A new version of the Scarab Ransomware has just been detected, but instead of being distributed via email it uses RDP (Remote Desktrop Protocol) connections and is installed by various malicious users manually. Codenamed Scarabey, this new threat is identical to the old Scarab ransomware but there are three key differences, according to a Malwarebytes report published earlier this week.
The 3 very basic differences are as follows:
1) The Scarab is written in Visual C language while the Scarabey is in Delphi (without the C++ packaging)
2) Secondly, the instructions for the payment methods of the Scarab are written in English while those of the Scarabey are in Russian. The presence of only this language in Scarabey indicates that currently they target only Russian‑speaking countries.
3) The third major difference between the two is that unlike Scarab, which tells victims that the price to decrypt their files will increase after a certain period, Scarabey tells victims that it will delete 24 files for every 24 hours that pass until the amount they demand is paid.
Most evidence shows that the creators of Scarab created Scarabey in order to target Russian businesses. The ransomware that strike via RDP are not something new and most of them are never used on a large scale, but only against carefully selected targets that can pay large sums to “save” their files. Given that computers with open RDP ports are mainly found in corporate environments and are used for remote system management, it is almost certain that Scarabey was created to mainly hit businesses.
The Scarab ransomware was discovered for the first time last June and entered mass distribution in November, when it was considered part of a large spam campaign sent from the Necurs botnet
