{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nNova vrsta zlonamerne programske opreme klase ransomware \u0161ifrira datoteke i dodaje im ekstenziju \".SaveTheQueen\", \u0161ire\u0107i se kroz sistemsku mre\u017enu mapu SYSVOL na aktivnim direktorijumima kontrolera domena.<\/p>\n<p>Na\u0161i naro\u010dniki so se s to zlonamerno programsko opremo prvi\u010d sre\u010dali pred kratkim. Spodaj navajamo na\u0161o celotno analizo, njene rezultate in sklepe.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Detekce<\/h2>\n<\/h2>\n<p>\nJedan od na\u0161ih klijenata kontaktirao nas je nakon \u0161to su se suo\u010dili s novim tipom ransomware-a koji je dodavao ekstenziju \".SaveTheQueen\" novim \u0161ifriranim datotekama u njihovom okru\u017eenju.<\/p>\n<p>Med na\u0161im preiskovanjem, natan\u010dneje v fazi iskanja virov oku\u017ebe, smo ugotovili, da je \u0161irjenje in sledenje oku\u017eenim \u017ertvam potekalo prek <strong>mre\u017ene mape SYSVOL <\/strong> na domeni naro\u010dnika.<\/p>\n<p>SYSVOL je klju\u010dna mapa za vsak nadzorni domen, ki se uporablja za dostavo objektov skupinskih politik (GPO) ter skriptov za prijavo in odjavo na ra\u010dunalnike v domeni. Vsebina te mape se replikira med kontrolorji domen, da se sinhronizirajo ti podatki na lokacijah organizacije. Pisanje v SYSVOL zahteva visoke domenske privilegije, vendar pa, po kompromitaciji, to sredstvo postane mo\u010dno orodje za napadalce, ki ga lahko uporabijo za hitro in u\u010dinkovito \u0161irjenje zlonamerne obremenitve po domeni.<\/p>\n<p>Veriga revizij Varonis je hitro razkrila naslednje:<\/p>\n<ul>\n<li> Inficirani uporabni\u0161ki ra\u010dun je ustvaril datoteko z imenom \"hourly\" v SYSVOL<\/li>\n<li> \u0160tevilo dnevni\u0161kih datotek se je ustvarjalo v SYSVOL \u2013 vsaka poimenovana po imenu domena naprave<\/li>\n<li>\u0160tevilni razli\u010dni IP-naslovi so dostopali do datoteke \"hourly\"<\/li>\n<\/ul>\n<p>\nPri\u0161li smo do zaklju\u010dka, da so se dnevni\u0161ke datoteke uporabljale za sledenje procesu oku\u017ebe na novih napravah, in da je \"hourly\" na\u010drtovana naloga, ki je izvajala zlonamerno obremenitev na novih napravah s pomo\u010djo Powershell skripta \u2013 vzorci \"v3\" in \"v4\".<\/p>\n<p>Verjetno je napadalec pridobil in uporabil privilegije administratorja domene za pisanje datotek v SYSVOL. Na oku\u017eenih vozli\u0161\u010dih je napadalec zagnal kodo PowerShell, ki je ustvarila na\u010drtovano nalogo za odprtje, de\u0161ifriranje in zagon zlonamerne programske opreme.<\/p>\n<h2>\n<h2>De\u0161ifriranje zlonamerne programske opreme<\/h2>\n<\/h2>\n<p>\nNeuspe\u0161no smo preizkusili ve\u010d na\u010dinov de\u0161ifriranja vzorcev:<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSkoraj smo se pripravljali na predajo, ko smo se odlo\u010dili preizkusiti na\u010din \u201eMagic\u201c odli\u010dnega<br \/>\norodja <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> avtorstva GCHQ. \u201eMagic\u201c posku\u0161a ugotoviti \u0161ifro datoteke z upo\u0161tevanjem razli\u010dnih tipov \u0161ifriranja in merjenjem entropije. <\/p>\n<p><b class=\"spoiler_title\">Opomba prevajalca<\/b> Op.