{"id":69513,"date":"2020-02-20T06:38:30","date_gmt":"2020-02-20T03:38:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen"},"modified":"2020-03-03T16:14:51","modified_gmt":"2020-03-03T13:14:51","slug":"vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","title":{"rendered":"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/3b555cf5fad7a1472b9db7a26a736f57.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <br \/>\nNj\u00eb lloj i ri i malware-it t\u00eb kategoris\u00eb ransomv\u00ebrit, q\u00eb enkripton skedar\u00ebt dhe u shton atyre zgjerimin \".SaveTheQueen\", duke u p\u00ebrhapur p\u00ebrmes dosjes s\u00eb rrjetit sistemor SYSVOL n\u00eb kontrollet e domenit Active Directory.<\/p>\n<p>Klient\u00ebt tan\u00eb kan\u00eb hasur k\u00ebt\u00eb malware s\u00eb fundmi. Po sjellim analiz\u00ebn ton\u00eb t\u00eb plot\u00eb, rezultatet e saj dhe p\u00ebrfundimet m\u00eb posht\u00eb.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\n<h2>Zbulimi<\/h2>\n<\/h2>\n<p>\nNj\u00eb nga klient\u00ebt tan\u00eb na kontaktoi pasi has\u00ebn nj\u00eb lloj t\u00eb ri t\u00eb ransomware q\u00eb i shtonte zgjerimin \".SaveTheQueen\" skedar\u00ebve t\u00eb enkriptuar t\u00eb rinj n\u00eb mjedisin e tyre.<\/p>\n<p>Gjat\u00eb hetimit ton\u00eb, m\u00eb sakt\u00ebsisht n\u00eb faz\u00ebn e k\u00ebrkimit t\u00eb burimeve t\u00eb infektimit, zbulova se p\u00ebrhapja dhe mbik\u00ebqyrja e viktimave t\u00eb infektuara kryhej p\u00ebrmes p\u00ebrdorimit t\u00eb <strong>dosjes rrjetore SYSVOL <\/strong> n\u00eb kontrollerin e domainit t\u00eb klientit.<\/p>\n<p>SYSVOL \u00ebsht\u00eb nj\u00eb dosje ky\u00e7e p\u00ebr \u00e7do kontroller t\u00eb domainit, e p\u00ebrdorur p\u00ebr t\u00eb shp\u00ebrndar\u00eb objektet e politikave t\u00eb grupeve (GPO) dhe skenaret e ky\u00e7jes dhe daljes nga sistemi n\u00eb kompjuter\u00ebt e domainit. P\u00ebrmbajtja e k\u00ebsaj dosjeje replikon midis kontroller\u00ebve t\u00eb domainit p\u00ebr t\u00eb sinkronizuar k\u00ebto t\u00eb dh\u00ebna n\u00eb vendet e organizat\u00ebs. Shkruajtja n\u00eb SYSVOL k\u00ebrkon privilegje t\u00eb larta t\u00eb domainit, megjithat\u00eb, pas kompromitimit, kjo aktiv b\u00ebhet nj\u00eb mjet i fuqish\u00ebm p\u00ebr sulmuesit, t\u00eb cil\u00ebt mund ta p\u00ebrdorin at\u00eb p\u00ebr shp\u00ebrndarjen e shpejt\u00eb dhe efektive t\u00eb ngarkes\u00ebs malware n\u00eb domain.<\/p>\n<p>Zgjidhja e auditimit Varonis ndihmoi n\u00eb identifikimin e shpejt\u00eb t\u00eb s\u00eb ardhmes:<\/p>\n<ul>\n<li> Llogaria e infektuar e p\u00ebrdoruesit krijoi nj\u00eb skedar me emrin \u00abhourly\u00bb n\u00eb SYSVOL<\/li>\n<li> Shum\u00eb skedar\u00eb logu u krijuan n\u00eb SYSVOL \u2014 \u00e7do i em\u00ebruar me emrin e pajisjes s\u00eb domainit<\/li>\n<li>Shum\u00eb IP t\u00eb ndryshme mor\u00ebn akses n\u00eb skedarin \u00abhourly\u00bb<\/li>\n<\/ul>\n<p>\nArrit\u00ebm n\u00eb p\u00ebrfundimin se skedar\u00ebt e log\u00ebve ishin p\u00ebrdorur p\u00ebr t\u00eb ndjekur procesin e infektimit n\u00eb pajisje t\u00eb reja, dhe se \u00abhourly\u00bb \u00ebsht\u00eb nj\u00eb detyr\u00eb e cila ekzekutohet n\u00eb m\u00ebnyr\u00eb t\u00eb planifikuar, duke ekzekutuar ngarkes\u00ebn malware n\u00eb pajisje t\u00eb reja, duke p\u00ebrdorur skenarin PowerShell \u2013 mostrave \u00abv3\u00bb dhe \u00abv4\u00bb.<\/p>\n<p>Mund\u00ebsisht, sulmuesi fitoi dhe p\u00ebrdori privilegjet e administratorit t\u00eb domainit p\u00ebr t\u00eb shkruar skedar\u00eb n\u00eb SYSVOL. N\u00eb nyjet e infektuara, sulmuesi ekzekutoi kodin PowerShell, i cili krijoi nj\u00eb detyr\u00eb t\u00eb planifikuar p\u00ebr t\u00eb hapur, dekoduar dhe ekzekutuar malware-in.