技巨头","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e77000444bd6273ea0f","group_id":"6517105279203541518","is_related":true,"media_url":"/c/user/86646636719/"},{"comments_count":53,"media_avatar_url":"//p3.pstatp.com/large/4e5f0004d829789ac63e","is_feed_ad":false,"is_diversion_page":false,"title":"如何提取CAD中各点的坐标","single_mode":true,"gallary_image_count":13,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517409715310297603/","source":"幻月独影","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":22,"image_url":"//p3.pstatp.com/list/190x124/5e7c0001724cf5f77992","group_id":"6517409715310297603","is_related":true,"media_url":"/c/user/5766033862/"},{"comments_count":7,"media_avatar_url":"//p6.pstatp.com/large/5b4e000409e37d0d8e34","is_feed_ad":false,"is_diversion_page":false,"title":"任何厂家生产的计算机系统,只要遵守IP协议就能与因特网互连互通","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6517103637087388164/","source":"VR科技嗅","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e7900035aefacf2e360","group_id":"6517103637087388164","is_related":true,"media_url":"/c/user/87069437693/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/group/6518870049296482823/, abstract: 勒索软件“圣甲虫”是在2017年6月首次被发现的。从那以后,其发布了数个变种并被发现。网络安全公司Malwarebytes却在去年12月份发现了另一个独特的新变种,他们将其标识为“Scarabey”。
小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!



