{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis \"SaveTheQueen\" adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nYeni bir \u00e7e\u015fit fidye yaz\u0131l\u0131m\u0131, dosyalar\u0131 \u015fifreleyerek onlara &quot;.SaveTheQueen&quot; uzant\u0131s\u0131n\u0131 ekliyor ve Active Directory etki alan\u0131 denetleyicilerindeki SYSVOL sistem a\u011f dizini \u00fczerinden yay\u0131l\u0131yor.<\/p>\n<p>M\u00fc\u015fterilerimiz, bu k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m ile yak\u0131n zamanda kar\u015f\u0131la\u015ft\u0131lar. A\u015fa\u011f\u0131da, kapsaml\u0131 analizimiz ve sonu\u00e7lar\u0131m\u0131z\u0131 bulabilirsiniz.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Tespit<\/h2>\n<\/h2>\n<p>\nM\u00fc\u015fterilerimizden biri, ortamlar\u0131ndaki yeni \u015fifreleyici fidye yaz\u0131l\u0131m\u0131 ile kar\u015f\u0131la\u015ft\u0131ktan sonra bizimle ileti\u015fime ge\u00e7ti; bu yaz\u0131l\u0131m yeni \u015fifrelenmi\u015f dosyalara &quot;.SaveTheQueen&quot; uzant\u0131s\u0131n\u0131 ekliyordu.<\/p>\n<p>Soru\u015fturma s\u0131ras\u0131nda, enfekte kaynaklar\u0131n izini s\u00fcrme a\u015famas\u0131nda, enfekte olan kurbanlar\u0131 bulmak ve izlemek i\u00e7in <strong>SYSVOL a\u011f payla\u015f\u0131m\u0131n\u0131 <\/strong> m\u00fc\u015fterinin domain denetleyicisinde.<\/p>\n<p>SYSVOL, her domain denetleyicisi i\u00e7in anahtar bir klas\u00f6rd\u00fcr; grup politikas\u0131 nesneleri (GPO) ve sistem giri\u015f\/\u00e7\u0131k\u0131\u015f scriptlerini domain bilgisayarlar\u0131na da\u011f\u0131tmak i\u00e7in kullan\u0131l\u0131r. Bu klas\u00f6r\u00fcn i\u00e7eri\u011fi, bu verilerin organizasyonun sitelerinde senkronize edilmesi i\u00e7in domain denetleyicileri aras\u0131nda \u00e7o\u011falt\u0131l\u0131r. SYSVOL'a yazmak, y\u00fcksek domain ayr\u0131cal\u0131klar\u0131 gerektirir; ancak, bir kez tehlikeye at\u0131ld\u0131\u011f\u0131nda, bu kaynak, sald\u0131rganlar i\u00e7in domain genelinde k\u00f6t\u00fc ama\u00e7l\u0131 y\u00fck\u00fc h\u0131zl\u0131 ve etkili bir \u015fekilde yaymak amac\u0131yla g\u00fc\u00e7l\u00fc bir ara\u00e7 haline gelir.<\/p>\n<p>Varonis denetim zinciri, \u015fu bilgilerin h\u0131zl\u0131 bir \u015fekilde belirlenmesine yard\u0131mc\u0131 oldu:<\/p>\n<ul>\n<li> Enfekte kullan\u0131c\u0131 hesab\u0131, SYSVOL i\u00e7inde \"hourly\" adl\u0131 bir dosya olu\u015fturuyordu.<\/li>\n<li> SYSVOL'da \u00e7ok say\u0131da g\u00fcnl\u00fck dosyas\u0131 olu\u015fturuldu \u2014 her biri bir domain cihaz\u0131n\u0131n ad\u0131yla.<\/li>\n<li>Farkl\u0131 IP adresleri \"hourly\" dosyas\u0131na eri\u015fim sa\u011flad\u0131.