2020年9月份勒索病毒分析

分享到:

2020-10-23 23:40:20

感染数据分析

分析本月勒索病毒家族占比:phobos家族占比23.89%居首位;其次是占比17.00%的Crysis;GlobeImposter家族以占比16.60%位居第三。本月新增的勒索并未有大量传播态势,针对NAS(网络附属存储)设备进行攻击的Ech0raix勒索病毒在本月再度活跃,并成功打入前十。

图1. 2020年09月勒索病毒家族占比

从被感染系统分布看:本月位居前三的系统是:Windows 10、Windows7和Windows Servers 2008。而从本月被感染设备数据看,NAS类设备再次被黑客作为攻击目标。

图2. 2020年09月被感染系统占比

2020年09月被感染系统中桌面系统和服务器系统占比显示,受攻击的主要系统仍是个人桌面系统。被攻击的NAS设备占少部分。

 

黑客信息披露

以下是本月搜集到的黑客邮箱信息:

x3m@usa.com

tools1990m@gmail.com

decryptor666@420blaze.it

AESMew@pm.me

crypto0077@gmail.com

newhelper24@protonmail.ch

rx99@cock.li

De-crypt@foxmail.com

sookie.stackhouse@gmx.com

murryu@aol.com

rdp571@protonmail.ch

Ctorsenoria@ttutanota.com

cryhelp@dr.com

maedeh81@firemail.cc

SurpriseN1@protonmail.com

pewpew@TuTa.io

newrecoverybot@pm.me

alexwind46@protonmail.com

r4ns0m@cock.li

xilttbg@tutanota.com

sorcinacin@protonmail.com

alfryy@cock.li

PabFox@protonmail.com

neyhyretim@protonmail.com

l_crypt@aol.com

Sidmouleux996@aol.com

securityteamex@yandex.com

FoxHelp@cock.li

virus@countermail.com

MikeyMaus77@protomail.com

epicday@cock.li

Genovo@protonmail.com

rdpconnect@protonmail.com

moncler@cock.li

crioso@protonmail.com

Steven77xx@protonmail.com

mr.yoba@aol.com

akzhq808@tutanota.com

TeslaBrain@protonmail.com

mk.rain@aol.com

filerestory@gmail.com

unlock0101@protonmail.com

mk_rain@aol.com

btcsupport@msgsafe.io

Founder94@yakuzacrypt.com

jacdecr@tuta.io

sambolero@tutanoa.com

johnsonwhate@tutanota.com

js3010@rape.lol

best@desharonline.top

decrypter02@cumallover.me

newbang@cock.li

mrromber@tutanota.com

getthefiles2@protonmail.ch

M0rphine@cock.li

decoderforyou@cock.li

leakthemall@protonmail.com

Helpsir@rape.lol

immunityyoung@aol.com

suppdecrypt@protonmail.com

operator3@qq.com

pewpew@Protonmail.Com

notesteam2018@tutanota.com

decrypt@rape.lol

polssh@protonmail.com

MayarChenot@protonmail.com

decrypt20@vpn.tg

lewismccown@yahoo.com

michael.reynolds74@aol.com

corebitp@cock.li

ultrasert77@gmail.com

yourlastchancehelp@cock.li

mk.kabal@aol.com

blair_lockyer@aol.com

unlockme123@protonmail.com

d.fedor2@aol.com

ww6666@protonmail.com

Decryptions@protonmail.com

mk.smoke@aol.com

farik1@protonmail.com

blackroot54@protonmail.com

Rezcrypt@cock.li

pittt@prt-decrypt.xyz

darkencryptor@tutanota.com

bosxsxsx@cock.li

support@p-security.li

recowerdata@protonmail.com

repairdb@mail.fr

2k19sys@p-security.li

jimmtheworm@dicksinmyan.us

1rest0re@cock.li

wecanh3lpyou2@cock.li

Recoverybat@protonmail.com

BatHelp@india.com

wecanhelpyou@elude.in

klowershit1835@tutanota.com

rdpunlock@cock.li

rdpmanager@airmail.cc

decoder83540@protonmail.com

mrromber@cock.lii

gomer@horsefucker.org

immunityyoung@aol.com.young

Crypt@zimbabwe.su

piterpen02@keemail.me

viruszone4209@opentrash.com

dcr@cumallover.me

BatHelp@protonmail.com

e95c12d08b14@protonmail.com

swhost@msgsafe.io

ThunderBirdXeX@cock.li

support@all-ransomware.info

coryell.r@aol.com

russiawolf09@gmail.com

nemesis-decryptor@india.com

alexbanan@tuta.io

05250lock@tutamail.com

BackFileHelp@protonmail.com

pay@cyberdude.com

reidcry@hackermail.com

cryptofiles@horsefucker.org

mk.baraka@aol.com

fartcool@protonmail.ch

decodeodveta@protonmail.com

m.reptile@aol.com

rdp_unlock@outlook.com

mzrdecryptorbuy@firemail.cc

