Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ

ืžืืœ ืื™ืจ ื ืึธืจ ื•ื•ื™ืœืŸ ืฆื• ืงื•ืงืŸ ืื™ืŸ ื“ื™ ืื•ื™ื’ืŸ ืคื•ืŸ ืขื˜ืœืขื›ืข ื•ื•ื™ืจื•ืก ืฉืจื™ื™ึทื‘ืขืจ ืื•ืŸ ืคืจืขื’ืŸ: ื•ื•ืึธืก ืื•ืŸ ื•ื•ืึธืก? ืžื™ืจ ืงืขื ืขืŸ ืขื ื˜ืคึฟืขืจืŸ ื“ื™ ืงืฉื™ื "ื•ื•ื™" ื–ื™ืš, ืึธื‘ืขืจ ืขืก ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ ื–ื™ื™ืขืจ ื˜ืฉื™ืงืึทื•ื•ืข ืฆื• ื’ืขืคื™ื ืขืŸ ืื•ื™ืก ื•ื•ืึธืก ื“ืขื ืึธื“ืขืจ ืึทื– ืžืึทืœื•ื•ืึทืจืข ื‘ืืฉืขืคืขืจ ืื™ื– ื’ืขื•ื•ืขืŸ ื˜ืจืื›ื˜ืŸ. ืกืคืขืฆื™ืขืœ ื•ื•ืขืŸ ืžื™ืจ ื˜ืจืขืคืŸ ืื–ืขืœื›ืข "ืคืขืจืœ".

ื“ืขืจ ื”ืขืœื“ ืคื•ืŸ ื”ื™ื™ึทื ื˜ ืก ืึทืจื˜ื™ืงืœ ืื™ื– ืึท ื˜ืฉื™ืงืึทื•ื•ืข ื‘ื™ื™ึทืฉืคึผื™ืœ ืคื•ืŸ ืึท ืงืจื™ืคึผื˜ืึธื’ืจืึทืฃ. ืขืก ืื™ื– ืžืฉืžืขื•ืช ืงืึทื ืกื™ื•ื•ื“ ื•ื•ื™ ื ืึธืจ ืืŸ ืื ื“ืขืจ "ืจืึทื ืกืึธืžื•ื•ืึทืจืข", ืึธื‘ืขืจ ื“ื™ ื˜ืขื›ื ื™ืฉ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืงื•ืงื˜ ืžืขืจ ื•ื•ื™ ืขืžืขืฆืขืจ ืก ื’ืจื•ื™ื–ืึทื ื•ื•ื™ืฅ. ืžื™ืจ ื•ื•ืขืœืŸ ืจืขื“ืŸ ื•ื•ืขื’ืŸ ื“ืขื ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ื”ื™ื™ึทื ื˜.

ืฆื•ื ื‘ืึทื“ื•ื™ืขืจืŸ, ืขืก ืื™ื– ื›ึผืžืขื˜ ืื•ืžืžืขื’ืœืขืš ืฆื• ืฉืคึผื•ืจ ื“ื™ ืœืขื‘ืŸ ืฆื™ืงืœ ืคื•ืŸ ื“ืขื ืขื ืงืึธื“ืขืจ - ืขืก ื–ืขื ืขืŸ ืื•ื™ืš ื•ื•ื™ื™ื ื™ืง ืกื˜ืึทื˜ื™ืกื˜ื™ืง, ื•ื•ื™ื™ึทืœ, ื’ืœื™ืง, ืขืก ืื™ื– ื ื™ืฉื˜ ื•ื•ื™ื™ื“ืกืคึผืจืขื“. ื“ืขืจื™ื‘ืขืจ, ืžื™ืจ ื•ื•ืขืœืŸ ืœืึธื–ืŸ ืื•ื™ืก ื“ื™ ืึธื ื”ื™ื™ื‘, ืžืขื˜ื”ืึธื“ืก ืคื•ืŸ ื™ื ืคืขืงืฆื™ืข ืื•ืŸ ืื ื“ืขืจืข ื‘ืึทื•ื•ื™ื™ึทื–ืŸ. ืœืึธืžื™ืจ ื ืึธืจ ืจืขื“ืŸ ื•ื•ืขื’ืŸ ืื•ื ื“ื–ืขืจ ืคืึทืœ ืคื•ืŸ ื‘ืึทื’ืขื’ืขื ื™ืฉ ืžื™ื˜ Wulfric Ransomware ืื•ืŸ ื•ื•ื™ ืžื™ืจ ื’ืขื”ืึธืœืคึฟืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืจืึทื˜ืขื•ื•ืขืŸ ื–ื™ื™ืŸ ื˜ืขืงืขืก.

