Rast Gang

中高活跃

Rast Gang勒索病毒是由Rust语言编写的一款勒索软件，自2023年12月起在国内活跃，主要针对政企单位实施攻击。截至2024年9月，该病毒已迭代至第三个版本。攻击手法多采用暴力破解与Nday组合的方式进行入侵。

首次发现：

勒索信： readme.txt

算法： AES-256、chacha20

扩展名： .wstop；.sstop；.peng; .wman

情报摘要：

别名：: Steloj（关联）
IOC数量：: 5
受害记录：: 0
ATT&CK战术：: 0

概览

加密特征

暂无加密特征数据。

勒索信

勒索信文件： readme.txt

############################################################################### !!!!!!!!!!!! THE FILES ON YOUR DEVICE HAVE BEEEN ENCRYPTED !!!!!!!!!!!!!! ############################################################################### Due to a security breach, all files on your computer have been encrypted, for decryption, send an email to us: Be sure to specify this ID in the header of the letter when contacting us: vfpFIU7U To decrypt your files, you will need to pay a certain amount in bitcoins.The decryption rate depends on the speed of your computer. After payment, you will receive a special tool for decrypting fileson your computer. ####################################### As a guarantee, we make a free decryption #######################################

勒索信文件： DECRYPTION_INFORMATION.html

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>DECRYPTION INFORMATION</title> <style> *{padding:0;margin:0;box-sizing:border-box;} body{width:100%;text-align:left;font-family:sans-serif;background-color:#333333;color:#fff;} .wrapper{width:100%;height:100%;display:flex;justify-content:center;align-items:center;flex-direction:column;} .title{text-transform:uppercase; margin-top:50px; margin-bottom:50px;} .content p{margin-bottom:20px;} .content p b{color:burlywood;} .content h3{margin-top:20px;margin-bottom:7px;color:orange;} .content h2{margin-top:20px;margin-bottom:7px;color:red;} </style> </head> <body> <div class="wrapper"> <div class="title"><h1>Your computer is encrypted!</h1></div> <div class="content"> <p>To decrypt, send us an email to: <b>dawsones@cock.li</b></p> <p>Be sure to include this identifier in the email header when contacting us: <b>HAPvR9JzRaQ1F</b></p> <div> <h3>1. What happened?</h3> <p>Due to a security breach, all files on your computer were encrypted, the file structure was not damaged, we did everything possible to prevent this from happening.</p> </div> <hr> <div> <h3>2. How do I get my files back?</h3> <p>If you want to recover your files, you need to pay us for our work by writing to us at <b>dawsones@cock.li</b> and discussing the price of the transaction.</p> </div> <hr> <div> <h3>3. How can I pay?</h3> <p>We only accept payment in Bitcoin cryptocurrency, if you do not know how to replenish Bitcoin yourself, there are many intermediaries in your country who are ready to help you with this.</p> </div> <hr> <div> <h3>4. How quickly will the files be restored?</h3> <p>The speed of decryption depends on the speed of your contact with us and how quickly we can agree on the price.</p> </div> <hr> <div> <h3>5. File recovery guarantee</h3> <p>If you do not attempt to decrypt it yourself, we guarantee the return of all your files.</p> <p>We are ready to decrypt any two small files up to 1MB with a simple extension (jpg, xls, doc, etc) for free, not a database (otherwise you may not need our work).</p> <p>We will decrypt and send you back, thereby demonstrating the possibility of returning your files.</p> <p>Be sure to include this identifier in the email header when contacting us: <b>HAPvR9JzRaQ1F</b></p> </div> <hr> <div> <h2>:::BEWARE:::</h2> <p>DON'T try to change encrypted files by yourself!</p> <p>If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!</p> <p>Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.</p> </div> </div> </div> </body> </html>

勒索信文件： INFORMATION_c.txt

######################################################################## !!!!!!!!!!!!! THE FILES ON YOUR DEVICE HAVE BEEN ENCRYPTED !!!!!!!!!!!!! ######################################################################## Due to a security breach, all files on your computer have been encrypted, for decryption, send an email to us: dataserver@airmail.cc Be sure to specify this ID in the header of the letter when contacting us: x9VUJHAc To decrypt your files, you will need to pay a certain amount in bitcoins. The decryption rate depends on the speed of your contact with us. After payment, you will receive a special tool for decrypting files on your computer. ######################################### As a guarantee, we make a free decryption ######################################### For the test, we can decrypt one small file as proof of decryption. We do not decrypt important files during testing, such as XLS, databases and other important files! We don't consider ourselves criminals! We only show you the problems with your security and get rewarded for our hard work! We never cheat and value our reputation! ######################################### How can I buy Bitcoins? ######################################### Contact us and we will provide you with instructions for buying Bitcoin. Please note that by contacting third parties, the cost may increase due to additional fees. We will help you to purchase bitcoin without unnecessary difficulties, our experienced specialists will tell you in detail about the process. ######################################### This is very important! ######################################### - Do not rename encrypted files. - Do not try to decrypt your data using third party software, this may lead to irreversible data loss. - No one else will be able to return your files except us! #########################################################################

技术细节

我们捕获到的 Rast 勒索软件信息如下，由 rust 语言编写：

Path	MD5
%userprofile%\documents\recovery.exe（早期版本）	4680edef53618e2dbda7832492ede62e
%UserProfile%\Documents\svhost.exe（中期版本）	e3d2e511a9a783f6ff3c25e305821be7
%UserProfile%\Documents\svhost.exe（最新版本）	e96dc82b080bc4c229cc5c049c0a187b