{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 un ransomware inexistent","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Uneori, m-ar tenta s\u0103 privesc \u00een ochii unui creator de viru\u0219i \u0219i s\u0103 \u00eentreb: de ce \u0219i pentru ce? R\u0103spunsul la \u00eentrebarea \u201ecum\u201d \u00eel putem g\u0103si singuri, \u00eens\u0103 ar fi foarte interesant s\u0103 \u0219tim ce g\u00e2ndea creatorul acelui sau altui malware, mai ales c\u00e2nd ne \u00eent\u00e2lnim cu astfel de \u201eperle\u201d.<\/p>\n<p>Eroul articolului de ast\u0103zi este un exemplu interesant de ransomware. Se pare c\u0103 a fost g\u00e2ndit ca un alt \u201er\u0103pitor\u201d, dar implementarea sa tehnic\u0103 seam\u0103n\u0103 mai mult cu o glum\u0103 proast\u0103. Despre aceast\u0103 implementare vom discuta ast\u0103zi. <\/p>\n<p>Din p\u0103cate, urm\u0103rirea ciclului de via\u021b\u0103 al acestui encoder este practic imposibil\u0103 \u2013 exist\u0103 prea pu\u021bine statistici despre el, deoarece nu a avut parte de o r\u0103sp\u00e2ndire semnificativ\u0103. Prin urmare, vom l\u0103sa deoparte originea, metodele de infectare \u0219i alte men\u021biuni. Vom vorbi doar despre \u00eent\u00e2lnirea noastr\u0103 cu <b>Wulfric Ransomware<\/b> \u0219i despre cum am ajutat utilizatorul s\u0103 \u00ee\u0219i salveze fi\u0219ierele. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Cum a \u00eenceput totul<\/h3>\n<p>\nLaboratorul nostru antivirus prime\u0219te frecvent cereri de ajutor din partea persoanelor afectate de ransomware. Oferim suport indiferent de produsele antivirus instalate. De data aceasta, un individ a apelat la noi, a c\u0103rui fi\u0219iere au fost infectate de un encoder necunoscut.<\/p>\n<blockquote><p>Bun\u0103 ziua! Fi\u0219ierele de pe unitatea de stocare (samba4) au fost criptate f\u0103r\u0103 parol\u0103. Suspectez c\u0103 infectarea a venit de pe calculatorul fiicei mele (Windows 10 cu protec\u021bia standard Windows Defender). Calculatorul fiicei nu a fost pornit dup\u0103 aceea. Fi\u0219ierele sunt criptate \u00een principal \u00een formatele .jpg \u0219i .cr2. Extensia fi\u0219ierelor dup\u0103 criptare: .aef.<\/p><\/blockquote>\n<p>Am primit de la utilizator mostre de fi\u0219iere criptate, o not\u0103 de r\u0103scump\u0103rare \u0219i un fi\u0219ier care, cel mai probabil, este cheia necesar\u0103 creatorului ransomware-ului pentru decriptarea fi\u0219ierelor.<\/p>\n<p>Iat\u0103 toate indiciile noastre:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nS\u0103 arunc\u0103m o privire la nota de r\u0103scump\u0103rare. C\u00e2te bitcoinuri sunt de dat\u0103 asta? <\/p>\n<p><b>Traducere:<\/b><\/p>\n<blockquote><p>Aten\u021bie, fi\u0219ierele dumneavoastr\u0103 au fost criptate!<br \/>\nparola este unic\u0103 pentru PC-ul dumneavoastr\u0103.<\/p>\n<p>Pl\u0103ti\u021bi suma de 0.05 BTC la adresa de bitcoin: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nDup\u0103 plat\u0103, trimite\u021bi-mi un email, ata\u0219\u00e2nd fi\u0219ierul pass.key la Wulfric@gmx.com cu notificarea despre plat\u0103.<\/p>\n<p>Dup\u0103 confirmare, v\u0103 voi trimite decriptarea pentru fi\u0219iere.<\/p>\n<p>Pute\u021bi pl\u0103ti bitcoinuri online \u00een diverse moduri:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> \u2014 plat\u0103 cu cardul bancar<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>Despre Bitcoin:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nDac\u0103 ave\u021bi \u00eentreb\u0103ri, scrie\u021bi-mi la Wulfric@gmx.com<br \/>\nCa un bonus, v\u0103 voi explica cum a fost spart computerul dumneavoastr\u0103 \u0219i cum s\u0103-l proteja\u021bi \u00een viitor.<\/p><\/blockquote>\n<p>\nLupul patetic, chemat s\u0103 arate victimei gravitatea situa\u021biei. Totu\u0219i, ar fi putut fi \u0219i mai r\u0103u.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 1. - Ca un bonus, v\u0103 voi spune cum s\u0103 v\u0103 proteja\u021bi computerul \u00een viitor. - Pare legitim.