<\/p>\n<h2>\n<h2>Dekodimi i malware-it<\/h2>\n<\/h2>\n<p>\nNe provuam pa rezultate disa m\u00ebnyra p\u00ebr dekodimin e mostrave:<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/1473714dab68c4c046e057012bf27632.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIshim ishim gati kurkes besh se jemi me u dorzhu, kur vendosem te provokojme menges \"Magic\" te mrekullueshme<br \/>\nutilitare <noindex><a rel=\"nofollow\" href=\"https:\/\/gchq.github.io\/CyberChef\/\">Cyberchef<\/a><\/noindex> nga GCHQ. \"Magic\" p\u00ebrpiqet t\u00eb parashikoj\u00eb enkriptimin e skedarit duke p\u00ebrdorur prov\u00ebn e fjal\u00ebkalimeve p\u00ebr lloje t\u00eb ndryshme t\u00eb enkriptimit dhe duke matur entropin\u00eb. <\/p>\n<p><b class=\"spoiler_title\">Sh\u00ebnim i p\u00ebrkthyesit<\/b> Shiko.<noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%94%D0%B8%D1%84%D1%84%D0%B5%D1%80%D0%B5%D0%BD%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F_%D1%8D%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F\">Entropia diferenciale<\/a><\/noindex> dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%AD%D0%BD%D1%82%D1%80%D0%BE%D0%BF%D0%B8%D1%8F#%D0%92_%D1%82%D0%B5%D0%BE%D1%80%D0%B8%D0%B8_%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%B8\">Entropia n\u00eb teorin\u00eb e informacionit<\/a><\/noindex>. Artikulli aktual dhe komentet nuk parashikojn\u00eb diskutimin nga autor\u00ebt e metodave t\u00eb p\u00ebrdorura si k\u00ebso mjetesh t\u00eb jashtme ashtu edhe softuer\u00ebve pron\u00ebsor\u00eb <br \/>\n<img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/af405d7c71cc799f50d8a1e56a32dd3f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\"Magic\" p\u00ebrcaktoi se ishte p\u00ebrdorur nj\u00eb paketues GZip me kodim base64, duke na lejuar t\u00eb nxjerrim skedarin dhe t\u00eb zbulojm\u00eb kodin p\u00ebr injektimin \u2013 \"injektor\".<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/5f7ff7505b607fc502f24fe5cbe6ba61.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Droppper: \"N\u00eb rajon epidemia! Vaksinime masive. S\u00ebmundja\"<\/h2>\n<p>\nDroppper ishte nj\u00eb skedar i zakonsh\u00ebm .NET pa ndonj\u00eb mbrojtje. Pas leximit t\u00eb kodit burimor me an\u00eb t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0xd4d\/dnSpy\">DNSpy<\/a><\/noindex> kuptuam se q\u00ebllimi i tij i vet\u00ebm ishte injektimi i kodit shell n\u00eb procesin winlogon.exe.<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/539b3ddb63bad6d3ebc48993462db135.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/3135f51dcd9534c0a11a9a0dcf01bc0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kodi shell ose thjesht kompleksitete t\u00eb zakonshme<\/h2>\n<p>\nNe p\u00ebrdor\u00ebm mjetin e autor\u00ebsis\u00eb Hexacorn \u2013 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.hexacorn.com\/blog\/2015\/12\/10\/converting-shellcode-to-portable-executable-32-and-64-bit\/\">shellcode2exe<\/a><\/noindex> p\u00ebr t\u00eb \"kompiluara\" kodin shell n\u00eb nj\u00eb skedar ekzekutues p\u00ebr debugging dhe analiz\u00eb. Pastaj zbuluam se ai punonte si n\u00eb makinat 32-bit ashtu edhe n\u00eb ato 64-bit.<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/df319bd4fa849be9e0afc0f4be5fe753.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkrimi edhe i nj\u00eb kodi shell t\u00eb thjesht\u00eb n\u00eb transmetimin natyror me assembler mund t\u00eb jet\u00eb i komplikuar, nd\u00ebrsa shkruajtja e nj\u00eb kodi shell t\u00eb plot\u00eb q\u00eb funksionon n\u00eb t\u00eb dyja llojet e sistemeve k\u00ebrkon aft\u00ebsi elitar, k\u00ebshtu q\u00eb filluam t\u00eb habiteshim nga sofistikimi i sulmuesit.