{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Ndonj\u00ebher\u00eb do t\u00eb doja t\u00eb shikoja n\u00eb sy ndonj\u00eb programues virusi dhe t\u00eb pyesja: p\u00ebrse dhe pse? Me pyetjen \"si\" do t\u00eb merremi ne vet\u00eb, por do t\u00eb ishte shum\u00eb interesante t\u00eb dinim se \u00e7far\u00eb mendonte ai ose ajo q\u00eb krijoi k\u00ebt\u00eb ose at\u00eb malware. Sidomos kur hasim n\u00eb k\u00ebto \"perl\u00eb\".<\/p>\n<p>Heroi i artikullit t\u00eb sot\u00ebm \u00ebsht\u00eb nj\u00eb shembull interesant i nj\u00eb shifruesi. Dukej se ishte menduar si nj\u00eb \"shfryt\u00ebzues\", por realizimi i tij teknik \u00ebsht\u00eb m\u00eb shum\u00eb si nj\u00eb shaka e keqe e dikujt. K\u00ebt\u00eb realizim do t\u00eb bisedojm\u00eb sot. <\/p>\n<p>Fatkeq\u00ebsisht, ndjekja e ciklit t\u00eb jet\u00ebs s\u00eb k\u00ebtij enkoduesi \u00ebsht\u00eb praktikisht e pamundur \u2013 statistik\u00eb \u00ebsht\u00eb tep\u00ebr e vog\u00ebl p\u00ebr t\u00eb, pasi, p\u00ebr fat t\u00eb mir\u00eb, nuk ka patur shp\u00ebrndarje. Prandaj, do ta l\u00ebm\u00eb m\u00ebnjan\u00eb origjin\u00ebn, metodat e infektimit dhe p\u00ebrmendje t\u00eb tjera. Do t\u00eb tregojm\u00eb vet\u00ebm p\u00ebr rastin ton\u00eb t\u00eb takimit me <b>Wulfric Ransomware<\/b> dhe se si ne ndihmuam nj\u00eb p\u00ebrdorues t\u00eb shp\u00ebtoj\u00eb skedar\u00ebt e tij. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Si filloi gjith\u00e7ka<\/h3>\n<p>\nN\u00eb laboratori ton\u00eb t\u00eb antivirusit shpesh na kontaktojn\u00eb njer\u00ebz q\u00eb vuajn\u00eb nga shifrimtar\u00ebt. Ne ofrojm\u00eb ndihm\u00eb pa marr\u00eb parasysh se cilat produkte antivirus ata kan\u00eb instaluar. K\u00ebt\u00eb her\u00eb na kontaktoi nj\u00eb person, skedar\u00ebt e t\u00eb cilit ishin prekur nga nj\u00eb enkodues i panjohur.<\/p>\n<blockquote><p>P\u00ebrsh\u00ebndetje! Skedar\u00ebt n\u00eb magazin\u00ebn e skedar\u00ebve (samba4) u shifruan pa fjal\u00ebkalim p\u00ebr hyrje. Kam dyshime se infeksioni erdhi nga kompjuteri i s\u00eb bij\u00ebs (Windows 10 me mbrojtjen standarde Windows Defender). Kompjuteri i saj nuk \u00ebsht\u00eb ngjallur pas k\u00ebsaj. Skedar\u00ebt kryesisht jan\u00eb .jpg dhe .cr2. Shtesa e skedar\u00ebve pas shifrimit: .aef.<\/p><\/blockquote>\n<p>Ne mor\u00ebm nga p\u00ebrdoruesi mostra t\u00eb skedar\u00ebve t\u00eb shifruar, nj\u00eb sh\u00ebnim k\u00ebrkese t\u00eb shp\u00ebrblimit dhe nj\u00eb skedar, i cili, p\u00ebr sa duket, \u00ebsht\u00eb \u00e7el\u00ebsi q\u00eb autor\u00ebt e shifruesit kan\u00eb nevoj\u00eb p\u00ebr t\u00eb dekriptuar skedar\u00ebt.