Scarab
- First seen
- 2017-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-21 04:33:35
- Profile updated
- 2026-07-07 13:29:31
Context
The Scarab ransomware is a relatively new ransomware strain that was first spotted by security researcher Michael Gillespie in June this year. Written in Delphi, the first version was simplistic and was recognizable via the ".scarab" extension it appended after the names of encrypted files. Malwarebytes researcher Marcelo Rivera spotted a second version in July that used the ".scorpio" extension. The version spotted with the Necurs spam today has reverted back to using the .scarab extension. The current version of Scarab encrypts files but does not change original file names as previous versions. This Scarab version appends each file's name with the ".[[email protected]].scarab" extension. Scarab also deletes shadow volume copies and drops a ransom note named "IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT" on users' computers, which it opens immediately.
Detection coverage
- 2 YARA rules
Detection rules
- SEKOIA_Backdoor_Win_Headertip (yara-rule)
- CAPE_Scarab (yara-rule)
Reports & references
- bleepingcomputer.com — The Week In Ransomware October 12Th 2018 Notpetya Gandcrab And More (report)
- bleepingcomputer.com — Scarab Ransomware Pushed Via Massive Spam Campaign (report)
- labsblog.f-secure.com — Necurs Business Is Booming In A New Partnership With Scarab Ransomware (report)
- blogs.forcepoint.com — Massive Email Campaign Spreads Scarab Ransomware (report)
- twitter.com — 933643147766321152 (report)
- myonlinesecurity.co.uk — Necurs Botnet Malspam Delivering A New Ransomware Via Fake Scanner Copier Messages (report)
- twitter.com — 1006222754385924096 (report)
- twitter.com — 1006908267862396928 (report)
- twitter.com — 1007694117449682945 (report)
- twitter.com — 1049316344183836672 (report)
- twitter.com — 1039105453735784448 (report)
- twitter.com — 1072057088019496960 (report)
- id-ransomware.blogspot.com — Scarab Ransomware (report)
- ransomlook.io — Scarab (report)