{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Aeglane, vahel on soov vaadata m\u00f5ne viirusetegija silma ja k\u00fcsida: miks ja milleks? \"Kuidas\" k\u00fcsimusele saame ise vastata, kuid selle kohta, mida m\u00f5tles selle v\u00f5i teise kahvatu tarkvara looja, oleks v\u00e4ga huvitav teada. Eriti kui kohtume selliste \"ehted\".<\/p>\n<p>T\u00e4nase artikli peategelane on huvitav n\u00e4ide kr\u00fcptoraha. Tundub, et see m\u00f5eldi v\u00e4lja taas kord \"l\u00f5henemisena\", kuid selle tehniline teostus sarnaneb rohkem kellegi halvale naljale. R\u00e4\u00e4gime t\u00e4na just sellest teostusest. <\/p>\n<p>Kahjuks on selle kodeerija eluts\u00fckli j\u00e4lgimine peaaegu v\u00f5imatu - statistika alusel on seda liiga v\u00e4he, kuna see ei ole \u00f5nneks laialdaselt levinud. Seet\u00f5ttu j\u00e4tame k\u00f5rvale p\u00e4ritolu, nakatumismeetodid ja muud mainimised. R\u00e4\u00e4gime ainult meie kohtumisest <b>Wulfric Ransomware<\/b> ja sellest, kuidas me aitasime kasutajal oma faile p\u00e4\u00e4sta. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Kuidas k\u00f5ik algas<\/h3>\n<p>\nMeie viiruset\u00f5rje laborisse p\u00f6\u00f6rduvad sageli inimesed, kes on kannatanud kr\u00fcptoraha all. Me pakume abi s\u00f5ltumata sellest, milliseid viiruset\u00f5rje tooteid neil on. Seekord p\u00f6\u00f6rdus meie poole inimene, kelle failid olid nakatunud tundmatu kodeerijaga.<\/p>\n<blockquote><p>Tere! Faile kr\u00fcpteeriti failide hoidlas (samba4) ja parooli ei olnud. Kahtlustan, et nakkus tuli t\u00fctre arvutist (Windows 10 koos Windows Defender'i p\u00f5hikaitsega). T\u00fctar ei ole p\u00e4rast seda arvutit sisse l\u00fclitanud. Failid on peamiselt kr\u00fcpteeritud .jpg ja .cr2. Failide laiendid p\u00e4rast kr\u00fcpteerimist: .aef.<\/p><\/blockquote>\n<p>Saime kasutajalt kr\u00fcpteeritud failide proovide, lunaraha kirja ja faili, mis t\u00f5en\u00e4oliselt on v\u00f5ti, mida autor vajab failide dekr\u00fcpteerimiseks.<\/p>\n<p>See on k\u00f5ik meie vihjed:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nVaadake kirja. Kui palju bitcoine seekord? <\/p>\n<p><b>T\u00f5lge:<\/b><\/p>\n<blockquote><p>T\u00e4helepanu, teie failid on kr\u00fcpteeritud!<br \/>\nparool on teie PC jaoks ainulaadne.<\/p>\n<p>Makse tuleb teha summas 0.05 BTC bitcoiniaadressile: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nP\u00e4rast makse sooritamist saatke mulle kiri, lisades faili pass.key Wulfric@gmx.com, koos makse teatega.<\/p>\n<p>P\u00e4rast kinnitamist saadan teile failide dekr\u00fcpteerija.<\/p>\n<p>V\u00f5ite bitcoine maksta erinevate meetoditega:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> \u2014 pangakaardiga makse<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>Bitcoini kohta:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nKui teil on k\u00fcsimusi, kirjutage mulle aadressil Wulfric@gmx.com<br \/>\nBoonuseks r\u00e4\u00e4gin, kuidas teie arvuti on h\u00e4kitud ja kuidas seda tulevikus kaitsta.<\/p><\/blockquote>\n<p>\nPafosne hunt, kes on kutsutud n\u00e4itama ohvrile olukorra t\u00f5sidust. Kuid see v\u00f5iks olla ka hullem.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 1. \u2013 Boonusena r\u00e4\u00e4gin, kuidas tulevikus oma arvutit kaitsta. \u2013 Tundub usutav.