{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nNj\u00eb lloj i ri i malware-it t\u00eb familjes s\u00eb virus\u00ebve-ransomware kripton skedar\u00ebt dhe u shton atyre zgjedhjen \".SaveTheQueen\", duke u p\u00ebrhapur n\u00ebp\u00ebrmjet dosjes n\u00eb rrjetin sistemor SYSVOL n\u00eb kontrollor\u00ebt e domainit Active Directory.<\/p>\n<p>K\u00ebta klient\u00eb tan\u00eb u p\u00ebrball\u00ebn me k\u00ebt\u00eb malware s\u00eb fundmi. Po sjellim analiz\u00ebn ton\u00eb t\u00eb plot\u00eb, rezultatet dhe p\u00ebrfundimet m\u00eb posht\u00eb.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Zbulimi<\/h2>\n<\/h2>\n<p>\nNj\u00eb nga klient\u00ebt tan\u00eb na kontaktoi pasi has\u00ebn nj\u00eb lloj t\u00eb ri t\u00eb kriptuesit-ransomware, i cili i shtonte zgjedhjen \".SaveTheQueen\" skedar\u00ebve t\u00eb rinj t\u00eb kriptuar n\u00eb ambientin e tyre.<\/p>\n<p>Gjat\u00eb hetimit ton\u00eb, n\u00eb faz\u00ebn e k\u00ebrkimit t\u00eb burimeve t\u00eb infektimit, zbuluam se shp\u00ebrndarja dhe ndjekja e viktimave t\u00eb infektuara b\u00ebhej p\u00ebrmes p\u00ebrdorimit t\u00eb <strong>dosjes rrjetore SYSVOL <\/strong> n\u00eb kontrollet e domenit t\u00eb klientit.<\/p>\n<p>SYSVOL \u2013 \u00ebsht\u00eb nj\u00eb dosje ky\u00e7e p\u00ebr \u00e7do kontrollues t\u00eb domainit, e cila p\u00ebrdoret p\u00ebr t\u00eb d\u00ebrguar objekte t\u00eb politikave grupore (GPO) dhe skenar\u00ebt e hyrjes dhe daljes n\u00eb sistem p\u00ebr kompjuter\u00ebt e domainit. P\u00ebrmbajtja e k\u00ebsaj dosjeje riprodhohet midis kontrolluesve t\u00eb domainit p\u00ebr t\u00eb sinkronizuar k\u00ebta t\u00eb dh\u00ebna n\u00eb lokacionet e organizat\u00ebs. Shkrimi n\u00eb SYSVOL k\u00ebrkon privilegje t\u00eb larta domaini, megjithat\u00eb, pas kompromentimit, ky aset b\u00ebhet nj\u00eb mjet i fuqish\u00ebm p\u00ebr sulmuesit, t\u00eb cil\u00ebt mund ta p\u00ebrdorin at\u00eb p\u00ebr shp\u00ebrndarjen e shpejt\u00eb dhe efektive t\u00eb ngarkes\u00ebs p\u00ebrkeq\u00ebsuese n\u00eb domain.<\/p>\n<p>Zinxhiri i auditi Varonis ndihmoi n\u00eb identifikimin e shpejt\u00eb t\u00eb m\u00ebposhtme:<\/p>\n<ul>\n<li> Llogaria e infektuar e p\u00ebrdoruesit krijoi nj\u00eb skedar me emrin \"hourly\" n\u00eb SYSVOL<\/li>\n<li> Mjaft skedar\u00eb regjistrimi u krijuan n\u00eb SYSVOL - \u00e7do nj\u00ebri i em\u00ebruar me emrin e pajisjes s\u00eb domainit<\/li>\n<li>Mjaft adresa IP t\u00eb ndryshme kishin akses n\u00eb skedarin \"hourly\"<\/li>\n<\/ul>\n<p>\nNe arrit\u00ebm n\u00eb p\u00ebrfundimin se skedar\u00ebt e regjistrimit ishin p\u00ebrdorur p\u00ebr t\u00eb ndjekur procesin e infektimit n\u00eb pajisje t\u00eb reja, dhe se \"hourly\" ishte nj\u00eb detyr\u00eb e caktuar q\u00eb ekzekutonte ngarkes\u00ebn p\u00ebrkeq\u00ebsuese n\u00eb pajisje t\u00eb reja, duke p\u00ebrdorur nj\u00eb skenar Powershell \u2013 mostrave \"v3\" dhe \"v4\".<\/p>\n<p>Mund\u00ebsi q\u00eb sulmuesi t\u00eb ket\u00eb fituar dhe p\u00ebrdorur privilegjet e administratorit t\u00eb domain-it p\u00ebr t\u00eb shkruar skedar\u00eb n\u00eb SYSVOL. N\u00eb nyjat e infektuara, sulmuesi ekzekutoi kodin PowerShell q\u00eb krijonte nj\u00eb detyr\u00eb programimi p\u00ebr t\u00eb hapur, dekriptuar dhe ekzekutuar malware.