vdgtuВестник Дагестанского государственного технического университета. Технические наукиHerald of Dagestan State Technical University. Technical Sciences2073-61852542-095XDaghestan State Technical University10.21822/2073-6185-2024-51-1-79-86vdgtu-1457Research ArticleИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИ И ТЕЛЕКОММУНИКАЦИИINFORMATION TECHNOLOGY AND TELECOMMUNICATIONSОбнаружение вируса «Telegram Rat»Detection of «Telegram Rat» virusДубровинаА. И.DubrovinaA. I.

 Дубровина Ангелина Игоревна, ассистент, кафедра «Вычислительные системы и информационная безопасность»  

344000, г. Ростов-на-Дону, пл. Гагарина, 1, Россия

344000, г. Ростов-на-Дону, ул. Мечникова, 130, Россия  

Angelina I. Dubrovina, Assistant, Department of Computer Systems and Information Security 

1 Gagarin Square, Rostov-on-Don 344000, Russia 

130 Mechnikova St., Rostov-on-Don 344000, Russia 

adubrovina@yug.gkovd.ruАлкордиМ. Х.AlkordiM. H.

 Алкорди Мустафа Хельми Муса, студент, кафедра «Вычислительные системы и информационнаябезопасность» 

 344000, г. Ростов-на-Дону, пл. Гагарина, 1, Россия 

Mustafa Helmi Musa Alkordi, Student, Department of Computer Systems and Information Security

 1 Gagarin Square, Rostov-on-Don 344000, Russia 

ministrelia69@yandex.ruДонской государственный технический университет; Частное образовательное учреждение высшего образования «Южный университет» (Институт управления, бизнеса и права)РоссияDon State Technical University; Southern University (Institute of Management, Business and Law)Russian FederationДонской государственный технический университетРоссияDon State Technical UniversityRussian Federation2024160420245117986Copyright © Дубровина А.И., Алкорди М.Х., 20242024Дубровина А.И., Алкорди М.Х.Dubrovina A.I., Alkordi M.H.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.dgtu.ru/jour/article/view/1457Цель

Цель. Целью исследования является анализ вируса «Telegram Rat», подчеркивая важность информирования для эффективной борьбы с киберугрозами и обеспечения безопасности в цифровой эпохе.

Методы

Методы. В статье использовался анализ характеристик и распространения вирусов «Telegram Rat». Приведен пример анализа технических механизмов вымогательства на примере «WAGNER GROUP» и сформулированы этапы ликвидации вируса.

Результаты

Результаты. Рассмотрена акуальность проблемы вируса «Telegram Rat» и пути его передачи. Представлены практические методы выявления и нейтрализации угрозы. Метод обнаружения угроз вируса «Telegram Rat» основан на анализе активных процессов, сетевой активности и файловой системы. Выявлено, что основным уязвимым местом на устройствах, зараженных вирусом, является неосторожное поведение пользователей.

Вывод

Вывод. В содержании настоящей работы подчеркивается важность бдительности при скачивании файлов и переходах по неизвестным ссылкам. Недостаточная осторожность может привести к утрате данных и утечке информации, подчеркивая необходимость сознательного поведения в цифровой среде.

Objective

Objective. The aim of this study is to analyze the «Telegram Rat» virus, emphasizing the importance of awareness to effectively combat cyber threats and ensure security in the digital age.

Methods

Methods. This paper used an analysis of the characteristics and distribution of «Telegram Rat» viruses. An example of analyzing the technical mechanisms of extortion on the example of «WAGNER GROUP» was given and the steps of virus elimination were formulated.

Results

Results. The acuality of the «Telegram Rat» virus problem and ways of its transmission are considered. Practical methods of threat detection and neutralization are stipulated. The method of «Telegram Rat» virus threat detection is based on the analysis of active processes, network activity and file system. It is revealed that the main vulnerability on devices infected with the virus is careless user behavior.

Conclusion

Conclusion. The contents of this paper emphasize the importance of vigilance when downloading files and clicking on links. Lack of caution can lead to data loss and information leakage, emphasizing the need for conscious behavior in the digital environment.

