{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nUus t\u00fc\u00fcpi lunavara viirus kr\u00fcpteerib faile ja lisab neile laiendi \".SaveTheQueen\", levitudes l\u00e4bi s\u00fcsteemi v\u00f5rgu kausta SYSVOL Active Directory domeenikontrollerites.<\/p>\n<p>Meie kliendid on hiljuti selle pahavaraga kokku puutunud. Toome allpool v\u00e4lja meie p\u00f5hjaliku anal\u00fc\u00fcsi, tulemused ja j\u00e4reldused.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Avastamine<\/h2>\n<\/h2>\n<p>\n\u00dcks meie klientidest v\u00f5ttis meiega \u00fchendust p\u00e4rast seda, kui nad sattusid uue t\u00fc\u00fcpi lunavara r\u00fcnnaku ohvriks, mis lisas laiendi \".SaveTheQueen\" nende keskkonnas uutele kr\u00fcpteeritud failidele.<\/p>\n<p>Meie uurimise k\u00e4igus, t\u00e4psemalt nakkusallikate otsimise etapis, selgitasime v\u00e4lja, et nakatunud ohvreid j\u00e4lgiti ja levitati <strong>SYSVOL v\u00f5rgu kausta <\/strong> kliendi domeenikontrolleril.<\/p>\n<p>SYSVOL on iga domeenikontrolleri oluline kaust, mida kasutatakse r\u00fchmapoliitika (GPO) objektide ning sisenemise ja v\u00e4ljamineku skriptide edastamiseks domeeni arvutitele. Selle kausta sisu replitseerub domeenikontrollerite vahel, et s\u00fcnkroniseerida neid andmeid organisatsiooni saitidel. Kirjutamine SYSVOL-i n\u00f5uab k\u00f5rgeid domeeniprivilege, kuid p\u00e4rast kompromiteerimist muutub see vara r\u00fcndajatele v\u00f5imsaks t\u00f6\u00f6riistaks, mille abil nad saavad pahavara kiiresti ja efektiivselt domeenis levitada.<\/p>\n<p>Varonise auditeerimise ahel aitas kiiresti tuvastada j\u00e4rgmise:<\/p>\n<ul>\n<li> Nakatunud kasutajakonto l\u00f5i faili nimega \u00abhourly\u00bb SYSVOL-is<\/li>\n<li> Paljusid logifailide loodi SYSVOL-is \u2014 iga\u00fche nimi vastas domeeni seadme nimele<\/li>\n<li>Paljusid erinevaid IP-aadresse p\u00e4\u00e4ses failile \u00abhourly\u00bb<\/li>\n<\/ul>\n<p>\nJ\u00f5udsime j\u00e4reldusele, et logifailide kasutati nakkusprotsessi j\u00e4lgimiseks uutest seadmetest, ja et \u00abhourly\u00bb on ajastatud \u00fclesanne, mis viis pahavara t\u00f6\u00f6kohale uutes seadmetes, kasutades PowerShelli skripte \u2013 proovide \u00abv3\u00bb ja \u00abv4\u00bb.<\/p>\n<p>T\u00f5en\u00e4oliselt omas r\u00fcndaja ja kasutas domeeni administraatori \u00f5igusi failide kirjutamiseks SYSVOL-i. Nakatunud seadmetes k\u00e4ivitas r\u00fcndaja PowerShelli koodi, mis l\u00f5i ajastatud \u00fclesande selleks, et avada, kr\u00fcpteerida ja k\u00e4ivitada pahavara.<\/p>\n<h2>\n<h2>Pahavara dekr\u00fcpteerimine<\/h2>\n<\/h2>\n<p>\nOleme proovinud mitu dekr\u00fcpteerimise meetodit edutult:<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOlimeh oleksime peaaegu loobunud, kui otsustasime proovida GCHQ meistriteose \"Magic\"!<br \/>\nutiliidi <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> \u00abMagic\u00bb p\u00fc\u00fcab arvata faili kr\u00fcptimist, kasutades paroolide j\u00e4rjekorda erinevate kr\u00fcptimiste t\u00fc\u00fcpide jaoks ja m\u00f5\u00f5tes entropiat. <\/p>\n<p><b class=\"spoiler_title\">T\u00f5lkija m\u00e4rkus<\/b> Vt.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Diferentsiaalne entropia<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entroopia infotheoorias<\/a><\/noindex>. K\u00e4esolev artikkel ja kommentaarid ei sisalda autori poolt meetodite detailide arutelu, mis on kasutatud nii kolmandate osapoolte kui ka patenteeritud tarkvaras. <br \/>\n<img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00abMagic\u00bb tuvastas, et kasutati GZip-pakendit, kus oli base64-kodeering, mille t\u00f5ttu saime faili lahti pakkida ja leida s\u00fcstimise koodi \u2013 \"injektor\".