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Diferen\u010dna entropija<\/a><\/noindex> in <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropija v teoriji informacij<\/a><\/noindex>. Ta \u010dlanek in komentarji ne predvidevajo razprave avtorjev o podrobnostih metod, uporabljenih tako v odprtokodnem kot v lastni\u0161kem programski opremi. <br \/>\n<img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u201eMagic\u201c je ugotovil, da je bil uporabljen GZip pakirnik s kodiranjem base64, kar nam je omogo\u010dilo, da smo razpakirali datoteko in odkrili kodo za vstavitev \u2013 \u201einjektor\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Drobilec: \u201eV regiji epidemija! Masovna cepljenja. Kuga\u201c<\/h2>\n<p>\nDrobilec je bil obi\u010dajna .NET datoteka brez kakr\u0161ne koli za\u0161\u010dite. Po branju izvorne kode z uporabo <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> smo ugotovili, da je bil njegov edini namen vnesti shell-kodo v proces winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Shell-koda ali preproste te\u017eave<\/h2>\n<p>\nUporabili smo avtorsko orodje Hexacorn \u2014 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> da \u201eskompajliramo\u201c shell-kodo v izvr\u0161ljivi datoteki za odpravljanje napak in analizo. Nato smo ugotovili, da deluje tako na 32- kot na 64-bitnih strojih.<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPisanje celo preproste shell-kode v naravni transkripciji z assemblerjem je lahko zapleteno; pisanje celotne shell-kode, ki deluje na obeh vrstah sistemov, pa zahteva elitne ve\u0161\u010dine, zato smo se za\u010deli \u010duditi iznajdljivosti napadalca.<\/p>\n<p>Ko smo raz\u010dlenili skompajlirano shell-kodo z uporabo <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, smo opazili, da je nalagal <strong> dinami\u010dne knji\u017enice .NET <\/strong>, kot sta clr.dll in mscoreei.dll. Zdel se nam je nenavaden \u2013 obi\u010dajno se zlonamerni akterji trudijo, da je shell-koda \u010dim manj\u0161a, tako da kli\u010dejo naravne funkcije OS namesto nalaganja. <em>Zakaj bi bilo komur koli potrebno integrirati funkcionalnost sistema Windows v shell-kodo namesto neposrednega klica po zahtevi? <\/em><\/p>\n<p>Kot se je izkazalo, avtor zlonamerne programske opreme tega zapletenega shell-kode sploh ni napisal \u2013 uporabljena je bila zna\u010dilna programska oprema za prevajanje izvr\u0161ljivih datotek in skript v shell-kodo. <\/p>\n<p>Na\u0161li smo orodje <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, za katerega se nam je zdelo, da bi lahko skompajpiralo podobno shell-kodo. Tukaj je njegov opis z GitHub:<\/p>\n<p><em>Donut generira shell-kod x86 ili x64 iz VBScript, JScript, EXE, DLL (uklju\u010duju\u0107i .NET zgrade). Ovaj shell-kod mo\u017ee biti umetnut u bilo koji Windows proces za izvr\u0161enje u<br \/>\ndelovnega pomnilnika.<\/em><\/p>\n<p>Kako bismo potvrdili na\u0161u teoriju, sastavili smo vlastiti kod koriste\u0107i Donut i uporedili ga sa uzorkom - i... da, otkrili smo jo\u0161 jednu komponentu kori\u0161\u0107enog alata. Nakon toga, ve\u0107 smo mogli da izdvojimo i analiziramo originalnu izvr\u0161nu datoteku na .NET.<\/p>\n<h2> Za\u0161tita koda <\/h2>\n<p>\nOva datoteka je obfuskovana pomo\u0107u <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx je .NET projekat otvorenog koda za za\u0161titu koda drugih \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a. Softver ove klase omogu\u0107ava programerima da \u0161tite svoj kod od reverznog in\u017eenjeringa koriste\u0107i metode kao \u0161to su: zamena simbola, maskiranje toka upravlja\u010dkih komandi i skrivanje referentne metode. Autori zlonamernog softvera koriste obfuskatore s ciljem izbegavanja otkrivanja i da ote\u017eaju zadatak reverznog in\u017eenjeringa.<\/p>\n<p>Zahvaljujo\u010d <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> raspakovali smo kod:<\/p>\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Zaklju\u010dak - korisni teret<\/h2>\n<p>\nKorisni teret dobijen kao rezultat transformacija je vrlo jednostavan ransom virus. Nema mehanizma za odr\u017eavanje prisutnosti u sistemu, nema konekcija sa komandnim centrom - samo staro dobro asimetri\u010dno enkripcija, kako bi se podaci \u017ertve u\u010dinili ne\u010ditljivim.