{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nEn ny type ransomware krypterer filer og tilf\u00f8jer dem filtypenavnet \".SaveTheQueen\", og spreder sig gennem den systemnetv\u00e6rksmappe, der hedder SYSVOL, p\u00e5 Active Directory-dom\u00e6nekontrollere.<\/p>\n<p>Vores kunder har for nylig st\u00f8dt p\u00e5 denne malware. Vi pr\u00e6senterer vores fulde analyse, resultater og konklusioner nedenfor.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Opdagelse<\/h2>\n<\/h2>\n<p>\nEn af vores kunder kontaktede os, efter at de st\u00f8dte p\u00e5 en ny type ransomware, der tilf\u00f8jede filtypenavnet \".SaveTheQueen\" til nye krypterede filer i deres milj\u00f8.<\/p>\n<p>Under vores efterforskning, n\u00e6rmere bestemt i fasen med at finde smittekilder, fandt vi ud af, at spredning og sporing af inficerede ofre blev foretaget ved hj\u00e6lp af <strong>netv\u00e6rksmappen SYSVOL <\/strong> p\u00e5 kundens dom\u00e6nekontroller.<\/p>\n<p>SYSVOL er en n\u00f8gleresource for hver dom\u00e6nekontroller, der bruges til at levere gruppepolitiksobjekter (GPO) og login\/logout-scripts til dom\u00e6necomputere. Indholdet af denne mappe replikeres mellem dom\u00e6nekontrollere for at synkronisere disse data p\u00e5 organisationens placeringer. At skrive til SYSVOL kr\u00e6ver h\u00f8je dom\u00e6neprivilegier, men efter en kompromittering bliver denne ressource et kraftfuldt v\u00e6rkt\u00f8j for angribere, der kan bruge det til hurtigt og effektivt at sprede malware over dom\u00e6net.<\/p>\n<p>Varonis' revisionsk\u00e6de hjalp med hurtigt at identificere f\u00f8lgende:<\/p>\n<ul>\n<li> Den inficerede brugerkonto oprettede en fil med navnet \"hourly\" i SYSVOL<\/li>\n<li> Mange logfiler blev oprettet i SYSVOL \u2013 hver opkaldt efter det dom\u00e6neapparat<\/li>\n<li>Mange forskellige IP-adresser havde adgang til filen \"hourly\"<\/li>\n<\/ul>\n<p>\nVi konkluderede, at logfilerne blev brugt til at spore infektionseprocessen p\u00e5 nye enheder, og at \"hourly\" var en planlagt opgave, der udf\u00f8rte malware p\u00e5 nye enheder ved hj\u00e6lp af Powershell-script \u2013 pr\u00f8verne \"v3\" og \"v4\".<\/p>\n<p>Angriberen fik sandsynligvis adgang til og brugte dom\u00e6neadministratorprivilegier til at skrive filer til SYSVOL. P\u00e5 de inficerede noder k\u00f8rte angriberen PowerShell-kode, der oprettede en planlagt opgave for at \u00e5bne, dekryptere og k\u00f8re malware.<\/p>\n<h2>\n<h2>Dekryptering af malware<\/h2>\n<\/h2>\n<p>\nVi har uden held pr\u00f8vet flere metoder til dekryptering af pr\u00f8verne:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVi var n\u00e6sten klar til at give op, da vi besluttede at pr\u00f8ve \"Magic\" metoden, skabt af<br \/>\nv\u00e6rkt\u00f8j <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> GCHQ. \"Magic\" fors\u00f8ger at g\u00e6tte filens kryptering ved at pr\u00f8ve forskellige typer kryptering og m\u00e5le entropien. <\/p>\n<p><b class=\"spoiler_title\">Overs\u00e6tterens note<\/b> Se.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Differential entropi<\/a><\/noindex> og <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropi i informationsteori<\/a><\/noindex>. Denne artikel og kommentarerne giver ikke mulighed for diskussion fra forfatterne om detaljer i metoderne, der er brugt i b\u00e5de tredjeparts og propriet\u00e6r software. <br \/>\n<img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\"Magic\" fastslog, at en GZip-packer med base64-kodning blev anvendt, hvilket gjorde det muligt for os at udpakkefilen og opdage koden til injektionen \u2013 \"injectoren\".