{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>M\u00f5nikord tahaks vaadata m\u00f5ne viiruse kirjutaja silmadesse ja k\u00fcsida: miks ja milleks? Kuidas me sellega hakkama saame, sellega saame ise hakkama, aga oleks v\u00e4ga huvitav teada, mida m\u00f5tles \u00fcks v\u00f5i teine pahavara looja. Eriti kui leiame selliseid \u00abp\u00e4rleid\u00bb.<\/p>\n<p>K\u00e4esoleva artikli kangelane on huvitav n\u00e4ide kr\u00fcptohjajast. Tundub, et ta m\u00f5eldi v\u00e4lja kui j\u00e4rjekordne \u00ablunastaja\u00bb, kuid tema tehniline teostus sarnaneb pigem kellegi kurjale naljale. T\u00e4na r\u00e4\u00e4gimegi just sellest teostusest. <\/p>\n<p>Kahjuks on selle kodeerija eluts\u00fckli j\u00e4lgimine praktiliselt v\u00f5imatu \u2013 statistika on tema kohta liiga v\u00e4he, kuna ta ei ole, \u00f5nneks, laialdaselt levinud. J\u00e4tame seega k\u00f5rvale p\u00e4ritolu, nakkusmeetodid ja muud mainimised. R\u00e4\u00e4gime vaid meie tutvumisest <b>Wulfric Ransomware<\/b> ja sellest, kuidas me aitasime kasutajal tema faile p\u00e4\u00e4sta. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Kuidas k\u00f5ik algas<\/h3>\n<p>\nMeie viiruset\u00f5rje laborisse p\u00f6\u00f6rdub sageli inimesi, kes on kannatanud kr\u00fcpteerijate t\u00f5ttu. Me aitame, s\u00f5ltumata sellest, millised viiruset\u00f5rje programmid neil on. Seekord p\u00f6\u00f6rdus meie poole inimene, kelle failid said tundmatu kodeerija ohvriks.<\/p>\n<blockquote><p>Tere p\u00e4evast! Failid salvestuses (samba4) on kr\u00fcpteeritud, sissep\u00e4\u00e4s on ilma paroolita. Kahtlustan, et viirus tuli t\u00fctarde arvutist (Windows 10 koos vaikeseade Windows Defenderiga). T\u00fctarde arvutit ei ole p\u00e4rast seda sisse l\u00fclitatud. Failid on peamiselt .jpg ja .cr2 formaadis. Failide laiend p\u00e4rast kr\u00fcptimist: .aef.<\/p><\/blockquote>\n<p>Oleme kasutajalt saanud n\u00e4idiseid kr\u00fcpteeritud failidest, lunapakkumise m\u00e4rkusest ja faili, mis t\u00f5en\u00e4oliselt on v\u00f5ti, mida kr\u00fcpteerija vajab failide dekodeerimiseks.<\/p>\n<p>Siin on k\u00f5ik meie vihjed:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nVaatame m\u00e4rkust. Kui palju bitcoine seekord? <\/p>\n<p><b>T\u00f5lge:<\/b><\/p>\n<blockquote><p>T\u00e4helepanu, teie failid on kr\u00fcpteeritud!<br \/>\nparool on teie arvutiga ainulaadne.<\/p>\n<p>Makske summa 0.05 BTC bitcoiniaadressile: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nP\u00e4rast maksmist saatke mulle kiri, lisades faili pass.key aadressile Wulfric@gmx.com makse kinnitamisega.<\/p>\n<p>P\u00e4rast kinnitamist saadab ma teile failide dekr\u00fcptori.<\/p>\n<p>Saate maksta Bitcoine internetis erinevate meetoditega:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> \u2014 makse krediitkaardiga<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>Bitcoinidest:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nKui teil on k\u00fcsimusi, kirjutage mulle aadressile Wulfric@gmx.com<br \/>\nLisaboonusena r\u00e4\u00e4gin, kuidas teie arvuti l\u00f6\u00f6di ja kuidas seda tulevikus kaitsta.<\/p><\/blockquote>\n<p>\nPatoslik hunt, kelle \u00fclesanne on n\u00e4idata ohvrile olukorra t\u00f5sidust. Kuigi v\u00f5iks olla hullem.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 1. -Lisaboonusena r\u00e4\u00e4gin, kuidas tulevikus oma arvutit kaitsta. -Tundub usutav.