I. ื•ื•ื™ ืขืก ืึทืœืข ืื ื’ืขื”ื•ื™ื‘ืŸ

ืžืขื ื˜ืฉืŸ ื•ื•ืึธืก ื”ืึธื‘ืŸ ืฉื•ื™ืŸ ื•ื•ื™ืงื˜ื™ืžืก ืคื•ืŸ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืึธืคื˜ ืงืึธื ื˜ืึทืงื˜ ืื•ื ื“ื–ืขืจ ืึทื ื˜ื™-ื•ื•ื™ืจื•ืก ืœืึทื‘ืึธืจืึทื˜ืึธืจื™ืข. ืžื™ืจ ืฆื•ืฉื˜ืขืœืŸ ื”ื™ืœืฃ ืจืึทื’ืึทืจื“ืœืึทืก ืคื•ืŸ ื•ื•ืึธืก ืึทื ื˜ื™ื•ื•ื™ืจื•ืก ืคึผืจืึธื“ื•ืงื˜ืŸ ื–ื™ื™ ื”ืึธื‘ืŸ ืื™ื ืกื˜ืึทืœื™ืจืŸ. ื“ืึธืก ืžืึธืœ ื”ืึธื‘ืŸ ืžื™ืจ ืงืึธื ื˜ืึทืงื˜ืขื“ ื“ื•ืจืš ืึท ืžืขื ื˜ืฉ ื•ื•ืขืžืขื ืก ื˜ืขืงืขืก ื–ืขื ืขืŸ ืึทืคืขืงื˜ืึทื“ ื“ื•ืจืš ืึทืŸ ืื•ืžื‘ืึทืงืึทื ื˜ ืขื ืงืึธื“ืขืจ.

ื ื’ื•ื˜ืŸ ืžื™ื˜ืื’ ื˜ืขืงืขืก ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืื•ื™ืฃ ืึท ื˜ืขืงืข ืกื˜ืึธืจื™ื“ื–ืฉ (samba4) ืžื™ื˜ ืคึผืึทืจืึธืœืœืขืกืก ืœืึธื’ื™ืŸ. ืื™ืš ื›ืึธืฉืขื“ ืึทื– ื“ื™ ื™ื ืคืขืงืฆื™ืข ื’ืขืงื•ืžืขืŸ ืคื•ืŸ ืžื™ื™ืŸ ื˜ืึธื›ื˜ืขืจ 'ืก ืงืึธืžืคึผื™ื•ื˜ืขืจ (Windows 10 ืžื™ื˜ ื ืึธืจืžืึทืœ Windows Defender ืฉื•ืฅ). ื“ืขืจ ื˜ืื›ื˜ืขืจ'ืก ืงืืžืคื™ื•ื˜ืขืจ ืื™ื– ื ืื›ื“ืขื ื ื™ืฉื˜ ืื•ื™ืกื’ืขืœืืฉืŸ ื’ืขื•ื•ืืจืŸ. ื“ื™ ื˜ืขืงืขืก ื–ืขื ืขืŸ ืขื ืงืจื™ืคึผื˜ื™ื“ ื“ืขืจ ื”ื•ื™ืคึผื˜ .ื“ื–ืฉืคึผื’ ืื•ืŸ .ืงืจ2. ื˜ืขืงืข ื’ืขืฉืคึผืจื™ื™ื˜ ื ืึธืš ืขื ืงืจื™ืคึผืฉืึทืŸ: .ืึทืขืฃ.

ืžื™ืจ ื‘ืืงื•ืžืขืŸ ืคื•ืŸ ื“ื™ ื‘ืึทื ื™ืฆืขืจ ืกืึทืžืคึผืึทืœื– ืคื•ืŸ ืขื ืงืจื™ืคึผื˜ื™ื“ ื˜ืขืงืขืก, ืึท ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜, ืื•ืŸ ืึท ื˜ืขืงืข ื•ื•ืึธืก ืื™ื– ืžืกืชึผืžื ื“ืขืจ ืฉืœื™ืกืœ ื•ื•ืึธืก ื“ืขืจ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืžื—ื‘ืจ ื“ืืจืฃ ืฆื• ื“ืขืงืจื™ืคึผื˜ ื“ื™ ื˜ืขืงืขืก.

