ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

ืฆื• ืฆื™ืœ ืึทืงืึทื•ื ื˜ืึทื ืฅ ืื™ืŸ ืึท ืกื™ื™ื‘ืขืจ ื‘ืึทืคืึทืœืŸ, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืึทืจื‘ืขื˜ ื“ืึธืงื•ืžืขื ื˜ืŸ ื•ื•ืึธืก ื–ื™ื™ ื–ื•ื›ืŸ ืึธื ืœื™ื™ืŸ. ื“ืึธืก ืื™ื– ื‘ืขืขืจืขืš ื•ื•ืึธืก ืึท ืกื™ื™ื‘ืขืจ ื’ืจื•ืคึผืข ืื™ื– ื˜ืืŸ ืื™ืŸ ื“ื™ ืœืขืฆื˜ืข ื—ื“ืฉื™ื, ื“ื™ืกื˜ืจื™ื‘ื™ื•ื˜ื™ื ื’ ื‘ืึทื•ื•ื•ืกื˜ ื‘ืึทืงื“ืึธืจื–. ื‘ื•ื”ื˜ืจืึทืคึผ ะธ ืจื˜ื, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ืขื ืงืจื™ืคึผื˜ืึธืจืก ืื•ืŸ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ืคึฟืึทืจ ืกื˜ื™ืœื™ื ื’ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™. ืจื•ื‘ึฟ ื˜ืึทืจื’ืึทืฅ ื–ืขื ืขืŸ ืœื™ื’ืŸ ืื™ืŸ ืจื•ืกืœืึทื ื“. ื“ื™ ื‘ืึทืคืึทืœืŸ ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ื“ื•ืจืš ืคึผืœื™ื™ืกื™ื ื’ ื‘ื™ื™ื–ืข ื’ืึทื ืฆืข ืื•ื™ืฃ Yandex.Direct. ืคึผืึธื˜ืขื ืฆื™ืขืœ ื•ื•ื™ืงื˜ื™ืžืก ื–ืขื ืขืŸ ื“ื™ืจืขืงื˜ืขื“ ืฆื• ืึท ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ื•ื•ื• ื–ื™ื™ ื–ืขื ืขืŸ ื’ืขื‘ืขื˜ืŸ ืฆื• ืึธืคึผืœืึธื“ื™ืจืŸ ืึท ื‘ื™ื™ื–ืข ื˜ืขืงืข ื“ื™ืกื’ื™ื™ื–ื“ ื•ื•ื™ ืึท ื“ืึธืงื•ืžืขื ื˜ ืžื•ืกื˜ืขืจ. ื™ืึทื ื“ืขืงืก ื”ืึธื˜ ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ื“ื™ ื‘ื™ื™ื–ืข ื’ืึทื ืฆืข ื ืึธืš ืื•ื ื“ื–ืขืจ ื•ื•ืืจืขื ื•ื ื’.

ื“ื™ ืžืงื•ืจ ืงืึธื“ ืคื•ืŸ Buhtrap ืื™ื– ืœื™ืงื˜ ืึธื ืœื™ื™ืŸ ืื™ืŸ ื“ืขืจ ืคืึทืจื’ืึทื ื’ืขื ื”ื™ื™ื˜ ืึทื–ื•ื™ ื•ื•ืขืจ ืขืก ื™ื– ืงืขื ืขืŸ ื ื•ืฆืŸ ืขืก. ืžื™ืจ ื”ืึธื‘ืŸ ืงื™ื™ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ืึทื•ื•ื™ื™ืœืึทื‘ื™ืœืึทื˜ื™ ืคื•ืŸ RTM ืงืึธื“.

ืื™ืŸ ื“ืขื ืคึผืึธืกื˜ืŸ ืžื™ืจ ื•ื•ืขื˜ ื–ืึธื’ืŸ ืื™ืจ ื•ื•ื™ ื“ื™ ืึทื˜ืึทืงืขืจื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžืึทืœื•ื•ืึทืจืข ื ื™ืฆืŸ Yandex.Direct ืื•ืŸ ื›ืึธื•ืกื˜ื™ื“ ืขืก ืื•ื™ืฃ GitHub. ื“ืขืจ ืคึผืึธืกื˜ืŸ ื•ื•ืขื˜ ืคืึทืจืขื ื“ื™ืงืŸ ืžื™ื˜ ืึท ื˜ืขื›ื ื™ืฉ ืึทื ืึทืœื™ืกื™ืก ืคื•ืŸ ื“ื™ ืžืึทืœื•ื•ืึทืจืข.

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

Buhtrap ืื•ืŸ RTM ื–ืขื ืขืŸ ืฆื•ืจื™ืง ืื™ืŸ ื’ืขืฉืขืคื˜

ืžืขืงืึทื ื™ื–ืึทื ืคื•ืŸ ืคืึทืจืฉืคึผืจื™ื™ื˜ืŸ ืื•ืŸ ื•ื•ื™ืงื˜ื™ืžืก

ื“ื™ ืคืึทืจืฉื™ื“ืŸ ืคึผื™ื™ืœืึธื•ื“ื– ืื™ื‘ืขืจื’ืขื’ืขื‘ืŸ ืฆื• ื•ื•ื™ืงื˜ื™ืžืก ื˜ื™ื™ืœืŸ ืึท ืคึผืจืึธืกื˜ ืคึผืจืึทืคึผืึทื’ื™ื™ืฉืึทืŸ ืžืขืงืึทื ื™ื–ืึทื. ืึทืœืข ื‘ื™ื™ื–ืข ื˜ืขืงืขืก ื‘ืืฉืืคืŸ ื“ื•ืจืš ื“ื™ ืึทื˜ืึทืงืขืจื– ื–ืขื ืขืŸ ื’ืขืฉื˜ืขืœื˜ ืื™ืŸ ืฆื•ื•ื™ื™ ืคืึทืจืฉื™ื“ืขื ืข GitHub ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ื–.

ื˜ื™ืคึผื™ืงืึทืœืœื™, ื“ื™ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ื›ึผื•ืœืœ ืื™ื™ืŸ ื“ืึธื•ื•ื ืœืึธืึทื“ืึทื‘ืœืข ื‘ื™ื™ื–ืข ื˜ืขืงืข, ื•ื•ืึธืก ืื™ื– ืึธืคื˜ ื˜ืฉื™ื™ื ื“ื–ืฉื“. ื–ื™ื ื˜ GitHub ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื–ืขืŸ ื“ื™ ื’ืขืฉื™ื›ื˜ืข ืคื•ืŸ โ€‹โ€‹ืขื ื“ืขืจื•ื ื’ืขืŸ ืื™ืŸ ืึท ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™, ืžื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ื•ื•ืึธืก ืžืึทืœื•ื•ืึทืจืข ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืื™ืŸ ืึท ื–ื™ื›ืขืจ ืฆื™ื™ื˜. ืฆื• ืื™ื‘ืขืจืฆื™ื™ื’ืŸ ื“ื™ ืงืึธืจื‘ืŸ ืฆื• ืึธืคึผืœืึธื“ื™ืจืŸ ื“ื™ ื‘ื™ื™ื–ืข ื˜ืขืงืข, ื“ื™ ื•ื•ืขื‘ื–ื™ื™ื˜ืœ blanki-shabloni24[.]ru, ื’ืขื•ื•ื™ื–ืŸ ืื™ืŸ ื“ื™ ืคื™ื’ื•ืจ ืื•ื™ื‘ืŸ, ืื™ื– ื’ืขื ื™ืฆื˜.

ื“ืขืจ ืคึผืœืึทืŸ ืคื•ืŸ ื“ืขื ืคึผืœืึทืฅ ืื•ืŸ ืึทืœืข ื“ื™ ื ืขืžืขืŸ ืคื•ืŸ ื“ื™ ื‘ื™ื™ื–ืข ื˜ืขืงืขืก ื ืึธื›ื’ื™ื™ืŸ ืึท ืื™ื™ืŸ ื‘ืึทื’ืจื™ืฃ - ืคืืจืžืขืŸ, ื˜ืขืžืคึผืœืึทื˜ืขืก, ืงืึทื ื˜ืจืึทืงืฅ, ืกืึทืžืคึผืึทืœื–, ืืื–"ื• ื•. ื‘ืื˜ืจืื›ื˜ ืึทื– ื‘ื•ื”ื˜ืจืึทืคึผ ืื•ืŸ ืจื˜ื ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื–ืขื ืขืŸ ืฉื•ื™ืŸ ื’ืขื ื™ืฆื˜ ืื™ืŸ ืื ืคืืœืŸ ืื•ื™ืฃ ืึทืงืึทื•ื ื˜ืึทื ืฅ ืื™ืŸ ื“ืขืจ ืคืึทืจื’ืึทื ื’ืขื ื”ื™ื™ื˜, ืžื™ืจ ืื ื’ืขื ื•ืžืขืŸ ืึทื– ื“ื™ ืกื˜ืจืึทื˜ืขื’ื™ืข ืื™ื– ื“ื™ ื–ืขืœื‘ืข ืื™ืŸ ื“ื™ ื ื™ื™ึทืข ืงืืžืคืื ื™ืข. ื“ืขืจ ื‘ืœื•ื™ื– ืงืฉื™ื ืื™ื– ื•ื•ื™ ื“ื™ ืงืึธืจื‘ืŸ ื’ืขืงื•ืžืขืŸ ืฆื• ื“ื™ ืึทื˜ืึทืงืขืจื– 'ืคึผืœืึทืฅ.

