[C/C++] RansomWar.c 介紹

Link: eof-project.net (可能不安全)

Ransomware is computer malware which holds a computer system, or the data it contains, hostage against its user by demanding a ransom for its restoration. (wiki: Ransomware (malware))

Functions:

• DWORD WINAPI MsgToUser(LPVOID Data)
  
  • 利用 GetSystemDirectory(), WriteFile() 寫檔。
    
  • 利用 ShellExecute() Win32 API 開檔。
    
• void Encrypt_File(char *filename)
  
  • 用 blowfish encryption 加密 (找不到 blowfish.c)
    
  • 利用 CreateFile(), GetFileSize(), SetFilePointer(), WriteFile(), MoveFile() 操作檔案
    
  • Append RANSOMED_EXT to each encrypted file.
    
  • More sophisticated ransomware may hybrid-encrypt the victim's plaintext with a random symmetric key and a fixed public key.
    
  • The malware author is the only party that knows the needed private decryption key. The author who carries out this cryptoviral extortion attack offers to recover the symmetric key for a fee.
    
• void S3arch(char *pt)
  
  • 利用 FindFirstFile(), FindNextFile() 找出所有非 dll, exe, ini, vxd, drv 的檔案來加密
    
  • Recursive.
    
• DWORD WINAPI AntiDebug(LPVOID Data)
  
  • 利用 LoadLibrary("kernel32.dll") 及 GetProcAddress(Lib,"IsDebuggerPresent") 偵測有沒有人在 debug
    
  • 如果有，用 OutputDebugString() 送訊息給使用者
    
  • 用 WinExec() 及 while(1) 不斷打開記事本
    
• DWORD WINAPI R4ns0m(LPVOID Data)
  
  • 用 GetDriveType() 找 drivers.
    
• SendMail(), DisableMAPIWarning(), MailMySelf()
  
  • 值得研究

我得說 malware 作者 programming 功力還不錯，而且這個 business model 還挺有創意的，cryptovirology 真的太有意思了。