ื“ืึธ ื–ืขื ืขืŸ ืึทืœืข ืื•ื ื“ื–ืขืจ ืงืœื•ื–:

  • 01c.aef (4481K)
  • hacked.jpg (254K)
  • hacked.txt (0K)
  • 04c.aef (6540K)
  • pass.key (0K)

ื–ืืœ ืก ื ืขืžืขืŸ ืึท ืงื•ืง ื‘ื™ื™ึท ื“ื™ ื˜ืึธืŸ. ื•ื•ื™ ืคื™ืœืข ื‘ื™ื˜ืงืึธื™ื ืก ื“ืึธืก ืžืึธืœ?

ืื™ื‘ืขืจื–ืขืฆื•ื ื’:

ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ึทื˜, ื“ื™ื™ืŸ ื˜ืขืงืขืก ื–ืขื ืขืŸ ื™ื ืงืจื™ืคึผื˜ื™ื“!
ื“ื™ ืคึผืึทืจืึธืœ ืื™ื– ื™ื™ื ืฆื™ืง ืฆื• ื“ื™ื™ืŸ ืคึผื™ืกื™.

ื‘ืึทืฆืึธืœืŸ ื“ื™ ืกื•ืžืข ืคื•ืŸ โ€‹โ€‹0.05 ื‘ื˜ืง ืฆื• ื“ื™ ื‘ื™ื˜ืงืึธื™ืŸ ืึทื“ืจืขืก: 1ERTRjWAKyG2Edm9nKLLCzd8p1CjjdTiF
ื ืึธืš ืฆืึธืœื•ื ื’, ืฉื™ืงืŸ ืžื™ืจ ืึท ื‘ืœื™ืฆืคึผืึธืกื˜, ืึทื˜ืึทื˜ืฉื™ื ื’ ื“ื™ pass.key ื˜ืขืงืข ืฆื• [ืื™ืžืขื™ืœ ื‘ืืฉื™ืฆื˜] ืžื™ื˜ ืึธื ื–ืึธื’ ืคื•ืŸ ืฆืึธืœื•ื ื’.

ื ืึธืš ื‘ืึทืฉื˜ืขื˜ื™ืงื•ื ื’, ืื™ืš ื•ื•ืขืœ ืฉื™ืงืŸ ืื™ืจ ืึท ื“ืขืงืจื™ืคึผื˜ืึธืจ ืคึฟืึทืจ ื“ื™ ื˜ืขืงืขืก.

ืื™ืจ ืงืขื ืขืŸ ืฆืึธืœืŸ ืคึฟืึทืจ ื‘ื™ื˜ืงืึธื™ื ืก ืึธื ืœื™ื™ืŸ ืื™ืŸ ืคืึทืจืฉื™ื“ืขื ืข ื•ื•ืขื’ืŸ:
buy.blockexplorer.com - ืฆืึธืœื•ื ื’ ื“ื•ืจืš ื‘ืึทื ืง ืงืึทืจื˜ืœ
www.buybitcoinworldwide.com
localbitcoins.net

ื•ื•ืขื’ืŸ ื‘ื™ื˜ืงืึธื™ื ืก:
en.wikipedia.org/wiki/Bitcoin
ืื•ื™ื‘ ืื™ืจ ื”ืึธื˜ ืงื™ื™ืŸ ืคืจืื’ืขืก, ื‘ื™ื˜ืข ืฉืจื™ื™ึทื‘ืŸ ืฆื• ืžื™ืจ ืื™ืŸ [ืื™ืžืขื™ืœ ื‘ืืฉื™ืฆื˜]
ื•ื•ื™ ืึท ื‘ืึธื ื•ืก, ืื™ืš ื•ื•ืขื˜ ื–ืึธื’ืŸ ืื™ืจ ื•ื•ื™ ื“ื™ื™ืŸ ืงืึธืžืคึผื™ื•ื˜ืขืจ ืื™ื– ื›ืึทืงื˜ ืื•ืŸ ื•ื•ื™ ืฆื• ื‘ืึทืฉื™ืฆืŸ ืขืก ืื™ืŸ ื“ืขืจ ืฆื•ืงื•ื ืคึฟื˜.