<\/p>\n<p>Kur e shqyrtuam kodin shell t\u00eb kompiliuar me an\u00eb t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><\/noindex>, v\u00ebrejt\u00ebm se ai ngarkonte <strong> biblioteka dinamike .NET <\/strong>, si clr.dll dhe mscoreei.dll. Kjo duket shum\u00eb e \u00e7uditshme \u2013 zakonisht sulmuesit p\u00ebrpiqen t\u00eb b\u00ebjn\u00eb kodin shell sa m\u00eb t\u00eb vog\u00ebl q\u00eb t\u00eb jet\u00eb e mundur duke thirrur funksionet native t\u00eb OS-s\u00eb n\u00eb vend q\u00eb t'i ngarkojn\u00eb ato. <em>Pse dikush do t\u00eb doj\u00eb t\u00eb integroj\u00eb n\u00eb kodin shell funksionalitetin e Windows, n\u00eb vend q\u00eb t\u00eb th\u00ebrras\u00eb drejtp\u00ebrdrejt sipas k\u00ebrkes\u00ebs? <\/em><\/p>\n<p>Si\u00e7 e zbuluam, autori i malware nuk e kishte shkruar fare k\u00ebt\u00eb kod shell t\u00eb komplikuar \u2013 ishte p\u00ebrdorur nj\u00eb softuer karakteristik p\u00ebr k\u00ebt\u00eb detyr\u00eb p\u00ebr t\u00eb p\u00ebrkthyer skedar\u00eb ekzekutues dhe skriptet n\u00eb kod shell. <\/p>\n<p>Gjet\u00ebm mjetin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TheWover\/donut\">Donut<\/a><\/noindex>, q\u00eb duket se mund t\u00eb kompilon nj\u00eb kod shell t\u00eb ngjash\u00ebm. Ja p\u00ebrshkrimi i tij nga GitHub:<\/p>\n<p><em>Donut gjeneron kod shell x86 ose x64 nga VBScript, JScript, EXE, DLL (duke p\u00ebrfshir\u00eb mbledhjet .NET). Ky kod-shell mund t\u00eb injektohet n\u00eb \u00e7do proces Windows p\u00ebr t'u ekzekutuar n\u00eb<br \/>\nmemorie RAM.<\/em><\/p>\n<p>P\u00ebr t\u00eb konfirmuar teorin\u00eb ton\u00eb, ne kompiluam kodin ton\u00eb, duke p\u00ebrdorur Donut, dhe e krahasuam at\u00eb me nj\u00eb model - dhe... po, gjet\u00ebm edhe nj\u00eb komponent t\u00eb instrumenteve t\u00eb p\u00ebrdorura. Pas k\u00ebsaj, ne arrit\u00ebm t\u00eb nxjerrim dhe analizojm\u00eb skedarin origjinal ekzekutiv n\u00eb .NET.<\/p>\n<h2> Mbrojtja e kodit <\/h2>\n<p>\nKy skedar \u00ebsht\u00eb obfuskues me an\u00eb t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/yck1509.github.io\/ConfuserEx\/\">ConfuserEx<\/a><\/noindex>:<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/573d8e66ce3bdf8723201646d374a4cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/cf94a7938184c72864acb8a8d81e8475.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfuserEx \u00ebsht\u00eb nj\u00eb projekt .NET me kod t\u00eb hapur p\u00ebr mbrojtjen e kodit t\u00eb zhvillimeve t\u00eb tjera. Softueri i k\u00ebtij lloji u lejon zhvilluesve t\u00eb mbrojn\u00eb kodin e tyre nga ingenieria e reversit p\u00ebrmes teknologjive si: z\u00ebvend\u00ebsimi i simboleve, maskimi i rrjedh\u00ebs s\u00eb komandave dhe fshehja e metodave t\u00eb referenc\u00ebs. Autor\u00ebt e malware-it p\u00ebrdorin obfuskator\u00eb me q\u00ebllim shmangien e zbulimit dhe p\u00ebr t\u00eb b\u00ebr\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb detyr\u00ebn e inxhinieris\u00eb s\u00eb reversit.<\/p>\n<p>Fal\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/drive.google.com\/file\/d\/1cXHTHH1S90RCqWYnFOSp1rtYmURecQVm\/view\">ElektroKill Unpacker<\/a><\/noindex> ne \u00e7'repackuam kodin:<\/p>\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/03249d2b493027354396894cf9710041.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2> Rezultati - ngarkesa<\/h2>\n<p>\nNgarkesa e marr\u00eb si rezultat i transformimeve \u00ebsht\u00eb nj\u00eb virus ransomware shum\u00eb i thjesht\u00eb. Nuk ka mekaniz\u00ebm p\u00ebr t\u00eb siguruar pranin\u00eb n\u00eb sistem, asnj\u00eb lidhje me qendr\u00ebn e komand\u00ebs - vet\u00ebm ajo e vjet\u00ebr e mir\u00eb asimetrike e enkriptimeve, p\u00ebr t\u00eb b\u00ebr\u00eb t\u00eb dh\u00ebnat e viktim\u00ebs t\u00eb pa lexueshme.