«Telegram Rat»киберугрозыинформационная безопасность«Telegram Rat»cyber threatsinformation securityReferencesDrKLO. 2013. Telegram messenger for Android. (Oct. 2013). https://github.com/DrKLO/Telegram.DrKLO. 2013. Telegram messenger for Android. (Oct. 2013). https://github.com/DrKLO/Telegram.Кара И., Айдос М. Призрак в системе: технический анализ трояна удаленного доступа //International Journal on Information Technologies & Security. – 2019. – Т. 11. – No 1. – С. 73-84.Kara I., Aidos M. A ghost in the system: technical analysis of a remote access Trojan. International Journal on Information Technologies & Security. 2019; 11(1): 73-84.Li X. et al. An Android Malicious Application Detection Method with Decision Mechanism in the Operating Environment of Blockchain//Security and Communication Networks. – 2022. – Т. 2022. https://www.hindawi.com/journals/scn/2022/3111540/Li X. et al. An Android Malicious Application Detection Method with Decision Mechanism in the Operating Environment of Blockchain. Security and Communication Networks. 2022;2022.Luo X. et al. Social engineering: The neglected human factor for information security management //Information Resources Management Journal (IRMJ). – 2011. – Т. 24. – №. 3. – С. 1-8.https://www.hindawi.com/journals/scn/2022/3111540/Chislova O., Sokolova M. Cybersecurity in Russia //International Cybersecurity Law Review. – 2021. – Т. 2. – №. 2. – С. 245-251.Luo X. et al. Social engineering: The neglected human factor for information security management. Information Resources Management Journal (IRMJ). 2011; 24(3):1-8.Govender I., Watson B. W. W., Amra J. Global virus lockdown and cybercrime rate trends: A routine activity approach //Journal of Physics: Conference Series. – IOP Publishing, 2021. – Т. 1828. – №. 1. – С. 012107.Chislova O., Sokolova M. Cybersecurity in Russia. International Cybersecurity Law Review. 2021; 2(2): 245-251.Peeters S., Willaert T. Telegram and digital methods: Mapping networked conspiracy theories through platform affordances //M/C Journal.–2022.–Т.25.–№.1 https://journal.mediaculture.org.au/index.php/mcjournal/article/view/2878.Govender I., Watson B. W. W., Amra J. Global virus lockdown and cybercrime rate trends: A routine activity approach. Journal of Physics: Conference Series. IOP Publishing, 2021; 1828 (1): 012107.Koutsokostas V. et al. Invoice# 31415 attached: Automated analysis of malicious Microsoft Office documents //Computers & Security. – 2022. – Т. 114. – С. 102582. https://www.mdpi.com/2076-3417/12/8/4088Peeters S., Willaert T. Telegram and digital methods: Mapping networked conspiracy theories through platform affordances. M/C Journal. 2022;25(1): https://journal.mediaculture.org.au/index.php/mcjournal/article/view/2878.Dubin R. Content Disarm and Reconstruction of RTF Files a Zero File Trust Methodology //IEEE Transactions on Information Forensics and Security. – 2023. – Т. 18. – С. 1461-1472. https://ieeexplore.ieee.org/abstract/document/10034674/Koutsokostas V. et al. Invoice# 31415 attached: Automated analysis of malicious Microsoft Office documents. Computers & Security. 2022;114:102582. https://www.mdpi.com/2076-3417/12/8/4088Balikcioglu P. G. et al. Malicious code detection in android: the role of sequence characteristics and disassembling methods //International Journal of Information Security. – 2023. – Т. 22. – №. 1. – С. 107-118. https://link.springer.com/article/10.1007/s10207-022-00626-2Dubin R. Content Disarm and Reconstruction of RTF Files a Zero File Trust Methodology. IEEE Transactions on Information Forensics and Security.2023;18:1461-1472. https://ieeexplore.ieee.org/abstract/document/10034674/Acharya S., Rawat U., Bhatnagar R. A comprehensive review of android security: Threats, vulnerabilities, malware detection, and analysis //Security and Communication Networks. – 2022. – Т. 2022. https://www.hindawi.com/journals/scn/2022/7775917/Balikcioglu P. G. et al. Malicious code detection in android: the role of sequence characteristics and disassembling methods. International Journal of Information Security. 