ื ืคึผืจื™ื˜ืขื ืฉืึทืก ื•ื•ืึธืœืฃ, ื“ื™ื–ื™ื™ื ื“ ืฆื• ื•ื•ื™ื™ึทื–ืŸ ื“ื™ ืงืึธืจื‘ืŸ ื“ื™ ืกื™ืจื™ืึทืกื ืึทืก ืคื•ืŸ ื“ื™ ืกื™ื˜ื•ืึทืฆื™ืข. ืึธื‘ืขืจ, ืขืก ืงืขืŸ ื”ืึธื‘ืŸ ื’ืขื•ื•ืขืŸ ืขืจื’ืขืจ.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 1. -ื•ื•ื™ ืึท ื‘ืึธื ื•ืก, ืื™ืš ื•ื•ืขืœ ื–ืึธื’ืŸ ืื™ืจ ื•ื•ื™ ืฆื• ื‘ืึทืฉื™ืฆืŸ ืื™ื™ืขืจ ืงืึธืžืคึผื™ื•ื˜ืขืจ ืื™ืŸ ื“ืขืจ ืฆื•ืงื•ื ืคึฟื˜. -ืงื•ืงื˜ ืื•ื™ืก ืจื™ื›ื˜ื™ื’.

ื•ื•. ืœืืžื™ืจ ืื ื”ื™ื™ื‘ืขืŸ

ืขืจืฉื˜ืขืจ ืคื•ืŸ ืึทืœืข, ืžื™ืจ ื’ืขืงื•ืงื˜ ืื™ืŸ ื“ื™ ืกื˜ืจื•ืงื˜ื•ืจ ืคื•ืŸ ื“ื™ ื’ืขืฉื™ืงื˜ ืžื•ืกื˜ืขืจ. ืึทื“ืœื™ ื’ืขื ื•ื’, ืขืก ื”ืื˜ ื ื™ืฉื˜ ืงื•ืงืŸ ื•ื•ื™ ืึท ื˜ืขืงืข ื•ื•ืึธืก ืื™ื– ื“ืึทืžื™ื“ื–ืฉื“ ื“ื•ืจืš ืจืึทื ืกืึธืžื•ื•ืึทืจืข. ืขืคึฟืขื ืขืŸ ื“ืขื ื”ืขืงืกืึทื“ืขืกื™ืžืึทืœ ืจืขื“ืึทืงื˜ืึธืจ ืื•ืŸ ืงื•ืง. ื“ืขืจ ืขืจืฉื˜ืขืจ 4 ื‘ื™ื˜ืขืก ืึทื ื˜ื”ืึทืœื˜ืŸ ื“ื™ ืึธืจื™ื’ื™ื ืขืœ ื˜ืขืงืข ื’ืจื™ื™ืก, ื“ื™ ื•ื•ื™ื™ึทื˜ืขืจ 60 ื‘ื™ื˜ืขืก ื–ืขื ืขืŸ ืึธื ื’ืขืคื™ืœื˜ ืžื™ื˜ ื–ืขืจืึธืก. ืื‘ืขืจ ื“ื™ ืžืขืจืกื˜ ื˜ืฉื™ืงืึทื•ื•ืข ื–ืึทืš ืื™ื– ืื™ืŸ ื“ื™ ืกื•ืฃ:

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 2 ืึทื ืึทืœื™ื™ื– ื“ื™ ื“ืึทืžื™ื“ื–ืฉื“ ื˜ืขืงืข. ื•ื•ืึธืก ืžื™ื“ ืงืึทื˜ืฉืึทื– ื“ื™ื™ืŸ ืื•ื™ื’?

