Malware researchers have a new version of the notorious
Scarab ransomware. According to some of them, the cryptovirus uses the
AES encryption algorithm and is coded in
Delphi.
The idea behind the
Delphi programming usage is for it cause more infections as it might be spread to older systems, like
Windows 98, others speculate.
The
Scarab virus (with the
.xtbl extension) creates the following mutexes:
- ShimCacheMutex
- STOPSCARABSTOPSCARABSTOPSCARABSTOPSCARABSTOPSCARAB
The
Scarab ransomware deletes
Shadow Volume Copies and some
System Backups via commands.
You can read more about the threat from the following article:
.xtbl Files Virus (Scarab Ransomware) – Remove and Restore .xtbl Files