<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Dropper: \"Alal on epideemia! Hooajalised vaktsineerimised. Pahandused\"<\/h2>\n<p>\nDropper oli tavaline .NET fail ilma igasuguste kaitsemehhanismideta. P\u00e4rast l\u00e4htekoodi lugemist <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> saime aru, et selle ainus eesm\u00e4rk oli shell-koodi s\u00fcstimine protsessi winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell-kood v\u00f5i lihtsad keerukused<\/h2>\n<p>\nKasutasime Hexacorni loomisinstrumenti \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> et \"kompileerida\" shell-kood t\u00e4idetavaks failiks h\u00e4\u00e4lestamiseks ja anal\u00fc\u00fcsiks. Siis avastasime, et see t\u00f6\u00f6tas nii 32- kui ka 64-bitistes masinates.<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIsegi lihtsa shell-koodi kirjutamine natiivses t\u00f5lkes assembleriga v\u00f5ib olla keeruline, kuid t\u00e4ieliku shell-koodi kirjutamine, mis t\u00f6\u00f6tab m\u00f5lemat t\u00fc\u00fcpi s\u00fcsteemides, n\u00f5uab eliitoskusi, seet\u00f5ttu hakkasime h\u00e4mmastuma r\u00fcndaja keerukusest.<\/p>\n<p>Kui me anal\u00fc\u00fcsisime kompileeritud shell-koodi <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, m\u00e4rkisime, et see laadis <strong> d\u00fcnaamilisi .NET teeke <\/strong>, nagu clr.dll ja mscoreei.dll. See tundus meile kummaline \u2013 tavaliselt p\u00fc\u00fcavad kurjategijad tekitada shell-koodi nii v\u00e4ikseks kui v\u00f5imalik, kutsudes OSi natiivseid funktsioone otse. <em>Miks peaks keegi integreerima shell-koodi Windowsi funktsioone, selle asemel, et otse kutsuda? <\/em><\/p>\n<p>Kuidas selgus, ei kirjutanud pahavara autor ise seda keerulist shell-koodi \u2013 selleks kasutati \u00fclesandele iseloomulikku tarkvara, et t\u00f5lkida teostatavad failid ja skriptid shell-koodiks. <\/p>\n<p>Leidsime t\u00f6\u00f6riista <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, mis, nagu me arvasime, v\u00f5iks kompileerida sarnast shell-koodi. Siin on selle kirjeldus GitHubist:<\/p>\n<p><em>Donut genereerib x86 v\u00f5i x64 shell-koodi VBScriptist, JScriptist, EXE-st, DLL-ist (sealhulgas .NET kogumitest). See shell-kood v\u00f5ib olla integreeritud igasse Windowsi protsessi t\u00e4itmiseks.<br \/>\noperatiivm\u00e4lu.<\/em><\/p>\n<p>Teooria kinnitamiseks koostasime oma koodi Donut'iga ning v\u00f5rrelda seda n\u00e4idisega \u2013 ja\u2026 jah, avastasime veel \u00fche kasutatud t\u00f6\u00f6riista komponendi. P\u00e4rast seda suutsime ekstrakti ja anal\u00fc\u00fcsida originaal .NET esitatavat faili.<\/p>\n<h2> Koodi kaitse <\/h2>\n<p>\nSee fail on obfuskeeritud kasutades <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx on avatud l\u00e4htekoodiga .NET projekt, mis on m\u00f5eldud teiste arendajate koodi kaitsmiseks. Sellise klassi tarkvara v\u00f5imaldab arendajatel kaitsta oma koodi p\u00f6\u00f6rdprojekteerimise eest, kasutades selliseid meetodeid nagu: s\u00fcmbolite asendamine, juhtimisvoogude peitmine ja viitamise meetodi varjamine. K\u00fcberkurjategijad kasutavad obfuskaatoreid, et v\u00e4ltida avastamist ja teha \u00fclesanne p\u00f6\u00f6rdprojekteerimise osas raskemaks.<\/p>\n<p>T\u00e4nu <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> me ekstraktisime koodi:<\/p>\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Kokkuv\u00f5te \u2013 kasulik koormus<\/h2>\n<p>\nTulemuseks saadud kasulik koormus on v\u00e4ga lihtne lunavara. Ei mingit s\u00fcsteemisoleku mehhanismi, ei ole \u00fchendusi k\u00e4sureaga \u2013 ainult vana hea as\u00fcmmeetriline kr\u00fcpteerimine, et muuta ohvri andmed loetamatuks.