<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: \"Der er en epidemi i omr\u00e5det! Massesvaccinationer. Mund- og klovesyge\"<\/h2>\n<p>\nDropperen var en almindelig .NET fil uden nogen form for beskyttelse. Efter at have l\u00e6st kildekoden ved hj\u00e6lp af <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> forstod vi, at dets eneste m\u00e5l var at injicere shell-kode i processen winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell-kode eller enkle komplikationer<\/h2>\n<p>\nVi brugte et v\u00e6rkt\u00f8j fra Hexacorn \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> til at \"kompilere\" shell-koden til en eksekverbar fil til fejlfinding og analyse. Derefter opdagede vi, at den fungerede p\u00e5 b\u00e5de 32- og 64-bit systemer.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAt skrive selv simpel shell-kode i naturlig overs\u00e6ttelse fra assembler kan v\u00e6re sv\u00e6rt; at skrive komplet shell-kode, der fungerer p\u00e5 begge systemtyper, kr\u00e6ver elitetalenter, s\u00e5 vi begyndte at undre os over angriberens finesse.<\/p>\n<p>Da vi analyserede den kompilerede shell-kode ved hj\u00e6lp af <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, bem\u00e6rkede vi, at den indl\u00e6ste <strong> dynamiske .NET biblioteker <\/strong>, s\u00e5som clr.dll og mscoreei.dll. Det virkede underligt for os \u2013 normalt fors\u00f8ger ondsindede at g\u00f8re shell-koden s\u00e5 lille som muligt ved at kalde de native OS-funktioner i stedet for at indl\u00e6se dem. <em>Hvorfor skulle nogen indbygge Windows-funktionalitet i shell-koden i stedet for at kalde dem direkte efter behov? <\/em><\/p>\n<p>Som det viste sig, havde forfatteren af malware slet ikke skrevet denne komplekse shell-kode \u2013 der blev brugt et typisk v\u00e6rkt\u00f8j til denne opgave til at konvertere eksekverbare filer og scripts til shell-kode. <\/p>\n<p>Vi fandt v\u00e6rkt\u00f8jet <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, som vi mente kunne komprimere lignende shell-kode. Her er dens beskrivelse fra GitHub:<\/p>\n<p><em>Donut genererer shell-kode x86 eller x64 fra VBScript, JScript, EXE, DLL (inklusive .NET assemblies). Denne shell-kode kan injiceres i enhver Windows-proces for eksekvering.<br \/>\nRAM.<\/em><\/p>\n<p>For at bekr\u00e6fte vores teori komponerede vi vores egen kode ved hj\u00e6lp af Donut og sammenlignede den med et sample \u2013 og... ja, vi fandt endnu en komponent af det anvendte v\u00e6rkt\u00f8j. Derefter kunne vi allerede udtr\u00e6kke og analysere den oprindelige eksekverbare fil p\u00e5 .NET.<\/p>\n<h2> Kodebeskyttelse <\/h2>\n<p>\nDenne fil blev obfuskeret ved hj\u00e6lp af <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx er et .NET projekt med \u00e5bne kildekoder til beskyttelse af andres kode. Denne softwaremulighed g\u00f8r det muligt for udviklere at beskytte deres kode mod reverse engineering gennem metoder som: erstatning af symboler, masking af kontrolstr\u00f8mmen og skjulning af referencemetoden. Skadelig software bruger obfuskatorer for at undg\u00e5 registrering og for at g\u00f8re reverse engineering sv\u00e6rere.<\/p>\n<p>Takket v\u00e6re <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> vi pakkede koden ud:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Resultatet \u2013 nyttelasten<\/h2>\n<p>\nDen fremkomne nyttelast er en meget simpel ransomware. Ingen mekanisme til opretholdelse i systemet, ingen forbindelser til kommandocenteret \u2013 kun gammeldags asymmetrisk kryptering for at g\u00f8re offerets data ul\u00e6selige.