<\/p>\n<p>Glavna funkcija bira kao parametre slede\u0107e stringove:<\/p>\n<ul>\n<li> Ekstenzija datoteke za kori\u0161\u0107enje nakon enkripcije (SaveTheQueen) <\/li>\n<li> Email autora, kako bi ga stavili u datoteku bele\u0161ke sa zahtevom za otkup<\/li>\n<li> Javni klju\u010d koji se koristi za enkripciju datoteka <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Sam proces izgleda ovako:<\/strong><\/p>\n<ol>\n<li> Zlonamerni softver ispituje lokalne i povezane diskove na ure\u0111aju \u017ertve\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Tra\u017ei datoteke za enkripciju\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Poku\u0161ava da zavr\u0161i proces koji koristi datoteku koju planira da enkriptuje<\/li>\n<li> Preimenuje datoteku u \"Izvorno_ime_datoteke.SaveTheQueenING\", koriste\u0107i funkciju MoveFile, i enkriptuje je <\/li>\n<li>Nakon \u0161to je datoteka \u0161ifrirana javnim klju\u010dem autora, zlonamerna programska oprema ponovo preimenuje datoteku, sada u \"Izvorno_ime_datoteke.SaveTheQueen\"<\/li>\n<li>De\u0161ava se zapisivanje datoteke sa zahtevom za otkup u istu fasciklu\n<p><img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nNa osnovu kori\u0161\u0107enja nativne funkcije \"CreateDecryptor\", jedna od funkcija zlonamernog softvera izgleda da sadr\u017ei kao parametar mehanizam de\u0161ifrovanja koji zahteva privatni klju\u010d.<\/p>\n<p>Ransom virus <strong>NE \u0161ifrira fajlove<\/strong>, koji se nalaze u direktorijumima:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Tako\u0111e, on <strong>NE \u0161ifrira slede\u0107e tipove fajlova:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> Zaklju\u010dci i preporuke<\/h2>\n<\/h2>\n<p>\nIako sam virus-otkupac nije sadr\u017eavao nikakve neobi\u010dne funkcije, napada\u010d je kreativno koristio Active Directory za \u0161irenje droppera, a samo zlo\u0107udni softver nam je pru\u017eio zanimljive, iako na kraju ne ba\u0161 slo\u017eene, prepreke tokom analize. <\/p>\n<p>Smatramo da je autor zlo\u0107udnog softvera:<\/p>\n<ol>\n<li>Napisao virus-otkupac sa ugra\u0111enim umetanjem u proces winlogon.exe, kao i<br \/>\nfunkcionalno\u0161\u0107u \u0161ifrovanja i de\u0161ifrovanja fajlova<\/li>\n<li>Maskirao zlo\u0107udni kod pomo\u0107u ConfuserEx, konvertovao rezultat pomo\u0107u Donut i dodatno sakrio dropper base64 Gzip<\/li>\n<li>Dobio povi\u0161ene privilegije u domenu \u017ertve i iskoristio ih za kopiranje<br \/>\nenkriptovanog zlo\u0107udnog softvera i zakazanih zadataka u mre\u017enu folder SYSVOL domen kontrolera<\/li>\n<li>Pokrenuo PowerShell skriptu na ure\u0111ajima domena za \u0161irenje zlo\u0107udnog softvera i bele\u017eenje napredovanja napada u logove u SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Izpla\u010dati \u2014 tako kot kraljico: Varonis preiskuje hitro \u0161irjenje izsiljevalske naprave \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko imate pitanja o ovoj varijanti virusa-otkupca, ili bilo kojoj drugoj aktivnosti koje su na\u0161e ekipe obavile u vezi sa forenzikom i istragom bezbednosnih incidenata, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">se obrnite na nas <\/a><\/noindex> ili zatra\u017eite <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">\u017eivu demonstraciju odgovora na napade<\/a><\/noindex>, gde uvek odgovaramo na pitanja u okviru sesije pitanja i odgovora.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Otkupljivanje \u2014 kao kraljica: Varonis istra\u017euje brzo \u0161ire\u0107i ransomware \u201cSaveTheQueen\u201d | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}