<\/li>\n<\/ul>\n<p>\nG\u00fcnl\u00fck dosyalar\u0131n\u0131n, yeni cihazlardaki enfekte s\u00fcre\u00e7lerini izlemek i\u00e7in kullan\u0131ld\u0131\u011f\u0131n\u0131 ve \"hourly\"nin, Powershell scripti kullanarak yeni cihazlara k\u00f6t\u00fc ama\u00e7l\u0131 y\u00fck\u00fc \u00e7al\u0131\u015ft\u0131ran zamanlanm\u0131\u015f bir g\u00f6rev oldu\u011funu belirledik; \u00f6rnekler \"v3\" ve \"v4\".'t\u00fcr.<\/p>\n<p>Muhtemelen, sald\u0131rgan, SYSVOL'da dosya yazmak i\u00e7in domain y\u00f6neticisi ayr\u0131cal\u0131klar\u0131n\u0131 ald\u0131 ve kulland\u0131. Enfekte olan cihazlarda, sald\u0131rgan, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 a\u00e7mak, \u015fifresini \u00e7\u00f6zmek ve \u00e7al\u0131\u015ft\u0131rmak i\u00e7in zamanlama g\u00f6revi olu\u015fturan PowerShell kodunu \u00e7al\u0131\u015ft\u0131rd\u0131.<\/p>\n<h2>\n<h2>K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n \u015fifresini \u00e7\u00f6zme<\/h2>\n<\/h2>\n<p>\n\u015eu \u015fekilde \u015fifre \u00e7\u00f6z\u00fcc\u00fc \u00f6rnekleri denedik, sonu\u00e7 alamadan:<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeredeyse pes etmek \u00fczereydik, ancak \u015funu denemeye karar verdik: GCHQ'nun harika<br \/>\narac\u0131 <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef.<\/a><\/noindex> \"Magic\", dosyan\u0131n \u015fifrelemesini tahmin etmeye \u00e7al\u0131\u015farak, farkl\u0131 \u015fifreleme t\u00fcrleri i\u00e7in \u015fifreleri deniyor ve entropiyi \u00f6l\u00e7\u00fcyor. <\/p>\n<p><b class=\"spoiler_title\">T\u0259rc\u00fcm\u0259\u00e7inin qeydi<\/b> Bkz.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Farkl\u0131 entropi<\/a><\/noindex> v\u0259 <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Bilgi teorisinde entropi.<\/a><\/noindex>M\u0259qal\u0259 v\u0259 \u015f\u0259rhl\u0259r m\u00fc\u0259llifl\u0259r t\u0259r\u0259find\u0259n istifad\u0259 olunan metodlar\u0131n, ist\u0259r xarici, ist\u0259rs\u0259 d\u0259 m\u00fclkiyy\u0259t proqram\u0131n\u0131n detallar\u0131 il\u0259 m\u00fczakir\u0259sini n\u0259z\u0259rd\u0259 tutmur. <br \/>\n<img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00abMagic\u00bb m\u00fc\u0259yy\u0259n etdi ki, GZip s\u0131x\u0131c\u0131 il\u0259 base64 kodla\u015fd\u0131rmas\u0131 istifad\u0259 olunub, bu da biz\u0259 fayl\u0131 a\u00e7ma\u011fa v\u0259 daxil etm\u0259 kodunu \u2013 \u00abinjektor\u00bbu a\u015fkar etm\u0259y\u0259 imkan verdi.<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: \u00abB\u00f6lg\u0259d\u0259 epidemiyad\u0131r! \u00dcmumi vaksinl\u0259r. Qoyun yan\u0131\u011f\u0131\u00bb<\/h2>\n<p>\nDropper adi .NET fayl\u0131 idi v\u0259 he\u00e7 bir qoruma il\u0259 t\u0259min edilm\u0259mi\u015fdi. M\u0259nb\u0259 kodunu oxuduqdan sonra <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> biz anlad\u0131q ki, onun yegan\u0259 m\u0259qs\u0259di winlogon.exe prosesin\u0259 shell kodu daxil etm\u0259kdir.