ืึทืœืฅ ืื™ื– ื’ืขื•ื•ืขืŸ ืึทื ื•ื™ื™ื ื’ ืคึผืฉื•ื˜: 0x40 ื‘ื™ื˜ืขืก ืคื•ืŸ ื“ื™ ื›ืขื“ืขืจ ื–ืขื ืขืŸ ืืจื™ื‘ืขืจื’ืขืคืืจืŸ ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ืขืจ ื˜ืขืงืข. ืฆื• ื•ืžืงืขืจืŸ ื“ืึทื˜ืŸ, ื ืึธืจ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืขืก ืฆื• ื“ื™ ืึธื ื”ื™ื™ื‘. ืึทืงืกืขืก ืฆื• ื“ืขืจ ื˜ืขืงืข ืื™ื– ื’ืขื–ื•ื ื˜, ืึธื‘ืขืจ ื“ืขืจ ื ืึธืžืขืŸ ื‘ืœื™ื™ื‘ื˜ ื™ื ืงืจื™ืคึผื˜ื™ื“, ืื•ืŸ ื“ื™ ื˜ื™ื ื’ื– ื•ื•ืขืจืŸ ืžืขืจ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ืžื™ื˜ ืื™ื.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 3. ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื ืึธืžืขืŸ ืื™ืŸ Base64 ืงื•ืงื˜ ื•ื•ื™ ืึท ืจืึทืžื‘ืœื™ื ื’ ื’ืึทื ื’ ืคื•ืŸ ืื•ืชื™ื•ืช.

ื–ืืœ ืก ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืจืขื›ืขื ืขืŸ ืขืก ืื•ื™ืก ืคืึธืจืŸ.ืฉืœื™ืกืœ, ื“ืขืจืœืื ื’ื˜ ื“ื•ืจืš ื‘ืึทื ื™ืฆืขืจ. ืื™ืŸ ืขืก ืžื™ืจ ื–ืขืŸ ืึท 162-ื‘ื™ื˜ืข ืกื™ืงื•ื•ืึทื ืก ืคื•ืŸ ASCII ืื•ืชื™ื•ืช.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 4. 162 ืื•ืชื™ื•ืช ืœื™ื ืงืก ืื•ื™ืฃ ื“ื™ ืงืึธืจื‘ืŸ ืก ืคึผื™ืกื™.

ืื•ื™ื‘ ืื™ืจ ืงื•ืง ืขื ื’, ืื™ืจ ื•ื•ืขื˜ ื‘ืึทืžืขืจืงืŸ ืึทื– ื“ื™ ืกื™ืžื‘ืึธืœืก ื–ืขื ืขืŸ ืจื™ืคึผื™ื˜ื™ื“ ืžื™ื˜ ืึท ื–ื™ื›ืขืจ ืึธืคื˜ืงื™ื™ึทื˜. ื“ืึธืก ืงืขืŸ ืึธื ื•ื•ื™ื™ึทื–ืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ XOR, ื•ื•ืึธืก ืื™ื– ืงืขืจืึทืงื˜ืขืจื™ื™ื–ื“ ื“ื•ืจืš ืจืขืคึผืึทื˜ื™ืฉืึทื ื–, ื“ื™ ืึธืคื˜ืงื™ื™ึทื˜ ืคื•ืŸ ื•ื•ืึธืก ื“ืขืคึผืขื ื“ืก ืื•ื™ืฃ ื“ื™ ืฉืœื™ืกืœ ืœืขื ื’. ื•ื•ื™ื™ืœ ื“ื™ ืฉื˜ืจื™ืงืœ ืื™ื– ืฆืขื˜ื™ื™ืœื˜ ืื™ืŸ 6 ืื•ืชื™ื•ืช ืื•ืŸ XORed ืžื™ื˜ ืขื˜ืœืขื›ืข ื•ื•ืขืจื™ืึทื ืฅ ืคื•ืŸ XOR ืกื™ืงื•ื•ืึทื ืกื™ื–, ืžื™ืจ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื“ืขืจื’ืจื™ื™ื›ืŸ ืงื™ื™ืŸ ืžื™ื ื™ื ื’ืคืึทืœ ืจืขื–ื•ืœื˜ืึทื˜.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 5. ื–ืขืŸ ื“ื™ ืจื™ืคึผื™ื˜ื™ื ื’ ืงืึทื ืกื˜ืึทื ืฅ ืื™ืŸ ื“ื™ ืžื™ื˜ืœ?