2023; 22 (1):107-118. https://link.springer.com/article/10.1007/s10207-022-00626-2https://www.mdpi.com/2075-4698/12/6/164 Herrero-Solana V., Castro-Castro C. Telegram channels and bots: A ranking of media outlets based in Spain //Societies. – 2022. – Т. 12. – №. 6. – С. 164.Acharya S., Rawat U., Bhatnagar R. A comprehensive review of android security: Threats, vulnerabilities, malware detection, and analysis. Security and Communication Networks. 2022;2022. https://www.hindawi.com/journals/scn/2022/7775917/Haagman D., Ghavalas B. Trojan defence: A forensic view //Digital Investigation. – 2005. – Т. 2. – №. 1. – С. 23-30.https://www.mdpi.com/2075-4698/12/6/164 Herrero-Solana V., Castro-Castro C. Telegram channels and bots: A ranking of media outlets based in Spain. Societies. 2022; 12(6):164.Warrender C., Forrest S., Pearlmutter B. Detecting intrusions using system calls: Alternative data models //Proceedings of the 1999 IEEE symposium on security and privacy (Cat. No. 99CB36344). – IEEE, 1999. – С. 133-145.Haagman D., Ghavalas B. Trojan defence: A forensic view. Digital Investigation. 2005; 2(1): 23-30.Wu N., Qian Y., Chen G. A novel approach to trojan horse detection by process tracing //2006 IEEE International Conference on Networking, Sensing and Control. – IEEE, 2006. – С. 721-726.Warrender C., Forrest S., Pearlmutter B. Detecting intrusions using system calls: Alternative data models. Proceedings of the 1999 IEEE symposium on security and privacy (Cat. No. 99CB36344). IEEE, 1999; 133-145.Ciubotariu M. What next? trojan. linkoptimizer //Virus Bulletin. – 2006. – С. 6-10.Wu N., Qian Y., Chen G. A novel approach to trojan horse detection by process tracing. 2006 IEEE International Conference on Networking, Sensing and Control. IEEE, 2006: 721-726.Mustafa Alkordi (2023). Ransomware Campaign Urges Resistance Against Russian Officials. URL: https://www.linkedin.com/pulse/ransomware-campaign-urges-resistance-against-russian-alkordi.Ciubotariu M. What next? trojan. Linkoptimizer.Virus Bulletin. 2006: 6-10.Kok S. et al. Ransomware, threat and detection techniques: A review //Int. J. Comput. Sci. Netw. Secur. – 2019. – Т. 19. – №. 2. – С. 136. https://seap.taylors.edu.my/file/rems/publication/105055_5256_1.pdf.Mustafa Alkordi (2023). Ransomware Campaign Urges Resistance Against Russian Officials. URL: https://www.linkedin.com/pulse/ransomware-campaign-urges-resistance-against-russian-alkordi.Tuma K., Calikli G., Scandariato R. Threat analysis of software systems: A systematic literature review // Journal of Systems and Software. – 2018. – Т. 144. – С. 275-294.Kok S. et al. Ransomware, threat and detection techniques: A review //Int. J. Comput. Sci. Netw. Secur. – 2019;19(2): 136.https://seap.taylors.edu.my/file/rems/publication/105055_5256_1.pdf.https://www.sciencedirect.com/science/article/abs/pii/S0164121218301304Tuma K., Calikli G., Scandariato R. Threat analysis of software systems: A systematic literature review. Journal of Systems and Software. 2018; 144: 275-294. https://www.sciencedirect.com/science/article/abs/pii/S0164121218301304Zengy J. et al. Shadewatcher: Recommendation-guided cyber threat analysis using system audit records // 2022 IEEE Symposium on Security and Privacy (SP). – IEEE, 2022. – С. 489-506. https://www.sciencedirect.com/science/article/pii/S1319157821003621.Zengy J. et al. Shadewatcher: Recommendation-guided cyber threat analysis using system audit records // 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022;489-506. https://www.sciencedirect.com/science/article/pii/S1319157821003621.

The authors declare that there are no conflicts of interest present.