ื™ื ืคืขืงืฆื™ืข

ืื™ืŸ ืžื™ื ื“ืกื˜ืขืจ ืขื˜ืœืขื›ืข ืคึผืึธื˜ืขื ืฆื™ืขืœ ื•ื•ื™ืงื˜ื™ืžืก ื•ื•ืึธืก ืขื ื“ื™ืงื˜ ื–ื™ืš ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ื–ืขื ืขืŸ ื’ืขืฆื•ื™ื’ืŸ ื“ื•ืจืš ื‘ื™ื™ื–ืข ื’ืึทื ืฆืข. ื•ื ื˜ืขืจ ืื™ื– ืึท ื‘ื™ื™ึทืฉืคึผื™ืœ URL:

https://blanki-shabloni24.ru/?utm_source=yandex&utm_medium=banner&utm_campaign=cid|{blanki_rsya}|context&utm_content=gid|3590756360|aid|6683792549|15114654950_&utm_term=ัะบะฐั‡ะฐั‚ัŒ ะฑะปะฐะฝะบ ัั‡ะตั‚ะฐ&pm_source=bb.f2.kz&pm_block=none&pm_position=0&yclid=1029648968001296456

ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืคื•ืŸ ื“ื™ ืœื™ื ืง, ื“ื™ ืคืึธืŸ ืื™ื– ื’ืขื•ื•ืขืŸ ืึทืจื™ื™ึทื ื’ืขืฉื™ืงื˜ ืื•ื™ืฃ ื“ื™ ืœืึทื“ื–ืฉื™ื˜ืึทืžืึทื˜ ืึทืงืึทื•ื ื˜ื™ื ื’ ืคืึธืจื•ื bb.f2[.]kz. ืขืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ืฆื• ื˜ืึธืŸ ืึทื– ื“ื™ ื‘ืึทื ืขืจื– ืืจื•ื™ืก ืื•ื™ืฃ ืคืึทืจืฉื™ื“ืขื ืข ื–ื™ื™ื˜ืœืขืš, ืึทืœืข ื”ืึธื‘ืŸ ื“ื™ ื–ืขืœื‘ืข ืงืืžืคืื ื™ืข ืฉื™ื™ึทืŸ (ื‘ืœืึทื ืงื™_ืจืกื™ืึท), ืื•ืŸ ืจื•ื‘ึฟ ืฉื™ื™ึทื›ื•ืช ืฆื• ืึทืงืึทื•ื ื˜ื™ื ื’ ืึธื“ืขืจ ืœืขื’ืึทืœ ื”ื™ืœืฃ ื‘ืึทื“ื™ื ื•ื ื’ืก. ื“ื™ URL ื•ื•ื™ื™ื–ื˜ ืึทื– ื“ื™ ืคึผืึธื˜ืขื ืฆื™ืขืœ ืงืึธืจื‘ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื™ ื‘ืขื˜ืŸ "ืึธืคึผืœืึธื“ื™ืจืŸ ื™ื ื•ื•ื•ื™ืก ืคืึธืจืขื," ื•ื•ืึธืก ืฉื˜ื™ืฆื˜ ืื•ื ื“ื–ืขืจ ื›ื™ื™ืคึผืึทื˜ืึทืกืึทืก ืคื•ืŸ ื˜ืึทืจื’ืขื˜ืขื“ ืื ืคืืœืŸ. ื•ื ื˜ืขืจ ื–ืขื ืขืŸ ื“ื™ ื–ื™ื™ื˜ืœืขืš ื•ื•ื• ื“ื™ ื‘ืึทื ืขืจื– ืืจื•ื™ืก ืื•ืŸ ื“ื™ ืงืึธืจืึทืกืคึผืึทื ื“ื™ื ื’ ื–ื•ื›ืŸ ืงื•ื•ื™ืจื™ื–.

  • ืืจืืคืงืืคื™ืข ื™ื ื•ื•ื•ื™ืก ืคืึธืจืขื - bb.f2[.]kz
  • ืžื•ืกื˜ืขืจ ื”ืขืกืงืขื - Ipopen[.]ru
  • ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืงืœืึธื’ ืžื•ืกื˜ืขืจ - 77metrov[.]ru
  • ื”ืขืกืงืขื ืคืึธืจืขื - ืœื™ื™ื“ื™ืง-dogovor-kupli-prodazhi[.]ru
  • ืžื•ืกื˜ืขืจ ืคึผืœืึทืฅ ืคึผืขื˜ื™ืฆื™ืข - zen.yandex[.]ru
  • ืžื•ืกื˜ืขืจ ืงืœืึธื’ - yurday[.]ru
  • ืžื•ืกื˜ืขืจ ืงืึธื ื˜ืจืึทืงื˜ ืคืืจืžืขืŸ - Regforum[.]ru
  • ืงืึธื ื˜ืจืึทืงื˜ ืคืึธืจืขื โ€“ assistentus[.]ru
  • ืžื•ืกื˜ืขืจ ื•ื•ื•ื™ื ื•ื ื’ ื”ืขืกืงืขื - napravah[.]com
  • ืกืึทืžืคึผืึทืœื– ืคื•ืŸ ืœืขื’ืึทืœ ืงืึทื ื˜ืจืึทืงืฅ - avito[.]ru

ื“ื™ blanki-shabloni24[.]ru ืคึผืœืึทืฅ ืงืขืŸ ื–ื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื“ ืฆื• ืคืึธืจืŸ ืึท ืคึผืฉื•ื˜ ื•ื•ื™ื–ืฉืึทื•ื•ืึทืœ ืึทืกืขืกืžืึทื ื˜. ื˜ื™ืคึผื™ืงืึทืœืœื™, ืึท ืึทื“ ื•ื•ืึธืก ื•ื•ื™ื™ื–ื˜ ืฆื• ืึท ืคืึทื›ืžืึทืŸ-ืงื•ืงืŸ ืคึผืœืึทืฅ ืžื™ื˜ ืึท ืœื™ื ืง ืฆื• GitHub ื˜ื•ื˜ ื ื™ืฉื˜ ื•ื™ืกืงื•ืžืขืŸ ื•ื•ื™ ืขืคึผืขืก ื“ืึธืš ืฉืœืขื›ื˜. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, ื“ื™ ืึทื˜ืึทืงืขืจื– ื•ืคึผืœืึธืึทื“ืขื“ ื‘ื™ื™ื–ืข ื˜ืขืงืขืก ืฆื• ื“ื™ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ื‘ืœื•ื™ื– ืคึฟืึทืจ ืึท ืœื™ืžื™ื˜ืขื“ ืฆื™ื™ื˜, ืžืกืชึผืžื ื‘ืขืฉืึทืก ื“ื™ ืงืืžืคืื ื™ืข. ืจื•ื‘ึฟ ืคื•ืŸ ื“ื™ ืฆื™ื™ื˜, ื“ื™ GitHub ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ื›ึผื•ืœืœ ืึท ืœื™ื™ื“ื™ืง ืคืึทืจืฉืœืขืกืœืขืŸ ืึทืจืงื™ื™ื•ื• ืึธื“ืขืจ ืึท ืœื™ื™ื“ื™ืง ืขืงืกืข ื˜ืขืงืข. ืื–ื•ื™, ืึทื˜ืึทืงืขืจื– ืงืขืŸ ืคืึทืจืฉืคึผืจื™ื™ื˜ืŸ ื’ืึทื ืฆืข ื“ื•ืจืš Yandex.Direct ืื•ื™ืฃ ื–ื™ื™ื˜ืœืขืš ื•ื•ืึธืก ื–ืขื ืขืŸ ืจื•ื‘ึฟ ืžืกืชึผืžื ื‘ืื–ื•ื›ื˜ ื“ื•ืจืš ืึทืงืึทื•ื ื˜ืึทื ืฅ ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขืงื•ืžืขืŸ ืื™ืŸ ืขื ื˜ืคืขืจ ืฆื• ืกืคึผืขืฆื™ืคื™ืฉ ื–ื•ื›ืŸ ืคึฟืจืื’ืŸ.

ื“ืขืจื ืึธืš, ืœืึธืžื™ืจ ืงื•ืงืŸ ืื™ืŸ ื“ื™ ืคืึทืจืฉื™ื“ืŸ ืคึผื™ื™ืœืึธื•ื“ื– ื•ื•ืึธืก ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืื™ืŸ ื“ืขื ื•ื•ืขื’.

ืคึผื™ื™ืœืึธื•ื“ ืึทื ืึทืœื™ืกื™ืก

ื˜ืฉืจืึธื ืึธืœืึธื’ื™ ืคื•ืŸ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’

ื“ื™ ื‘ื™ื™ื–ืข ืงืืžืคืื ื™ืข ืื ื’ืขื”ื•ื™ื‘ืŸ ืื™ืŸ ื“ื™ ืกื•ืฃ ืคื•ืŸ ืืงื˜ืื‘ืขืจ 2018 ืื•ืŸ ืื™ื– ืึทืงื˜ื™ื•ื• ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ืฉืจื™ื™ื‘ืŸ. ื–ื™ื ื˜ ื“ื™ ื’ืื ืฆืข ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ืื™ื– ื’ืขื•ื•ืขืŸ ืขืคื ื˜ืœืขืš ื‘ื ื™ืžืฆื ืื•ื™ืฃ GitHub, ืžื™ืจ ื”ืึธื‘ืŸ ืฆื•ื ื•ื™ืคื’ืขืฉื˜ืขืœื˜ ืึท ืคึผื™ื ื˜ืœืขืš ื˜ื™ื™ืžืœื™ื™ืŸ ืคื•ืŸ ื“ื™ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’ ืคื•ืŸ ื–ืขืงืก ืคืึทืจืฉื™ื“ืขื ืข ืžืึทืœื•ื•ืึทืจืข ืคืึทืžื™ืœื™ืขืก (ื–ืขืŸ ืคื™ื’ื•ืจ ืื•ื ื˜ืŸ). ืžื™ืจ ื”ืึธื‘ืŸ ืฆื•ื’ืขืœื™ื™ื’ื˜ ืึท ืฉื•ืจื” ื•ื•ืึธืก ื•ื•ื™ื™ึทื–ืŸ ื•ื•ืขืŸ ื“ื™ ืคืึธืŸ ืœื™ื ืง ืื™ื– ื“ื™ืกืงืึทื•ื•ืขืจื“, ื•ื•ื™ ื’ืขืžืืกื˜ืŸ ื“ื•ืจืš ESET ื˜ืขืœืขืžืขื˜ืจื™, ืคึฟืึทืจ ืคืึทืจื’ืœื™ื™ึทืš ืžื™ื˜ ื’ื™ื˜ ื’ืขืฉื™ื›ื˜ืข. ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ, ื“ืึธืก ืงืึธืจืึทืœื™ื™ืฅ ื’ืขื–ื•ื ื˜ ืžื™ื˜ ื“ื™ ืึทื•ื•ื™ื™ืœืึทื‘ื™ืœืึทื˜ื™ ืคื•ืŸ ื“ื™ ืคึผื™ื™ืœืึธื•ื“ ืื•ื™ืฃ GitHub. ื“ื™ ื“ื™ืกืงืจืขืคึผืึทื ืกื™ ืื™ืŸ ื“ื™ ืกื•ืฃ ืคื•ืŸ ืคืขื‘ืจื•ืืจ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ืขืจืงืœืขืจื˜ ื“ื•ืจืš ื“ื™ ืคืึทืงื˜ ืึทื– ืžื™ืจ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื”ืึธื‘ืŸ ืึท ื˜ื™ื™ืœ ืคื•ืŸ ื“ืขืจ ืขื ื“ืขืจื•ื ื’ ื’ืขืฉื™ื›ื˜ืข ื•ื•ื™ื™ึทืœ ื“ื™ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ ืื™ื– ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ืคื•ืŸ GitHub ืื™ื™ื“ืขืจ ืžื™ืจ ืงืขืŸ ื‘ืึทืงื•ืžืขืŸ ืขืก ืื™ืŸ ืคื•ืœ.