<\/b><\/p>\n<h3>II. \u00cencepem lucrul<\/h3>\n<p>\nPrimul lucru pe care l-am f\u0103cut a fost s\u0103 ne uit\u0103m la structura modelului trimis. Ciudat, acesta nu sem\u0103na cu un fi\u0219ier afectat de ransomware. Deschidem editorul hexazecimal \u0219i ne uit\u0103m. \u00cen primele 4 bytes se afl\u0103 dimensiunea original\u0103 a fi\u0219ierului, urm\u0103toarele 60 de bytes sunt umplute cu zerouri. Dar cel mai interesant se afl\u0103 la final:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 2 Analiz\u0103m fi\u0219ierul deteriorat. Ce iese imediat \u00een eviden\u021b\u0103?<\/b><\/p>\n<p>Totul s-a dovedit a fi sup\u0103r\u0103tor de simplu: 0x40 bytes din antet au fost mutate la finalul fi\u0219ierului. Pentru a recupera datele, este suficient s\u0103 le returna\u021bi la \u00eenceput. Accesul la fi\u0219ier a fost recuperat, dar numele a r\u0103mas criptat, \u0219i cu acesta e mai complicat. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 3. Numele criptat \u00een Base64 arat\u0103 ca un set incoerent de simboluri. <\/b><\/p>\n<p>S\u0103 \u00eencerc\u0103m s\u0103-l descompunem <b>pass.key<\/b>, trimis de utilizator. \u00cen el vedem o secven\u021b\u0103 de 162 bytes de caractere \u00een ASCII.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 4. 162 caractere, l\u0103sate pe PC-ul victimei. <\/b><\/p>\n<p>Dac\u0103 ne uit\u0103m mai atent, putem observa c\u0103 simbolurile se repet\u0103 cu o anumit\u0103 periodicitate. Acest lucru poate indica utilizarea XOR, unde repeti\u021biile sunt caracteristice, iar frecven\u021ba lor depinde de lungimea cheii. \u00cemp\u0103r\u021bind \u0219irul \u00een grupuri de 6 caractere \u0219i aplic\u00e2nd diverse secven\u021be XOR, nu am ob\u021binut niciun rezultat semnificativ.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 5. Vezi constantele repetate din mijloc?<\/b> <\/p>\n<p>Am decis s\u0103 c\u0103ut\u0103m pe Google constantele, pentru c\u0103 da, \u0219i asta se poate face! \u0218i toate au dus, \u00een cele din urm\u0103, la un singur algoritm - Batch Encryption. Dup\u0103 ce am studiat scriptul, a devenit clar c\u0103 \u0219irul nostru este nimic altceva dec\u00e2t rezultatul muncii sale. Trebuie men\u021bionat c\u0103 acesta nu este un ransomware, ci doar un codificator, care \u00eenlocuie\u0219te caracterele cu secven\u021be de c\u00e2te 6 bytes. F\u0103r\u0103 chei sau alte secrete \ud83d\ude41<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 6. O bucat\u0103 din algoritmul original de autor necunoscut. <\/b><\/p>\n<p>Algoritmul nu ar func\u021biona corect dac\u0103 nu ar fi un detaliu:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 7. Aprobat de Morpheus.<\/b><\/p>\n<p>Folosind substitu\u021bia invers\u0103, transform\u0103m \u0219irul din <b>pass.key<\/b> \u00een text de 27 de caractere. Un aspect demn de men\u021bionat este textul uman (cel mai probabil) \u2018asmodat\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig.8. USGFDG=7.<\/b><\/p>\n<p>Google ne va ajuta din nou. Dup\u0103 o mic\u0103 c\u0103utare, g\u0103sim un proiect interesant pe GitHub \u2013 Folder Locker, scris \u00een .Net \u0219i utiliz\u00e2nd biblioteca \u2018asmodat\u2019 de pe alt cont de pe \u2018Git\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 9. Interfa\u021ba Folder Locker. A fost verificat obligatoriu pentru malware. <\/b><\/p>\n<p>Utilitarul este un \u0219ifruitor pentru Windows 7 si mai recent, care se distribuie cu cod surs\u0103 deschis. La criptare se folose\u0219te o parol\u0103, necesar\u0103 pentru decodare ulterioar\u0103. Permite lucrul at\u00e2t cu fi\u0219iere individuale, c\u00e2t \u0219i cu directoare \u00eentregi.