{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u011bkdy by bylo zaj\u00edmav\u00e9 pod\u00edvat se n\u011bkter\u00e9mu tv\u016frci vir\u016f do o\u010d\u00ed a zeptat se: pro\u010d a jak? S odpov\u011bd\u00ed na ot\u00e1zku \u201ejak\u201c si porad\u00edme sami, ale bylo by velmi zaj\u00edmav\u00e9 zjistit, co toho \u010di onoho tv\u016frce \u0161kodliv\u00e9ho softwaru vedlo k jeho \u010dinu. Zvl\u00e1\u0161\u0165 kdy\u017e naraz\u00edme na takov\u00e9 \u201eperly\u201c.<\/p>\n<p>Hrdina dne\u0161n\u00edho \u010dl\u00e1nku je zaj\u00edmav\u00fd p\u0159\u00edklad \u0161ifrovac\u00edho malwaru. Byl zam\u00fd\u0161len, zd\u00e1 se, jako dal\u0161\u00ed \u201evyko\u0159is\u0165ovatel\u201c, ale jeho technick\u00e1 realizace v\u00edce p\u0159ipom\u00edn\u00e1 n\u011b\u010d\u00ed zl\u00fd vtip. O t\u00e9to realizaci si dnes pov\u00edme. <\/p>\n<p>Bohu\u017eel, sledov\u00e1n\u00ed \u017eivotn\u00edho cyklu tohoto enkod\u00e9ru je prakticky nemo\u017en\u00e9 - statistiky o n\u011bm jsou p\u0159\u00edli\u0161 skromn\u00e9, proto\u017ee se mu, na\u0161t\u011bst\u00ed, nedostalo \u0161irok\u00e9ho roz\u0161\u00ed\u0159en\u00ed. Proto nech\u00e1me stranou p\u016fvod, metody infekce a dal\u0161\u00ed zm\u00ednky. \u0158ekneme si jen o na\u0161em setk\u00e1n\u00ed s <b>Wulfric Ransomware<\/b> a o tom, jak jsme pomohli u\u017eivateli zachr\u00e1nit jeho soubory. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Jak to v\u0161echno za\u010dalo<\/h3>\n<p>\nNa\u0161\u00ed antivirov\u00e9 laborato\u0159i se \u010dasto oz\u00fdvaj\u00ed lid\u00e9, kte\u0159\u00ed byli posti\u017eeni \u0161ifrovac\u00edmi malwaremi. Pom\u00e1h\u00e1me, bez ohledu na to, jak\u00e9 antivirov\u00e9 produkty maj\u00ed nainstalovan\u00e9. Tentokr\u00e1t se na n\u00e1s obr\u00e1til \u010dlov\u011bk, jeho\u017e soubory byly zasa\u017eeny nezn\u00e1m\u00fdm enkod\u00e9rem.<\/p>\n<blockquote><p>Dobr\u00fd den! Byly za\u0161ifrov\u00e1ny soubory na file storage (samba4) s p\u0159\u00edstupem bez hesla. Podez\u0159\u00edv\u00e1m, \u017ee n\u00e1kaza p\u0159i\u0161la z po\u010d\u00edta\u010de dcery (Windows 10 s b\u011b\u017enou ochranou Windows Defender). Po\u010d\u00edta\u010d dcery nebyl od t\u00e9 doby zapnut. Soubory jsou za\u0161ifrov\u00e1ny hlavn\u011b .jpg a .cr2. Roz\u0161\u00ed\u0159en\u00ed soubor\u016f po \u0161ifrov\u00e1n\u00ed: .aef.<\/p><\/blockquote>\n<p>Dostali jsme od u\u017eivatele vzorky za\u0161ifrovan\u00fdch soubor\u016f, v\u00fdkupn\u00ed dopis a soubor, kter\u00fd pravd\u011bpodobn\u011b je kl\u00ed\u010dem pot\u0159ebn\u00fdm autorovi \u0161ifrovac\u00edho malwaru pro de\u0161ifrov\u00e1n\u00ed soubor\u016f.<\/p>\n<p>To jsou v\u0161echny na\u0161e stopy:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nPod\u00edvejme se na v\u00fdkupn\u00ed dopis. Kolik bitcoin\u016f je tentokr\u00e1t? <\/p>\n<p><b>P\u0159eklad:<\/b><\/p>\n<blockquote><p>Pozor, va\u0161e soubory jsou za\u0161ifrov\u00e1ny!<br \/>\nheslo je jedine\u010dn\u00e9 pro v\u00e1\u0161 po\u010d\u00edta\u010d.<\/p>\n<p>Zapla\u0165te \u010d\u00e1stku 0.05 BTC na bitcoinovou adresu: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nPo zaplacen\u00ed mi za\u0161lete e-mail, p\u0159i\u010dem\u017e p\u0159ilo\u017ete soubor pass.key na Wulfric@gmx.com s ozn\u00e1men\u00edm o platb\u011b.