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct
ืคื™ื’ื•ืจืข 1. ื˜ืฉืจืึธื ืึธืœืึธื’ื™ ืคื•ืŸ ืžืึทืœื•ื•ืึทืจืข ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’.

ืงืึธื“ ืกื™ื™ื ื™ื ื’ ืกืขืจื˜ื™ืคื™ืงืึทืฅ

ื“ื™ ืงืึทืžืคึผื™ื™ืŸ ื’ืขื ื™ืฆื˜ ืงื™ื™ืคืœ ืกืขืจื˜ื™ืคื™ืงืึทืฅ. ืขื˜ืœืขื›ืข ื–ืขื ืขืŸ ื’ืขื—ืชืžืขื˜ ื“ื•ืจืš ืžืขืจ ื•ื•ื™ ืื™ื™ืŸ ืžืึทืœื•ื•ืึทืจืข ืžืฉืคึผื—ื”, ื•ื•ืึธืก ื•ื•ื™ื™ึทื˜ืขืจ ื™ื ื“ื™ืงื™ื™ืฅ ืึทื– ืคืึทืจืฉื™ื“ืขื ืข ืกืึทืžืคึผืึทืœื– ื’ืขื”ืขืจื˜ ืฆื• ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืงืืžืคืื ื™ืข. ื˜ืจืึธืฅ ื“ื™ ืึทื•ื•ื™ื™ืœืึทื‘ื™ืœืึทื˜ื™ ืคื•ืŸ ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ, ืึธืคึผืขืจื™ื™ื˜ืขืจื– ื”ืึธื‘ืŸ ื ื™ืฉื˜ ืกื™ืกื˜ืึทืžืึทื˜ื™ืงืœื™ ืฆื™ื™ื›ืŸ ื“ื™ ื‘ื™ื ืึทืจื™ืขืก ืื•ืŸ ื ื™ืฉื˜ ื ื•ืฆืŸ ื“ืขื ืฉืœื™ืกืœ ืคึฟืึทืจ ืึทืœืข ืกืึทืžืคึผืึทืœื–. ืื™ืŸ ืฉืคึผืขื˜ ืคืขื‘ืจื•ืืจ 2019, ืึทื˜ืึทืงืขืจื– ืื ื’ืขื”ื•ื™ื‘ืŸ ืฆื• ืฉืึทืคึฟืŸ ืคืึทืจืงืจื™ืคึผืœื˜ ืกื™ื’ื ืึทื˜ืฉืขืจื– ื ื™ืฆืŸ ืึท Google-ืึธื•ื ื“ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื•ื•ืึธืก ื–ื™ื™ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื”ืึธื‘ืŸ ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ.

ืึทืœืข ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื™ื ื•ื•ืึทืœื•ื•ื“ ืื™ืŸ ื“ื™ ืงืืžืคืื ื™ืข ืื•ืŸ ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืคืึทืžื™ืœื™ืขืก ื–ื™ื™ ืฆื™ื™ื›ืŸ ื–ืขื ืขืŸ ืœื™ืกื˜ืขื“ ืื™ืŸ ื“ื™ ื˜ื™ืฉ ืื•ื ื˜ืŸ.

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

ืžื™ืจ ื”ืึธื‘ืŸ ืื•ื™ืš ื’ืขื ื™ืฆื˜ ื“ื™ ืงืึธื“ ืกื™ื™ื ื™ื ื’ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืฆื• ืคืึทืจืœื™ื™ื’ืŸ ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ืขืŸ ืžื™ื˜ ืื ื“ืขืจืข ืžืึทืœื•ื•ืึทืจืข ืคืึทืžื™ืœื™ืขืก. ืคึฟืึทืจ ืจื•ื‘ึฟ ืกืขืจื˜ื™ืคื™ืงืึทืฅ, ืžื™ืจ ื”ืึธื‘ืŸ ื ื™ื˜ ื’ืขืคึฟื•ื ืขืŸ ืกืึทืžืคึผืึทืœื– ื•ื•ืึธืก ื–ืขื ืขืŸ ื ื™ืฉื˜ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื“ื•ืจืš ืึท GitHub ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™. ืึธื‘ืขืจ, ื“ื™ TOV "MARIYA" ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื• ืฆื™ื™ื›ืŸ ืžืึทืœื•ื•ืึทืจืข ื‘ื™ืœืึธื ื’ื™ื ื’ ืฆื• ื“ื™ ื‘ืึธื˜ื ืขื˜ ื•ื•ืึทื•ื˜ืฉืึธืก, ืึทื“ื•ื•ืึทืจืข ืื•ืŸ ืžื™ื™ื ืขืจื–. ืขืก ืื™ื– ืึทื ืœื™ื™ืงืœื™ ืึทื– ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ืฉื™ื™ึทื›ื•ืช ืฆื• ื“ืขื ืงืืžืคืื ื™ืข. ืจื•ื‘ึฟ ืžืกืชึผืžื, ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ื’ืขืงื•ื™ืคื˜ ืื•ื™ืฃ ื“ื™ ื“ืึทืจืงื ืขื˜.

Win32/Filecoder.Buhtrap

ื“ืขืจ ืขืจืฉื˜ืขืจ ืงืึธืžืคึผืึธื ืขื ื˜ ื•ื•ืึธืก ื’ืขื›ืืคื˜ ืื•ื ื“ื–ืขืจ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ึทื˜ ืื™ื– ื“ื™ ื ื™ื™ ื“ื™ืกืงืึทื•ื•ืขืจื“ Win32/Filecoder.Buhtrap. ื“ืึธืก ืื™ื– ืึท ื“ืขืœืคื™ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ื•ื•ืึธืก ืื™ื– ืžืืœ ืคึผืึทืงื™ื“ื–ืฉื“. ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ื“ืขืจ ื”ื•ื™ืคึผื˜ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืื™ืŸ ืคืขื‘ืจื•ืืจ-ืžืขืจืฅ 2019. ืขืก ื‘ื™ื›ื™ื™ื•ื•ื– ื•ื•ื™ ืคึผืึทืกื™ืง ืคึฟืึทืจ ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืคึผืจืึธื’ืจืึทื - ืขืก ื–ื•ื›ืŸ ื”ื™ื’ืข ื“ืจื™ื™ื•ื•ื– ืื•ืŸ ื ืขืฅ ืคืึธืœื“ืขืจืก ืื•ืŸ ืขื ืงืจื™ืคึผื˜ ื“ื™ ื“ื™ื˜ืขืงื˜ืึทื“ ื˜ืขืงืขืก. ืขืก ื˜ื•ื˜ ื ื™ืฉื˜ ื“ืึทืจืคึฟืŸ ืึทืŸ ืื™ื ื˜ืขืจื ืขืฅ ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ ืฆื• ื–ื™ื™ืŸ ืงืึทืžืคึผืจืึทืžื™ื™ื–ื“ ื•ื•ื™ื™ึทืœ ืขืก ืงืขืŸ ื ื™ืฉื˜ ืงืึธื ื˜ืึทืงื˜ ื“ื™ ืกืขืจื•ื•ืขืจ ืฆื• ืฉื™ืงืŸ ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœืขืŸ. ืึทื ืฉื˜ืึธื˜, ืขืก ืžื•ืกื™ืฃ ืึท "ืกื™ืžืขืŸ" ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ื™ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืึธื ื–ืึธื’, ืื•ืŸ ืกืึทื’ื“ื–ืฉืขืกืฅ ื ื™ืฆืŸ E- ื‘ืจื™ื•ื• ืึธื“ืขืจ Bitmessage ืฆื• ืงืึธื ื˜ืึทืงื˜ ืึธืคึผืขืจื™ื™ื˜ืขืจื–.

ืฆื• ืขื ืงืจื™ืคึผื˜ ื•ื•ื™ ืคื™ืœืข ืฉืคึผื™ืจืขื•ื•ื“ื™ืง ืจืขืกื•ืจืกืŸ ื•ื•ื™ ืžืขื’ืœืขืš, Filecoder.Buhtrap ืœื•ื™ืคื˜ ืึท ืคืึธื“ืขื ื“ื™ื–ื™ื™ื ื“ ืฆื• ืคืึทืจืžืึทื›ืŸ ืฉืœื™ืกืœ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื•ื•ืึธืก ืงืขืŸ ื”ืึธื‘ืŸ ืึธืคึฟืŸ ื˜ืขืงืข ื”ืึทื ื“ืœืขืจืก ืžื™ื˜ ื•ื•ืขืจื˜ืคื•ืœ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืึธืก ืงืขืŸ ืึทืจื™ื™ึทื ืžื™ืฉื  ื–ื™ืš ืžื™ื˜ ืขื ืงืจื™ืคึผืฉืึทืŸ. ื“ืขืจ ืฆื™ืœ ืคึผืจืึทืกืขืกืึทื– ื–ืขื ืขืŸ ื“ืขืจ ื”ื•ื™ืคึผื˜ ื“ืึทื˜ืึทื‘ื™ื™ืก ืคืึทืจื•ื•ืึทืœื˜ื•ื ื’ ืกื™ืกื˜ืขืžืขืŸ (DBMS). ืื™ืŸ ื“ืขืจืฆื•, Filecoder.Buhtrap ื“ื™ืœื™ืฅ ืงืœืึธืฅ ื˜ืขืงืขืก ืื•ืŸ ื‘ืึทืงืึทืคึผืก ืฆื• ืžืึทื›ืŸ ื“ืึทื˜ืŸ ืึธืคึผื–ื•ืš ืฉื•ื•ืขืจ. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืœื•ื™ืคืŸ ื“ื™ ืคึผืขืงืœ ืฉืจื™ืคื˜ ืื•ื ื˜ืŸ.

bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
wbadmin delete catalog -quiet
wbadmin delete systemstatebackup
wbadmin delete systemstatebackup -keepversions:0
wbadmin delete backup
wmic shadowcopy delete
vssadmin delete shadows /all /quiet
reg delete "HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientDefault" /va /f
reg delete "HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers" /f
reg add "HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers"
attrib "%userprofile%documentsDefault.rdp" -s -h
del "%userprofile%documentsDefault.rdp"
wevtutil.exe clear-log Application
wevtutil.exe clear-log Security
wevtutil.exe clear-log System
sc config eventlog start=disabled

