1、勒索软件交易服务平台Satan现身暗网
标题：Satan, the ransomware-as-a-service surfaced in the dark web
作者信息：January 20, 2017 By Pierluigi Paganini
//BEGIN
The independent malware research @Xylit0l discovered the Satan ransomware, a malware belonging to the Gen:Trojan.Heur2.FU family.
Yesterday the independent malware research @Xylit0l discovered the Satan ransomware, a malware belonging to the Gen:Trojan.Heur2.FU family. Satan is provided as a RaaS (Ransomware-as-a-Service).
勒索软件即服务RaaS (Ransomware-as-a-Service)增加了一个新的平台Satan,其最明显的特征是如果被该勒索软件侵害，那么所有的文件会被新增stn字符串。比如原来的文件名如果是myfile.txt，那么被加密后，其完整的文件名会变成myfile.txt.stn.
这个发现是由一个独立的恶意代码分析师完成的。
//END
Satan, while crypt, changes files’ extension in .stn for example myfile.txt in myfile.txt.stn.
Satan, once encrypted the files, creates an HTML file (HELP_DECRYPT_FILES.html) on desktop containing the ransomware note and instructions for the payment.
Crooks encourage victims to pay ransom to receive the private key for decrypt files. But never pay any ransom or attempt to contact these cyber criminals, because there is no guarantee that your files will be decrypted!.
Satan uses several anti-evasion and anti-debugging techniques, for example, it doesn’t run on a virtual machine making it difficult to analyze.
In a couple of days, crooks already released two version of the Satan platform.
该勒索软件Satan采用的加密模式有RSA和AES。该样本在VT平台的当前表现是有14家（全球总共55家）安全公司已经能检测、拦截了。
RaaS的服务费，Satan索求的是30%。也就是如果受害者支付1比特币，那么Satan会收取0.3比特币的服务费，其余的才是实施勒索软件者能得到的“净赎金”。能收取服务费，当然Satan平台还可以提供各种抗跟踪或者分析的能力，比如至少能检测如果是虚拟机环境，则不运行，避免其被动态跟踪分析。
截止目前为止，已经出现了两个版本的Satan平台了。
点评：对付勒索软件，建议采用备份备份再备份的3B原则：Backup、Backup、Backup（Beifen、Beifen、Beifen）。
|
发表于 2017-1-20 17:30
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2017-1-21 21:31