<\/p>\n<p>Peamine funktsioon valib parameetritena j\u00e4rgmised read:<\/p>\n<ul>\n<li> Faili laiend, mida kasutada p\u00e4rast kr\u00fcpteerimist (SaveTheQueen) <\/li>\n<li> Autori e-post, et lisada see v\u00e4ljaantud lunavara n\u00f5udmise faili<\/li>\n<li> Avalik v\u00f5ti, mida kasutatakse failide kr\u00fcpteerimiseks <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Protsess n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/strong><\/p>\n<ol>\n<li> Lunavara uurib ohvri seadmes kohalikku ja \u00fchendatud ketast\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Otsib faile kr\u00fcpteerimiseks\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> P\u00fc\u00fcab l\u00f5petada protsessi, mis kasutab faili, mille ta kavatseb kr\u00fcpteerida<\/li>\n<li> Muudab faili nimeks \"Algne_faili_nimi.SaveTheQueenING\", kasutades funktsiooni MoveFile, ja kr\u00fcpteerib selle <\/li>\n<li>P\u00e4rast faili kr\u00fcpteerimist autori avaliku v\u00f5tmega, nimetas pahavara selle uuesti, n\u00fc\u00fcd \"Algne_failinimi.SaveTheQueen\".<\/li>\n<li>K\u00e4ivitab lunavara n\u00f5udmise faili kirjutamise samasse kausta\n<p><img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nP\u00f5hinedes natiivse funktsiooni \u00abCreateDecryptor\u00bb kasutusele, tundub, et \u00fcks lunavara funktsioonidest sisaldab parameetrina dekr\u00fcpteerimise mehhanismi, mis n\u00f5uab suletud v\u00f5tmeid.<\/p>\n<p>Kr\u00fcpteeriv viirus <strong>EI kr\u00fcpteeri faile<\/strong>, mis asuvad j\u00e4rgmistes kaustades:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Samuti <strong>EI kr\u00fcpteeri j\u00e4rgmisi failit\u00fc\u00fcpe:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Kokkuv\u00f5tted ja j\u00e4reldused<\/h2>\n<\/h2>\n<p>\nKuigi lunavarius ennast erakordsete funktsioonidega ei kiitle, kasutas r\u00fcndaja loominguliselt Active Directory't droppide levitamiseks, samas kui kahjulik tarkvara esitas meile huvitavaid, kui mitte eriti keerulisi, takistusi anal\u00fc\u00fcsi k\u00e4igus. <\/p>\n<p>Arvame, et kahvatusa tegija:<\/p>\n<ol>\n<li>Kirjutas lunavariuse, mis sisaldas integreeritud protsessi winlogon.exe, samuti<br \/>\nfailide kr\u00fcptimise ja dekr\u00fcptimise funktsionaalsust<\/li>\n<li>Maskeeris kahjulikku koodi ConfuserEx abil, muutes tulemuse Donut'iga ja lisaks peites droppi base64 Gzip'i<\/li>\n<li>Hankis t\u00f5stetud \u00f5igused ohvri domeenis ja kasutas neid<br \/>\nkr\u00fcptitud kahjuliku tarkvara ja ajastatud \u00fclesannete kopeerimiseks domeeni kontrollerite v\u00f5rgukausta SYSVOL<\/li>\n<li>K\u00e4itas PowerShelli skripti domeeni seadmetes, et levitada kahjulikku tarkvara ja salvestada r\u00fcnde edenemist logidesse SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Ostetakse kuninganna: Varonis uurib kiiresti levinud lunavirus \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKui teil on k\u00fcsimusi selle lunavariuse variandi v\u00f5i meie meeskondade l\u00e4bi viidud foorumide ja IT-juhtumite uurimise kohta, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">v\u00f5tke meiega \u00fchendust <\/a><\/noindex> v\u00f5i k\u00fcsige <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">elavat r\u00fcnnakutele vastamise demonstratsiooni<\/a><\/noindex>, kus me vastame alati k\u00fcsimustele Q&amp;A sessiooni raames.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Lunastada \u2013 nagu kuninganna: Varonis uurib kiiresti levinud kr\u00fcptovarikate \"SaveTheQueen\"","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}