<\/p>\n<p>Hovedfunktionen v\u00e6lger f\u00f8lgende strenge som parametre:<\/p>\n<ul>\n<li> Filtypen til brug efter kryptering (SaveTheQueen) <\/li>\n<li> Forfatterens e-mail, s\u00e5 den kan placeres i ransom note-filen<\/li>\n<li> Offentligt n\u00f8gle, som bruges til at kryptere filer <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Selve processen ser s\u00e5ledes ud:<\/strong><\/p>\n<ol>\n<li> Malwaren scanner lokale og tilsluttede drev p\u00e5 offerets enhed\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Leder efter filer til kryptering\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Fors\u00f8ger at afslutte processen, der bruger den fil, den vil kryptere<\/li>\n<li> Omd\u00f8ber filen til \"Original_filnavn.SaveTheQueenING\" ved hj\u00e6lp af MoveFile funktionaliteten og krypterer den <\/li>\n<li>Efter at filen er krypteret med forfatterens offentlig n\u00f8gle, omd\u00f8ber malware den igen, nu til \"Oprindeligt_filenavn.SaveTheQueen\".<\/li>\n<li>Der skrives en ransom note-fil til samme mappe\n<p><img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nBaseret p\u00e5 brugen af den native funktion \"CreateDecryptor\", synes en af malwarens funktioner at indeholde en dekrypteringsmekanisme, der kr\u00e6ver den private n\u00f8gle som parameter.<\/p>\n<p>Ransomware <strong>KRYPER IKKE filer<\/strong>, der ligger i mapperne:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Det krypterer heller ikke f\u00f8lgende filtyper: <strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Konklusioner og resultater<\/h2>\n<\/h2>\n<p>\nSelvom selve ransomware-virus ikke indeholdt nogen us\u00e6dvanlige funktioner, brugte angriberen kreativt Active Directory til at sprede dropperen, og selve malware'en gav os interessante, om end ikke komplicerede, forhindringer under analysen. <\/p>\n<p>Vi mener, at forfatteren til malware:<\/p>\n<ol>\n<li>Skrev ransomware med indbygget inds\u00e6ttelse i processen winlogon.exe samt<br \/>\nfunktionalitet til kryptering og dekryptering af filer.<\/li>\n<li>Maskerede malware-koden ved hj\u00e6lp af ConfuserEx, konverterede resultatet med Donut og skjulte yderligere dropperen med base64 Gzip.<\/li>\n<li>Fik forh\u00f8jede privilegier i offerets dom\u00e6ne og brugte dem til at kopiere<br \/>\nden krypterede malware og opgaver til planl\u00e6gning i netv\u00e6rksmappen SYSVOL p\u00e5 dom\u00e6necontrollerne.<\/li>\n<li>K\u00f8rte PowerShell-script p\u00e5 dom\u00e6nets enheder for at sprede malware og registrere angrebets fremskridt i logfiler i SYSVOL.<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"K\u00f8be \u2014 s\u00e5dan er dronningen: Varonis unders\u00f8ger den hastigt sprede ransomware \u2019SaveTheQueen\u2019\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHvis du har sp\u00f8rgsm\u00e5l om denne variant af ransomware, eller om noget andet, som vores teams har udf\u00f8rt inden for retsmedicinsk og unders\u00f8gelse af it-sikkerhedsh\u00e6ndelser, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">kontakt os <\/a><\/noindex> eller anmod om <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">en live demonstration af angrebsh\u00e5ndtering,<\/a><\/noindex>hvor vi altid besvarer sp\u00f8rgsm\u00e5l i l\u00f8bet af sp\u00f8rgsm\u00e5ls- og svarsessionen.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47For at betale - s\u00e5 dronningen: Varonis unders\u00f8ger hurtigt spredende ransomware \"SaveTheQueen\" | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}