<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell kod v\u0259 ya sad\u0259 \u00e7\u0259tinlikl\u0259r<\/h2>\n<p>\nHexacorn yaratma al\u0259tind\u0259n istifad\u0259 etdik \u2014 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> sad\u0259 kodu t\u0259hlil v\u0259 qeyd\u0259 almaq \u00fc\u00e7\u00fcn icra edil\u0259 bil\u0259n fayla \u00abkompilyasiya\u00bb etm\u0259k m\u0259qs\u0259diyl\u0259. Sonra onun h\u0259m 32-, h\u0259m d\u0259 64-bitli ma\u015f\u0131nlarda i\u015fl\u0259diyini a\u015fkar etdik.<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nH\u0259tta sad\u0259 shell kodunun yerli translyasiyas\u0131nda yaz\u0131lmas\u0131 \u00e7\u0259tin ola bil\u0259r, h\u0259r iki sistem n\u00f6v\u00fcnd\u0259 i\u015fl\u0259y\u0259n tam shell kodunu yazmaq is\u0259 elit bacar\u0131qlar t\u0259l\u0259b edir, buna g\u00f6r\u0259 d\u0259 biz h\u00fccum\u00e7unun z\u0259rifliyin\u0259 heyran qalma\u011fa ba\u015flad\u0131q.<\/p>\n<p>\u0130cmal\u0131 in\u015fa edilmi\u015f shell kodunu <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>il\u0259 inc\u0259l\u0259y\u0259nd\u0259, onun <strong> dinamik .NET kitabxanalar\u0131n\u0131 <\/strong>y\u00fckl\u0259diyini g\u00f6rd\u00fck, m\u0259s\u0259l\u0259n clr.dll v\u0259 mscoreei.dll. Bu, biz\u0259 q\u0259rib\u0259 g\u0259ldi \u2013 ad\u0259t\u0259n, ziyanverici \u015f\u0259xsl\u0259r shell kodunu m\u00fcmk\u00fcn q\u0259d\u0259r ki\u00e7ik etm\u0259y\u0259 \u00e7al\u0131\u015f\u0131rlar, yerli \u0259mrl\u0259ri \u00e7a\u011f\u0131raraq bunun yerin\u0259 y\u00fckl\u0259mirl\u0259r. <em>N\u0259y\u0259 g\u00f6r\u0259 birisi shell koduna Windows funksionall\u0131\u011f\u0131n\u0131 inteqrasiya etm\u0259y\u0259 \u00e7al\u0131\u015f\u0131r, bunun yerin\u0259 birba\u015fa \u00e7a\u011f\u0131rma\u011fa? <\/em><\/p>\n<p>M\u0259lum oldu ki, z\u0259r\u0259rli proqram\u0131n m\u00fc\u0259llifi \u00fcmumiyy\u0259tl\u0259 bu m\u00fcr\u0259kk\u0259b shell kodunu yazmay\u0131b \u2013 icra edil\u0259 bil\u0259n fayllar\u0131 v\u0259 skriptl\u0259ri shell koduna \u00e7evirm\u0259k \u00fc\u00e7\u00fcn spesifik bir proqramdan istifad\u0259 olunub. <\/p>\n<p>Biz <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>al\u0259tini tapd\u0131q, bunun da ox\u015far shell kodunu kompilyasiya ed\u0259 bil\u0259c\u0259yini d\u00fc\u015f\u00fcnd\u00fck. GitHub-dan onun t\u0259sviri a\u015fa\u011f\u0131dak\u0131 kimidir:<\/p>\n<p><em>Donut VBScript, JScript, EXE, DLL (o c\u00fcml\u0259d\u0259n .NET toplular\u0131) \u00fc\u00e7\u00fcn x86 v\u0259 ya x64 shell kodu yarad\u0131r. Bu shell kodu Windows-da h\u0259r hans\u0131 bir prosesi daxil etm\u0259k \u00fc\u00e7\u00fcn icra edil\u0259 bil\u0259r.