<\/p>\n<p>Ja edhe t\u00eb gjitha gjurm\u00ebt tona:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nLe t\u00eb shohim sh\u00ebnimin. Sa Bitcoin \u00ebsht\u00eb k\u00ebt\u00eb her\u00eb? <\/p>\n<p><b>P\u00ebrkthimi:<\/b><\/p>\n<blockquote><p>Kujdes, skedar\u00ebt tuaj jan\u00eb shifruar!<br \/>\n\u00e7el\u00ebsi \u00ebsht\u00eb unik p\u00ebr PC-n\u00eb tuaj.<\/p>\n<p>Paguani shum\u00ebn 0.05 BTC n\u00eb adres\u00ebn e bitcoin: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nPas pages\u00ebs, m\u00eb d\u00ebrgoni nj\u00eb email, duke bashkuar skedarin pass.key n\u00eb Wulfric@gmx.com me nj\u00eb njoftim p\u00ebr pages\u00ebn.<\/p>\n<p>Pas konfirmimit un\u00eb do t'ju d\u00ebrgoj nj\u00eb dekriptor p\u00ebr skedar\u00ebt.<\/p>\n<p>Mund t\u00eb paguani bitcoin online n\u00eb disa m\u00ebnyra:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> \u2013 pages\u00eb me kart\u00eb bankare<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>P\u00ebr bitcoin:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nN\u00ebse keni ndonj\u00eb pyetje, m\u00eb shkruani n\u00eb Wulfric@gmx.com<br \/>\nSi nj\u00eb bonus, do t'ju tregoj se si \u00ebsht\u00eb hackuar kompjuteri juaj dhe si ta mbrojtni at\u00eb n\u00eb t\u00eb ardhmen.<\/p><\/blockquote>\n<p>\nNj\u00eb ujk patetik, i thirrur p\u00ebr t\u00eb treguar viktim\u00ebs seriozitetin e situat\u00ebs. Megjithat\u00eb, mund t\u00eb kishte qen\u00eb edhe m\u00eb keq.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 1. - Si nj\u00eb bonus, do t'ju tregoj si t\u00eb mbrojtni kompjuterin tuaj n\u00eb t\u00eb ardhmen. - Duket e besueshme.<\/b><\/p>\n<h3>II. T\u00eb fillojm\u00eb pun\u00ebn<\/h3>\n<p>\nFaza e par\u00eb ishte t\u2019i hedhim nj\u00eb sy struktur\u00ebs s\u00eb mostr\u00ebs s\u00eb d\u00ebrguar. Si\u00e7 \u00ebsht\u00eb e \u00e7uditshme, ajo nuk dukej si nj\u00eb skedar i ndikuar nga shifrovuesi. Hapim editorin hexadecimal dhe shohim. N\u00eb kat\u00ebr byte e par\u00eb ndodhet madh\u00ebsia origjinale e skedarit, 60 byte t\u00eb tjera jan\u00eb t\u00eb mbushura me zero. Por ajo q\u00eb \u00ebsht\u00eb m\u00eb interesante ndodhet n\u00eb fund:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 2. Analizojm\u00eb skedarin e d\u00ebmtuar. \u00c7far\u00eb bie n\u00eb sy menj\u00ebher\u00eb?<\/b><\/p>\n<p>T\u00eb gjitha ishin aq t\u00eb thjeshta sa q\u00eb ishte p\u00ebr t\u00eb ardhur keq: 0x40 byte nga titulli ishin transferuar n\u00eb fund t\u00eb skedarit. P\u00ebr rikthimin e t\u00eb dh\u00ebnave mjafton t'i kthejm\u00eb ato n\u00eb fillim. Qasja n\u00eb skedar \u00ebsht\u00eb rikuperuar, por emri \u00ebsht\u00eb ende i enkriptuar, dhe me k\u00ebt\u00eb \u00ebsht\u00eb m\u00eb e nd\u00ebrlikuar. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 3. Emri i enkriptuar n\u00eb Base64 duket si nj\u00eb grup shp\u00ebrthyes simbolesh. <\/b><\/p>\n<p>Le t\u00eb p\u00ebrpiqemi ta analizojm\u00eb <b>pass.key<\/b>, i d\u00ebrguar nga p\u00ebrdoruesi. N\u00eb t\u00eb shohim nj\u00eb sekuenc\u00eb 162-byte simbolesh n\u00eb ASCII.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 4. 162 simbol, t\u00eb l\u00ebn\u00eb n\u00eb PC-n\u00eb e viktim\u00ebs. <\/b><\/p>\n<p>N\u00ebse e shikoni me kujdes, mund t\u00eb v\u00ebreni se simbolet p\u00ebrs\u00ebriten me nj\u00eb periudh\u00eb t\u00eb caktuar. Kjo mund t\u00eb tregoj\u00eb p\u00ebrdorimin e XOR, ku p\u00ebrs\u00ebritjet jan\u00eb karakteristike dhe frekuenca e tyre varet nga gjat\u00ebsia e \u00e7el\u00ebsit. Duke e ndar\u00eb stringun n\u00eb grupe prej 6 simbolesh dhe duke aplikoni disa variante t\u00eb sekuencave XOR, nuk arrit\u00ebm t\u00eb merrnim ndonj\u00eb rezultat kuptimplote.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 5. A shihni konstanta p\u00ebrs\u00ebrit\u00ebse n\u00eb mes?<\/b> <\/p>\n<p>Vendos\u00ebm t\u00eb gjejm\u00eb n\u00eb Google konstantat, sepse po, k\u00ebshtu mund t\u00eb b\u00ebhet edhe kjo! Dhe t\u00eb gjitha ato p\u00ebrfundimisht na \u00e7uan n\u00eb nj\u00eb algorit\u00ebm - Batch Encryption. Pas studimit t\u00eb skriptit u b\u00eb e qart\u00eb se stringu yn\u00eb \u00ebsht\u00eb thjesht rezultati i pun\u00ebs s\u00eb tij. Duhet t\u00eb p\u00ebrmendet se ky nuk \u00ebsht\u00eb nj\u00eb shifrovues, por thjesht nj\u00eb kodifikues, i cili z\u00ebvend\u00ebson simbolet me sekuenca 6-byte. Asnj\u00eb \u00e7el\u00ebs apo sekrete t\u00eb tjera \ud83d\ude41<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 6. Nj\u00eb cop\u00eb origjinale algoritmi me autor\u00ebsi t\u00eb panjohur. <\/b><\/p>\n<p>Algoritmi nuk do t\u00eb punonte si\u00e7 duhet, n\u00ebse nuk do t\u00eb ishte nj\u00eb detaj i vet\u00ebm:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 7. Morpheus miratuar.<\/b><\/p>\n<p>Me ndihm\u00ebn e z\u00ebvend\u00ebsimit t\u00eb kund\u00ebrt, kthejm\u00eb stringun nga <b>pass.key<\/b> n\u00eb tekstin me 27 karaktere. Vlen t\u00eb theksohet se teksti \u00ebsht\u00eb ndoshta njer\u00ebzor \u2018asmodat\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 8. USGFDG=7.<\/b><\/p>\n<p>Google na ndihmon s\u00ebrish. Pas nj\u00eb k\u00ebrkimi t\u00eb vog\u00ebl gjejm\u00eb nj\u00eb projekt interesant n\u00eb GitHub \u2013 Folder Locker, i shkruar n\u00eb .Net dhe q\u00eb p\u00ebrdor bibliotek\u00ebn \u2018asmodat\u2019 nga nj\u00eb llogari tjet\u00ebr n\u00eb \u00abGit\u00bb. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 9. Nd\u00ebrfaqja e Folder Locker. U kontrollua me patjet\u00ebr p\u00ebr maluer. <\/b><\/p>\n<p>Utilitari \u00ebsht\u00eb nj\u00eb enkriptor p\u00ebr Windows 7 dhe m\u00eb lart, i cili shp\u00ebrndahet me kod t\u00eb hapur. N\u00eb enkriptim p\u00ebrdoret nj\u00eb fjal\u00ebkalim, i nevojsh\u00ebm p\u00ebr dekriptimin e m\u00ebpassh\u00ebm. Lejon t\u00eb punoni si me skedar\u00eb individual\u00eb ashtu edhe me direktori t\u00eb t\u00ebra.<\/p>\n<p>Biblioteka e saj p\u00ebrdor algoritmin simetrik t\u00eb enkriptimit Rijndael n\u00eb modalitetin CBC. E ve\u00e7anta \u00ebsht\u00eb se madh\u00ebsia e bllokut \u00ebsht\u00eb zgjedhur t\u00eb jet\u00eb 256 bit \u2013 ndryshe nga standardi AES, ku madh\u00ebsia kufizohet n\u00eb 128 bit. <\/p>\n<p>\u00c7el\u00ebsi yn\u00eb formohet sipas standardit PBKDF2. Si fjal\u00ebkalim p\u00ebrdoret SHA-256 nga vargu i futur n\u00eb utilitar. T\u00eb mbetet vet\u00ebm t\u00eb gjejm\u00eb k\u00ebt\u00eb varg p\u00ebr t\u00eb formuar \u00e7el\u00ebsin e dekriptimit. <\/p>\n<p>Mir\u00eb, le t\u00eb kthehemi te dekriptuari yn\u00eb tashm\u00eb <b>pass.key<\/b>. Kujtoni at\u00eb varg me numra dhe tekstin \u2018asmodat\u2019? Provojm\u00eb t\u00eb p\u00ebrdorim 20 bajt\u00ebt e par\u00eb t\u00eb vargut si fjal\u00ebkalim p\u00ebr Folder Locker. <\/p>\n<p>Shiko, funksionon! Fjal\u00ebkalimi u p\u00ebrshtat, dhe gjith\u00e7ka u deshifrua mrekullisht. Sipas simboleve t\u00eb fjal\u00ebkalimit \u2013 kjo \u00ebsht\u00eb nj\u00eb p\u00ebrfaq\u00ebsim HEX i nj\u00eb fjale t\u00eb caktuar n\u00eb ASCII. Provojm\u00eb ta tregojm\u00eb fjal\u00ebkalimin n\u00eb form\u00eb tekstuale. Marrim \u2018<b>shadowwolf<\/b>\u2019. A ndiheni tashm\u00eb simptomat e likantropis\u00eb?<\/p>\n<p>Le t\u00eb hedhim nj\u00eb her\u00eb tjet\u00ebr nj\u00eb v\u00ebshtrim n\u00eb struktur\u00ebn e dosjes s\u00eb prekur, tani q\u00eb e dim\u00eb mekanizmin e pun\u00ebs s\u00eb lokatorit:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 m\u00ebnyra e enkriptimit t\u00eb emrave;<\/li>\n<li>58 00 00 00 \u2013 gjat\u00ebsia e emrit t\u00eb skedarit t\u00eb enkriptuar dhe t\u00eb koduar n\u00eb base64;<\/li>\n<li>40 00 00 00 \u2013 madh\u00ebsia e titullit t\u00eb transferuar.<\/li>\n<\/ul>\n<p>\nMe t\u00eb kuqe dhe t\u00eb verdh\u00eb jan\u00eb theksuar emri i enkriptuar dhe titulli i transferuar, p\u00ebrkat\u00ebsisht. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 10. Me t\u00eb kuqe \u00ebsht\u00eb theksuar emri i enkriptuar, me t\u00eb verdh\u00eb \u2013 titulli i transferuar. <\/b><\/p>\n<p>Tani le t\u00eb krahasojm\u00eb emrat e enkriptuar dhe t\u00eb dekriptuar n\u00eb p\u00ebrfaq\u00ebsim hexadecimal. <\/p>\n<p>Struktura e t\u00eb dh\u00ebnave t\u00eb dekriptuara:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 mbeturinat e krijuara nga utilitari (4 bajt\u00eb);<\/li>\n<li>0C 00 00 00 \u2013 gjat\u00ebsia e emrit t\u00eb dekriptuar (12 bajt\u00eb);<\/li>\n<li>m\u00eb pas vjen, n\u00eb fakt, emri i skedarit dhe plot\u00ebsimi me zerot deri n\u00eb gjat\u00ebsin\u00eb e nevojshme t\u00eb bllokut (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb kodifikues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 11. IMG_4114 duket shum\u00eb m\u00eb mir\u00eb. <\/b><\/p>\n<h3>III. Konkluzionet dhe p\u00ebrfundimi<\/h3>\n<p>\nDuke u kthyer n\u00eb fillim. Ne nuk e dim\u00eb se \u00e7far\u00eb e udh\u00ebhoqi autorin Wulfric.Ransomware dhe \u00e7far\u00eb q\u00ebllimi kishte. Sigurisht, p\u00ebr p\u00ebrdoruesin e zakonsh\u00ebm, rezultati i pun\u00ebs s\u00eb nj\u00eb kriptuesi t\u00eb till\u00eb do t\u00eb duket nj\u00eb fatkeq\u00ebsi e madhe. Dokumentet nuk hapen. T\u00eb gjith\u00eb emrat jan\u00eb zhdukur. N\u00eb vend t\u00eb imazhit t\u00eb zakonsh\u00ebm \u2013 nj\u00eb ujk n\u00eb ekran. T\u00eb detyruar t\u00eb lexojn\u00eb p\u00ebr bitcoin\u00ebt. <\/p>\n<p>Megjithat\u00eb, k\u00ebt\u00eb her\u00eb pas mask\u00ebs \"kriptares s\u00eb tmerrshme\" fshihej nj\u00eb p\u00ebrpjekje e till\u00eb absurde dhe e pad\u00ebshiruar p\u00ebr shantazh, ku b\u00ebri grev\u00eb p\u00ebrdoruesi p\u00ebrdor programe p\u00ebrfundimisht t\u00eb gatshme dhe la \u00e7el\u00ebsat direkt n\u00eb vendin e krimit. <\/p>\n<p>P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb lidhje me \u00e7el\u00ebsat. Ne nuk kishim ndonj\u00eb skript t\u00eb d\u00ebmsh\u00ebm ose trojan, n\u00ebp\u00ebrmjet t\u00eb cilit mund t\u00eb kuptohej se si kishte lindur ky <b>pass.key<\/b> \u2013 mekanizmi i shfaqjes s\u00eb sked\u00ebs n\u00eb kompjuterin e infektuar mbetet i panjohur. Por, m\u00eb kujtohet, n\u00eb sh\u00ebnimin e tij autori p\u00ebrmendi ve\u00e7orin\u00eb e fjal\u00ebkalimit. K\u00ebshtu q\u00eb, fjala kod p\u00ebr dekriptimin \u00ebsht\u00eb po aq unike sa \u00ebsht\u00eb unik emri i p\u00ebrdoruesit shadow wolf \ud83d\ude42<\/p>\n<p>Dhe megjithat\u00eb, ujku i err\u00ebt, p\u00ebrse dhe pse?<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 kriptuesi q\u00eb nuk ekziston | ProHoster","description":"Ndonj\u00ebher\u00eb d\u00ebshiron t\u00eb shoh\u00ebsh n\u00eb syt\u00eb e ndonj\u00eb shkruesi virusi dhe t\u00eb pyes\u00ebsh: p\u00ebrse dhe pse?","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?","og:url":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}