ืžื™ืจ ื‘ืึทืฉืœืึธืกืŸ ืฆื• ื’ื•ื’ืœ ืงืึทื ืกื˜ืึทื ืฅ, ื•ื•ื™ื™ึทืœ ื™ืึธ, ื“ืึธืก ืื™ื– ืื•ื™ืš ืžืขื’ืœืขืš! ืื•ืŸ ื–ื™ื™ ืึทืœืข ืœืขืกืึธืฃ ื’ืขืคึฟื™ืจื˜ ืฆื• ืื™ื™ืŸ ืึทืœื’ืขืจื™ื“ืึทื - ื‘ืึทื˜ืฉ ืขื ืงืจื™ืคึผืฉืึทืŸ. ื ืึธื›ืŸ ืœืขืจื ืขืŸ ื“ืขื ืฉืจื™ืคื˜ ืื™ื– ืงืœืึธืจ ื’ืขื•ื•ืึธืจืŸ, ืึทื– ืื•ื ื“ื–ืขืจ ืฉื•ืจื” ืื™ื– ื’ืึธืจื ื™ืฉื˜ ืžืขืจ ื•ื•ื™ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคึฟื•ืŸ ืื™ืจ ืึทืจื‘ืขื˜. ืขืก ื–ืึธืœ ื–ื™ื™ืŸ ื“ืขืจืžืื ื˜ ืึทื– ื“ืึธืก ืื™ื– ื ื™ืฉื˜ ืึท ืขื ืงืจื™ืคึผื˜ืขืจ ืื™ืŸ ืึทืœืข, ืึธื‘ืขืจ ื ืึธืจ ืึท ืขื ืงืึธื“ืขืจ ื•ื•ืึธืก ืจื™ืคึผืœื™ื™ืกื™ื– ืื•ืชื™ื•ืช ืžื™ื˜ 6-ื‘ื™ื˜ืข ืกื™ืงื•ื•ืึทื ืกื™ื–. ืงื™ื™ืŸ ืฉืœื™ืกืœืขืŸ ืึธื“ืขืจ ืื ื“ืขืจืข ืกื™ืงืจื™ืฅ ืคึฟืึทืจ ืื™ืจ :)

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 6. ื ืฉื˜ื™ืง ืคื•ืŸ ื“ืขืจ ืึธืจื™ื’ื™ื ืขืœ ืึทืœื’ืขืจื™ื“ืึทื ืคื•ืŸ ืื•ืžื‘ืึทืงืึทื ื˜ ืึธื˜ืขืจืฉื™ืคึผ.

ื“ืขืจ ืึทืœื’ืขืจื™ื“ืึทื ื•ื•ืึธืœื˜ ื ื™ืฉื˜ ืึทืจื‘ืขื˜ืŸ ื•ื•ื™ ืขืก ื–ืึธืœ ืื•ื™ื‘ ื ื™ืฉื˜ ืคึฟืึทืจ ืื™ื™ืŸ ื“ืขื˜ืึทืœ:

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 7. ืžืึธืจืคืขื•ืก ื‘ืื•ื•ื™ืœื™ืงื˜.

ื ื™ืฆืŸ ืคืึทืจืงืขืจื˜ ืกืึทื‘ืกื˜ื™ื˜ื•ืฉืึทืŸ ืžื™ืจ ื™ื‘ืขืจืžืึทื›ืŸ ื“ื™ ืฉื˜ืจื™ืงืœ ืคื•ืŸ ืคืึธืจืŸ.ืฉืœื™ืกืœ ืื™ืŸ ืึท ื˜ืขืงืกื˜ ืคื•ืŸ 27 ืื•ืชื™ื•ืช. ื“ืขืจ ืžืขื ื˜ืฉ (ืจื•ื‘ึฟ ืžืกืชึผืžื) ื˜ืขืงืกื˜ 'ืึทืกืžืึธื“ืึทื˜' ืคืืจื“ื™ื ื˜ ืกืคึผืขืฆื™ืขืœ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ื˜.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืคื™ื’.8. USGFDG=7.

Google ื•ื•ืขื˜ ื”ืขืœืคึฟืŸ ืื•ื ื“ื– ื•ื•ื™ื“ืขืจ. ื ืึธืš ืึท ื‘ื™ืกืœ ื–ื•ื›ืŸ, ืžื™ืจ ื’ืขืคึฟื™ื ืขืŸ ืึท ื˜ืฉื™ืงืึทื•ื•ืข ืคึผืจื•ื™ืขืงื˜ ืื•ื™ืฃ GitHub - Folder Locker, ื’ืขืฉืจื™ื‘ืŸ ืื™ืŸ .ื ืขื˜ ืื•ืŸ ื ื™ืฆืŸ ื“ื™ 'ืึทืกืžืึธื“ืึทื˜' ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืคึฟื•ืŸ ืืŸ ืื ื“ืขืจ ื’ื™ื˜ ื—ืฉื‘ื•ืŸ.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 9. ืคืึธืœื“ืขืจ ืœืึทืงืขืจ ืฆื•ื‘ื™ื ื“. ื–ื™ื™ื˜ ื–ื™ื›ืขืจ ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืคึฟืึทืจ ืžืึทืœื•ื•ืึทืจืข.