<\/p>\n<p>Funksioni kryesor zgjidh si parametra rreshta t\u00eb m\u00ebposht\u00ebm:<\/p>\n<ul>\n<li> Zgjedhja e shtrirjes s\u00eb skedarit p\u00ebr t'u p\u00ebrdorur pas enkriptimit (SaveTheQueen) <\/li>\n<li> Emailin e autorit, p\u00ebr ta vendosur n\u00eb skedarin e not\u00ebs me k\u00ebrkes\u00ebn e shp\u00ebrblimit<\/li>\n<li> \u00c7el\u00ebsi publik, i p\u00ebrdorur p\u00ebr t\u00eb enkriptuar skedar\u00ebt <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/51b7194260b58e26636b5cbe1e9cdb28.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<strong>Procesi duket si m\u00eb posht\u00eb:<\/strong><\/p>\n<ol>\n<li> Malware-i studion disqet lokale dhe t\u00eb lidhura n\u00eb pajisjen e viktim\u00ebs\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/ca93bce285bdcf05cd9f7f52bac78f25.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> K\u00ebrkon skedar\u00eb p\u00ebr enkriptim\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/e9790631b12dbf816a2c728c2267f1b0.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li> P\u00ebrpiqet t\u00eb mbyll\u00eb procesin q\u00eb p\u00ebrdor skedarin q\u00eb po planifikon t\u00eb enkriptoj\u00eb<\/li>\n<li> Rivendos skedarin n\u00eb \"Emri_Origjinal_i_Skedarit.SaveTheQueenING\", duke p\u00ebrdorur funksionin MoveFile, dhe e enkripton at\u00eb <\/li>\n<li>Pasi skedari \u00ebsht\u00eb enkriptuar me \u00e7el\u00ebsin publik t\u00eb autorit, malware-i e rinominon at\u00eb, tani n\u00eb \"Emri_Fillestar_i_Skedarit.SaveTheQueen\"<\/li>\n<li>Kjo ndodh duke shkruar skedarin me k\u00ebrkes\u00ebn e shp\u00ebrblimit n\u00eb t\u00eb nj\u00ebjt\u00ebn dosje\n<p><img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/c79df5ec0e714d9df01130a40b241f60.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<\/ol>\n<p>\nDuke u bazuar n\u00eb p\u00ebrdorimin e funksionit natyror \"CreateDecryptor\", nj\u00eb nga funksionet e malware-it duket se p\u00ebrmban si paramet\u00ebr mekanizmin e dekodimit q\u00eb k\u00ebrkon \u00e7el\u00ebsin privat.<\/p>\n<p>Virusi enkriptues <strong>Nuk enkripton skedar\u00ebt<\/strong>, q\u00eb ruhen n\u00eb drejtorit\u00eb:<\/p>\n<p>C:windows<br \/>\nC:Program Files<br \/>\nC:Program Files (x86)<br \/>\nC:Users\\AppData<br \/>\nC:inetpub<\/p>\n<p>Po ashtu <strong>Nuk enkripton llojet e m\u00ebposhtme t\u00eb skedar\u00ebve:<\/strong>EXE, DLL, MSI, ISO, SYS, CAB.<\/p>\n<h2>\n<h2> P\u00ebrfundimet dhe konkluzionet<\/h2>\n<\/h2>\n<p>\nMegjith\u00ebse vet\u00eb virusi i k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim nuk kish ndonj\u00eb funksion t\u00eb pazakont\u00eb, sulmuesi e p\u00ebrdori kreativisht Active Directory p\u00ebr t\u00eb p\u00ebrhapur dropper-in, nd\u00ebrsa vet\u00eb softueri keqdash\u00ebs na ofroi pengesa interesante, ndon\u00ebse p\u00ebrfundimisht jo t\u00eb komplikuara, gjat\u00eb analiz\u00ebs. <\/p>\n<p>Mendojm\u00eb se autori i keqsoftuerit:<\/p>\n<ol>\n<li>ka shkruar virusin e k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim me nj\u00eb integrim t\u00eb nd\u00ebrtuar n\u00eb procesin winlogon.exe, si dhe<br \/>\nfunksionalitetin e enkriptimit dhe dekryptimit t\u00eb skedave.<\/li>\n<li>Ka maskuar kodin e keq\u00ebs dhe me ConfuserEx, e ka transformuar rezultatin me Donut dhe p\u00ebr m\u00eb tep\u00ebr ka fshehur dropper-in n\u00eb base64 Gzip.<\/li>\n<li>Ka fituar privilegje t\u00eb larta n\u00eb domainin e viktim\u00ebs dhe i ka p\u00ebrdorur ato p\u00ebr t\u00eb kopjuar<br \/>\nkeqsoftuerin e enkriptuar dhe detyrat e programuar n\u00eb dosjen rrjetore SYSVOL t\u00eb kontrolleve t\u00eb domainit.<\/li>\n<li>Ka ekzekutuar nj\u00eb skript PowerShell n\u00eb pajisjet e domainit p\u00ebr t\u00eb p\u00ebrhapur keqsoftuerin dhe p\u00ebr t\u00eb regjistruar p\u00ebrparimin e sulmit n\u00eb regjistrat n\u00eb SYSVOL.<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Ta rr\u00ebmbesh, qoft\u00eb edhe mbret\u00ebresh\u00ebn: Varonis heton ransomware-in \u201cSaveTheQueen\u201d, i cili po p\u00ebrhapet me shpejt\u00ebsi\" src=\"\/wp-content\/uploads\/2020\/02\/8419072a20487e5a7a3ff20862759f53.