<\/b><\/p>\n<h3>II. Alustame t\u00f6\u00f6d<\/h3>\n<p>\nEsimese asjana vaatasime saadetud n\u00e4idise struktuuri. \u00dcllatavalt ei olnud see sarnane failiga, mis on kannatanud kr\u00fcptori r\u00fcnnaku all. Avame kuue hulga redaktori ja vaatame. Esimesed 4 baiti sisaldavad faili originaalsuurust, j\u00e4rgmised 60 baiti on t\u00e4idetud nullidega. Kuid k\u00f5ige huvitavam on l\u00f5pus:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 2. Anal\u00fc\u00fcsime kahjustatud faili. Mis on kohe silmatorkav?<\/b><\/p>\n<p>Selgus, et k\u00f5ik oli \u00fcllatavalt lihtne: 0\u044540 baiti p\u00e4isest olid viidud faili l\u00f5ppu. Andmete taastamiseks on lihtsalt vajalik need tagasi algusesse viia. Juurdep\u00e4\u00e4s failile on taastatud, kuid kr\u00fcpteeritud on j\u00e4\u00e4nud nimi, ja seda on keerulisem k\u00e4sitleda. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 3. Kr\u00fcpteeritud nimi Base64-s n\u00e4eb v\u00e4lja nagu m\u00f5tetu s\u00fcmbolite kogum. <\/b><\/p>\n<p>P\u00fc\u00fcame lahti harutada <b>pass.key<\/b>, mille kasutaja saatis. Sellega n\u00e4eme 162-baitilist s\u00fcmbolite jada ASCII-s.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 4. 162 s\u00fcmbolit, mis j\u00e4id ohvri PC-le. <\/b><\/p>\n<p>Kui t\u00e4helepanelikult vaadata, siis v\u00f5ib m\u00e4rkida, et s\u00fcmbolid korduvad teatud perioodilisusega. See v\u00f5ib viidata XOR-i kasutamisele, kus kordused s\u00f5ltuvad v\u00f5tme pikkusest. Jagades joont 6 s\u00fcmbolid ja rakendades m\u00f5ningaid XOR-j\u00e4rjendeid, ei saavutanud me \u00fchtegi arvestatavat tulemust.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 5. Kas n\u00e4ete korduvaid konstande keskel?<\/b> <\/p>\n<p>Otsustasime googeldada konstandeid, sest jah, nii saab ka! Ja k\u00f5ik need viisid l\u00f5puks \u00fche algoritmi \u2013 Batch Encryption. P\u00e4rast skripti uurimist sai selgeks, et meie joon on mitte midagi muud kui selle t\u00f6\u00f6tulem.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 6. T\u00fckk originaalsest algoritmist tundmatu autori poolt. <\/b><\/p>\n<p>Algoritm ei t\u00f6\u00f6taks korralikult, kui mitte \u00fcks detail:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 7. Morpheus kiitis heaks.<\/b><\/p>\n<p>Tagasi asetuse abil muudame joonise <b>pass.key<\/b> tekst 27 t\u00e4hem\u00e4rgist. Erilist t\u00e4helepanu v\u00e4\u00e4rib inimlik (v\u00f5imalik) tekst 'asmodat'. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 8. USGFDG=7.<\/b><\/p>\n<p>Meil aitab taas Google. P\u00e4rast v\u00e4ikest otsingut leiame huvitava projekti GitHubis \u2013 Folder Locker, mis on kirjutatud .Net-is ja kasutab teise konto 'asmodat' raamatukogu Gitis. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 9. Folder Lockeri liides. Kontrollisime kindlasti pahavara suhtes. <\/b><\/p>\n<p>T\u00f6\u00f6riist on kr\u00fcptimisprogramm Windows 7 ja uuemate jaoks, mis levib avatud l\u00e4htekoodiga. Kr\u00fcptimiseks kasutatakse parooli, mida on vaja edasiseks dekr\u00fcptimiseks. See v\u00f5imaldab t\u00f6\u00f6tada nii \u00fcksikute failidega kui ka tervete kataloogidega.