{
  "timestamp": "2025-02-05T23:06:33.888094",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a cybersecurity expert specializing in company websites and product documentation.\n        Analyze the content and classify it into the given categories.\n        Return only the applicable categories as a comma-separated list, nothing else."
      },
      {
        "role": "user",
        "content": "\n        Categories to choose from:\n        product_security_features, end_user_security, compliance_certifications, security_best_practices, data_protection, access_management, threat_prevention, incident_response, privacy_policy, technical_documentation\n        \n        Content to classify:\n        Search Free Trial Get Demo New Scarab Ransomware Using Necurs-as-a-Service December 1, 2017 13.3 million Scarab ransomware emails detected in one day The new Scarab ransomware being distributed via email by the Necurs botnet appears to come from scanning devices or services like HP, Epson or Lexmark. While there are similarities to the Necurs-distributed Locky ransomware, Scarab seems to have been developed by a different malware author. Necurs began actively distributing Scarab on November 23rd Thanksgiving Day in the U.S.. Cyrens security cloud blocked 13.3 million emails containing the Scarab attachment that day. Ransomware-as-a-Service Necurs most recent scourge has similarities on the surface to earlier Necurs-connected ransomware. Analysts at the Cyren Security Lab note that the Visual Basic .vbs file that downloads the malicious content is similar to the downloads from Locky and Trickbot. But upon examining the actual Scarab ransomware see our How It Works breakdown below, appears very different from Locky, with indications that it was created by a different author. One of the most notable differences includes the lack of a TOR webpage for a ransom fee. Instead you send an email to  with the personal identifier. This suggests that the criminals behind the Necurs botnet might be offering a distribution service for ransomware authors, with the Necurs gang providing the .vbs file that downloads the ransomware payload, macros, and JavaScript. This approach enables the malware author to focus on developing the ransomware itself. What economic arrangement the two parties might have, we can only guess at. Cyren detects the Scarab files as the following EXE file  W32Ransom.Scarab.A Sha-256 7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f VBS file  VBSDownldr.HM Sha-256 e6715117fd6995fafe48a3a60a2b1275ef21a63f7878de2cc031c8f1a0e5d771 Necurs A Brief History Its the botnet that keeps on giving. Known for its technical complexity, diverse distributions, and exceptional persistence, Necurs is one of the largest if not the largest botnets in the world, estimated to have up to 6 million bots networked. Its been behind the distribution of ransomwares like Locky and banking trojans like Dridex and Trickbot. Necurs periodically goes into hibernation, with little or no activitythen bang. For example, in 2016, the botnet went on hiatus for three weeks after the arrest of 50 Russian cyber criminals connected to a banking trojan, several of whom were believed to be behind Necurs operation. The botnet went quiet again in early 2017, but reactivated in March 2017 and has been active to varying degrees since then. How Scarab Works When the email arrives, the victim sees a subject line and attachment that appear to come from a variety of scanning sources, such as HP, Epson, and Lexmark. The email itself is targeted at businesses and spoofs the HP, Epson, or Lexmark domain name, so it appears to be coming from a printer located at the business. Figure 1 Scarab email attachment captured by Cyren appears as a scanned image from an HP printer. The Scarab emails each contain a .7zip file as an attachment. Extracting the file gives you a .vbs file that, in turn, downloads JHgd476.txt from one of these locations httpmiamirecyclecenters.comJHgd476 httpmiamirecyclecenters.comJHgd476 httphellonwheelsthemovie.comJHgd476 httphard-grooves.comJHgd476? Figure 2 Scarab encrypts files and appends each with ..scarab. The JHgd476.txt file is actually an .exe file with the extension .txt to help hide its true intent. Once downloaded, the .vbs then runs the .exe that is the Scarab ransomware. Once the ransomware payload has executed, the victim sees the following message on their computer screen Figure 3 Scarab uses a Visual Basic attachment to deliver the ransomware payload. This version of Scarab encrypts the files and appends the file name with a ..scarab extension. Figure 4 Victims are asked to email  and pay the ransom in bitcoins.. Several other notable things stand out with Scarab. First, the ransom note contains no monetary sum, only the instructions to contact the  address. In addition, while Cyren detected the 13.3 million Scarab emails as primarily targeting businesses, the distribution day of Thursday, November 23rd, Thanksgiving Day, in the United States, meant that if the ransomware made it into email boxes, the vast majority of American business employees likely didnt actually see the email until they returned to work five days later. Dont Be a Victim An ounce of prevention is worth a pound of cure, as they say. To avoid falling victim to ransomware scams like Scarab, consider using Cyrens cloud-based email security and web security capable of identifying and blocking threats as they emerge, before they reach users. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev 10 Cyber Threat Terms Every IT Manager Should Know Analysten-Bericht Phishing-Angriffe sind ein Gesch\u00e4ftsproblem, kein IT-Problem Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n        "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "product_security_features,end_user_security,security_best_practices,data_protection,threat_prevention",
    "usage": {
      "prompt_tokens": 1271,
      "completion_tokens": 436,
      "total_tokens": 1707
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}