ืคื™ืœืขืงืึธื“ืขืจ.ื‘ื•ื”ื˜ืจืึทืคึผ ื ื™ืฆื˜ ืึท ืœืึทื“ื–ืฉื™ื˜ืึทืžืึทื˜ ืึธื ืœื™ื™ืŸ ื™ืคึผ ืœืึธื’ืขืจ ื“ื™ื ืกื˜ ื“ื™ื–ื™ื™ื ื“ ืฆื• ื–ืึทืžืœืขืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ื•ื•ื™ื–ืึทื˜ืขืจื–. ื“ืึธืก ืื™ื– ื‘ื“ืขื” ืฆื• ืฉืคึผื•ืจ ื•ื•ื™ืงื˜ื™ืžืก ืคื•ืŸ ื“ื™ ืจืึทื ืกืึธืžื•ื•ืึทืจืข, ื•ื•ืึธืก ืื™ื– ื“ื™ ืคึฟืึทืจืึทื ื˜ื•ื•ืึธืจื˜ืœืขื›ืงื™ื™ื˜ ืคื•ืŸ ื“ื™ ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื”:

mshta.exe "javascript:document.write('');"

ื˜ืขืงืขืก ืคึฟืึทืจ ืขื ืงืจื™ืคึผืฉืึทืŸ ื–ืขื ืขืŸ ืื•ื™ืกื’ืขืงืœื™ื‘ืŸ ืื•ื™ื‘ ื–ื™ื™ ื˜ืึธืŸ ื ื™ื˜ ื’ืœื™ื™ึทื›ืŸ ื“ืจื™ื™ ื™ืงืกืงืœื•ื–ืฉืึทืŸ ืจืฉื™ืžื•ืช. ืขืจืฉื˜ืขืจ, ื˜ืขืงืขืก ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ื™ืงืกื˜ืขื ืฉืึทื ื– ื–ืขื ืขืŸ ื ื™ืฉื˜ ื™ื ืงืจื™ืคึผื˜ื™ื“: .ืงืึธื, .ืงืžื“, .ืงืคึผืœ, .ื“ืœืœ, .ืขืงืกืข, .ื”ื˜ืึท, .ืœื ืง, .ืžืกืง, .ืžืกื™, .ืžืกืคึผ, .ืคึผื™ืฃ, .ืกืงืจ, .ืกื™ืก ืื•ืŸ . .ืคืœืขื“ืขืจืžื•ื™ื–. ืฆื•ื•ื™ื™ื˜ื ืก, ืึทืœืข ื˜ืขืงืขืก ืคึฟืึทืจ ื•ื•ืึธืก ื“ื™ ืคื•ืœ ื“ืจืš ื›ึผื•ืœืœ ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืกื˜ืจื™ื ื’ืก ืคื•ืŸ ื“ืขืจ ืจืฉื™ืžื” ืื•ื ื˜ืŸ ื–ืขื ืขืŸ ื™ืงืกืงืœื•ื“ื™ื“.

.{ED7BA470-8E54-465E-825C-99712043E01C}
tor browser
opera
opera software
mozilla
mozilla firefox
internet explorer
googlechrome
google
boot
application data
apple computersafari
appdata
all users
:windows
:system volume information
:nvidia
:intel

ื“ืจื™ื˜ื ืก, ื–ื™ื›ืขืจ ื˜ืขืงืข ื ืขืžืขืŸ ื–ืขื ืขืŸ ืื•ื™ืš ื™ืงืกืงืœื•ื“ื™ื“ ืคื•ืŸ ืขื ืงืจื™ืคึผืฉืึทืŸ, ืฆื•ื•ื™ืฉืŸ ื–ื™ื™ ื“ื™ ื˜ืขืงืข ื ืึธืžืขืŸ ืคื•ืŸ ื“ื™ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืึธื ื–ืึธื’. ื“ื™ ืจืฉื™ืžื” ืื™ื– ื“ืขืจืœืื ื’ื˜ ืื•ื ื˜ืŸ. ื“ืึธืš, ืึทืœืข ื“ื™ ืื•ื™ืกื ืขืžืขืŸ ื–ืขื ืขืŸ ื‘ื“ืขื” ืฆื• ื”ืึทืœื˜ืŸ ื“ื™ ืžืึทืฉื™ืŸ ืคืœื™ืกื ื“ื™ืง, ืึธื‘ืขืจ ืžื™ื˜ ืžื™ื ื™ืžืึทืœ ืจืึธื•ื“ื•ื•ืขืจื“ื™ื ืึทืก.

boot.ini
bootfont.bin
bootsect.bak
desktop.ini
iconcache.db
ntdetect.com
ntldr
ntuser.dat
ntuser.dat.log
ntuser.ini
thumbs.db
winupas.exe
your files are now encrypted.txt
windows update assistant.lnk
master.exe
unlock.exe
unlocker.exe

ื˜ืขืงืข ืขื ืงืจื™ืคึผืฉืึทืŸ ืกื›ืขืžืข

ืึทืžืึธืœ ืขืงืกืึทืงื™ื•ื˜ืึทื“, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื“ื–ืฉืขื ืขืจื™ื™ืฅ ืึท 512-ื‘ื™ืกืœ RSA ืฉืœื™ืกืœ ืคึผืึธืจ. ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืขืงืกืคึผืึธื ืขื ื˜ (ื“) ืื•ืŸ ืžืึธื“ื•ืœื•ืก (n) ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืžื™ื˜ ืึท ืฉื•ื•ืขืจ-ืงืึธื“ืขื“ 2048-ื‘ื™ืกืœ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ (ืฆื™ื‘ื•ืจ ืขืงืกืคึผืึธื ืขื ื˜ ืื•ืŸ ืžืึธื“ื•ืœื•ืก), ื–ืœื™ื‘-ืคึผืึทืงื˜ ืื•ืŸ ื‘ืึทื–ืข 64 ืขื ืงืึธื•ื“ื™ื“. ื“ืขืจ ืงืึธื“ ืคืึทืจืึทื ื˜ื•ื•ืึธืจื˜ืœืขืš ืคึฟืึทืจ ื“ืขื ืื™ื– ื’ืขื•ื•ื™ื–ืŸ ืื™ืŸ ืคื™ื’ื•ืจืข 2.

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct
ืคื™ื’ื•ืจืข 2. ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื”ืขืงืก-ืฉื˜ืจืึทืœืŸ ื“ืขืงืึธืžืคึผื™ืœืึทื˜ื™ืึธืŸ ืคื•ืŸ ื“ื™ 512-ื‘ื™ืกืœ RSA ืฉืœื™ืกืœ ืคึผืึธืจ ื“ื•ืจ ื“ื•ืจ ืคึผืจืึธืฆืขืก.

ื•ื ื˜ืขืจ ืื™ื– ืึท ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ืงืœืึธืจ ื˜ืขืงืกื˜ ืžื™ื˜ ืึท ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ, ื•ื•ืึธืก ืื™ื– ืึท ืกื™ืžืขืŸ ืึทื˜ืึทื˜ืฉื˜ ืฆื• ื“ื™ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืึธื ื–ืึธื’.

DF9228F4F3CA93314B7EE4BEFC440030665D5A2318111CC3FE91A43D781E3F91BD2F6383E4A0B4F503916D75C9C576D5C2F2F073ADD4B237F7A2B3BF129AE2F399197ECC0DD002D5E60C20CE3780AB9D1FE61A47D9735036907E3F0CF8BE09E3E7646F8388AAC75FF6A4F60E7F4C2F697BF6E47B2DBCDEC156EAD854CADE53A239

ื“ื™ ืคื•ื‘ืœื™ืง ืฉืœื™ืกืœ ืคื•ืŸ ื“ื™ ืึทื˜ืึทืงืขืจื– ืื™ื– ื’ืขื’ืขื‘ืŸ ืื•ื ื˜ืŸ.

e = 0x72F750D7A93C2C88BFC87AD4FC0BF4CB45E3C55701FA03D3E75162EB5A97FDA7ACF8871B220A33BEDA546815A9AD9AA0C2F375686F5009C657BB3DF35145126C71E3C2EADF14201C8331699FD0592C957698916FA9FEA8F0B120E4296193AD7F3F3531206608E2A8F997307EE7D14A9326B77F1B34C4F1469B51665757AFD38E88F758B9EA1B95406E72B69172A7253F1DFAA0FA02B53A2CC3A7F0D708D1A8CAA30D954C1FEAB10AD089EFB041DD016DCAAE05847B550861E5CACC6A59B112277B60AC0E4E5D0EA89A5127E93C2182F77FDA16356F4EF5B7B4010BCCE1B1331FCABFFD808D7DAA86EA71DFD36D7E701BD0050235BD4D3F20A97AAEF301E785005
n = 0x212ED167BAC2AEFF7C3FA76064B56240C5530A63AB098C9B9FA2DE18AF9F4E1962B467ABE2302C818860F9215E922FC2E0E28C0946A0FC746557722EBB35DF432481AC7D5DDF69468AF1E952465E61DDD06CDB3D924345A8833A7BC7D5D9B005585FE95856F5C44EA917306415B767B684CC85E7359C23231C1DCBBE714711C08848BEB06BD287781AEB53D94B7983EC9FC338D4320129EA4F568C410317895860D5A85438B2DA6BB3BAAE9D9CE65BCEA6760291D74035775F28DF4E6AB1A748F78C68AB07EA166A7309090202BB3F8FBFC19E44AC0B4D3D0A37C8AA5FA90221DA7DB178F89233E532FF90B55122B53AB821E1A3DB0F02524429DEB294B3A4EDD

ื“ื™ ื˜ืขืงืขืก ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืžื™ื˜ AES-128-CBC ืžื™ื˜ ืึท 256-ื‘ื™ืกืœ ืฉืœื™ืกืœ. ืคึฟืึทืจ ื™ืขื“ืขืจ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข, ืึท ื ื™ื™ึท ืฉืœื™ืกืœ ืื•ืŸ ืึท ื ื™ื™ึท ื™ื ื™ื˜ื™ืึทืœื™ื–ืึทื˜ื™ืึธืŸ ื•ื•ืขืงื˜ืึธืจ ื–ืขื ืขืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“. ื“ืขืจ ืฉืœื™ืกืœ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื™ื– ืžื•ืกื™ืฃ ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข. ื–ืืœ ืก ื‘ืึทื˜ืจืึทื›ื˜ืŸ ื“ื™ ืคึฟืึธืจืžืึทื˜ ืคื•ืŸ ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืข.
ืขื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืขืก ื”ืึธื‘ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื›ืขื“ืขืจ:

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

ื“ื™ ืžืงื•ืจ ื˜ืขืงืข ื“ืึทื˜ืŸ ืžื™ื˜ ื“ื™ ืึทื“ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ VEGA ืžืึทื’ื™ืฉ ื•ื•ืขืจื˜ ืื™ื– ื™ื ืงืจื™ืคึผื˜ื™ื“ ืฆื• ื“ืขืจ ืขืจืฉื˜ืขืจ 0x5000 ื‘ื™ื˜ืขืก. ื›ืœ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื™ื– ืึทื˜ืึทื˜ืฉื˜ ืฆื• ืึท ื˜ืขืงืข ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืกื˜ืจื•ืงื˜ื•ืจ:

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct

- ื“ืขืจ ื˜ืขืงืข ื’ืจื™ื™ืก ืžืึทืจืงืขืจ ื›ึผื•ืœืœ ืึท ืฆื™ื™ื›ืŸ ื•ื•ืึธืก ื™ื ื“ื™ืงื™ื™ืฅ ืฆื™ ื“ื™ ื˜ืขืงืข ืื™ื– ื’ืจืขืกืขืจ ื•ื•ื™ 0x5000 ื‘ื™ื˜ืขืก ืื™ืŸ ื’ืจื™ื™ืก
- AES ืฉืœื™ืกืœ ื‘ืœืึธื‘ = ZlibCompress (RSAencrypt (AES ืฉืœื™ืกืœ + IV, ืขืคื ื˜ืœืขืš ืฉืœื™ืกืœ ืคื•ืŸ ื“ื™ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ RSA ืฉืœื™ืกืœ ืคึผืึธืจ))
- RSA ืฉืœื™ืกืœ ื‘ืœืึธื‘ = ZlibCompress (RSAencrypt (ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ RSA ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ, ืฉื•ื•ืขืจ-ืงืึธื“ืขื“ RSA ืขืคื ื˜ืœืขืš ืฉืœื™ืกืœ))

Win32/ClipBanker

Win32 / ClipBanker ืื™ื– ืึท ืงืึธืžืคึผืึธื ืขื ื˜ ื•ื•ืึธืก ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื™ื ื˜ืขืจืžื™ื˜ืึทื ื˜ืœื™ ืคื•ืŸ ืฉืคึผืขื˜ ืืงื˜ืื‘ืขืจ ืฆื• ืคืจื™ ื“ืขืฆืขืžื‘ืขืจ 2018. ื–ื™ื™ึทืŸ ืจืึธืœืข ืื™ื– ืฆื• ืžืึธื ื™ื˜ืึธืจ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ืงืœื™ืคึผื‘ืึธืจื“, ืขืก ืงื•ืงื˜ ืคึฟืึทืจ ืึทื“ืจืขืกืขืก ืคื•ืŸ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™ ื•ื•ืึธืœืึทืฅ. ื ืึธืš ื‘ืืฉืœืืกืŸ ื“ื™ ืฆื™ืœ ื‘ื™ื™ึทื˜ืœ ืึทื“ืจืขืก, ClipBanker ืจื™ืคึผืœื™ื™ืกื™ื– ืขืก ืžื™ื˜ ืึท ืึทื“ืจืขืก ื•ื•ืึธืก ืื™ื– ื’ืขื’ืœื•ื™ื‘ื˜ ืฆื• ื’ืขื”ืขืจืŸ ืฆื• ื“ื™ ืึธืคึผืขืจื™ื™ื˜ืขืจื–. ื“ื™ ืกืึทืžืคึผืึทืœื– ืžื™ืจ ื™ื’ื–ืึทืžืึทื ื“ ื–ืขื ืขืŸ ื ื™ืฉื˜ ื‘ืึทืงืกื˜ ืึธื“ืขืจ ืึทื‘ืคืึทืกืงื™ื™ื˜ืึทื“. ื“ืขืจ ื‘ืœื•ื™ื– ืžืขืงืึทื ื™ื–ืึทื ื’ืขื ื™ืฆื˜ ืฆื• ืžืึทืกืงืข ื ืึทื˜ื•ืจ ืื™ื– ืฉื˜ืจื™ืงืœ ืขื ืงืจื™ืคึผืฉืึทืŸ. ืึธืคึผืขืจืึทื˜ืึธืจ ื‘ื™ื™ึทื˜ืœ ื•ื•ืขื ื“ื˜ ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืžื™ื˜ RC4. ืฆื™ืœ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™ ื–ืขื ืขืŸ ื‘ื™ื˜ืงืึธื™ืŸ, ื‘ื™ื˜ืงืึธื™ืŸ ื’ืขืœื˜, ื“ืึธื’ืขืงืึธื™ืŸ, ืขื˜ื”ืขืจืขื•ื ืื•ืŸ ืจื™ืคึผืคึผืœืข.

ื‘ืขืฉืึทืก ื“ื™ ืฆื™ื™ึทื˜ ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ื’ืขื•ื•ืขืŸ ืคืืจืฉืคืจื™ื™ื˜ ืฆื• ื“ื™ ืึทื˜ืึทืงืขืจื– 'ื‘ื™ื˜ืงืึธื™ืŸ ื•ื•ืึธืœืึทืฅ, ืึท ืงืœื™ื™ืŸ ืกื•ืžืข ืื™ื– ื’ืขืฉื™ืงื˜ ืฆื• VTS, ื•ื•ืึธืก ืงืึทืกืฅ ืฆื•ื•ื™ื™ืคืœ ืื•ื™ืฃ ื“ื™ ื”ืฆืœื—ื” ืคื•ืŸ ื“ื™ ืงืืžืคืื ื™ืข. ืึทื“ื“ื™ื˜ื™ืึธื ืึทืœืœื™, ืขืก ืื™ื– ืงื™ื™ืŸ ื–ืึธื’ืŸ ืฆื• ืคึฟืึธืจืฉืœืึธื’ืŸ ืึทื– ื“ื™ ื˜ืจืึทื ื–ืึทืงืฉืึทื ื– ื–ืขื ืขืŸ ืฉื™ื™ึทื›ื•ืช ืฆื• ClipBanker.

Win32/RTM

ื“ื™ Win32/RTM ืงืึธืžืคึผืึธื ืขื ื˜ ืื™ื– ื’ืขื•ื•ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืคึฟืึทืจ ืขื˜ืœืขื›ืข ื˜ืขื’ ืื™ืŸ ืคืจื™ ืžืึทืจืฅ 2019. RTM ืื™ื– ืึท ื˜ืจืึธื“ื–ืฉืึทืŸ ื‘ืึทื ืงื™ืจ ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ ื“ืขืœืคื™, ืึทื™ืžืขื“ ื‘ื™ื™ึท ื•ื•ื™ื™ึทื˜ ื‘ืึทื ืงื™ื ื’ ืกื™ืกื˜ืขืžืขืŸ. ืื™ืŸ 2017, ESET ืจื™ืกืขืจื˜ืฉืขืจื– ืืจื•ื™ืก ื“ื™ื˜ื™ื™ืœื“ ืึทื ืึทืœื™ืกื™ืก ืคื•ืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื, ื“ื™ ื‘ืึทืฉืจื™ื™ึทื‘ื•ื ื’ ืื™ื– ื ืึธืš ื‘ืึทื˜ื™ื™ึทื˜ื™ืง. ืื™ืŸ ื™ืื ื•ืืจ 2019, ืคึผืึทืœืึธ ืึทืœื˜ืึธ ื ืขื˜ื•ื•ืึธืจืงืก ืื•ื™ืš ื‘ืืคืจื™ื™ื˜ ื‘ืœืึธื’ ืคึผืึธืกื˜ืŸ ื•ื•ืขื’ืŸ RTM.

ื‘ื•ื”ื˜ืจืึทืคึผ ืœืึธื•ื“ืขืจ

ืคึฟืึทืจ ืขื˜ืœืขื›ืข ืžืึธืœ, ืึท ื“ืึธื•ื•ื ืœืึธืึทื“ืขืจ ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืืจืขื›ื˜ื™ื’ื˜ ืื•ื™ืฃ GitHub ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืขื ืœืขืš ืฆื• ื“ื™ ืคืจื™ืขืจื“ื™ืงืข Buhtrap ืžื›ืฉื™ืจื™ื. ืขืจ ื“ืจื™ื™ื˜ ื–ื™ืš ืฆื• https://94.100.18[.]67/RSS.php?<some_id> ืฆื• ื‘ืึทืงื•ืžืขืŸ ื“ื™ ื•ื•ื™ื™ึทื˜ืขืจ ื‘ื™ื ืข ืื•ืŸ ืœืึธื•ื“ื– ืขืก ื’ืœื™ื™ึทืš ืื™ืŸ ื–ื›ึผืจื•ืŸ. ืžื™ืจ ืงืขื ืขืŸ ื•ื™ืกื˜ื™ื™ืœืŸ ืฆื•ื•ื™ื™ ื‘ื™ื›ื™ื™ื•ื•ื™ืขืจื– ืคื•ืŸ ื“ื™ ืจื’ืข ื‘ื™ื ืข ืงืึธื“. ืื™ืŸ ื“ืขืจ ืขืจืฉื˜ืขืจ URL, RSS.php ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ื“ื™ Buhtrap ื‘ืึทืงื“ืึธืจ ื’ืœื™ื™ืš - ื“ื™ ื‘ืึทืงื“ืึธืจ ืื™ื– ื–ื™ื™ืขืจ ืขื ืœืขืš ืฆื• ื“ืขืจ ื‘ื ื™ืžืฆื ื ืึธืš ื“ื™ ืžืงื•ืจ ืงืึธื“ ืื™ื– ืœื™ืงื˜.

