WannaCry勒索软件的分析和检测  

Analysis and Detection of WannaCry Ransomware

作　　者：张新博 李雨琪 佟佳洋 王雨翔 唐远新[1] 翟继强[1] ZHANG Xinbo;LI Yuqi;TONG Jiayang;WANG Yuxiang;TANG Yuanxin;ZHAI Jiqiang(School of Computer Science and Technology,Harbin University of Science and Technology,Harbin 150080,China)

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《计算机与网络》2023年第9期68-72,共5页Computer & Network

基　　金：国家级大学生创新创业训练项目(202110214018)。

摘　　要：勒索软件是恶意软件的一种,以威胁发布受害者的数据或永久阻止受害者访问数据来勒索赎金。WannaCry勒索病毒是危害性和破坏力非常强的一种勒索软件病毒,基于多种动静态分析技术深入解析和研究了WannaCry勒索软件的攻击流程和文件加密过程,提取了多个特征码并构建了基于YARA的特征检测规则,测试结果证明,提取的静态规则可以有效效检测和识别WannaCry勒索软件。Ransomware is a malicious software that extorts ransom by threatening to release the victim's data or permanentlypreventing the victim from accessing the data. WannaCry ransomware is a very harmful and destructive ransomware virus. Theattacking process and file encryption of WannaCry ransomware are deeply analyzed and researched based on various dynamic and staticanalysis technologies. Several signature codes are extracted and feature detection rules based on YARA are constructed. Theexperimental results show that the static rules extracted can detect and identify WannaCry ransomware effectively.

关 键 词：勒索软件 WannaCry YARA规则 检测 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]