<\/p>\n<p>Po potvrzen\u00ed v\u00e1m po\u0161lu de\u0161ifrovac\u00ed n\u00e1stroj pro soubory.<\/p>\n<p>M\u016f\u017eete platit bitcoiny online r\u016fzn\u00fdmi zp\u016fsoby:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> \u2014 platba kreditn\u00ed kartou<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>O bitcoinech:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nPokud m\u00e1te n\u011bjak\u00e9 dotazy, napi\u0161te mi na Wulfric@gmx.com<br \/>\nJako bonus v\u00e1m uk\u00e1\u017eu, jak byl v\u00e1\u0161 po\u010d\u00edta\u010d napaden a jak se v budoucnu chr\u00e1nit.<\/p><\/blockquote>\n<p>\nPatetick\u00fd vlk, povolan\u00fd uk\u00e1zat ob\u011bti v\u00e1\u017enost situace. Mohlo to v\u0161ak b\u00fdt i hor\u0161\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 1. -Jako bonus v\u00e1m uk\u00e1\u017eu, jak chr\u00e1nit v\u00e1\u0161 po\u010d\u00edta\u010d v budoucnu. \u2013Zn\u00ed d\u016fv\u011bryhodn\u011b.<\/b><\/p>\n<h3>II. Za\u010d\u00edn\u00e1me pracovat<\/h3>\n<p>\nNejd\u0159\u00edve jsme se pod\u00edvali na strukturu zaslan\u00e9ho vzoru. Jak p\u0159ekvapiv\u00e9, nevypadal jako soubor napaden\u00fd ransomwarem. Otev\u00edr\u00e1me hexadecim\u00e1ln\u00ed editor a kouk\u00e1me. V prvn\u00edch 4 bytech je p\u016fvodn\u00ed velikost souboru, dal\u0161\u00edch 60 bytech jsou nuly. Ale to nejzaj\u00edmav\u011bj\u0161\u00ed je na konci:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 2. Analyzujeme po\u0161kozen\u00fd soubor. Co n\u00e1s okam\u017eit\u011b zaujme?<\/b><\/p>\n<p>V\u0161echno se uk\u00e1zalo b\u00fdt zbyte\u010dn\u011b jednoduch\u00e9: 0x40 byte z hlavi\u010dky bylo p\u0159esunuto na konec souboru. Pro obnovu dat sta\u010d\u00ed je vr\u00e1tit na za\u010d\u00e1tek. P\u0159\u00edstup k souboru byl obnoven, ale n\u00e1zev z\u016fstal za\u0161ifrov\u00e1n a situace je s n\u00edm slo\u017eit\u011bj\u0161\u00ed. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 3. Za\u0161ifrovan\u00fd n\u00e1zev v Base64 vypad\u00e1 jako nesmysln\u00e1 sekvence symbol\u016f. <\/b><\/p>\n<p>Zkus\u00edme to rozebrat <b>pass.key<\/b>, kter\u00fd u\u017eivatel poslal. Vid\u00edme v n\u011bm 162- byteovou sekvenci symbol\u016f v ASCII.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 4. 162 symbol\u016f zanechan\u00fdch na PC ob\u011bti. <\/b><\/p>\n<p>Pokud se pod\u00edv\u00e1me bl\u00ed\u017ee, m\u016f\u017eeme si v\u0161imnout, \u017ee se symboly opakuj\u00ed s ur\u010dit\u00fdm intervalem. To m\u016f\u017ee nazna\u010dovat pou\u017eit\u00ed XOR, kde jsou opakov\u00e1n\u00ed typick\u00e1, a jejich frekvence z\u00e1vis\u00ed na d\u00e9lce kl\u00ed\u010de. Jakmile jsme rozd\u011blili \u0159et\u011bzec na 6 symbol\u016f a proXORovali s n\u011bkter\u00fdmi variantami XOR-sekvenc\u00ed, \u017e\u00e1dn\u00e9ho smyslupln\u00e9ho v\u00fdsledku jsme nedos\u00e1hli.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 5. Vid\u00edte opakuj\u00edc\u00ed se konstanty uprost\u0159ed?