ื™ื ื˜ืขืจืขืกื˜ื™ื ื’ืœื™, ืžื™ืจ ื–ืขืŸ ืขื˜ืœืขื›ืข ืงืึทืžืคึผื™ื™ื ื– ืžื™ื˜ ื“ื™ Buhtrap ื‘ืึทืงื“ืึธืจ, ืื•ืŸ ื–ื™ื™ ื–ืขื ืขืŸ ืึทืœืขื“ื–ืฉืึทื“ืœื™ ืœื•ื™ืคืŸ ื“ื•ืจืš ืคืึทืจืฉื™ื“ืขื ืข ืึธืคึผืขืจื™ื™ื˜ืขืจื–. ืื™ืŸ ื“ืขื ืคืึทืœ, ื“ืขืจ ื”ื•ื™ืคึผื˜ ื—ื™ืœื•ืง ืื™ื– ืึทื– ื“ื™ ื‘ืึทืงื“ืึธืจ ืื™ื– ืœืึธื•ื“ื™ื“ ื’ืœื™ื™ึทืš ืื™ืŸ ื–ื›ึผืจื•ืŸ ืื•ืŸ ื˜ื•ื˜ ื ื™ืฉื˜ ื ื•ืฆืŸ ื“ื™ ื’ืขื•ื•ื™ื™ื ื˜ืœืขืš ืกื›ืขืžืข ืžื™ื˜ ื“ื™ DLL ื“ื™ืคึผืœื•ื™ืžืึทื ื˜ ืคึผืจืึธืฆืขืก ื•ื•ืึธืก ืžื™ืจ ื’ืขืจืขื“ื˜ ื•ื•ืขื’ืŸ ืคืจื™ืขืจ. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, ื“ื™ ืึธืคึผืขืจื™ื™ื˜ืขืจื– ื˜ืฉื™ื™ื ื“ื–ืฉื“ ื“ื™ RC4 ืฉืœื™ืกืœ ื’ืขื ื™ืฆื˜ ืฆื• ืขื ืงืจื™ืคึผื˜ ื ืขืฅ ืคืึทืจืงืขืจ ืฆื• ื“ื™ C&C ืกืขืจื•ื•ืขืจ. ืื™ืŸ ืจื•ื‘ึฟ ืคื•ืŸ ื“ื™ ืงืึทืžืคึผื™ื™ื ื– ืžื™ืจ ื•ื•ืข ื’ืขื–ืขืŸ, ืึธืคึผืขืจื™ื™ื˜ืขืจื– ื”ืึธื‘ืŸ ื ื™ืฉื˜ ืึทืจืŸ ื˜ืฉืึทื ื’ื™ื ื’ ื“ืขื ืฉืœื™ืกืœ.

ื“ื™ ืฆื•ื•ื™ื™ื˜ืข, ืžืขืจ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ื ืึทื˜ื•ืจ ืื™ื– ื’ืขื•ื•ืขืŸ ืึทื– ื“ื™ RSS.php URL ืื™ื– ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ืฆื• ืืŸ ืื ื“ืขืจ ืœืึธื•ื“ืขืจ. ืขืก ื™ืžืคึผืœืึทืžืขื ืึทื“ ืขื˜ืœืขื›ืข ืึทื‘ืคืึทืกืงื™ื™ืฉืึทืŸ, ืึทื–ืึท ื•ื•ื™ ืจื™ื‘ื™ืœื“ื™ื ื’ ื“ื™ ื“ื™ื ืึทืžื™ืฉ ืึทืจื™ื™ึทื ืคื™ืจ ื˜ื™ืฉ. ื“ืขืจ ืฆื™ืœ ืคื•ืŸ ื“ื™ ื‘ืึธืึธื˜ืœืึธืึทื“ืขืจ ืื™ื– ืฆื• ืงืึธื ื˜ืึทืงื˜ ื“ื™ C&C ืกืขืจื•ื•ืขืจ msiofficeupd[.]com/api/F27F84EDA4D13B15/2, ืฉื™ืงืŸ ื“ื™ ืœืึธื’ืก ืื•ืŸ ื•ื•ืึทืจื˜ืŸ ืคึฟืึทืจ ืึท ืขื ื˜ืคืขืจ. ืขืก ืคึผืจืึทืกืขืกืึทื– ื“ื™ ืขื ื˜ืคืขืจ ื•ื•ื™ ืึท ื‘ืœืึธื‘, ืœืึธื•ื“ื– ืขืก ืื™ืŸ ื–ื›ึผืจื•ืŸ ืื•ืŸ ืขืงืกืึทืงื™ื•ืฅ ืขืก. ื“ื™ ืคึผื™ื™ืœืึธื•ื“ ื•ื•ืึธืก ืžื™ืจ ื”ืึธื‘ืŸ ื’ืขื–ืขืŸ ืขืงืกืึทืงื™ื•ื˜ื™ื ื’ ื“ืขื ืœืึธื•ื“ืขืจ ืื™ื– ื’ืขื•ื•ืขืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ื‘ื•ื”ื˜ืจืึทืคึผ ื‘ืึทืงื“ืึธืจ, ืึธื‘ืขืจ ืขืก ืงืขืŸ ื–ื™ื™ืŸ ืื ื“ืขืจืข ืงืึทืžืคึผืึธื•ื ืึทื ืฅ.

ืึทื ื“ืจื•ื™ื“/ืกืคึผื™.ื‘ืึทื ืงืขืจ

ื™ื ื˜ืขืจืขืกื˜ื™ื ื’ืœื™, ืึท ืงืึธืžืคึผืึธื ืขื ื˜ ืคึฟืึทืจ ืึทื ื“ืจื•ื™ื“ ืื™ื– ืื•ื™ืš ื’ืขืคึฟื•ื ืขืŸ ืื™ืŸ ื“ื™ GitHub ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™. ืขืจ ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืœื•ื™ื– ืื™ื™ืŸ ื˜ืึธื’ ืื™ืŸ ื“ื™ ื”ื•ื™ืคึผื˜ ืฆื•ื•ื™ื™ึทื’ - 1 ื ืื•ื•ืขืžื‘ืขืจ 2018. ืึทื—ื•ืฅ ื“ื™ ืคึผืึธืกื˜ืขื“ ืื•ื™ืฃ GitHub, ESET ื˜ืขืœืขืžืขื˜ืจื™ ื’ืขืคื™ื ื˜ ืงื™ื™ืŸ ื–ืึธื’ืŸ ืึทื– ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜.

ื“ืขืจ ืงืึธืžืคึผืึธื ืขื ื˜ ืื™ื– ื›ืึธื•ืกื˜ื™ื“ ื•ื•ื™ ืึทืŸ ืึทื ื“ืจื•ื™ื“ ืึทืคึผืคึผืœื™ืงืึทื˜ื™ืึธืŸ ืคึผืึทืงืงืึทื’ืข (APK). ืขืก ืื™ื– ืฉื•ื•ืขืจ ืคืึทืจืฉื˜ืึธืจื‘ืŸ. ื“ื™ ื‘ื™ื™ื–ืข ื ืึทื˜ื•ืจ ืื™ื– ืคืึทืจื‘ืึธืจื’ืŸ ืื™ืŸ ืึท ื™ื ืงืจื™ืคึผื˜ื™ื“ JAR ืื™ืŸ ื“ื™ ืึทืคึผืง. ืขืก ืื™ื– ื™ื ืงืจื™ืคึผื˜ื™ื“ ืžื™ื˜ RC4 ื ื™ืฆืŸ ื“ืขื ืฉืœื™ืกืœ:

key = [
0x87, 0xd6, 0x2e, 0x66, 0xc5, 0x8a, 0x26, 0x00, 0x72, 0x86, 0x72, 0x6f,
0x0c, 0xc1, 0xdb, 0xcb, 0x14, 0xd2, 0xa8, 0x19, 0xeb, 0x85, 0x68, 0xe1,
0x2f, 0xad, 0xbe, 0xe3, 0xb9, 0x60, 0x9b, 0xb9, 0xf4, 0xa0, 0xa2, 0x8b, 0x96
]

ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฉืœื™ืกืœ ืื•ืŸ ืึทืœื’ืขืจื™ื“ืึทื ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ืฆื• ืขื ืงืจื™ืคึผื˜ ืกื˜ืจื™ื ื’ืก. JAR ืื™ื– ืœื™ื’ืŸ ืื™ืŸ APK_ROOT + image/files. ื“ืขืจ ืขืจืฉื˜ืขืจ 4 ื‘ื™ื˜ืขืก ืคื•ืŸ ื“ืขืจ ื˜ืขืงืข ืึทื ื˜ื”ืึทืœื˜ืŸ ื“ื™ ืœืขื ื’ ืคื•ืŸ ื“ื™ ืขื ืงืจื™ืคึผื˜ื™ื“ JAR, ื•ื•ืึธืก ื”ื™ื™ื‘ื˜ ื–ื™ืš ื’ืœื™ื™ืš ื ืึธืš ื“ื™ ืœืขื ื’ ืคืขืœื“.

ื ืึธืš ื“ืขืงืจื™ืคึผื˜ืขื“ ื“ื™ ื˜ืขืงืข, ืžื™ืจ ื“ื™ืกืงืึทื•ื•ืขืจื“ ืึทื– ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืึทื ื•ื‘ื™ืก - ืคืจื™ืขืจ ื“ืึทืงื™ืึทืžืขื ื˜ืึทื“ ื‘ืึทื ืงื™ืจ ืคึฟืึทืจ ืึทื ื“ืจื•ื™ื“. ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื”ืื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืคึฟืขื™ึดืงื™ื™ื˜ืŸ:

  • ืจืขืงืึธืจื“ื™ื ื’ ืคึฟื•ืŸ ืึท ืžื™ืงืจืึธืคืึธืŸ
  • ื’ืขื ื•ืžืขืŸ ืกืงืจืขืขื ืฉืึธืฅ
  • ื‘ืึทืงื•ืžืขืŸ ื’ืคึผืก ืงืึธื•ืึธืจื“ืึทื ืึทืฅ
  • ืงื™ื™ืœืึธื’ื’ืขืจ
  • ืžื™ื˜ืœ ื“ืึทื˜ืŸ ืขื ืงืจื™ืคึผืฉืึทืŸ ืื•ืŸ ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืคืึธื“ืขืจื•ื ื’
  • ืฉื™ืงื˜ ืกืคึผืึทื

ื™ื ื˜ืขืจืขืกื˜ื™ื ื’ืœื™, ื“ืขืจ ื‘ืึทื ืงื™ืจ ื’ืขื•ื•ื™ื™ื ื˜ ื˜ื•ื•ื™ื˜ื˜ืขืจ ื•ื•ื™ ืึท ื‘ืึทืงืึทืคึผ ืงืึธืžื•ื ื™ืงืึทืฆื™ืข ืงืึทื ืึทืœ ืฆื• ื‘ืึทืงื•ืžืขืŸ ืืŸ ืื ื“ืขืจ C&C ืกืขืจื•ื•ืขืจ. ื“ืขืจ ืžื•ืกื˜ืขืจ ื•ื•ืึธืก ืžื™ืจ ืึทื ืึทืœื™ื™ื–ื“ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื™ @JonesTrader ื—ืฉื‘ื•ืŸ, ืึธื‘ืขืจ ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ืึทื ืึทืœื™ืกื™ืก ืขืก ืื™ื– ืฉื•ื™ืŸ ืืคื’ืขืฉื˜ืขืœื˜.