<\/p>\n<h2>\n<h2>Dekodimi i malware<\/h2>\n<\/h2>\n<p>\nKemi provuar disa metoda dekriptime pa sukses:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIshim gati t\u00eb dor\u00ebzoheshim kur vendos\u00ebm t\u00eb provonim metod\u00ebn \"Magic\" t\u00eb mrekullueshme<br \/>\nutilitarit <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> t\u00eb GCHQ-s\u00eb. \"Magic\" p\u00ebrpiqet t\u00eb guess-oj\u00eb enkriptimin e skedarit duke p\u00ebrdorur provimin e fjal\u00ebkalimeve p\u00ebr lloje t\u00eb ndryshme t\u00eb enkriptimit dhe duke matur entropin\u00eb. <\/p>\n<p><b class=\"spoiler_title\">Sh\u00ebnimi i p\u00ebrkthyesit<\/b> Shih.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Entropia diferenciale<\/a><\/noindex> dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropia n\u00eb teorin\u00eb e informacionit<\/a><\/noindex>. Ky artikull dhe komentet nuk parashikojn\u00eb diskutimin nga autor\u00ebt e metodave t\u00eb p\u00ebrdorura si n\u00eb softverin e pal\u00ebve t\u00eb treta, ashtu edhe n\u00eb softverin pronar. <br \/>\n<img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\"Magic\" e p\u00ebrcaktoi se ishte p\u00ebrdorur nj\u00eb paketues GZip me kodim base64, duke na mund\u00ebsuar q\u00eb t\u00eb \u00e7paketojm\u00eb skedarin dhe t\u00eb zbulojm\u00eb kodin p\u00ebr implantimin \u2013 \"injektorin\".<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Drogues: \"N\u00eb rajon epidemia! Vaksinimi masiv. Tula\"<\/h2>\n<p>\nDroppieri p\u00ebrb\u00ebnte nj\u00eb skedar t\u00eb zakonsh\u00ebm .NET pa asnj\u00eb mbrojtje. Pas leximit t\u00eb kodit burimor me an\u00eb t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> , kuptuam se q\u00ebllimi i tij i vet\u00ebm ishte t\u00eb shqiptonte kodin e shell-it n\u00eb procesin winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kodi i shell-it ose thjesht\u00ebsit\u00eb e thjeshta<\/h2>\n<p>\nNe p\u00ebrdor\u00ebm mjetin e autorit Hexacorn \u2014 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> p\u00ebr t\u00eb \"kompiluara\" kodin e shell-it n\u00eb nj\u00eb skedar ekzekutiv p\u00ebr debug dhe analiz\u00eb. Pastaj zbuluam se ajo funksiononte si n\u00eb makinat 32-bit, ashtu dhe n\u00eb ato 64-bit.<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkrimi i kodit t\u00eb shell-it edhe n\u00eb nj\u00eb translacion t\u00eb thjesht\u00eb me assembler mund t\u00eb jet\u00eb i v\u00ebshtir\u00eb, nd\u00ebrsa krijimi i nj\u00eb kodi t\u00eb plot\u00eb t\u00eb shell-it q\u00eb funksionon n\u00eb t\u00eb dy llojet e sistemeve k\u00ebrkon aft\u00ebsi elitare, prandaj ne filluam t\u00eb mahniteshim nga sofistikimi i sulmuesit.<\/p>\n<p>Pasi kemi analizuar kodin e shell-it t\u00eb kompiliuar me an\u00eb t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, v\u00ebm\u00eb re se ai ngarkonte <strong> biblioteka dinamike .NET <\/strong>, si clr.dll dhe mscoreei.dll. Kjo na dukej e \u00e7uditshme \u2013 zakonisht sulmuesit p\u00ebrpiqen t\u00eb b\u00ebjn\u00eb kodin e shell-it sa m\u00eb t\u00eb vog\u00ebl, duke thirrur funksione natyrore t\u00eb OS n\u00eb vend q\u00eb t'i ngarkojn\u00eb ato. <em>Pse dikush do t\u00eb d\u00ebshironte t\u00eb nd\u00ebrtonte funksionalitetin e Windows n\u00eb kodin e shell-it, n\u00eb vend q\u00eb t\u00eb th\u00ebrriste drejtp\u00ebrdrejt me k\u00ebrkes\u00eb? <\/em><\/p>\n<p>Si rezultoi, autori i malware nuk e shkroi fare k\u00ebt\u00eb shell code t\u00eb komplikuar - u p\u00ebrdor nj\u00eb softuer karakteristik p\u00ebr k\u00ebt\u00eb q\u00ebllim p\u00ebr