<br \/>\nRAM.<\/em><\/p>\n<p>Teorimizi t\u0259sdiql\u0259m\u0259k \u00fc\u00e7\u00fcn \u00f6z kodumuzu Donut istifad\u0259 ed\u0259r\u0259k kompilyasiya etdik v\u0259 n\u00fcmun\u0259 il\u0259 m\u00fcqayis\u0259 etdik - v\u0259... b\u0259li, istifad\u0259 olunan al\u0259t d\u0259st\u0259yi il\u0259 bir komponent a\u015fkar etdik. Bunu etdikd\u0259n sonra, biz art\u0131q orijinal .NET icra edil\u0259 bil\u0259n fayl\u0131 \u00e7\u0131xara v\u0259 t\u0259hlil ed\u0259 bildik.<\/p>\n<h2> Kodun m\u00fchafiz\u0259 olunmas\u0131 <\/h2>\n<p>\nBu fayl <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx il\u0259 obfuskasiya edilmi\u015fdir.<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx \u2014 .NET a\u00e7\u0131q m\u0259nb\u0259 layih\u0259sidir ki, dig\u0259r inki\u015faflar\u0131n kodunu qorumaq \u00fc\u00e7\u00fcn istifad\u0259 olunur. Bu tip proqram t\u0259minat\u0131 inki\u015faf etdiricil\u0259r\u0259 kodlar\u0131n\u0131 t\u0259rsin\u0259 m\u00fch\u0259ndislikd\u0259n qorumaq \u00fc\u00e7\u00fcn simvollar\u0131n d\u0259yi\u015fdirilm\u0259si, idar\u0259etm\u0259 ax\u0131nlar\u0131n\u0131n maskalanmas\u0131 v\u0259 istinad metodunun gizl\u0259dilm\u0259si kimi \u00fcsullar t\u0259qdim edir. Z\u0259r\u0259rli proqram yarad\u0131c\u0131lar\u0131 a\u015fkar edilm\u0259m\u0259k v\u0259 t\u0259rsin\u0259 m\u00fch\u0259ndislik etm\u0259yi \u00e7\u0259tinl\u0259\u015fdirm\u0259k \u00fc\u00e7\u00fcn obfuskatorlardan istifad\u0259 edirl\u0259r.<\/p>\n<p>Bunun say\u0259sind\u0259 <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> kodunu a\u00e7d\u0131q:<\/p>\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> N\u0259tic\u0259 \u2013 y\u00fckl\u0259m\u0259<\/h2>\n<p>\nD\u00f6n\u00fc\u015f\u00fcmd\u0259n al\u0131nan y\u00fckl\u0259m\u0259 \u00e7ox sad\u0259 bir \u015fifr\u0259l\u0259yici virusudur. Sistem\u0259 yerl\u0259\u015fm\u0259 mexanizmi yoxdur, r\u0259hb\u0259rlik m\u0259rk\u0259zi il\u0259 birl\u0259\u015fm\u0259l\u0259r yoxdur \u2013 yaln\u0131z k\u00f6hn\u0259, yax\u015f\u0131 asimetrik \u015fifr\u0259l\u0259m\u0259, qurban\u0131n m\u0259lumatlar\u0131n\u0131 oxumaq \u00fc\u00e7\u00fcn qeyri-\u015f\u0259ffaf etm\u0259k m\u0259qs\u0259dil\u0259.