ื“ืขืจ ื‘ืึทื ืงื™ืจ ื›ึผื•ืœืœ ืึท ืจืฉื™ืžื” ืคื•ืŸ ืฆื™ืœ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืื•ื™ืฃ ื“ื™ ืึทื ื“ืจื•ื™ื“ ืžื™ื˜ืœ. ืขืก ืื™ื– ืžืขืจ ื•ื•ื™ ื“ื™ ืจืฉื™ืžื” ื‘ืืงื•ืžืขืŸ ืื™ืŸ ื“ื™ Sophos ืœืขืจื ืขืŸ. ื“ื™ ืจืฉื™ืžื” ื›ื•ืœืœ ืคื™ืœืข ื‘ืึทื ืงื™ื ื’ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–, ืึธื ืœื™ื™ืŸ ืฉืึทืคึผื™ื ื’ ืžื’ื™ืœื” ืึทื–ืึท ื•ื•ื™ ืึทืžืึทื–ืึธืŸ ืื•ืŸ ืขื‘ื™ื™ึท, ืื•ืŸ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™ ื‘ืึทื“ื™ื ื•ื ื’ืก.

MSIL/ClipBanker.IH

ื“ื™ ืœืขืฆื˜ืข ืงืึธืžืคึผืึธื ืขื ื˜ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื•ื•ื™ ืึท ื˜ื™ื™ืœ ืคื•ืŸ ื“ืขื ืงืืžืคืื ื™ืข ืื™ื– ื’ืขื•ื•ืขืŸ ื“ื™ .NET Windows ืขืงืกืขืงื•ื˜ืึทื‘ืœืข, ื•ื•ืึธืก ืื™ื– ืืจื•ื™ืก ืื™ืŸ ืžืขืจืฅ 2019. ืจื•ื‘ึฟ ืคื•ืŸ ื“ื™ ื•ื•ืขืจืกื™ืขืก ื’ืขืœืขืจื ื˜ ื–ืขื ืขืŸ ืคึผืึทืงื™ื“ื–ืฉื“ ืžื™ื˜ ConfuserEx v1.0.0. ื•ื•ื™ ClipBanker, ื“ืขื ืงืึธืžืคึผืึธื ืขื ื˜ ื ื™ืฆื˜ ื“ื™ ืงืœื™ืคึผื‘ืึธืจื“. ื–ื™ื™ืŸ ืฆื™ืœ ืื™ื– ืึท ื‘ืจื™ื™ื˜ ืงื™ื™ื˜ ืคื•ืŸ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ืึธืคืคืขืจืก ืื•ื™ืฃ ืคึผืึทืจืข. ืึทื“ื“ื™ื˜ื™ืึธื ืึทืœืœื™, ืขืจ ื ื™ืฆื˜ ื“ื™ IP ืœืึทื’ืขืจ ื“ื™ื ืกื˜ ืฆื• ื’ืึทื ื•ื•ืขื ืขืŸ ื“ื™ ื‘ื™ื˜ืงืึธื™ืŸ ืคึผืจื™ื•ื•ืึทื˜ WIF ืฉืœื™ืกืœ.

ืฉื•ืฅ ืžืขืงืึทื ื™ื–ืึทืžื–
ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ื“ื™ ื‘ืขื ืขืคื™ืฅ ื•ื•ืึธืก ConfuserEx ื’ื™ื˜ ืื™ืŸ ืคึผืจืขื•ื•ืขื ื˜ื™ื ื’ ื“ื™ื‘ืึทื’ื™ื ื’, ื“ืึทืžืคึผื™ื ื’ ืื•ืŸ ื˜ืึทืžืคึผืขืจื™ื ื’, ื“ืขืจ ืงืึธืžืคึผืึธื ืขื ื˜ ื›ื•ืœืœ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ื“ืขื˜ืขืงื˜ ืึทื ื˜ื™ื•ื•ื™ืจื•ืก ืคึผืจืึธื“ื•ืงื˜ืŸ ืื•ืŸ ื•ื•ื™ืจื˜ื•ืึทืœ ืžืืฉื™ื ืขืŸ.

ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึทื– ืขืก ืœื•ื™ืคื˜ ืื™ืŸ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื ื™ืฆื˜ ื“ื™ ื’ืขื‘ื•ื™ื˜-ืื™ืŸ Windows WMI ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื” (WMIC) ืฆื• ื‘ืขื˜ืŸ ื‘ื™ื™ืึธื•ืก ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข, ื ื™ื™ืžืœื™:

wmic bios

ื“ืขืจื ืึธืš ื“ืขืจ ืคึผืจืึธื’ืจืึทื ืคึผืึทืจืกืขืก ื“ื™ ื‘ืึทืคึฟืขืœ ืจืขื–ื•ืœื˜ืึทื˜ ืื•ืŸ ืงื•ืงื˜ ืคึฟืึทืจ ื˜ืขืจืžื™ื ืขืŸ: VBOX, VirtualBox, XEN, qemu, bochs, VM.

ืฆื• ื“ืขื˜ืขืงื˜ ืึทื ื˜ื™ื•ื•ื™ืจื•ืก ืคึผืจืึธื“ื•ืงื˜ืŸ, ืžืึทืœื•ื•ืึทืจืข ืกืขื ื“ื– ืึท ื‘ืงืฉื” ืคื•ืŸ Windows Management Instrumentation (WMI) ืฆื• Windows Security Center ื ื™ืฆืŸ ManagementObjectSearcher ืึทืคึผื™ ื•ื•ื™ ื’ืขื•ื•ื™ื–ืŸ ืื•ื ื˜ืŸ. ื ืึธืš ื“ื™ืงืึธื•ื“ื™ื ื’ ืคึฟื•ืŸ base64, ื“ื™ ืจื•ืคืŸ ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

ManagementObjectSearcher('rootSecurityCenter2', 'SELECT * FROM AntivirusProduct')

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct
ืคื™ื’ื•ืจืข 3. ืคึผืจืึธืฆืขืก ืคึฟืึทืจ ื™ื“ืขื ื˜ื™ืคื™ื™ื ื’ ืึทื ื˜ื™ื•ื•ื™ืจื•ืก ืคึผืจืึธื“ื•ืงื˜ืŸ.

ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื˜ืฉืขืงืก ืฆื™ ืงืจื™ืคึผื˜ืึธืงืœื™ืคึผื•ื•ืึทื˜ืฉืขืจ, ืึท ื’ืขืฆื™ื™ึทื’ ืฆื• ื‘ืึทืฉื™ืฆืŸ ืงืขื’ืŸ ืงืœื™ืคึผื‘ืึธืจื“ ืื ืคืืœืŸ ืื•ืŸ, ืื•ื™ื‘ ืคืœื™ืกื ื“ื™ืง, ืกื•ืกืคึผืขื ื“ื– ืึทืœืข ืคึฟืขื“ืขื ืื™ืŸ ื“ืขื ืคึผืจืึธืฆืขืก, ืื•ืŸ ื“ืขืจืžื™ื˜ ื“ื™ืกื™ื™ื‘ืึทืœ ื“ื™ ืฉื•ืฅ.

ืคึผืขืจืกื™ืกื˜ืึทื ืก

ื“ื™ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ืžืึทืœื•ื•ืึทืจืข ื•ื•ืึธืก ืžื™ืจ ื’ืขืœืขืจื ื˜ ืงืึทืคึผื™ื– ื–ื™ืš ืื™ืŸ %APPDATA%googleupdater.exe ืื•ืŸ ืฉื˜ืขืœื˜ ื“ื™ "ืคืึทืจื‘ืึธืจื’ืŸ" ืึทื˜ืจื™ื‘ื™ื•ื˜ ืคึฟืึทืจ ื“ื™ Google ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ. ื“ืขืžืึธืœื˜ ื–ื™ ืขื ื“ืขืจื•ื ื’ืขืŸ ื“ื™ ื•ื•ืขืจื˜ SoftwareMicrosoftWindows NTCurrentVersionWinlogonshell ืื™ืŸ ื“ื™ Windows ืจืขื’ื™ืกื˜ืจื™ ืื•ืŸ ืžื•ืกื™ืฃ ื“ืขื ื“ืจืš updater.exe. ื“ืขื ื•ื•ืขื’, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื•ื•ืขื˜ ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ื™ืขื“ืขืจ ืžืึธืœ ื•ื•ืขืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืœืึธื’ืก ืื™ืŸ.

ื‘ื™ื™ื–ืข ื ืึทื˜ื•ืจ

ื•ื•ื™ ืงืœื™ืคึผื‘ืึทื ืงืขืจ, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืžืึธื ื™ื˜ืึธืจืก ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ืงืœื™ืคึผื‘ืึธืจื“ ืื•ืŸ ื–ื•ื›ื˜ ืคึฟืึทืจ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™ ื‘ื™ื™ึทื˜ืœ ืึทื“ืจืขืกืขืก, ืื•ืŸ ื•ื•ืขืŸ ื’ืขืคื•ื ืขืŸ, ืจื™ืคึผืœื™ื™ืกื™ื– ืขืก ืžื™ื˜ ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืึธืคึผืขืจืึทื˜ืึธืจ ืก ืึทื“ืจืขืก. ื•ื ื˜ืขืจ ืื™ื– ืึท ืจืฉื™ืžื” ืคื•ืŸ ืฆื™ืœ ื•ื•ืขื ื“ื˜ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ื•ื•ืึธืก ืื™ื– ื’ืขืคึฟื•ื ืขืŸ ืื™ืŸ ื“ื™ ืงืึธื“.