t\u00eb konvertuar skedar\u00ebt e ekzekutuesh\u00ebm dhe skriptesh n\u00eb shell code. <\/p>\n<p>Gjet\u00ebm mjetin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, i cili, sipas mendimit ton\u00eb, mund t\u00eb kompilonte nj\u00eb shell code t\u00eb ngjash\u00ebm. Ja p\u00ebrshkrimi i tij nga GitHub:<\/p>\n<p><em>Donut gjeneron shell code x86 ose x64 nga VBScript, JScript, EXE, DLL (duke p\u00ebrfshir\u00eb grumbuj .NET). Ky shell code mund t\u00eb p\u00ebrfshihet n\u00eb \u00e7do proces Windows p\u00ebr t\u00eb ekzekutuar n\u00eb<br \/>\nmemorie operative.<\/em><\/p>\n<p>P\u00ebr t\u00eb v\u00ebrtetuar teorin\u00eb ton\u00eb, ne kompiluam kodin ton\u00eb duke p\u00ebrdorur Donut dhe e krahasuam at\u00eb me nj\u00eb shembull \u2013 dhe... po, gjet\u00ebm nj\u00eb tjet\u00ebr komponent t\u00eb mjeteve q\u00eb u p\u00ebrdor\u00ebn. Pas k\u00ebsaj, ne arrit\u00ebm t\u00eb nxjerrim dhe analizojm\u00eb skedarin origjinal t\u00eb ekzekutuesh\u00ebm n\u00eb .NET.<\/p>\n<h2> Mbrojtja e kodit <\/h2>\n<p>\nKy skedar \u00ebsht\u00eb obfuskatuar me <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx \u2014 \u00ebsht\u00eb nj\u00eb projekt .NET me burim t\u00eb hapur p\u00ebr mbrojtjen e kodit t\u00eb zhvillimeve t\u00eb tjera. Ky lloj softueri lejon zhvilluesit t\u00eb mbrojn\u00eb kodin e tyre nga inxhinieria e reversit p\u00ebrmes metodave si: z\u00ebvend\u00ebsimi i simboleve, maskimi i rrjedh\u00ebs s\u00eb komandave dhe fshehja e metod\u00ebs s\u00eb referenc\u00ebs. Autor\u00ebt e softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm p\u00ebrdorin obfuscator\u00eb p\u00ebr t\u00eb shmangur zbulimin dhe p\u00ebr ta b\u00ebr\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb procesin e inxhinieris\u00eb s\u00eb reversit.<\/p>\n<p>Fal\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> ne dham\u00eb pakon:<\/p>\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> P\u00ebrmbledhje \u2013 ngarkese e dobishme<\/h2>\n<p>\nNgarkesa e marr\u00eb si rezultat i transformimeve \u00ebsht\u00eb nj\u00eb virus i thjesht\u00eb ransomware. Pa mekanizma p\u00ebr t\u00eb siguruar pranin\u00eb n\u00eb sistem, pa lidhje me qendr\u00ebn e komand\u00ebs \u2013 vet\u00ebm enkriptim asimetrik i vjet\u00ebr dhe t\u00eb njohur, p\u00ebr t\u00eb b\u00ebr\u00eb t\u00eb dh\u00ebnat e viktim\u00ebs t\u00eb palexueshme.<\/p>\n<p>Funksioni kryesor zgjedh si parametra rreshtat e m\u00ebposht\u00ebm:<\/p>\n<ul>\n<li> Shtrirja e skedarit p\u00ebr t'u p\u00ebrdorur pas enkriptimit (SaveTheQueen) <\/li>\n<li> Emaili i autorit, p\u00ebr ta vendosur n\u00eb sked\u00ebn e k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim<\/li>\n<li> \u00c7el\u00ebsi publik i p\u00ebrdorur p\u00ebr enkriptimin e skedar\u00ebve <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Procesi duket si m\u00eb posht\u00eb:<\/strong><\/p>\n<ol>\n<li> K\u00ebrc\u00ebnimi shqyrton disk\u00ebt lokal\u00eb dhe t\u00eb lidhur n\u00eb pajisjen e viktim\u00ebs\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> K\u00ebrkon skedar\u00eb p\u00ebr enkriptim\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> Provon t\u00eb ndal\u00eb procesin q\u00eb p\u00ebrdor skedarin q\u00eb do t\u00eb enkriptohet<\/li>\n<li> Riem\u00ebron skedarin n\u00eb \"Emri_i_skedarit.Filloni_Mbret\u00ebresh\u00ebn\", duke p\u00ebrdorur funksionin MoveFile, dhe e enkripton at\u00eb <\/li>\n<li>Pasi skedari kriptohet me \u00e7el\u00ebsin publik t\u00eb autorit, malware-i e rinomi prap\u00eb at\u00eb, tani n\u00eb \"Emri_origjinal_i_skedarit.SaveTheQueen\"<\/li>\n<li>Ndodh regjistrimi i skedarit me k\u00ebrkes\u00ebn p\u00ebr shp\u00ebrblim n\u00eb t\u00eb nj\u00ebjt\u00ebn dosje\n<p><img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nDuke u bazuar n\u00eb p\u00ebrdorimin e funksionit natyror \"CreateDecryptor\", nj\u00eb nga funksionet e k\u00ebrc\u00ebnimit duket se p\u00ebrmban si paramet\u00ebr mekanizmin e dekriptimit q\u00eb k\u00ebrkon \u00e7el\u00ebsin privat.<\/p>\n<p>Virus enkriptues <strong>Nuk enkripton skedar\u00ebt<\/strong>, t\u00eb ruajtur n\u00eb direktori:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Gjithashtu ai <strong>Nuk enkripton llojet e m\u00ebposhtme t\u00eb skedar\u00ebve:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> P\u00ebrfundimet dhe konstatimet<\/h2>\n<\/h2>\n<p>\nMegjith\u00ebse vet\u00eb virusi i k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim nuk p\u00ebrmbante asnj\u00eb funksion t\u00eb pazakont\u00eb, sulmuesi e p\u00ebrdori kreativitetin p\u00ebr t\u00eb shp\u00ebrndar\u00eb dropper-in p\u00ebrmes Active Directory, dhe vet\u00eb malware na ofroi pengesa interesante, megjith\u00ebse n\u00eb fund nuk ishin t\u00eb komplikuara, gjat\u00eb analiz\u00ebs. <\/p>\n<p>Ne mendojm\u00eb se autori i malware-it:<\/p>\n<ol>\n<li>Krijoi nj\u00eb virus-ransomware me integrim t\u00eb nd\u00ebrtuar n\u00eb procesin winlogon.exe, si dhe<br \/>\nfunksionalitet p\u00ebr enkriptimin dhe dekryptimin e skedar\u00ebve<\/li>\n<li>Maskoi kodin e d\u00ebmsh\u00ebm me ndihm\u00ebn e ConfuserEx, p\u00ebrfundoi rezultatin me Donut dhe m\u00eb tej fshehu dropper-in n\u00eb base64 Gzip<\/li>\n<li>Mori privilegje t\u00eb larta n\u00eb domenin e viktim\u00ebs dhe i p\u00ebrdori ato p\u00ebr t\u00eb kopjuar<br \/>\nmalware-in e enkriptuar dhe detyrat e planifikuara n\u00eb dosjen rrjetore SYSVOL t\u00eb kontrollor\u00ebve t\u00eb domenit<\/li>\n<li>Ekzekutoi nj\u00eb skenar PowerShell n\u00eb pajisjet e domenit p\u00ebr t\u00eb shp\u00ebrndar\u00eb malware-in dhe p\u00ebr t\u00eb regjistruar progresin e sulmit n\u00eb ditar\u00ebt n\u00eb SYSVOL<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"K\u00ebrkoni t\u00eb shp\u00ebtoni \u2014 si\u00e7 do t\u00eb b\u00ebnte nj\u00eb mbret\u00ebresh\u00eb: Varonis heton ransomware-in q\u00eb p\u00ebrhapet shpejt \u201cSaveTheQueen\u201d\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse keni pyetje rreth k\u00ebtij variant t\u00eb virusit-ransomware, ose ndonj\u00eb tjet\u00ebr t\u00eb kryer nga ekipet tona t\u00eb forenzik\u00ebs dhe hetimeve t\u00eb incidenteve t\u00eb siguris\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">na kontaktoni <\/a><\/noindex> ose k\u00ebrkoni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">nj\u00eb demonstruar t\u00eb drejtp\u00ebrdrejt t\u00eb reagimit ndaj sulmeve<\/a><\/noindex>, ku ne gjithmon\u00eb p\u00ebrgjigjemi n\u00eb pyetje gjat\u00eb sesioneve t\u00eb pyetjeve dhe p\u00ebrgjigjeve.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Shp\u00ebto \u2014 si\u00e7 b\u00ebn nj\u00eb mbret\u00ebresh\u00eb: Varonis heton shpejt\u00ebsin\u00eb e shpejt\u00eb t\u00eb enkriptuesit-ransom \u201cSaveTheQueen\u201d | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}