<\/p>\n<p>\u018fsas funksiya a\u015fa\u011f\u0131dak\u0131 s\u0259tirl\u0259ri parametr kimi se\u00e7ir:<\/p>\n<ul>\n<li> \u015eifrl\u0259m\u0259d\u0259n sonra istifad\u0259 olunacaq fayl\u0131n uzant\u0131s\u0131 (SaveTheQueen) <\/li>\n<li> \u0130hal\u0259 t\u0259l\u0259bin\u0259 yazmaq \u00fc\u00e7\u00fcn m\u00fc\u0259llifin e-po\u00e7tu<\/li>\n<li> Fayllar\u0131 \u015fifr\u0259l\u0259m\u0259k \u00fc\u00e7\u00fcn istifad\u0259 olunan a\u00e7\u0131q a\u00e7ar <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Proses bel\u0259 g\u00f6r\u00fcn\u00fcr:<\/strong><\/p>\n<ol>\n<li> Z\u0259r\u0259rli proqram qurban\u0131n cihaz\u0131nda yerli v\u0259 qo\u015fulmu\u015f diskleri ara\u015fd\u0131r\u0131r\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> \u015eifrl\u0259m\u0259k \u00fc\u00e7\u00fcn fayllar\u0131 axtar\u0131r\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> \u015eifrl\u0259m\u0259k ist\u0259diyi fayl\u0131 istifad\u0259 ed\u0259n prosesi ba\u015fa \u00e7atd\u0131rma\u011fa \u00e7al\u0131\u015f\u0131r<\/li>\n<li> Fayl\u0131 \"\u0130lkin_fayl_ad\u0131.SaveTheQueenING\" adland\u0131raraq MoveFile funksiyas\u0131ndan istifad\u0259 edir v\u0259 onu \u015fifr\u0259l\u0259yir <\/li>\n<li>Dosya yazar\u0131n a\u00e7\u0131k anahtar\u0131yla \u015fifrelendikten sonra, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m tekrar adland\u0131rarak onu &quot;Eski_dosya_ad\u0131.SaveTheQueen&quot; haline getiriyor.<\/li>\n<li>T\u0259l\u0259b olunan \u00f6d\u0259m\u0259 il\u0259 fayl eyni qovlu\u011fa yaz\u0131l\u0131r\n<p><img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nYerli \"CreateDecryptor\" funksiyas\u0131ndan istifad\u0259 ed\u0259r\u0259k, z\u0259r\u0259rli proqram\u0131n bir funksiyas\u0131 g\u00f6r\u00fcn\u00fcr ki, onu \u015fifr\u0259l\u0259m\u0259k \u00fc\u00e7\u00fcn t\u0259l\u0259b olunan privat a\u00e7ar il\u0259 dekodlama mexanizmini parametr olaraq g\u00f6t\u00fcr\u00fcr.<\/p>\n<p>\u015eifr\u0259l\u0259yici virus <strong>fayllar\u0131 \u015fifrl\u0259mir<\/strong>, a\u015fa\u011f\u0131dak\u0131 qovluqlarda saxlan\u0131l\u0131r:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>H\u0259m\u00e7inin o <strong>a\u015fa\u011f\u0131dak\u0131 fayl tipl\u0259rini \u015fifrl\u0259mir:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> N\u0259tic\u0259l\u0259r v\u0259 x\u00fclas\u0259l\u0259r<\/h2>\n<\/h2>\n<p>\n\u015eifr\u0259l\u0259yici virusun \u00f6z\u00fcn\u00fcn qeyri-adi funksiyalar\u0131 olmamas\u0131na baxmayaraq, h\u00fccum ed\u0259n Active Directory-d\u0259n yararlanaraq dropper-i yayd\u0131 v\u0259 z\u0259r\u0259rli proqram biz\u0259 maraql\u0131, amma n\u0259tic\u0259d\u0259 \u00e7\u0259tinlik olmayan mane\u0259l\u0259r t\u0259qdim etdi. <\/p>\n<p>Biz d\u00fc\u015f\u00fcn\u00fcr\u00fck ki, z\u0259r\u0259rli proqram\u0131n m\u00fc\u0259llifi:<\/p>\n<ol>\n<li>\u015fifr\u0259l\u0259yici