<\/b> <\/p>\n<p>Rozhodli jsme se googlit konstanty, proto\u017ee pro\u010d ne! A v\u0161echny nakonec vedly k jednomu algoritmu \u2013 Batch Encryption. Po prostudov\u00e1n\u00ed skriptu bylo jasn\u00e9, \u017ee n\u00e1\u0161 \u0159et\u011bzec nen\u00ed nic jin\u00e9ho ne\u017e v\u00fdsledek jeho pr\u00e1ce. Je t\u0159eba zm\u00ednit, \u017ee to rozhodn\u011b nen\u00ed ransomware, ale pouh\u00fd k\u00f3dova\u010d, kter\u00fd nahrazuje symboly 6-byteov\u00fdmi sekvencemi. \u017d\u00e1dn\u00e9 kl\u00ed\u010de nebo jin\u00e9 tajemstv\u00ed \ud83d\ude41<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 6. Kousek origin\u00e1ln\u00edho algoritmu nezn\u00e1m\u00e9ho p\u016fvodu. <\/b><\/p>\n<p>Algoritmus by nefungoval, jak m\u00e1, kdyby nebylo jednoho detailu:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 7. Morpheus schv\u00e1len.<\/b><\/p>\n<p>Pomoc\u00ed inverzn\u00ed substituce m\u011bn\u00edme \u0159et\u011bzec z <b>pass.key<\/b> v textu o 27 znac\u00edch. Zvl\u00e1\u0161tn\u00ed pozornost zasluhuje lidsk\u00fd (nejsp\u00ed\u0161) text \u2018asmodat\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 8. USGFDG=7.<\/b><\/p>\n<p>Op\u011bt n\u00e1m pom\u016f\u017ee Google. Po men\u0161\u00edm hled\u00e1n\u00ed nal\u00e9z\u00e1me zaj\u00edmav\u00fd projekt na GitHubu \u2013 Folder Locker, napsan\u00fd na .Net a vyu\u017e\u00edvaj\u00edc\u00ed knihovnu \u2018asmodat\u2019 z jin\u00e9ho \u00fa\u010dtu na \u201eGitu\u201c. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 9. Rozhran\u00ed Folder Locker. Ov\u011b\u0159ili jsme na \u0161kodlivost. <\/b><\/p>\n<p>N\u00e1stroj p\u0159edstavuje \u0161ifrovac\u00ed program pro Windows 7 a vy\u0161\u0161\u00ed, kter\u00fd je dostupn\u00fd jako open-source. P\u0159i \u0161ifrov\u00e1n\u00ed se pou\u017e\u00edv\u00e1 heslo, kter\u00e9 je pot\u0159eba pro n\u00e1sledn\u00e9 de\u0161ifrov\u00e1n\u00ed. Umo\u017e\u0148uje pr\u00e1ci jak s jednotliv\u00fdmi soubory, tak s cel\u00fdmi adres\u00e1\u0159i.<\/p>\n<p>Jeho knihovna vyu\u017e\u00edv\u00e1 symetrick\u00fd \u0161ifrovac\u00ed algoritmus Rijndael v re\u017eimu CBC. Zaj\u00edmav\u00e9 je, \u017ee velikost bloku byla zvolena na 256 bit\u016f \u2013 na rozd\u00edl od standardu AES, kde je velikost omezena na 128 bit\u016f. <\/p>\n<p>N\u00e1\u0161 kl\u00ed\u010d je generov\u00e1n podle standardu PBKDF2. Jako heslo slou\u017e\u00ed SHA-256 zadan\u00e9ho \u0159et\u011bzce v n\u00e1stroji. Nyn\u00ed zb\u00fdv\u00e1 jen nal\u00e9zt tento \u0159et\u011bzec, abychom vytvo\u0159ili kl\u00ed\u010d pro de\u0161ifrov\u00e1n\u00ed. <\/p>\n<p>No, vra\u0165me se k ji\u017e de\u0161ifrovan\u00e9mu <b>pass.key<\/b>. Pamatujete onen \u0159et\u011bzec s \u010d\u00edsly a textem \u2018asmodat\u2019? Zkou\u0161\u00edme pou\u017e\u00edt prvn\u00edch 20 byt\u016f \u0159et\u011bzce jako heslo pro Folder Locker. <\/p>\n<p>Pod\u00edvejte se, funguje to! Kl\u00ed\u010dov\u00e9 slovo sed\u00ed a v\u0161echno se kr\u00e1sn\u011b de\u0161ifrovalo. Soud\u011b podle symbol\u016f hesla \u2013 jde o HEX-reprezentaci ur\u010dit\u00e9ho slova v ASCII. Zkus\u00edme zobrazen\u00ed kl\u00ed\u010dov\u00e9ho slova v textov\u00e9m form\u00e1tu. Dost\u00e1v\u00e1me \u2018<b>shadowwolf<\/b>\u2019. U\u017e c\u00edt\u00edte p\u0159\u00edznaky lycantropie?<\/p>\n<p>Pod\u00edvejme se znovu na strukturu napaden\u00e9ho souboru, tentokr\u00e1t ji\u017e s v\u011bdom\u00edm mechanismu provozu lockera:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 re\u017eim \u0161ifrov\u00e1n\u00ed n\u00e1zv\u016f;<\/li>\n<li>58 00 00 00 \u2013 d\u00e9lka za\u0161ifrovan\u00e9ho a k\u00f3dovan\u00e9ho v base64 n\u00e1zvu souboru;<\/li>\n<li>40 00 00 00 \u2013 velikost p\u0159enesen\u00e9 hlavi\u010dky.