<\/p>\n<p>Biblioteca sa folose\u0219te algoritmul simetric de criptare Rijndael \u00een modul CBC. Remarcabil este faptul c\u0103 dimensiunea blocului a fost aleas\u0103 ca 256 bi\u021bi \u2013 spre deosebire de standardul AES, unde dimensiunea este limitat\u0103 la 128 bi\u021bi. <\/p>\n<p>Cheia noastr\u0103 este generat\u0103 conform standardului PBKDF2. \u00cen acest sens, parola folosit\u0103 este SHA-256 a \u0219irului introdus \u00een utilitar. R\u0103m\u00e2ne doar s\u0103 g\u0103sim acest \u0219ir pentru a genera cheia de decriptare. <\/p>\n<p>Ei bine, s\u0103 ne \u00eentoarcem la ceea ce deja a fost decodat <b>pass.key<\/b>. \u00ce\u021bi aminte\u0219ti de acea linie cu un set de cifre \u0219i textul \u2018asmodat\u2019? \u00cencerc\u0103m s\u0103 folosim primii 20 de bi\u021bi ai \u0219irului ca parol\u0103 pentru Folder Locker. <\/p>\n<p>Uite, func\u021bioneaz\u0103! Cuv\u00e2ntul de cod s-a potrivit, \u0219i totul s-a descifrat perfect. Judec\u00e2nd dup\u0103 simbolurile parolei, acesta este o reprezentare HEX a unui cuv\u00e2nt anumit \u00een ASCII. S\u0103 \u00eencerc\u0103m s\u0103 afi\u0219\u0103m cuv\u00e2ntul de cod \u00een form\u0103 text.<b>shadowwolf<\/b>Te sim\u021bi deja simptomele licantropiei?<\/p>\n<p>S\u0103 privim din nou structura fi\u0219ierului infectat, acum \u0219tiind mecanismul func\u021bion\u0103rii locker-ului:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 modul de criptare a numelui;<\/li>\n<li>58 00 00 00 \u2013 lungimea numelui fi\u0219ierului criptat \u0219i codificat \u00een base64;<\/li>\n<li>40 00 00 00 \u2013 dimensiunea antetului transferat.<\/li>\n<\/ul>\n<p>\n\u00cen ro\u0219u \u0219i galben sunt eviden\u021biate numele criptat \u0219i antetul transferat, respectiv. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 10. Numele criptat este marcat cu ro\u0219u, iar antetul transferat cu galben. <\/b><\/p>\n<p>Acum s\u0103 compar\u0103m numele criptat \u0219i decodat \u00een reprezentare hexadecimal\u0103. <\/p>\n<p>Structura datelor decodificate:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 gunoi creat de utilitar (4 octe\u021bi);<\/li>\n<li>0C 00 00 00 \u2013 lungimea numelui decodat (12 octe\u021bi);<\/li>\n<li>ulterior urmeaz\u0103, de fapt, numele fi\u0219ierului \u0219i completarea cu zerouri p\u00e2n\u0103 la lungimea dorit\u0103 a blocului (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 un ransomware inexistent\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 11. IMG_4114 arat\u0103 mult mai bine. <\/b><\/p>\n<h3>III. Concluzii \u0219i concluzii<\/h3>\n<p>\nRevenind la \u00eenceput. Nu \u0219tim ce l-a motivat pe autorul Wulfric.Ransomware \u0219i care a fost scopul s\u0103u. Cu siguran\u021b\u0103, pentru utilizatorul obi\u0219nuit, rezultatul activit\u0103\u021bii unui astfel de ransomware va p\u0103rea o mare problem\u0103. Fi\u0219ierele nu se deschid. Toate numele au disp\u0103rut. \u00cen loc de imaginea obi\u0219nuit\u0103 \u2013 un lup pe ecran. Te oblig\u0103 s\u0103 cite\u0219ti despre bitcoin. <\/p>\n<p>Adev\u0103rul este c\u0103, de data aceasta, sub masca \u201eencoderului \u00eenfrico\u0219\u0103tor\u201d se ascundea o \u00eencercare ridicol\u0103 \u0219i inept\u0103 de r\u0103scump\u0103rare, unde infractorul folose\u0219te programe gata f\u0103cute \u0219i las\u0103 cheile chiar la locul faptei. <\/p>\n<p>Apropo de chei. Nu am avut un script mali\u021bios sau un troian din care s\u0103 putem \u00een\u021belege cum a ap\u0103rut acest <b>pass.key<\/b> \u2013 mecanismul de apari\u021bie a fi\u0219ierului pe PC-ul infectat r\u0103m\u00e2ne necunoscut. Dar, \u00eemi amintesc c\u0103 \u00een nota sa autorul a men\u021bionat unicitatea parolei. A\u0219adar, cuv\u00e2ntul de cod pentru decriptare este la fel de unic c\u00e2t este \u0219i numele de utilizator shadow wolf \ud83d\ude42<\/p>\n<p>\u0218i totu\u0219i, shadow wolf, de ce \u0219i pentru ce?<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 ransomware-ul care nu exist\u0103 | ProHoster","description":"Uneori, \u00ee\u021bi vine s\u0103 te ui\u021bi \u00een ochii unui creator de viru\u0219i \u0219i s\u0103 \u00eentrebi: de ce \u0219i de ce?","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?","og:url":"https:\/\/prohoster.info\/ro\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}