{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nA new type of ransomware encrypts files and adds the extension \".SaveTheQueen\", spreading through the SYSVOL network share on Active Directory domain controllers.<\/p>\n<p>Our clients recently encountered this malware. Below, we present our complete analysis, results, and conclusions.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Detection<\/h2>\n<\/h2>\n<p>\nOne of our clients contacted us after encountering a new type of ransomware that added the \".SaveTheQueen\" extension to newly encrypted files in their environment.<\/p>\n<p>During our investigation, specifically in the source infection tracing phase, we discovered that the spread and tracking of infected victims were conducted using <strong>the SYSVOL folder <\/strong> on the client's domain controller.<\/p>\n<p>SYSVOL is a key folder for each domain controller, used to deliver Group Policy Objects (GPO) and login\/logout scripts to domain computers. The content of this folder is replicated among domain controllers to synchronize this data across the organization's sites. Writing to SYSVOL requires high domain privileges; however, once compromised, this asset becomes a powerful tool for attackers who can use it to rapidly and effectively spread malware across the domain.<\/p>\n<p>The Varonis audit chain quickly revealed the following:<\/p>\n<ul>\n<li> An infected user account was creating a file named \u201chourly\u201d in SYSVOL<\/li>\n<li> Multiple log files were created in SYSVOL \u2014 each named after the domain device<\/li>\n<li>Various IP addresses were accessing the file \u201chourly\u201d<\/li>\n<\/ul>\n<p>\nWe concluded that the log files were used to track the infection process on new devices, and that \u201chourly\u201d is a scheduled task that executed the malware on new devices using a Powershell script \u2013 samples \u201cv3\u201d and \u201cv4\u201d.<\/p>\n<p>It appears that the attacker obtained and leveraged domain administrator privileges to write files to SYSVOL. On the infected nodes, the attacker executed PowerShell code that created a scheduled task to open, decrypt, and launch the malware.<\/p>\n<h2>\n<h2>Malware Decryptor<\/h2>\n<\/h2>\n<p>\nWe unsuccessfully tried several methods to decrypt the samples:<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWe were almost ready to give up when we decided to try the 'Magic' method of the excellent<br \/>\nutility <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> developed by GCHQ. 'Magic' attempts to guess the file encryption by performing a brute-force password attack on different encryption types and measuring entropy. <\/p>\n<p><b class=\"spoiler_title\">Translator's Note<\/b> See.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Differential Entropy<\/a><\/noindex> and <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropy in information theory<\/a><\/noindex>. This article and comments do not intend to discuss the details of the methods used by the authors, either in third-party or proprietary software. <br \/>\n<img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n'Magic' determined that a GZip packer with base64 encoding was used, allowing us to unpack the file and find the code for injection \u2013 the 'injector'.<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: 'There's an outbreak in the area! Mass vaccinations. Foot-and-mouth disease.'<\/h2>\n<p>\nThe dropper was an ordinary .NET file with no protection. After analyzing the source code using <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> , we realized that its sole purpose was to inject shell code into the winlogon.exe process.<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell Code or Simple Complexities<\/h2>\n<p>\nWe used the Hexacorn authoring tool to 'compile' the shell code into an executable file for debugging and analysis. We then discovered that it worked on both 32-bit and 64-bit machines. <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> Writing even simple shell code in native assembly can be challenging; writing full shell code that operates on both types of systems requires elite skills, so we began to marvel at the attacker's sophistication.<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWhen we dissected the compiled shell code using<\/p>\n<p>x64dbg <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">, we noticed that it was loading<\/a><\/noindex>dynamic .NET libraries <strong> , such as clr.dll and mscoreei.dll. This struck us as strange \u2013 typically, attackers try to make their shell code as small as possible by invoking native OS functions instead of loading them. <\/strong>Why would someone want to embed Windows functionality in shell code instead of making direct calls on demand? <em>Why would anyone need to embed Windows functionality in shell code instead of making a direct request? <\/em><\/p>\n<p>It turned out that the author of the malware did not write this complex shellcode at all \u2013 it utilized specific software designed to convert executable files and scripts into shellcode. <\/p>\n<p>We found a tool <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, which we thought could compile similar shellcode. Here is its description from GitHub:<\/p>\n<p><em>Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL (including .NET assemblies). This shellcode can be injected into any Windows process to execute in<br \/>\nof RAM.<\/em><\/p>\n<p>To confirm our theory, we compiled our own code using Donut and compared it to the sample \u2013 and... yes, we discovered another component of the toolkit used. After that, we were able to extract and analyze the original .NET executable file.<\/p>\n<h2> Code protection <\/h2>\n<p>\nThis file was obfuscated using <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx is an open-source .NET project for protecting other developers' code. Software of this class allows developers to protect their code from reverse engineering through methods such as: character replacement, control flow obfuscation, and hiding reference methods. Malware authors use obfuscators to avoid detection and to make reverse engineering more challenging.<\/p>\n<p>Thanks to <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> we unpacked the code:<\/p>\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> The result \u2013 payload<\/h2>\n<p>\nThe payload obtained from the transformations is a very simple ransomware. There is no presence assurance mechanism in the system, no connections to a command center \u2013 just the good old asymmetric encryption to make the victim's data unreadable.<\/p>\n<p>The main function takes the following parameters:<\/p>\n<ul>\n<li> File extension to use after encryption (SaveTheQueen) <\/li>\n<li> Author's email to include in the ransom note file<\/li>\n<li> Public key used for encrypting files <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>The process looks as follows:<\/strong><\/p>\n<ol>\n<li> The malware scans local and connected drives on the victim's device\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Looks for files to encrypt\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Attempts to terminate the process using the file it is about to encrypt<\/li>\n<li> Renames the file to 'Original_file_name.SaveTheQueenING', using the MoveFile function, and encrypts it <\/li>\n<li>After the file is encrypted with the author's public key, the malware renames it to \".Original_File_Name.SaveTheQueen\".<\/li>\n<li>The ransom note is created in the same folder as the file.\n<p><img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nBased on the use of the native 'CreateDecryptor' function, one of the malware's functions appears to include a decryption mechanism that requires the private key as a parameter.<\/p>\n<p>Ransomware <strong>DOES NOT encrypt files<\/strong>, stored in the directories:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>It also <strong>DOES NOT encrypt the following file types:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Summary and Conclusions<\/h2>\n<\/h2>\n<p>\nAlthough the ransomware itself did not contain any unusual features, the attacker creatively used Active Directory to spread the dropper, and the malware itself presented us with interesting, albeit not particularly complex, challenges during analysis. <\/p>\n<p>We believe that the author of the malware:<\/p>\n<ol>\n<li>Wrote the ransomware with an embedded injection into the winlogon.exe process, as well as<br \/>\nfunctionality for encrypting and decrypting files.<\/li>\n<li>Masked the malicious code using ConfuserEx, transformed the result with Donut, and further concealed the dropper using base64 Gzip.<\/li>\n<li>Gained elevated privileges in the victim's domain and used them to copy<br \/>\nthe encrypted malware and scheduled tasks to the SYSVOL network folder on domain controllers.<\/li>\n<li>Executed a PowerShell script on domain devices to spread the malware and log attack progress in SYSVOL.<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Ransom like a queen: Varonis investigates the rapidly spreading ransomware \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIf you have any questions about this variant of the ransomware, or any other investigations carried out by our forensic and incident response teams, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">please contact us <\/a><\/noindex> or request <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">a live demonstration of attack response<\/a><\/noindex>, where we always answer questions during a Q&amp;A session.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ransom - the queen: Varonis investigates the rapidly spreading ransomware 'SaveTheQueen' | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}