ื“ื™ ื ื•ืฆืŸ ืื™ื– ืึท ืขื ืงืจื™ืคึผื˜ืขืจ ืคึฟืึทืจ Windows 7 ืื•ืŸ ื”ืขื›ืขืจ, ื•ื•ืึธืก ืื™ื– ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ื•ื•ื™ ืึธืคึฟืŸ ืžืงื•ืจ. ื‘ืขืฉืึทืก ืขื ืงืจื™ืคึผืฉืึทืŸ, ืึท ืคึผืึทืจืึธืœ ืื™ื– ื’ืขื ื™ืฆื˜, ื•ื•ืึธืก ืื™ื– ื ื™ื™ื˜ื™ืง ืคึฟืึทืจ ืกืึทื‘ืกืึทืงื•ื•ืึทื ื˜ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ. ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืึทืจื‘ืขื˜ืŸ ื‘ื™ื™ื“ืข ืžื™ื˜ ื™ื—ื™ื“ ื˜ืขืงืขืก ืื•ืŸ ืžื™ื˜ ื’ืึทื ืฅ ื“ื™ืจืขืงื˜ืขืจื™ื–.

ื–ื™ื™ืŸ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื ื™ืฆื˜ ื“ื™ Rijndael ืกื™ืžืžืขื˜ืจื™ืง ืขื ืงืจื™ืคึผืฉืึทืŸ ืึทืœื’ืขืจื™ื“ืึทื ืื™ืŸ CBC ืžืึธื“ืข. ืขืก ืื™ื– ื ืึธื•ื˜ื•ื•ืขืจื“ื™ ืึทื– ื“ื™ ื‘ืœืึธืง ื’ืจื™ื™ืก ืื™ื– ื’ืขื•ื•ืขืŸ ืื•ื™ืกื“ืขืจื•ื•ื™ื™ืœื˜ ืฆื• ื–ื™ื™ืŸ 256 ื‘ื™ื˜ืŸ - ืื™ืŸ ืงืึทื ื˜ืจืึทืกื˜ ืฆื• ืึทื– ืื ื’ืขื ื•ืžืขืŸ ืื™ืŸ ื“ื™ AES ื ืึธืจืžืึทืœ. ืื™ืŸ ื“ื™ ืœืขืฆื˜ืข, ื“ื™ ื’ืจื™ื™ืก ืื™ื– ืœื™ืžื™ื˜ืขื“ ืฆื• 128 ื‘ื™ืฅ.

ืื•ื ื“ื–ืขืจ ืฉืœื™ืกืœ ืื™ื– ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ืœื•ื™ื˜ ื“ื™ PBKDF2 ื ืึธืจืžืึทืœ. ืื™ืŸ ื“ืขื ืคืึทืœ, ื“ื™ ืคึผืึทืจืึธืœ ืื™ื– SHA-256 ืคึฟื•ืŸ ื“ื™ ืฉื˜ืจื™ืงืœ ืืจื™ื™ืŸ ืื™ืŸ ื“ื™ ื ื•ืฆืŸ. ืึทืœืข ื•ื•ืึธืก ื‘ืœื™ื™ื‘ื˜ ืื™ื– ืฆื• ื’ืขืคึฟื™ื ืขืŸ ื“ืขื ืฉื˜ืจื™ืงืœ ืฆื• ื“ื–ืฉืขื ืขืจื™ื™ื˜ ื“ื™ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืฉืœื™ืกืœ.

ื ื•, ืœืึธืžื™ืจ ื–ื™ืš ืื•ืžืงืขืจืŸ ืฆื• ืื•ื ื“ื–ืขืจ ืฉื•ื™ืŸ ื“ืขืงืึธื“ื™ืจื˜ืข ืคืึธืจืŸ.ืฉืœื™ืกืœ. ื’ืขื“ืขื ืงื˜ ื“ื™ ืฉื•ืจื” ืžื™ื˜ ืึท ืกื›ื•ื ืคื•ืŸ ื ื•ืžืขืจืŸ ืื•ืŸ ื“ื™ ื˜ืขืงืกื˜ 'ืึทืกืžืึธื“ืึทื˜'? ืœืึธืžื™ืจ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื ื•ืฆืŸ ื“ื™ ืขืจืฉื˜ืขืจ 20 ื‘ื™ื˜ืขืก ืคื•ืŸ ื“ื™ ืฉื˜ืจื™ืงืœ ื•ื•ื™ ืึท ืคึผืึทืจืึธืœ ืคึฟืึทืจ ืคืึธืœื“ืขืจ ืœืึทืงืขืจ.