<\/p>\n<p>Selle raamatukogu kasutab s\u00fcmmeetrilist kr\u00fcpteerimisalgoritmi Rijndael CBC re\u017eiimis. M\u00e4rkimisv\u00e4\u00e4rne on, et ploki suurus on valitud 256 bitiks \u2013 erinevalt AES-i standardis s\u00e4testatust, kus see on piiratud 128 bitiga. <\/p>\n<p>Meie v\u00f5ti moodustatakse PBKDF2 standardi j\u00e4rgi. Sellest tulenevalt on parooliks SHA-256 sisestatud stringist t\u00f6\u00f6riistas. J\u00e4\u00e4b vaid leida see string, et luua dekr\u00fcptimise v\u00f5ti. <\/p>\n<p>Noh, naaseme tagasi meie juba dekodeeritud <b>pass.key<\/b>. Kas m\u00e4letate seda numbrite ja tekstiga 'asmodat' rida? Proovime kasutada stringi esimesi 20 baiti paroolina Folder Lockerile. <\/p>\n<p>Oh, see t\u00f6\u00f6tab! Koodis\u00f5na sobis ning k\u00f5ik dekodeeriti suurep\u00e4raselt. Parooli s\u00fcmbolite p\u00f5hjal \u2013 see on HEX-esituses teatud s\u00f5na ASCII-s. Proovime kuvada koodis\u00f5na tekstina. Saame '<b>shadowwolf<\/b>' Kas juba tunnete likantropia s\u00fcmptomeid?<\/p>\n<p>Vaadakem veel kord nakatunud faili struktuuri, n\u00fc\u00fcd juba teades lokeri t\u00f6\u00f6mehhanismi:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 kr\u00fcpteerimise re\u017eiim nimedega;<\/li>\n<li>58 00 00 00 \u2013 kr\u00fcptitud ja base64 kodeeritud faili nime pikkus;<\/li>\n<li>40 00 00 00 \u2013 \u00fcle kantud pealkirja suurus.<\/li>\n<\/ul>\n<p>\nPunase ja kollasega on v\u00e4lja toodud kr\u00fcpteeritud nimi ja \u00fcle kantud pealkiri vastavalt. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 10. Punasega on v\u00e4lja toodud kr\u00fcpteeritud nimi, kollasega \u2013 \u00fcle kantud pealkiri. <\/b><\/p>\n<p>Ja n\u00fc\u00fcd v\u00f5rreldame kr\u00fcpteeritud ja dekr\u00fcpteeritud nimesid kuhexakujulises esitusvormis. <\/p>\n<p>Dekodeeritud andmete struktuur:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 t\u00f6\u00f6lise loodud pr\u00fcgikraam (4 baiti);<\/li>\n<li>0C 00 00 00 \u2013 dekr\u00fcpteeritud nime pikkus (12 baiti);<\/li>\n<li>seej\u00e4rel tulebki, iseasi, faili nimi ja t\u00e4iendav nullide lisamine vajaliku ploki pikkuse saavutamiseks (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 kr\u00fcpteerija, mida pole olemas\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Joonis 11. IMG_4114 n\u00e4eb palju parem v\u00e4lja. <\/b><\/p>\n<h3>III. J\u00e4reldused ja j\u00e4reldused<\/h3>\n<p>\nNaastes algusesse. Me ei tea, millest juhindus autor Wulfric.Ransomware ja milline oli tema eesm\u00e4rk. Kindlasti tundub tavakasutajale isegi sellise ransomware'i t\u00f6\u00f6 tulemus suur probleem. Failid ei avane. K\u00f5ik nimed on kadunud. Harjumusp\u00e4rase pildi asemel \u2013 ekraanil on hunt, mis sunnib lugema bitcoini kohta. <\/p>\n<p>T\u00f5si, seekord peitis end \"hirmu kodeerija\" maski taga selline naljakas ja m\u00f5tlematu v\u00e4ljapressimise katse, kus kurjategija kasutab valmislahendusi ja j\u00e4tab v\u00f5tmed otse kuriteopaika. <\/p>\n<p>Muide, v\u00f5tmete kohta. Meil ei olnud pahatahtlikku skripti ega troojalasi, mille alusel oleks v\u00f5imalik m\u00f5ista, kuidas see <b>pass.key<\/b> \u2013 nakatunud arvutisse faili tekkimise mehhanism j\u00e4\u00e4b teadmata. Kuid meenub, et oma m\u00e4rkmes mainis autor parooli ainulaadsust. Niisiis, desifreerimise v\u00f5tmes\u00f5na on sama unikaalne kui kasutajanimi shadow wolf \ud83d\ude42<\/p>\n<p>Ja ikkagi, varjuline hunt, miks ja milleks?<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 ransomware, mida ei ole | ProHoster","description":"M\u00f5nikord on nii suur soov vaadata m\u00f5nele viirusetegijale silma ja k\u00fcsida: miks ja milleks?","canonical_url":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?","og:url":"https:\/\/prohoster.info\/et\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}