<\/b><\/p>\n<h3>II. Alustame t\u00f6\u00f6d<\/h3>\n<p>\nEsiteks vaatasime saadetud n\u00e4idise struktuuri. \u00dcllataval kombel ei olnud see sarnane faili, mis oli olnud kr\u00fcpteeritud. Avame heksade Redaktori ja vaatame. Esimeses 4 baitis on algne faili suurus, j\u00e4rgmised 60 baiti on t\u00e4idetud nullidega. Aga huvitavam osa asub l\u00f5pus:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 2. Anal\u00fc\u00fcsime kahjustatud faili. Mis kohe silma paistab?<\/b><\/p>\n<p>K\u00f5ik osutus \u00fcllatavalt lihtsaks: 0x40 baiti pealkirjast viidi faili l\u00f5ppu. Andmete taastamiseks piisab lihtsalt nende algusesse naasmisest. Failile p\u00e4\u00e4s on taastatud, kuid nime kaitseks on see endiselt kr\u00fcpteeritud, ja sellega on keerulisem. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joon. 3. Kr\u00fcpteeritud nimi Base64-s n\u00e4eb v\u00e4lja nagu m\u00f5tetu s\u00fcmbolite kogum. <\/b><\/p>\n<p>Proovime anal\u00fc\u00fcsida <b>pass.key<\/b>, mille kasutaja saatis. Sellest n\u00e4eme 162-baitist s\u00fcmbolite j\u00e4rjekorda ASCII-s.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joon. 4. 162 s\u00fcmbolit, mis j\u00e4id ohvri arvutisse. <\/b><\/p>\n<p>Kui l\u00e4hemalt vaadata, siis v\u00f5ib m\u00e4rgata, et s\u00fcmbolid korduvad teatud perioodilisusega. See v\u00f5ib viidata XOR-i kasutamisele, kus kordumised on iseloomulikud ning nende sagedus s\u00f5ltub v\u00f5tme pikkusest. Jagades stringi 6 s\u00fcmboliks ja XORides seda m\u00f5nede XOR-j\u00e4rjekordade variantidega, ei saavutanud me mingit m\u00f5istetavat tulemust.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joon. 5. Kas n\u00e4ete korduvaid konstante keskel?<\/b> <\/p>\n<p>Otsustasime uurida konstandte, sest jah, ka nii saab! Ja k\u00f5ik need viisid l\u00f5puks \u00fche algoritmini \u2212 Batch Encryption. Skripti uurides sai selgeks, et meie rida ei ole midagi muud kui selle t\u00f6\u00f6 tulemus. Tuleks mainida, et see ei ole kr\u00fcptograaf, vaid lihtsalt kodeerija, mis asendab s\u00fcmbolid 6-baitiliste j\u00e4rjestustega. Ei mingeid v\u00f5tmeid v\u00f5i muid saladusi \ud83d\ude41<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 6. Originaalalgoritmi t\u00fckk, mille autor ei ole teada. <\/b><\/p>\n<p>Algoritm ei t\u00f6\u00f6taks korralikult, kui mitte \u00fcks detail:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 7. Morpheus poolt heaks kiidetud.<\/b><\/p>\n<p>Tagasip\u00f6\u00f6ramise asendamisega muundame rea <b>pass.key<\/b> 27 s\u00fcmbolist tekstiks. Erilist t\u00e4helepanu v\u00e4\u00e4rib inimlik (t\u00f5en\u00e4oliselt) tekst \u2018asmodat\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 8. USGFDG=7.<\/b><\/p>\n<p>Google aitab meid taas. P\u00e4rast v\u00e4ikest otsingut leiame huvitava projekti GitHubis \u2013 Folder Locker, mis on kirjutatud .Net-is ja kasutab \u2018asmodat\u2019 raamatukogu teiselt kontolt \u2018Git\u2019is. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 9. Folder Lockeri liides. Kontrollisime kindlasti kahjulikkuse osas. <\/b><\/p>\n<p>Utilities on Windows 7 and later serve as encryptors with open-source code. Encryption uses a password that is necessary for subsequent decryption. It allows working with both individual files and entire directories.