virus yazm\u0131\u015fd\u0131r ki, o da winlogon.exe prosesin\u0259 daxil edilmi\u015fdir v\u0259 h\u0259m\u00e7inin<br \/>\nfayllar\u0131n \u015fifr\u0259l\u0259nm\u0259si v\u0259 a\u00e7\u0131lmas\u0131 funksionall\u0131\u011f\u0131na malikdir<\/li>\n<li>z\u0259r\u0259rli kodu ConfuserEx il\u0259 maskalam\u0131\u015f, n\u0259tic\u0259ni Donut il\u0259 \u00e7evirmi\u015f v\u0259 \u0259lav\u0259 olaraq dropper-i base64 Gzip il\u0259 gizl\u0259tdirmi\u015fdir<\/li>\n<li>qurban\u0131n domenind\u0259 art\u0131r\u0131lm\u0131\u015f imtiyazlar \u0259ld\u0259 etmi\u015f v\u0259 onlar\u0131 \u015fifr\u0259l\u0259nmi\u015f z\u0259r\u0259rli proqram\u0131 v\u0259 c\u0259dv\u0259l \u00fczr\u0259 tap\u015f\u0131r\u0131qlar\u0131 domen kontrol\u00e7ular\u0131n\u0131n SYSVOL qovlu\u011funa kopyalamaq \u00fc\u00e7\u00fcn istifad\u0259 etmi\u015fdir.<br \/>\n\u015fifr\u0259l\u0259nmi\u015f z\u0259r\u0259rli proqram v\u0259 c\u0259dv\u0259l \u00fczr\u0259 tap\u015f\u0131r\u0131qlar\u0131 domen kontrol\u00e7ular\u0131n\u0131n SYSVOL qovlu\u011funa kopyalay\u0131b.<\/li>\n<li>PowerShell skriptini domen qur\u011fular\u0131nda z\u0259r\u0259rli proqram\u0131n yay\u0131lmas\u0131 v\u0259 h\u00fccumun ir\u0259lil\u0259m\u0259sini SYSVOL qeydl\u0259rin\u0259 yazmaq \u00fc\u00e7\u00fcn i\u015f\u0259 sald\u0131m.<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Krali\u00e7an\u0131 sat\u0131n almaq - Varonis &quot;SaveTheQueen&quot; adl\u0131 s\u00fcr\u0259tli yay\u0131lan \u015fifrl\u0259yici t\u0259l\u0259bi ara\u015fd\u0131r\u0131r.\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u018fg\u0259r bu \u015fifr\u0259l\u0259yici virusu v\u0259 ya komandalar\u0131m\u0131z t\u0259r\u0259find\u0259n apar\u0131lan dig\u0259r forensik v\u0259 \u0130T hadis\u0259l\u0259ri ara\u015fd\u0131rmalar\u0131 il\u0259 ba\u011fl\u0131 suallar\u0131n\u0131z varsa, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">istifad\u0259 imkanlar\u0131n\u0131z\u0131 m\u00fczakir\u0259 etm\u0259k \u00fc\u00e7\u00fcn. <\/a><\/noindex> ya da <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">h\u00fccumlara reaksiya verm\u0259k \u00fc\u00e7\u00fcn canl\u0131 n\u00fcmayi\u015f t\u0259l\u0259b edin<\/a><\/noindex>, burada h\u0259mi\u015f\u0259 suallar\u0131n\u0131za cavab veririk.<br \/>\n<br \/>M\u0259nb\u0259: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"az_AZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Almaq \u2014 krali\u00e7an\u0131 bel\u0259: Varonis s\u00fcr\u0259tl\u0259 yay\u0131lan \u201cSaveTheQueen\u201d \u015fifr\u0259l\u0259yici virusunu ara\u015fd\u0131r\u0131r | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}