{"id":41163,"date":"2020-02-06T10:06:32","date_gmt":"2020-02-06T07:06:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/wulfric-ransomware-shifrovalshhik-kotorogo-net"},"modified":"2020-02-06T10:06:32","modified_gmt":"2020-02-06T07:06:32","slug":"wulfric-ransomware-shifrovalshhik-kotorogo-net","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","title":{"rendered":"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nj\u00ebher\u00eb ndonj\u00ebher\u00eb do t\u00eb doja t'i shikoja n\u00eb sy ndonj\u00eb shkrues virusesh dhe t\u00eb pyesja: p\u00ebrse dhe pse? Me p\u00ebrgjigjen e pyetjes \"si\" do ta menaxhojm\u00eb vet\u00eb, por do t\u00eb ishte shum\u00eb interesante t\u00eb dim\u00eb se \u00e7far\u00eb e udh\u00ebhoqi krijuesin e keqdash\u00ebsis\u00eb n\u00eb mendime t\u00eb caktuara, sidomos kur na bien n\u00eb dor\u00eb k\u00ebso \"perlave\".<\/p>\n<p>Heroi i artikullit t\u00eb sot\u00ebm \u00ebsht\u00eb nj\u00eb rast interesant i nj\u00eb enkriptuese. Ai, me sa duket, u krijua si nj\u00eb \"shfryt\u00ebzues\", por realizimi i tij teknik \u00ebsht\u00eb m\u00eb shum\u00eb si nj\u00eb shaka e keqe e dikujt. P\u00ebr k\u00ebt\u00eb realizim do t\u00eb flasim sot. <\/p>\n<p>Fatkeq\u00ebsisht, \u00ebsht\u00eb praktikisht e pamundur t\u00eb ndiqet cikli i jet\u00ebs s\u00eb k\u00ebtij enkoderi - ka shum\u00eb pak statistika n\u00eb lidhje me t\u00eb, pasi ai, p\u00ebr fat t\u00eb mir\u00eb, nuk ka marr\u00eb shp\u00ebrndarje. Prandaj, do ta l\u00ebm\u00eb jasht\u00eb diskutimit origjin\u00ebn, metodat e infektimit dhe p\u00ebrmendje t\u00eb tjera. Do t\u00eb tregojm\u00eb vet\u00ebm p\u00ebr rastin ton\u00eb t\u00eb njohjes me <b>Wulfric Ransomware<\/b> dhe p\u00ebr m\u00ebnyr\u00ebn se si e ndihmuam p\u00ebrdoruesin t\u00eb shp\u00ebtonte skedar\u00ebt e tij. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>I. Si filloi gjith\u00e7ka<\/h3>\n<p>\nN\u00eb laboratorin ton\u00eb antivirus, shpesh njer\u00ebzit drejtohen p\u00ebr ndihm\u00eb pasi jan\u00eb goditur nga enkriptuese. Ne ofrojm\u00eb ndihm\u00eb pavar\u00ebsisht se cilat produkte antivirus ata kan\u00eb t\u00eb instaluar. K\u00ebt\u00eb her\u00eb, nj\u00eb person erdhi tek ne, i cili kishte skedar\u00ebt e tij t\u00eb infektuar nga nj\u00eb enkoder t\u00eb panjohur.<\/p>\n<blockquote><p>P\u00ebrsh\u00ebndetje! Skedar\u00ebt n\u00eb magazin\u00ebn e skedar\u00ebve (samba4) u enkriptuan pa fjal\u00ebkalim. Dyshoj se infeksioni erdhi nga kompjuteri i vajz\u00ebs (Windows 10 me mbrojtjen standarde t\u00eb Windows Defender). Kompjuteri i vajz\u00ebs nuk \u00ebsht\u00eb ndizur pas k\u00ebsaj. Skedar\u00ebt jan\u00eb enkriptuar kryesisht n\u00eb .jpg dhe .cr2. Shtrirja e skedar\u00ebve pas enkriptimit: .aef.<\/p><\/blockquote>\n<p>Ne mor\u00ebm nga p\u00ebrdoruesi mostra t\u00eb skedar\u00ebve t\u00eb enkriptuar, nj\u00eb sh\u00ebnim p\u00ebr shp\u00ebrblim dhe nj\u00eb skedar, i cili, me sa duket, \u00ebsht\u00eb \u00e7el\u00ebsi i nevojsh\u00ebm p\u00ebr autorin e enkriptuese p\u00ebr dekryptimin e skedar\u00ebve.<\/p>\n<p>K\u00ebto jan\u00eb t\u00eb gjitha gjurm\u00ebt tona:<\/p>\n<ul>\n<li>01c.aef (4481K) <\/li>\n<li>hacked.jpg (254K) <\/li>\n<li>hacked.txt (0K) <\/li>\n<li>04c.aef (6540K) <\/li>\n<li>pass.key (0K) <\/li>\n<\/ul>\n<p>\nLe t\u00eb japim nj\u00eb v\u00ebshtrim n\u00eb sh\u00ebnim. Sa bitcoin-e ka k\u00ebt\u00eb her\u00eb? <\/p>\n<p><b>P\u00ebrkthimi:<\/b><\/p>\n<blockquote><p>Kujdes, skedar\u00ebt tuaj jan\u00eb enkriptuar!