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse keni pyetje rreth k\u00ebtij varianti t\u00eb virusit t\u00eb k\u00ebrkes\u00ebs p\u00ebr shp\u00ebrblim, ose \u00e7do tjet\u00ebr hulumtim q\u00eb \u00ebsht\u00eb b\u00ebr\u00eb nga ekipet tona t\u00eb forenzik\u00ebs dhe hetimeve t\u00eb incidenteve t\u00eb siguris\u00eb IT, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/company\/contact-us\/\">kontaktoni me ne <\/a><\/noindex> ose k\u00ebrkoni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/ru\/cyber-workshop\/\">nj\u00eb demonstrim n\u00eb koh\u00eb reale t\u00eb reagimit ndaj sulmeve,<\/a><\/noindex>ku gjithmon\u00eb p\u00ebrgjigjemi pyetjeve n\u00eb kuad\u00ebr t\u00eb sesioneve t\u00eb pyetjeve dhe p\u00ebrgjigjeve.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/488896\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u043e\u0432\u0430\u044f \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043a\u043b\u0430\u0441\u0441\u0430 \u0432\u0438\u0440\u0443\u0441\u043e\u0432-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u043d\u0438\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 &quot;.SaveTheQueen&quot;, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044f\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043f\u0430\u043f\u043a\u0443 SYSVOL \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Active Directory. \u041d\u0430\u0448\u0438 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u044d\u0442\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043e\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e. \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u043c \u043d\u0430\u0448 \u043f\u043e\u043b\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437, \u0435\u0433\u043e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438 \u0432\u044b\u0432\u043e\u0434\u044b \u043d\u0438\u0436\u0435. \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u041e\u0434\u0438\u043d \u0438\u0437 \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432 \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 \u043d\u0430\u043c\u0438 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":69514,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-69513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-20T03:38:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:14:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Shp\u00ebto \u2014 si mbret\u00ebresha: Varonis heton k\u00ebrc\u00ebnuese shpejt t\u00eb p\u00ebrhapur 'SaveTheQueen' | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043a\u0443\u043f\u0430\u0442\u044c \u2014 \u0442\u0430\u043a \u043a\u043e\u0440\u043e\u043b\u0435\u0432\u0443: Varonis \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u201cSaveTheQueen\u201d | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vykupat-tak-korolevu-varonis-rassleduet-bystro-rasprostranyayushhijsya-shifrovalshhik-vymogatel-savethequeen","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-20T03:38:30+00:00","article:modified_time":"2020-03-03T13:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"69513","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:24","updated":"2022-10-08 01:25:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/69513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=69513"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/69513\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/69514"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=69513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=69513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=69513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}