<\/p>\n<p>Its library uses the symmetric encryption algorithm Rijndael in CBC mode. Notably, the block size has been set to 256 bits, in contrast to the 128-bit limit imposed by the AES standard. <\/p>\n<p>Our key is generated according to the PBKDF2 standard. Here, the password is the SHA-256 of the input string in the utility. You just need to find this string to create the decryption key. <\/p>\n<p>Well, let's return to our already decoded <b>pass.key<\/b>. Remember the line with the set of numbers and the text \u2018asmodat\u2019? We try using the first 20 bytes of the string as a password for Folder Locker. <\/p>\n<p>Look at that, it works! The password fits, and everything decrypted perfectly. Judging by the password symbols \u2013 it's the HEX representation of a specific word in ASCII. Let\u2019s try to display the password in text form. We get \u2018<b>shadowwolf<\/b>\u2019. Are you already feeling the symptoms of lycanthropy?<\/p>\n<p>Vaatame n\u00fc\u00fcd uuesti rikutud faili struktuuri, teades n\u00fc\u00fcd lukustuse t\u00f6\u00f6mehhanismi:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 failinimede kr\u00fcpteerimisre\u017eiim;<\/li>\n<li>58 00 00 00 \u2013 failinime kr\u00fcpteeritud ja base64-sse kodeeritud pikkus;<\/li>\n<li>40 00 00 00 \u2013 edastatud p\u00e4ise suurus.<\/li>\n<\/ul>\n<p>\nPunase ja kollasega on t\u00e4histatud vastavalt kr\u00fcpteeritud nimi ja edastatud p\u00e4is. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Kujutis 10. Punasega on v\u00e4lja toodud kr\u00fcpteeritud nimi, kollasega \u2013 edastatud p\u00e4is. <\/b><\/p>\n<p>Ja n\u00fc\u00fcd v\u00f5rreldakse kr\u00fcpteeritud ja dekodeeritud nimesid kuuek\u00fcmnendlikus esituses. <\/p>\n<p>Dekodeeritud andmete struktuur:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 utiliidi loodud pr\u00fcgi (4 baiti);<\/li>\n<li>0C 00 00 00 \u2013 dekodeeritud nime pikkus (12 baiti);<\/li>\n<li>seej\u00e4rel j\u00e4rgneb nime osa ja t\u00e4iendatakse nullidega vajaliku ploki pikkuseni (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, keda ei ole\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Kujutis 11. IMG_4114 n\u00e4eb palju parem v\u00e4lja. <\/b><\/p>\n<h3>III. J\u00e4reldused ja kokkuv\u00f5te<\/h3>\n<p>\nTagasi algusesse. Me ei tea, mida autor Wulfric.Ransomware silmas pidas ja milline oli tema eesm\u00e4rk. Tavalise kasutaja jaoks tundub isegi sellise kr\u00fcptori t\u00f6\u00f6 tulemus suur katastroof. Failid ei avane. K\u00f5ik nimed on kadunud. Harjunud pildi asemel \u2013 ekraanil on hunt. Sunnitakse lugema bitcoini kohta. <\/p>\n<p>T\u00f5si, seekord peitis ''hirmutava kodeerija'' maski taga selline absurdene ja rumal v\u00e4ljapressimis\u00fcritus, kus kurjategija kasutab valmisprogramme ja j\u00e4tab v\u00f5tmed otse kuriteopaika. <\/p>\n<p>Muide, v\u00f5tmetest. Meil polnud pahavara ega troojalasi, mille p\u00f5hjal oleks saanud aru, kuidas see <b>pass.key<\/b> \u2013 faili tekkimise mehhanism nakatunud arvutisse j\u00e4\u00e4b teadmata. Kuid meeles on, et oma m\u00e4rkmes mainis autor parooli unikaalsust. Nii et on seotud kodeeritud s\u00f5na on sama unikaalne kui kasutajanimi shadow wolf \ud83d\ude42<\/p>\n<p>Ja ikkagi, varjuline hunt, miks ja milleks?<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 kr\u00fcpteerija, keda pole | ProHoster","description":"M\u00f5nikord on nii tahtmine vaadata m\u00f5nele viiruseloojale silma ja k\u00fcsida: miks ja milleks? K\u00fcsimusele 'kuidas' saame ise vastata, kuid teada, millest m\u00f5tles see v\u00f5i teine kahjuliku tarkvara looja, oleks v\u00e4ga huvitav. Eriti kui me leiame selliseid 'p\u00e4rleid'. T\u00e4nane artikkel k\u00e4sitleb huvitavat n\u00e4idet kr\u00fcpteerijast. Ta m\u00f5eldi, rohkem kui kogu","canonical_url":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}