<br \/>\nfjal\u00ebkalimi \u00ebsht\u00eb unik p\u00ebr PC-n\u00eb tuaj.<\/p>\n<p>Paguani shum\u00ebn 0.05 BTC n\u00eb adres\u00ebn bitcoin: 1ERtRjWAKyG2Edm9nKLLCzd8p1CjjdTiF<br \/>\nPas pages\u00ebs, m\u00eb d\u00ebrgoni nj\u00eb email, duke bashk\u00ebngjitur skedarin pass.key n\u00eb Wulfric@gmx.com me nj\u00eb njoftim p\u00ebr pages\u00ebn.<\/p>\n<p>Pas konfirmimit, un\u00eb do t'ju d\u00ebrgoj dekryptorin p\u00ebr skedar\u00ebt.<\/p>\n<p>Mund t\u00eb paguani bitcoin online n\u00eb m\u00ebnyra t\u00eb ndryshme:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/buy.blockexplorer.com\/\">buy.blockexplorer.com<\/a><\/noindex> - pagesa me kart\u00eb bankare<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.buybitcoinworldwide.com\/\">www.buybitcoinworldwide.com<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/localbitcoins.net\">localbitcoins.net<\/a><\/noindex><\/p>\n<p>P\u00ebr bitcoin-et:<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Bitcoin\">en.wikipedia.org\/wiki\/Bitcoin<\/a><\/noindex><br \/>\nN\u00ebse keni ndonj\u00eb pyetje, m\u00eb shkruani n\u00eb Wulfric@gmx.com<br \/>\nSi bonus, un\u00eb do t'ju tregoj se si b\u00ebhet hackimi i kompjuterit tuaj dhe si ta mbroni at\u00eb n\u00eb t\u00eb ardhmen.<\/p><\/blockquote>\n<p>\nNj\u00eb ujk pompues, i thirrur p\u00ebr t\u00eb treguar viktim\u00ebs seriozitetin e situat\u00ebs. Megjithat\u00eb, mund t\u00eb kishte qen\u00eb m\u00eb keq.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/83546fd6abaf84c07c4471f75320a99d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 1. - Si bonus, do t'ju tregoj si ta mbroni kompjuterin tuaj n\u00eb t\u00eb ardhmen. - Duket legjitime.<\/b><\/p>\n<h3>II. Nisim pun\u00ebn<\/h3>\n<p>\nS\u00eb pari, ne e shqyrtuam struktur\u00ebn e mostr\u00ebs s\u00eb d\u00ebrguar. Si\u00e7 ndodh shpesh, ajo nuk dukej si nj\u00eb skedar i prekur nga enkriptuese. Hapim editorin hexadecimal dhe shikojm\u00eb. N\u00eb 4 bajtat e par\u00eb ndodhet madh\u00ebsia origjinale e skedarit, 60 bajt t\u00eb tjer\u00eb jan\u00eb plot\u00ebsisht me zero. Por m\u00eb e interesantja ndodhet n\u00eb fund:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/47e1039822100885ec4c400a6d85f705.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 2 Analizojm\u00eb skedarin e d\u00ebmtuar. \u00c7far\u00eb bien n\u00eb sy menj\u00ebher\u00eb?<\/b><\/p>\n<p>T\u00eb gjitha dol\u00ebn t\u00eb ishin jashtzakonisht t\u00eb thjeshta: 0x40 bajt nga kreu u transferuan n\u00eb fund t\u00eb skedarit. P\u00ebr t\u00eb rikuperuar t\u00eb dh\u00ebnat, mjafton t'i kthesh ato n\u00eb fillim. Qasja n\u00eb skedar \u00ebsht\u00eb rikuperuar, por emri mbeti i enkriptuar dhe me t\u00eb \u00ebsht\u00eb m\u00eb e komplikuar. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/82e22bd3820247d72be8452620970e5f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 3. Emri i enkriptuar n\u00eb Base64 duket si nj\u00eb grup i paqart\u00eb simbolesh. <\/b><\/p>\n<p>T\u00eb provojm\u00eb t\u00eb analizojm\u00eb <b>pass.key<\/b>, e d\u00ebrguar nga p\u00ebrdoruesi. N\u00eb t\u00eb shohim nj\u00eb varg simbolesh 162-bajt n\u00eb ASCII.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/cf932ca88de8ebf419f06a70f6dc2cb3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 4. 