<\/li>\n<\/ul>\n<p>\n\u010cerven\u011b a \u017elut\u011b jsou zv\u00fdrazn\u011bny za\u0161ifrovan\u00fd n\u00e1zev a p\u0159enesen\u00e1 hlavi\u010dka. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 10. \u010cerven\u011b je zv\u00fdrazn\u011bn za\u0161ifrovan\u00fd n\u00e1zev, \u017elut\u011b \u2013 p\u0159enesen\u00e1 hlavi\u010dka. <\/b><\/p>\n<p>A nyn\u00ed porovnejme za\u0161ifrovan\u00e9 a de\u0161ifrovan\u00e9 n\u00e1zvy v \u0161estn\u00e1ctkov\u00e9 reprezentaci. <\/p>\n<p>Struktura de\u0161ifrovan\u00fdch dat:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 odpad vytvo\u0159en\u00fd n\u00e1strojem (4 bajty);<\/li>\n<li>0\u0421 00 00 00 \u2013 d\u00e9lka de\u0161ifrovan\u00e9ho n\u00e1zvu (12 bajt\u016f);<\/li>\n<li>n\u00e1sleduje vlastn\u00ed n\u00e1zev souboru a dopln\u011bn\u00ed nulami do po\u017eadovan\u00e9 d\u00e9lky bloku (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 ransomware, kter\u00fd neexistuje\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Obr. 11. IMG_4114 vypad\u00e1 daleko l\u00e9pe. <\/b><\/p>\n<h3>III. Z\u00e1v\u011bry a shrnut\u00ed<\/h3>\n<p>\nVra\u0165me se na za\u010d\u00e1tek. Nev\u00edme, co vedlo autora Wulfric.Ransomware a jak\u00e9ho c\u00edle cht\u011bl dos\u00e1hnout. Pro b\u011b\u017en\u00e9ho u\u017eivatele je v\u0161ak v\u00fdsledek pr\u00e1ce takov\u00e9ho ransomwaru skute\u010dn\u011b velk\u00fdm probl\u00e9mem. Soubor se neotev\u0159e. V\u0161echny n\u00e1zvy zmizely. M\u00edsto obvykl\u00e9ho obr\u00e1zku se na obrazovce zobrazuje vlk. Nut\u00ed n\u00e1s to \u010d\u00edst o bitcoinech. <\/p>\n<p>Pravda, tentokr\u00e1t se za maskou \u201ed\u011bsiv\u00e9ho \u0161ifrovatele\u201c skr\u00fdval takov\u00fd absurdn\u00ed a bezhlav\u00fd pokus o vyd\u00edr\u00e1n\u00ed, kdy \u00fato\u010dn\u00edk pou\u017e\u00edv\u00e1 hotov\u00e9 programy a nech\u00e1v\u00e1 kl\u00ed\u010de p\u0159\u00edmo na m\u00edst\u011b \u010dinu. <\/p>\n<p>Mimochodem, o kl\u00ed\u010d\u00edch. Nem\u011bli jsme \u017e\u00e1dn\u00fd \u0161kodliv\u00fd skript nebo trojana, podle kter\u00e9ho bychom mohli pochopit, jak do\u0161lo k tomu <b>pass.key<\/b> \u2013 mechanismus vzniku souboru na infikovan\u00e9m PC z\u016fst\u00e1v\u00e1 nezn\u00e1m\u00fd. Ale pamatuji si, \u017ee ve sv\u00e9m vzkazu autor zmi\u0148oval jedine\u010dnost hesla. Tak\u017ee, k\u00f3dov\u00e9 slovo pro de\u0161ifrov\u00e1n\u00ed je stejn\u011b jedine\u010dn\u00e9, jako je jedine\u010dn\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no shadow wolf \ud83d\ude42<\/p>\n<p>A p\u0159ece, shadow wolf, pro\u010d a jak\u00fd m\u00e1\u0161 \u00famysl?<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0161ifrovac\u00ed software, kter\u00fd neexistuje | ProHoster","description":"N\u011bkdy by bylo tak skv\u011bl\u00e9 pod\u00edvat se n\u011bjak\u00e9mu tv\u016frci vir\u016f do o\u010d\u00ed a zeptat se: pro\u010d a jak\u00fd m\u00e1\u0161 pl\u00e1n?","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?","og:url":"https:\/\/prohoster.info\/cs\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}