又一使用.net开发的勒索病毒出现——Prodecryptor勒索病毒_安全资讯_浙江省地震局

背景介绍

近日捕获到Prodecryptor勒索病毒, 此病毒的编译时间是今年的4月26日。与之前所报道的FilesLocker勒索、Satyr勒索、BlackRouter勒索都是使用.net开发, 并且加密代码也十分相似。使用AES算法加密文件, 使用RSA算法加密秘钥, 成熟的.net加密算法库。没有攻击者私钥的情况下无法解密文件。要求受害者通过电子邮箱联系攻击者, 支付一定数额的比特币解密。

病毒MD5：70745C6D104C8AE717C9C3C0F315304A

威胁等级：4星 ★★★★

病毒演示视频

<span style="color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; background-color: rgb(255, 255, 255);"/><h2 style="box-sizing: border-box; font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; line-height: 1.1; color: rgb(51, 51, 51); margin-top: 20px; margin-bottom: 20px; font-size: 30px; white-space: normal; background-color: rgb(255, 255, 255);">技术分析</h2><p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">该勒索病毒由.Net编写, 通过反编译可以清晰看到程序的执行逻辑.<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image1.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：清晰的执行代码<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">程序生成133字节的随机字符串作为AES-32bit的摘要数据块。<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">将作者的RSA公钥导入, 加密133字节随机字符串数据。<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image2.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：RSA加密<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">计算133字符串的16字节Hash值, 将Hash值重复组合为32字节作为AES-KEY来加密文件<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image3.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：AES加密<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">修改文件的扩展名为Prodecryptor<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image4.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：修改扩展名<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">加密的文件格式如下:<pre style="box-sizing: border-box; overflow: auto; font-family: Menlo, Monaco, Consolas, &quot;Courier New&quot;, monospace; font-size: 13px; padding: 9.5px; margin-top: 0px; margin-bottom: 10px; line-height: 1.42857; word-break: break-all; word-wrap: break-word; color: rgb(51, 51, 51); background-color: rgb(245, 245, 245); border: 1px solid rgb(204, 204, 204); border-radius: 4px;">exe, der, pfx, key, crt, csr, p12, pem, odt, sxw, stw, 3ds, max, 3dm, ods, sxc, &#13; stc, dif, slk, wb2, odp, sxd, std, sxm, sqlite3, sqlitedb, sql, accdb, mdb, dbf, &#13; odb, mdf, ldf, cpp, pas, asm, cmd, bat, vbs, sch,jsp, php, asp, java, jar, class, &#13; mp3, wav, swf, fla, wmv, mpg, vob, mpeg, asf, avi, mov, mp4, mkv, flv, wma, mid, &#13; m3u, m4u, svg, psd, tiff, tif, raw, gif, png, bmp, jpg, jpge, iso, backup, zip, &#13; rar, tgz, tar, bak, ARC, vmdk, vdi, sldm, sldx, sti, sxi, dwg, pdf, wkl, wks, &#13; rtf, csv, txt, msg, pst, ppsx, ppsm, pps, pot, pptm, pptx, ppt, xltm, xltx, xlc, &#13; xlm, xlt, xlw, xlsb, xlsm, xlsx, xls, dotm, dot, docm, docx, doc, ndf, pdf, ib, &#13; ibk, bkp, sdk</pre><p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">优先加密的路径：<pre style="box-sizing: border-box; overflow: auto; font-family: Menlo, Monaco, Consolas, &quot;Courier New&quot;, monospace; font-size: 13px; padding: 9.5px; margin-top: 0px; margin-bottom: 10px; line-height: 1.42857; word-break: break-all; word-wrap: break-word; color: rgb(51, 51, 51); background-color: rgb(245, 245, 245); border: 1px solid rgb(204, 204, 204); border-radius: 4px;">C:\\Users\\mz\\Desktop&#13; C:\\Users\\mz\\Documents&#13; C:\\Users\\mz\\Music&#13; C:\\Users\\mz\\AppData\\Local\\Microsoft\\Windows\\History&#13; C:\\Users\\mz\\Downloads&#13; C:\\Users\\mz\\Pictures&#13; C:\\Users\\mz\\Videos&#13; C:\\Users\\mz\\Music&#13; C:\\User\\mz&#13; C:\\Users\\mz\\Favorites&#13; C: \\ProgramData&#13; C:\\Users</pre><p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">获得有效磁盘, 对磁盘依次遍历, 并加密文件.<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image5.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：遍历磁盘加密<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">创建CMD删除卷影拷贝, "cmd.exe /c vssadmin.exe delete shadows /all /quiet"。<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image6.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：删除卷影拷贝<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">在所有磁盘根目录以及桌面创建勒索文本ReadME-Prodecryptor@gmail.com.txt.<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image7.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：勒索文本消息<p style="box-sizing: border-box; margin-top: 20px; margin-bottom: 20px; text-indent: 36px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);">最后, 恶意程序弹窗出一个勒索窗口.<img src="http://it.rising.com.cn/d/file/it/fanglesuo/20190507/image8.png" data-bd-imgshare-binded="1" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; display: block;"/>图：加密完成弹窗勒索<h2 style="box-sizing: border-box; font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; line-height: 1.1; color: rgb(51, 51, 51); margin-top: 20px; margin-bottom: 20px; font-size: 30px; white-space: normal; background-color: rgb(255, 255, 255);">防范措施</h2><ol style="box-sizing: border-box; margin-bottom: 10px; color: rgb(85, 85, 85); font-family: Helvetica, Tahoma, Arial, &quot;Xin Gothic&quot;, &quot;Hiragino Sans GB&quot;, &quot;Droid Sans Fallback&quot;, &quot;Microsoft YaHei&quot;, sans-serif; font-size: 18px; white-space: normal; background-color: rgb(255, 255, 255);" class=" list-paddingleft-2"><li>勒索病毒通常伪装为常用软件、播放器等传播。因此用户要避免下载可疑文件</li><li>对于可疑的邮件附件也不要轻易打开</li><li>及时安装系统补丁，防止攻击者通过漏洞攻击，植入病毒</li><li>不使用弱口令密码，防止被攻击者暴力破解</li><li>安装杀毒软件保持防护开启</li><li>安装勒索防御软件</li></ol>