m.subzero@aol.com

777decoder777@tfwno.gf

helptounlock@protonmail.com

SuckBaBe@Rape.LoL

polssh1@protonmail.com

johnsonwhate@protonmail.com

A654763764@qq.com

rizonlocker@airmail.cc

remotePChelper@tutanota.com

doctor666@mail.fr

BhatMaker@tutanota.com

filemaster777@protonmail.com

doctor666@cock.li

divevecufa@firemail.cc

deloneThunder@protonmail.com

support@lzt.design

elfbash@protonmail.com

777decoder777@protonmail.com

prndssdnrp@mail.fr

Adamfox69@criptext.com

decoderforyou@protonmail.com

decrypt@europe.com

admcphel@protonmail.ch

SuzuMcpherson@protonmail.com

vulicapson@cock.lu

petrus34@p-security.li

securityit123@protonmail.com

vulicapson@tuta.io

decryptdocs@msgsafe.io

jacksteam2018@protonmail.com

rightcheck@cock.li

montanarecover@aol.com

loyaldecrypt@privatemail.com

berstife@gmail.com

montanarecover@cock.li

caizonatu1987@protonmail.com

linajamser@aol.com

data_cloud2012@aol.com

nowabosag1988@protonmail.com

databack44@tuta.io

x3m-pro@protonmail.com

DharmaParrack@protonmail.com

endereless@cock.li

contactsupport@cock.li

paradise@all-ransomware.info

SurpriseN1@aol.com

helpdesk_nemty@aol.com

cyber.duskfly@protonmail.com

epicday@airmail.cc

FilesHelp@tutanota.com

don-corleone@mortalkombat.su

alexwind46@aol.com

RestoreData@airmail.cc

letitbedecryptedzi@gmail.com

badbeeteam@cock.li

softs98@protonmail.com

Mr.TeslaBrain@protonmail.com

badbeeteam@mail.ee

blacklivesatter@qq.com

Filedecryptor@protonmail.com

file@p-security.li

newbang@protonmail.com

repairdatadochelp@airmail.cc

decodor@airmail.cc

Founder94@tutanota.com

ellenfabiana01@protonmail.com

mk.kunglao@aol.com

alfryy@yakuzacrypt.com

coincidenceleague@firemail.cc

asmo49@asmodeus.us

newrecoveryrobot@pm.me

RemotePChelper@protonmail.com

Hiddenhelp@cock.li

RemotePChelper@cock.li

dogeremembersss@protonmail.ch

recovery94@cock.li

BCPFILE17@tutanota.com

paologaldini2020@tutanota.com

teslabrain@cock.li

doctorhelp2120@cock.li

befittingdavid@protonmail.com

giveyoukey@cock.li

SpadeFiles@tutanota.com

pebawestsa1973@protonmail.com

sqlbackup3@mail.fr

blacklivesmatter@qq.com

nespabatbe1989@protonmail.com

repairdb@seznam.cz

ataback2@protonmail.com

indilacons1975@protonmail.com

returndb@seznam.cz

tchukopchu@tutanota.com

chocolate_muffin@tutanota.com

support911@cock.li

Folielol@protonmail.com

restoring.data@protonmail.com

file-cloud@email.tg

AsuxidOruraep1999@o2.pl

babyfromparadise666@gmail.com

zimbabwe@msgsafe.io

buransupport@exploit.im

legion.developers72@gmail.com

grdoks@tutanota.com

recovery1server@cock.li

RECOVERUNKNOWN@protonmail.com

bestcool@keemail.me

e95c12d08b14@airmail.cc

AdvancedBackup@protonmail.com

Writeme4@airmail.cc

rizonlocker@firemail.cc

Black.Berserks@protonmail.com

Chadmad@nuke.africa

puckett_jeffrey@aol.com

olgearreabo1989@protonmail.com

greenreed007@qq.com

immortalsupport@cock.li

coincidenceleague@tutanota.com

Daves.smith@aol.com

decryptdocs@firemail.cc

recovery_server@protonmail.com

decryp7@foxmail.com

macgregor@aolonline.top

gustafkeach@tohaveandtohold.us

Datarest0re@aol.com

deyscriptors1@india.com

luizunwrite2020@protonmail.com

datarest0re@xmpp.jp

yotabyte@protonmail.com

surguitenve1986@protonmail.com

fixallfiles@tuta.io

liukang@mortalkombat.su

wyattpettigrew8922555@mail.com