BTC_P2PKH, BTC_P2SH, BTC_BECH32, BCH_P2PKH_CashAddr, BTC_GOLD, LTC_P2PKH, LTC_BECH32, LTC_P2SH_M, ETH_ERC20, XMR, DCR, XRP, DOGE, DASH, ZEC_T_ADDR, ZEC_Z_ADDR, STELLAR, NEO, ADA, IOTA, NANO_1, NANO_3, BANANO_1, BANANO_3, STRATIS, NIOBIO, LISK, QTUM, WMZ, WMX, WME, VERTCOIN, TRON, TEZOS, QIWI_ID, YANDEX_ID, NAMECOIN, B58_PRIVATEKEY, STEAM_URL

ืคึฟืึทืจ ื™ืขื“ืขืจ ื˜ื™ืคึผ ืคื•ืŸ ืึทื“ืจืขืก ืขืก ืื™ื– ืึท ืงืึธืจืึทืกืคึผืึทื ื“ื™ื ื’ ืจืขื’ื•ืœืขืจ ืื•ื™ืกื“ืจื•ืง. ื“ื™ STEAM_URL ื•ื•ืขืจื˜ ืื™ื– ื’ืขื ื•ืฆื˜ ืฆื• ื‘ืึทืคืึทืœืŸ ื“ื™ ืคึผืึทืจืข ืกื™ืกื˜ืขื, ื•ื•ื™ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื–ืขืŸ ืคึฟื•ืŸ ื“ื™ ืจืขื’ื•ืœืขืจ ืื•ื™ืกื“ืจื•ืง ื•ื•ืึธืก ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื• ื“ืขืคื™ื ื™ืจืŸ ื“ื™ ื‘ืึทืคืขืจ:

b(https://|http://|)steamcommunity.com/tradeoffer/new/?partner=[0-9]+&token=[a-zA-Z0-9]+b

ืขืงืกืคื™ืœื˜ืจืึทื˜ื™ืึธืŸ ืงืึทื ืึทืœ

ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ืจื™ืคึผืœื™ื™ืกื™ื ื’ ืึทื“ืจืขืกืขืก ืื™ืŸ ื“ื™ ื‘ืึทืคืขืจ, ื“ื™ ืžืึทืœื•ื•ืึทืจืข ื˜ืึทืจื’ืึทืฅ ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ WIF ืฉืœื™ืกืœืขืŸ ืคื•ืŸ ื‘ื™ื˜ืงืึธื™ืŸ, ื‘ื™ื˜ืงืึธื™ืŸ ืงืึธืจ ืื•ืŸ ืขืœืขืงื˜ืจืึธื ื‘ื™ื˜ืงืึธื™ืŸ ื•ื•ืึธืœืึทืฅ. ื“ืขืจ ืคึผืจืึธื’ืจืึทื ื ื™ืฆื˜ plogger.org ื•ื•ื™ ืึทืŸ ืขืงืกืคื™ืœื˜ืจื™ื™ืฉืึทืŸ ืงืึทื ืึทืœ ืฆื• ื‘ืึทืงื•ืžืขืŸ ื“ื™ WIF ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืึธืคึผืขืจื™ื™ื˜ืขืจื– ืœื™ื™ื’ืŸ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ื“ืึทื˜ืŸ ืฆื• ื“ื™ User-Agent HTTP ื›ืขื“ืขืจ, ื•ื•ื™ ื’ืขื•ื•ื™ื–ืŸ ืื•ื ื˜ืŸ.

ื“ื™ ื‘ืึทืงื“ืึธืจ ืื•ืŸ ื‘ื•ื”ื˜ืจืึทืคึผ ืขื ืงืจื™ืคึผื˜ืึธืจ ื–ืขื ืขืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืžื™ื˜ Yandex.Direct
ืคื™ื’ื•ืจืข 4. ื™ืคึผ ืœืึทื’ืขืจ ืงืึทื ืกืึธื•ืœ ืžื™ื˜ ืจืขื–ื•ืœื˜ืึทื˜ ื“ืึทื˜ืŸ.

ืึธืคึผืขืจื™ื™ื˜ืขืจื– ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื ื•ืฆืŸ iplogger.org ืฆื• ืขืงืกืคื™ืœื˜ืจื™ืจืŸ ื•ื•ืึธืœืึทืฅ. ื–ื™ื™ ืžื™ืกื˜ืึธืžืข ืจื™ื–ืึธืจื˜ื™ื“ ืฆื• ืึท ืึทื ื“ืขืจืฉ ืื•ืคึฟืŸ ืจืขื›ื˜ ืฆื• ื“ืขืจ 255 ื›ืึทืจืึทืงื˜ืขืจ ืœื™ืžื™ื˜ ืื™ืŸ ื“ืขื ืคืขืœื“ User-Agentื’ืขื•ื•ื™ื–ืŸ ืื™ืŸ ื“ื™ IP ืœืึทื’ืขืจ ื•ื•ืขื‘ ืฆื•ื‘ื™ื ื“. ืื™ืŸ ื“ื™ ืกืึทืžืคึผืึทืœื– ืžื™ืจ ื’ืขืœืขืจื ื˜, ื“ื™ ืื ื“ืขืจืข ืจืขื–ื•ืœื˜ืึทื˜ ืกืขืจื•ื•ืขืจ ืื™ื– ืกื˜ืึธืจื“ ืื™ืŸ ื“ื™ ืกื•ื•ื™ื•ื•ืข ื‘ื™ื™ึทื˜ืขื•ื•ื“ื™ืง DiscordWebHook. ืกืึทืคึผืจื™ื™ื–ื™ื ื’ืœื™, ื“ืขื ื™ื ื•ื•ื™ื™ืจืึทื ืžืขื ืึทืœ ื‘ื™ื™ึทื˜ืขื•ื•ื“ื™ืง ืื™ื– ื ื™ืฉื˜ ืึทืกื™ื™ื ื“ ืขืจื’ืขืฅ ืื™ืŸ ื“ื™ ืงืึธื“. ื“ืึธืก ืกืึทื’ื“ื–ืฉืขืกืฅ ืึทื– ื“ื™ ืžืึทืœื•ื•ืึทืจืข ืื™ื– ื ืึธืš ืื•ื ื˜ืขืจ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืื•ืŸ ื“ื™ ื‘ื™ื™ึทื˜ืขื•ื•ื“ื™ืง ืื™ื– ืึทืกื™ื™ื ื“ ืฆื• ื“ืขืจ ืึธืคึผืขืจืึทื˜ืึธืจ ืก ืคึผืจื•ื‘ื™ืจืŸ ืžืึทืฉื™ืŸ.

ืขืก ืื™ื– ืืŸ ืื ื“ืขืจ ืฆื™ื™ื›ืŸ ืึทื– ื“ื™ ืคึผืจืึธื’ืจืึทื ืื™ื– ืื™ืŸ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’. ื“ื™ ื‘ื™ื™ื ืขืจื™ ื˜ืขืงืข ื™ื ืงืœื•ื“ื– ืฆื•ื•ื™ื™ iplogger.org URL ืก, ืื•ืŸ ื‘ื™ื™ื“ืข ื–ืขื ืขืŸ ืงื•ื•ืขืจื“ ื•ื•ืขืŸ ื“ืึทื˜ืŸ ื–ืขื ืขืŸ ืขืงืกืคื™ืœื˜ืจื™ื™ื˜ื™ื“. ืื™ืŸ ืึท ื‘ืงืฉื” ืฆื• ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ URL ืก, ื“ื™ ื•ื•ืขืจื˜ ืื™ืŸ ื“ื™ ืจืขืคืขืจืขืจ ืคืขืœื“ ืื™ื– ืคึผืจื™ืกื™ื“ืึทื“ ื“ื•ืจืš "DEV /". ืžื™ืจ ืื•ื™ืš ื’ืขืคึฟื•ื ืขืŸ ืึท ื•ื•ืขืจืกื™ืข ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืคึผืึทืงื™ื“ื–ืฉื“ ื ื™ืฆืŸ ConfuserEx, ื“ืขืจ ื‘ืึทืงื•ืžืขืจ ืคึฟืึทืจ ื“ืขื URL ืื™ื– ื’ืขื”ื™ื™ืกืŸ DevFeedbackUrl. ื‘ืึทื–ื™ืจื˜ ืื•ื™ืฃ ื“ื™ ื™ื ื•ื•ื™ื™ืจืึทื ืžืขื ืึทืœ ื•ื•ืขืจื™ืึทื‘ืึทืœ ื ืึธืžืขืŸ, ืžื™ืจ ื’ืœื•ื™ื‘ืŸ ืึทื– ื“ื™ ืึธืคึผืขืจื™ื™ื˜ืขืจื– ื–ืขื ืขืŸ ืคึผืœืึทื ื™ืจื•ื ื’ ืฆื• ื ื•ืฆืŸ ื“ื™ ืœืึทื“ื–ืฉื™ื˜ืึทืžืึทื˜ ื“ื™ื ืกื˜ ื“ื™ืกืงืึธืจื“ ืื•ืŸ ื–ื™ื™ึทืŸ ื•ื•ืขื‘ ื™ื ื˜ืขืจืกืขืคึผืฉืึทืŸ ืกื™ืกื˜ืขื ืฆื• ื’ืึทื ื•ื•ืขื ืขืŸ ืงืจื™ืคึผื˜ืึธืงื•ืจืจืขื ืกื™ ื•ื•ืึธืœืึทืฅ.

ืกืึธืฃ

ื“ื™ ืงืืžืคืื ื™ืข ืื™ื– ืึท ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ืœืึทื“ื–ืฉื™ื˜ืึทืžืึทื˜ ื’ืึทื ืฆืข ื‘ืึทื“ื™ื ื•ื ื’ืก ืื™ืŸ ืกื™ื™ื‘ืขืจ ืึทื˜ืึทืงืก. ื“ื™ ืกื›ืขืžืข ื˜ืึทืจื’ืึทืฅ ืจื•ืกื™ืฉืข ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืขืก, ืึธื‘ืขืจ ืžื™ืจ ื•ื•ืึธืœื˜ ื ื™ืฉื˜ ื–ื™ื™ืŸ ืกืึทืคึผืจื™ื™ื–ื“ ืฆื• ื–ืขืŸ ืึทื–ืึท ืึท ื‘ืึทืคืึทืœืŸ ื ื™ืฆืŸ ื ื™ื˜-ืจื•ืกื™ืฉ ื‘ืึทื“ื™ื ื•ื ื’ืขืŸ. ืฆื• ื•ื™ืกืžื™ื™ื“ืŸ ืงืึธืžืคึผืจืึธืžื™ืก, ื ื™ืฆืขืจืก ืžื•ื–ืŸ ื–ื™ื™ืŸ ื–ื™ื›ืขืจ ืื™ืŸ ื“ื™ ืฉืขื ืคื•ืŸ ื“ื™ ืžืงื•ืจ ืคื•ืŸ ื“ื™ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื–ื™ื™ ืืจืืคืงืืคื™ืข.

ื ื’ืึทื ืฅ ืจืฉื™ืžื” ืคื•ืŸ ื™ื ื“ื™ืงืึทื˜ืึธืจืก ืคื•ืŸ ืงืึธืžืคึผืจืึธืžื™ืก ืื•ืŸ MITER ATT&CK ืึทื˜ืจื™ื‘ื™ื•ืฅ ืื™ื– ื‘ื ื™ืžืฆื ืื™ืŸ ืจื•ื ื’.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’