| CTB-Locker[敲诈者病毒]分析 比特币…能吃么 又一个邮件引发的病毒闹剧…好戏即将上演 以下内容非土豪伤不起→_→被敲诈的钱都能买两个“iPhone6 Plus”了 1.CTB-Locker主要通过邮件传播，然后会有一个类似是传真发错邮箱的假象，让人打开了他的附件就中毒。 1. The CTB-Locker is transmitted mainly by mail, and then there is a similar pseudo-mail box by fax, which causes poisoning to be caused by the opening of an attachment to him. CTB-Locker样本下载: 点击下载 解压密码：www.aiwanba.net Depress password: www.aiwanba.net
2.打开之后会看到一个传真文件，打开他发现，真的是一个传真文件，不过看不懂，所以就扔在一边了，其实它还在后台默默的运行着。 When opened, he saw a fax file, which he found was really a fax file, but did not understand, so he left it on the other side, but it was still running silently in the backstage.
3.他会悄然的识别电脑中的各种照片文档等加密，等下次开机的时候就会出现勒索画面。 3. He will quietly identify the various photo files in the computer and encrypt them, etc., and the next time they are activated, the scene of extortion will appear. 4.在此之后，你所有文件[文档]就变成了7位随机结尾的加密文件[文档]，将后缀名更改成原后缀仍然无法正常打开。 4. Since then, all your files [documents] have become encrypted files [documents] with seven random endings, and the suffixing remains unopenable.
5.剩下的解决办法就是：付钱/重装系统。 The remaining solution is to pay for/reload the system. 7.上面那个界面点击NEXT之后的一个画面上，作者会给出一个BTC钱包的汇款地址，并且标出需要支付的比特币数量，该样本是勒索3个BTC。 The above interface clicked on an image after NEXT, where the author gave a remittance address for the BTC wallet and indicated the amount of bitcoins to be paid, a sample of three BTCs for extortion.
8.目前CTB-locker还在不断升级，勒索的比特币也从3个成了8个。 8. CTB-locker is currently on the rise, and the number of extorted bitcoins has grown from three to eight. 9.支付的时候会有一定的手续费，所以多支付了0.0007比特币。 9. Payment was made with a certain handling fee, which resulted in an overpayment of 0.0007 bits.
10.大约在一个半小时之后那个画面产生变化，开始解密运算。 10. About an hour and a half later, that image changed and deciphered the algorithm. 12.解密的过程非常的长，不过起码作者遵守约定为文档解密。 12. The process of declassification is very long, although at least the authors comply with the agreement to declassify the document.
13.比特币换算：1比特币=1500+人民币 13. Bitcoin conversion: 1 bitcoin=1,500 + RMB 温馨提醒：利用虚拟机测试CTB-Locker是行不通的！虚拟机无法触发CTB-Locker；首先，CTB-Locker远程注入恶意代码到svchost.exe中，接着，判断中毒用户是否有vboxtray.exe、vboxservice.exe、vmtoolsd.exe等虚拟机进程，目的也是为了阻碍分析，增加触发病毒代码的条件。 Caring reminder: Testing the CTB-Locker using a virtual machine is not feasible! Virtual machines cannot trigger the CTB-Locker; first, CTB-Locker remotely injects the malignant code into the svchost.exe, and then determines whether poisoning users have virtual machine processes such as vboxtray.exe, vboxservation.exe, vmtoolsd.exe, also in order to block analysis and increase the conditions for triggering the virus code.
CTB-Locker实机运行截图： CTB-Locker operation screenshot:
& nbsp; & nbsp; 外带赠送一个易语言【高仿[CTB-Locker]源代码套组】 – 高仿[CTB-Locker]源代码套组：CTB-Locker高仿装逼版源码 + CTB-Locker图标 + CTB-Locker高清截图(1) + CTB-Locker高清截图(2): 点击下载 & #8211; & #8211; & #8211; High [CB-Locker] Source Set: CTB-Locker High Simulation Force Code + CTB-Locker Icon + CTB-Locker High Clear Screen Map (1) + CTB-Locker High Clear Map (2) & nbsp; |
![[software] CB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/86ef8b61b36d12576fa48b4a568e9768.jpeg "[software] CB-Locker extortioner viral analysis")
![[software] CB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/2178a3dd271d7da547f861728f167c.jpeg "[software] CB-Locker extortioner viral analysis")
![[software] CB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/5e052e85e6950ffc8c8f1b26fbeff9.jpeg "[software] CTB-Locker extortioner viral analysis")
![[software] CTB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/bcc6fbaf775710f10474b5116b93.jpeg "[software] CB-Locker extortioner viral analysis")
![[software] CTB-Locker blackmailer viral analysis](https://www.aiwanba.net/wp-content/uploads/16/05/34316baf460579797995f4d293199321.jpeg "[software] CB-Locker blackmailer viral analysis")
![[software] CB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/16/05/eb3cdf12ee06e02f09bbc9192df6391.jpeg "[software]")
![[software] CTB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/320756ce86b28f68b30fb6669000bc.jpeg "[software] CB-Locker extortioner viral analysis")
![[software] CTB-Locker extortioner viral analysis](https://www.aiwanba.net/wp-content/uploads/1916/05/0c80f37e667c06f9b6770d780c1581b.jpeg" "[soft]")
注册有任何问题请添加 微信：MVIP619 拉你进入群
打开微信扫一扫
添加客服
进入交流群
发表评论