162 simbole, t\u00eb l\u00ebna n\u00eb PC-n\u00eb e viktim\u00ebs. <\/b><\/p>\n<p>N\u00ebse e shikoni me kujdes, mund t\u00eb v\u00ebreni se simbolet p\u00ebrs\u00ebriten me nj\u00eb periudh\u00eb t\u00eb caktuar. Kjo mund t\u00eb tregoj\u00eb p\u00ebrdorimin e XOR-it, ku p\u00ebrs\u00ebritjet jan\u00eb karakteristike, dhe frekuenca e tyre varet nga gjat\u00ebsia e \u00e7el\u00ebsit. Pas ndarjes s\u00eb vargut n\u00eb 6 simbole dhe duke p\u00ebrdorur disa variante t\u00eb sekuencave XOR, nuk arrit\u00ebm ndonj\u00eb rezultat t\u00eb kuptuesh\u00ebm.<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/378d6be895bf9d9b4fd163afe38b6589.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 5. Shihni se si konstanta p\u00ebrs\u00ebritet n\u00eb mes?<\/b> <\/p>\n<p>Vendos\u00ebm t\u00eb b\u00ebjm\u00eb nj\u00eb k\u00ebrkim p\u00ebr konstantat, sepse po, k\u00ebshtu gjithashtu mund t\u00eb b\u00ebhet! Dhe t\u00eb gjitha ato n\u00eb fund t\u00eb fundit na \u00e7uan n\u00eb nj\u00eb algorit\u00ebm - Batch Encryption. Pas studimit t\u00eb skriptit, u b\u00eb e qart\u00eb se vargu yn\u00eb ishte asgj\u00eb m\u00eb shum\u00eb se rezultatet e pun\u00ebs s\u00eb tij. Duhet t\u00eb p\u00ebrmendet se nuk \u00ebsht\u00eb aspak nj\u00eb enkriptuese, por thjesht nj\u00eb kodues, i cili z\u00ebvend\u00ebson simbolet me sekuenca 6-bajt\u00ebshe. Asnj\u00eb \u00e7el\u00ebs apo sekrete t\u00eb tjera \ud83d\ude41<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/20f26580ab8f5bf4d301e7212fefbf35.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 6. Nj\u00eb pjes\u00eb e algoritmit origjinal t\u00eb panjohur. <\/b><\/p>\n<p>Algoritmi nuk do t\u00eb funksiononte si\u00e7 duhet, n\u00ebs\u00eb nuk do t\u00eb ishte nj\u00eb detaj:<\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/c4cb297f51ba110f9c21866a9db29e34.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 7. Morpheus e miratoi.<\/b><\/p>\n<p>Me ndihm\u00ebn e z\u00ebvend\u00ebsimit t\u00eb kund\u00ebrt, e kthejm\u00eb vargun nga <b>pass.key<\/b> n\u00eb tekst prej 27 karakteresh. Vlen t\u00eb theksohet teksti njer\u00ebzor (me shum\u00eb mund\u00ebsi) \u2018asmodat\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/6e5ab19d688f9a085a327a883900d298.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig.8. USGFDG=7.<\/b><\/p>\n<p>S\u00ebrish na ndihmon Google. Pas nj\u00eb k\u00ebrkimi t\u00eb vog\u00ebl gjejm\u00eb nj\u00eb projekt interesant n\u00eb GitHub \u2013 Folder Locker, i shkruar n\u00eb .Net dhe q\u00eb p\u00ebrdor bibliotek\u00ebn \u2018asmodat\u2019 nga nj\u00eb llogari tjet\u00ebr n\u00eb \u2018Git\u2019. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/39de88fc343cabce3d8209e749ac6341.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 9. Nd\u00ebrfaqja e Folder Locker. E kemi kontrolluar p\u00ebr malware. <\/b><\/p>\n<p>Utilita p\u00ebrb\u00ebn nj\u00eb enkriptues p\u00ebr Windows 7 dhe m\u00eb sip\u00ebr, q\u00eb shp\u00ebrndahet me kod t\u00eb hapur. Gjat\u00eb enkriptimit p\u00ebrdoret nj\u00eb fjal\u00ebkalim, e nevojshme p\u00ebr dekriptimin m\u00eb pas. Lejon pun\u00ebn si me skedar\u00eb t\u00eb ve\u00e7ant\u00eb, ashtu edhe me direktori t\u00eb plota.<\/p>\n<p>Biblioteka e saj p\u00ebrdor algoritmin simetrik t\u00eb enkriptimit Rijndael n\u00eb modin CBC. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb madh\u00ebsia e bllokut t\u00eb ket\u00eb qen\u00eb zgjedhur t\u00eb jet\u00eb 256 bite \u2013 ndryshe nga standardi AES, ku madh\u00ebsia kufizohet n\u00eb 128 bite. <\/p>\n<p>\u00c7el\u00ebsi yn\u00eb formohet sipas standardit PBKDF2. Nd\u00ebrkaq, fjal\u00ebkalimi p\u00ebrb\u00ebn SHA-256 nga stringu i futur n\u00eb utilit\u00eb. Na mbetet t\u00eb gjejm\u00eb k\u00ebt\u00eb string p\u00ebr t\u00eb formuar \u00e7el\u00ebsin e dekriptimit. <\/p>\n<p>T\u00eb kthehemi te kodimi yn\u00eb tashm\u00eb t\u00eb dekoduar <b>pass.key<\/b>. Mbani mend at\u00eb string me numra dhe tekstin \u2018asmodat\u2019? Po p\u00ebrpiqemi t\u00eb p\u00ebrdorim 20 bajt t\u00eb par\u00eb t\u00eb stringut si fjal\u00ebkalim p\u00ebr Folder Locker. <\/p>\n<p>Oho, funksionon! Fjala kalim ishte e sakt\u00eb dhe gjith\u00e7ka u deshifrua mir\u00eb. Sipas karaktereve t\u00eb fjal\u00ebkalimit \u2013 kjo \u00ebsht\u00eb nj\u00eb p\u00ebrshtatje HEX e nj\u00eb fjale t\u00eb caktuar n\u00eb ASCII. Le t\u00eb p\u00ebrpiqemi ta shfaqim fjal\u00ebn kod n\u00eb form\u00eb tekstuale. Marrim \u2018<b>shadowwolf<\/b>\u2019. A ndiheni tashm\u00eb simptomat e likantropis\u00eb?<\/p>\n<p>Le t\u00eb shohim p\u00ebrs\u00ebri struktur\u00ebn e skedarit t\u00eb prekur, tani duke e ditur mekanizmin e funksionimit t\u00eb lokut:<\/p>\n<ul>\n<li>02 00 00 00 \u2013 moda e enkriptimit t\u00eb emrave;<\/li>\n<li>58 00 00 00 \u2013 gjat\u00ebsia e emrit t\u00eb skedarit t\u00eb enkriptuar dhe t\u00eb koduar n\u00eb base64;<\/li>\n<li>40 00 00 00 \u2013 madh\u00ebsia e titullit t\u00eb transferuar.<\/li>\n<\/ul>\n<p>\nMe kuqe dhe t\u00eb verdh\u00eb jan\u00eb theksuar emri i enkriptuar dhe titulli i transferuar p\u00ebrkat\u00ebsisht. <\/p>\n<p><img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/b96cb599127e3d4af198dd2065fd51e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 10. Me kuqe \u00ebsht\u00eb theksuar emri i enkriptuar, me t\u00eb verdh\u00eb \u2013 titulli i transferuar. <\/b><\/p>\n<p>E tani, krahasojm\u00eb emrat e enkriptuar dhe t\u00eb dekriptuar n\u00eb paraqitjen heksadeci. <\/p>\n<p>Struktura e t\u00eb dh\u00ebnave t\u00eb dekoduara:<\/p>\n<ul>\n<li>78 B9 B8 2E \u2013 pleh, i krijuar nga utilita (4 bajta);<\/li>\n<li>0C 00 00 00 \u2013 gjat\u00ebsia e emrit t\u00eb dekriptuar (12 bajt);<\/li>\n<li>m\u00eb pas vjen, n\u00eb fakt, emri i skedarit dhe plot\u00ebsimi me zero deri n\u00eb gjat\u00ebsin\u00eb e nevojshme t\u00eb bllokut (padding).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Wulfric Ransomware \u2013 nj\u00eb enkriptues q\u00eb nuk ekziston\" src=\"\/wp-content\/uploads\/2020\/02\/1e2a6e57f9a7f594a7394c03d2f52c5a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<b>Fig. 11. IMG_4114 duket shum\u00eb m\u00eb mir\u00eb. <\/b><\/p>\n<h3>III. Konkluzionet dhe p\u00ebrfundimi<\/h3>\n<p>\nDuke u rikthyer n\u00eb fillim. Ne nuk e dim\u00eb se \u00e7far\u00eb e udh\u00ebhoqi autorin Wulfric.Ransomware dhe cilin q\u00ebllim kishte. Sigurisht, p\u00ebr p\u00ebrdoruesin e zakonsh\u00ebm, rezultati i nj\u00eb enkriptuesi t\u00eb till\u00eb duket si nj\u00eb katastrof\u00eb e madhe. Skedar\u00ebt nuk hapen. T\u00eb gjitha emrat kan\u00eb humbur. N\u00eb vend t\u00eb pics s\u00eb zakonshme \u2013 nj\u00eb wilk n\u00eb ekran. T\u00eb detyrojn\u00eb t\u00eb lexosh p\u00ebr bitcoin. <\/p>\n<p>Megjithat\u00eb, her\u00ebn e k\u00ebsaj, n\u00ebn mask\u00ebn e \u2018enkriptuesit t\u00eb friksh\u00ebm\u2019 q\u00ebndron nj\u00eb p\u00ebrpjekje e till\u00eb qesharake dhe glib, ku sulmuesi p\u00ebrdor programe t\u00eb gatshme dhe l\u00eb \u00e7el\u00ebsat direkt n\u00eb vendin e krimit. <\/p>\n<p>Meqen\u00ebse, p\u00ebr \u00e7el\u00ebsat. Ne nuk pat\u00ebm skript\u00eb keqdash\u00ebse ose trojan\u00eb, p\u00ebrmes t\u00eb cilave mund t\u00eb kuptonim se si ndodhi ky <b>pass.key<\/b> \u2013 mekanizmi i shfaqjes s\u00eb skedarit n\u00eb PC e infektuar mbetet i panjohur. Por, m\u00eb kujtohet se n\u00eb sh\u00ebnimin e tij autori p\u00ebrmendi unikalitetin e fjal\u00ebkalimit. Pra, fjala kod p\u00ebr dekriptim \u00ebsht\u00eb po aq unik sa \u00ebsht\u00eb t\u00eb p\u00ebrdorur emri i p\u00ebrdoruesit shadow wolf \ud83d\ude42<\/p>\n<p>E megjithat\u00eb, ujku i err\u00ebt, pse dhe p\u00ebrse?<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/drweb\/blog\/486908\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443? \u0421 \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u043a\u0430\u043a\u00bb \u043c\u044b \u0441\u043f\u0440\u0430\u0432\u0438\u043c\u0441\u044f \u0441\u0430\u043c\u0438, \u0430 \u0432\u043e\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u0447\u0435\u043c \u0434\u0443\u043c\u0430\u043b \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f \u0442\u043e\u0442 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u0431\u044b\u043b\u043e \u0431\u044b \u043e\u0447\u0435\u043d\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e. \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430\u043c \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u00ab\u0436\u0435\u043c\u0447\u0443\u0436\u0438\u043d\u044b\u00bb. \u0413\u0435\u0440\u043e\u0439 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2013 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u0430. \u0417\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0441\u044f \u043e\u043d, \u043f\u043e \u0432\u0441\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-06T07:06:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wulfric Ransomware \u2013 enkriptuesi q\u00eb nuk ekziston | ProHoster","description":"Ndonj\u00ebher\u00eb, d\u00ebshiroj t'i shikoj n\u00eb sy ndonj\u00eb programuesi virusi dhe t\u00eb pyes: p\u00ebrse dhe pse?","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Wulfric Ransomware \u2013 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 | ProHoster","og:description":"\u041f\u043e\u0440\u043e\u0439 \u0442\u0430\u043a \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u043a\u0430\u043a\u043e\u043c\u0443-\u043d\u0438\u0431\u0443\u0434\u044c \u0432\u0438\u0440\u0443\u0441\u043e\u043f\u0438\u0441\u0430\u0442\u0435\u043b\u044e \u0432 \u0433\u043b\u0430\u0437\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c: \u0437\u0430\u0447\u0435\u043c \u0438 \u043f\u043e\u0447\u0435\u043c\u0443?","og:url":"https:\/\/prohoster.info\/sq\/blog\/wulfric-ransomware-shifrovalshhik-kotorogo-net","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T07:06:32+00:00","article:modified_time":"2020-02-06T07:06:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41163","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 22:24:47","updated":"2022-09-28 11:39:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=41163"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/41164"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=41163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=41163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=41163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}