VASHMAIL@KEEMAIL.ME

dd.coala@protonmail.com

your_last_chance_help@elude.in

helpdesk_mz@aol.com

dcyptfils@protonmail.ch

leltitbedecrypteddzi@gmail.com

Deus69@criptext.com

Helpcrypt1@tutanota.com

Black.Berserks@yakuzacrypt.com

returndb@airmail.cc

Mr.TeslaBrain@gmail.com

imBoristheBlade@protonmail.com

Recoverybat@cock.li

Bitdefender2020@cock.li

gaetwelsenba1983@protonmail.com

returndb@airmail.ee

vashmail@protonmail.com

profhandgomo1989@protonmail.com

Filesback@keemail.me

Decfile431@tutanota.com

phrasitliter1981@protonmail.com

nekross@tutanota.com

smartrecav@tutanota.com

coincidenceleague@thesecure.biz

BatHelp@tutanota.com

Jonbrown88@criptext.com

nicenphacock1976@protonmail.com

FoxHelp@tutanota.com

gomersimpson@keemail.me

glocadboysun1978@protonmail.com

John91Done@yahoo.com

decryptor911@airmail.cc

DecrypterSupport@protonmail.com

Chadmad@ctemplar.com

1rest0re@protonmail.com

Recoveryhelp2019@protonmail.com

decoder83540@cock.li

MREncptor@protonmail.com

filedownload2020@protonmail.com

buransupport@xmpp.jp

gustav.strasserg@gmx.com

coftocounbio1977@protonmail.com

happyless@airmail.cc

Ctorsenoria@tutanota.com

decoding_help8888@protonmail.com

johnsmith654@cock.li

ITAmbuler@protonmail.com

guifullcharti1970@protonmail.com

johnsmith456@cock.li

bavaria54@protonmail.com

coincidenceleague@protonmail.com

sanio.marino@aol.com

nic.shulz@protonmail.com

supp0rtdecrypti0n@protonmail.com

bullockcraig@aol.com

BhatMaker@protonmail.com

sxvcsacobyzurlock@protonmail.com

decryptor@cock.email

recowery1servers@cock.li

StephanVeamont1997C@tutanota.com

stopcrypt@cock.email

greenreed911@foxmail.com

carbedispgret1983@protonmail.com

VictorLustig@gmx.com

backtonormal@foxmail.com

SupportMIICCSSetup@protonmail.com

alexwind46@yahoo.com

fiasco911@protonmail.com

sookie_stackhousse@protonmail.com

augusto.ruby@aol.com

server-support@india.com

ScorpionEncryption@protonmail.com

mecybaki@firemail.cc

contact-support@elude.in

ScorpionEncryption@Protonmail.com

opensafezona@cock.li

Honeylock@protonmail.com

ScorpionEncryption@yakuzacrypt.com

blackblackra@tuta.io

recover85@protonmail.com

your_last_chance_help@protonmail.com

w3canh3lpy0u@cock.li

josefrendal797@gmail.com

MariaJackson2019williams@protonmail.com

karnel.fikol@aol.com

helper571@protonmail.com

MariaJackson2020williams@protonmail.com

TeslaBrain@gmail.com

maedeh81@yakuzacrypt.com

 

 

表格1. 黑客邮箱
 

总结

针对服务器的勒索病毒攻击依然是当下勒索病毒的一个主要方向,企业需要加强自身的信息安全管理能力——尤其是弱口令、漏洞、文件共享和远程桌面的管理,以应对勒索病毒的威胁,在此我们给各位管理员一些建议:

发现中勒索病毒后的正确处理流程:1.发现中毒机器应立即关闭其网络和该计算机。关闭网络能阻止勒索病毒在内网横向传播,关闭计算机能及时阻止勒索病毒继续加密文件。2.联系安全厂商,对内部网络进行排查处理。3.公司内部所有机器口令均应更换,你无法确定黑客掌握了内部多少机器的口令。

后续安全防护建议:

1. 多台机器,不要使用相同的账号和口令

2. 登录口令要有足够的长度和复杂性,并定期更换登录口令

3. 重要资料的共享文件夹应设置访问权限控制,并进行定期备份

4. 定期检测系统和软件中的安全漏洞,及时打上补丁。

5. 定期到服务器检查是否存在异常。查看范围包括:

(1) 是否有新增账户

(2) Guest是否被启用

(3) Windows系统日志是否存在异常

(4) 杀毒软件是否存在异常拦截情况

6. 安装安全防护软件,并确保其正常运行。

7. 从正规渠道下载安装软件。

8. 对不熟悉的软件,如果已经被杀毒软件拦截查杀,不要添加信任继续运行。

此外,无论是企业受害者还是个人受害者,都不建议支付赎金。支付赎金不仅变相鼓励了勒索攻击行为,而且解密的过程还可能会带来新的安全风险。

常见的勒索病毒,很多只加密文件头部数据,对于某些类型的文件(如数据库文件),可以尝试通过数据修复手段来挽回部分损失。如果不得不支付赎金的话,可以尝试和黑客协商来降低赎金价格,同时在协商过程中要避免暴露自己真实身份信息和紧急程度,以免黑客漫天要价。由于第三方均是通过联系黑客购买密钥解密文件,所以尽量避免咨询太多第三方(咨询太多第三方相当于咨询多次黑客,会导致黑客涨价。)

声明:此篇为用友服务中心文章,转载请标明出处链接:
  • 相关文章
  • 热门下载
  • 数据修复
  • 热门标签
合作伙伴