免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

发表评论

最新评论

引用 游客 2018-2-25 05:12
Thanks for all your effort on this web site. My mum take interest in carrying out investigations and it's easy to see why. My spouse and i hear all regarding the lively means you provide valuable secrets via your blog and therefore encourage contribution from people on that content so our princess is certainly understanding so much. Take advantage of the rest of the year. Your carrying out a powerful job.
nmd http://catb.in/d9oE
引用 游客 2018-2-24 11:54
This is the suitable weblog for anyone who needs to find out about this topic. You notice a lot its virtually hard to argue with you (not that I truly would want匟aHa). You definitely put a brand new spin on a topic thats been written about for years. Nice stuff, simply nice!
adidas outlet http://www.adidasoutletonline.com
引用 游客 2018-2-23 09:27
I discovered your blog website on google and check a few of your early posts. Proceed to maintain up the excellent operate. I simply additional up your RSS feed to my MSN Information Reader. In search of forward to reading more from you later on!?
adidas eqt support adv http://www.adidas-eqt.us.com
引用 游客 2018-2-23 07:02
I intended to create you one very small remark in order to thank you very much again over the fantastic thoughts you've shown in this article. It has been certainly seriously open-handed with people like you to provide without restraint precisely what many of us might have offered for sale for an ebook to help with ** some cash for their own end, even more so now that you could possibly have done it if you wanted. These guidelines also acted to become a easy way to realize that other people  ...
引用 游客 2018-2-22 07:49
It抯 onerous to search out educated folks on this matter, however you sound like you know what you抮e talking about! Thanks
air jordans http://www.cheap-airjordans.us.com
引用 游客 2018-2-21 10:20
I truly wanted to compose a  word to appreciate you for those unique recommendations you are placing here. My extensive internet investigation has at the end been recognized with really good content to go over with my family members. I would suppose that most of us readers actually are truly blessed to exist in a very good community with  many outstanding individuals with good methods. I feel very happy to have discovered your web page and look forward to tons of more thrilling moments reading h ...
引用 游客 2018-2-21 06:23
It抯 exhausting to find educated folks on this subject, but you sound like you recognize what you抮e speaking about! Thanks
adidas outlet online http://www.adidasoutletonline.com
引用 游客 2018-2-20 06:40
Good post. I study something more challenging on totally different blogs everyday. It is going to at all times be stimulating to read content material from different writers and practice somewhat one thing from their store. I抎 want to make use of some with the content on my weblog whether or not you don抰 mind. Natually I抣l give you a hyperlink in your net blog. Thanks for sharing.
cheap jordans http://www.cheap--jordans.us.com
引用 游客 2018-2-20 06:38
This web page is mostly a walk-through for all the data you needed about this and didn抰 know who to ask. Glimpse here, and you抣l undoubtedly discover it.
Adidas NMD Runner men women Black Red http://www.adidas-nmds.us.com/adidas-nmd-runner-men-women-black-red-p-47.html
引用 游客 2018-2-19 18:41
I wanted to compose you one tiny observation to finally give many thanks yet again for these great secrets you have contributed above. This has been so remarkably open-handed of people like you to offer extensively what exactly many people would've supplied as an e-book in ** some dough for their own end, certainly considering that you could possibly have done it if you ever considered necessary. The concepts additionally served as the good way to fully grasp that some people have similar ea ...
引用 游客 2018-2-19 06:29
Youre so cool! I dont suppose Ive read something like this before. So good to find any person with some original thoughts on this subject. realy thanks for starting this up. this website is something that is needed on the internet, someone with a little originality. helpful job for bringing something new to the internet!
goyard bags http://www.goyardhandbags.us.com
引用 游客 2018-2-18 06:36
There are actually loads of details like that to take into consideration. That may be a nice point to convey up. I provide the thoughts above as general inspiration however clearly there are questions like the one you bring up where an important thing will be working in trustworthy good faith. I don?t know if best practices have emerged round things like that, however I'm certain that your job is clearly identified as a good game. Each boys and girls really feel the influence of just a second抯  ...
引用 游客 2018-2-17 08:49
I found your blog site on google and check a couple of of your early posts. Continue to maintain up the very good operate. I simply further up your RSS feed to my MSN News Reader. Searching for ahead to reading more from you afterward!?
fitflops http://www.fitflops.cc
引用 游客 2018-2-16 15:00
I wish to express my thanks to the writer just for bailing me out of such a circumstance. After surfing throughout the the web and seeing recommendations which were not powerful, I assumed my life was well over. Living without the presence of answers to the issues you have sorted out by way of this site is a crucial case, and the ones that could have badly affected my entire career if I hadn't noticed the blog. Your primary training and kindness in dealing with all the pieces was invaluable. I d ...
引用 游客 2018-2-16 12:06
There are some attention-grabbing time limits on this article but I don抰 know if I see all of them heart to heart. There may be some validity but I'll take maintain opinion till I look into it further. Good article , thanks and we would like extra! Added to FeedBurner as nicely
hermes belt http://www.hermesbelts.co.uk
引用 游客 2018-2-15 17:17
very nice put up, i actually love this web site, keep on it
nike polo http://www.nikepolo.us
引用 游客 2018-2-15 06:22
I'm just commenting to let you be aware of of the superb discovery my friend's princess found checking your web site. She mastered a wide variety of pieces, most notably what it is like to possess a marvelous helping character to get other individuals completely learn about a variety of multifaceted topics. You actually exceeded my desires. I appreciate you for providing the precious, healthy, revealing as well as easy tips about that topic to Tanya.
nmd uk http://izap.fr/5whB
引用 游客 2018-2-14 21:57
I used to be very pleased to seek out this internet-site.I wanted to thanks for your time for this excellent learn!! I positively having fun with each little bit of it and I have you bookmarked to take a look at new stuff you blog post.
yeezy boost http://www.yeezy-boost350.us.com
引用 游客 2018-2-14 02:30
I discovered your weblog web site on google and check a couple of of your early posts. Continue to maintain up the very good operate. I simply further up your RSS feed to my MSN News Reader. Looking for forward to reading more from you in a while!?
basketball shoes http://www.kobebasketballshoes.us.com
引用 游客 2018-2-13 20:23
Thanks so much for giving everyone remarkably wonderful opportunity to discover important secrets from here. It is always very excellent plus jam-packed with a lot of fun for me personally and my office colleagues to search the blog minimum three times in 7 days to study the newest guidance you will have. And of course, I'm also usually astounded with your brilliant strategies served by you. Some 3 ideas in this post are rather the most efficient we have all had.
yeezy boost 350 v2 http://gul.l ...

查看全部评论(26)


新出炉

返回顶部