ืงื•ืง, ืขืก ืึทืจื‘ืขื˜! ื“ืขืจ ืงืึธื“ ื•ื•ืึธืจื˜ ื’ืขืงื•ืžืขืŸ ืึทืจื•ื™ืฃ, ืื•ืŸ ืึทืœืฅ ืื™ื– ื’ืขื•ื•ืขืŸ ื“ื™ืกื™ืคืขืจื“ ื‘ื™ืฉืœื™ื™ืžืขืก. ืื•ื™ื‘ ืžืฉืคื˜ืŸ ื“ื•ืจืš ื“ื™ ืื•ืชื™ื•ืช ืื™ืŸ ื“ื™ ืคึผืึทืจืึธืœ, ืขืก ืื™ื– ืึท ื”ืขืงืก ืคืึทืจื˜ืจืขื˜ื•ื ื’ ืคื•ืŸ ืึท ืกืคึผืขืฆื™ืคื™ืฉ ื•ื•ืึธืจื˜ ืื™ืŸ ASCII. ื–ืืœ ืก ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื•ื•ื™ื™ึทื–ืŸ ื“ื™ ืงืึธื“ ื•ื•ืึธืจื˜ ืื™ืŸ ื˜ืขืงืกื˜ ืคืึธืจืขื. ืžื™ืจ ื‘ืึทืงื•ืžืขืŸ 'ืฉืึทื“ืึธื•ื•ื•ืœืฃ'. ืฉื•ื™ืŸ ื’ืขืคื™ืœ ื“ื™ ืกื™ืžืคึผื˜ืึธืžืก ืคื•ืŸ ืœื™ืงืึทื ื˜ืจืึธืคึผื™ืข?

ืœืึธืžื™ืจ ื ืขืžืขืŸ ืืŸ ืื ื“ืขืจ ืงื•ืง ืื™ืŸ ื“ื™ ืกื˜ืจื•ืงื˜ื•ืจ ืคื•ืŸ ื“ื™ ืึทืคืขืงื˜ืึทื“ ื˜ืขืงืข, ืื™ืฆื˜ ื•ื•ื™ืกืŸ ื•ื•ื™ ื“ื™ ืœืึทืงืขืจ ืึทืจื‘ืขื˜:

  • 02 00 00 00 - ื ืึธืžืขืŸ ืขื ืงืจื™ืคึผืฉืึทืŸ ืžืึธื“ืข;
  • 58 00 00 00 - ืœืขื ื’ ืคื•ืŸ ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืื•ืŸ ื‘ืึทืกืข64 ืขื ืงืึธื•ื“ื™ื“ ื˜ืขืงืข ื ืึธืžืขืŸ;
  • 40 00 00 00 - ื’ืจื™ื™ืก ืคื•ืŸ ื“ื™ ื˜ืจืึทื ืกืคืขืจื“ ื›ืขื“ืขืจ.

ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื ืึธืžืขืŸ ื–ื™ืš ืื•ืŸ ื“ื™ ื˜ืจืึทื ืกืคืขืจื“ ื›ืขื“ืขืจ ื–ืขื ืขืŸ ื›ื™ื™ืœื™ื™ื˜ื™ื“ ืื™ืŸ ืจื•ื™ื˜ ืื•ืŸ ื’ืขืœ ืจื™ืกืคึผืขืงื˜ื™ื•ื•ืœื™.

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 10. ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ื ืึธืžืขืŸ ืื™ื– ื›ื™ื™ืœื™ื™ื˜ื™ื“ ืื™ืŸ ืจื•ื™ื˜, ื“ื™ ื˜ืจืึทื ืกืคืขืจื“ ื›ืขื“ืขืจ ืื™ื– ื›ื™ื™ืœื™ื™ื˜ื™ื“ ืื™ืŸ ื’ืขืœ.

ืื™ืฆื˜ ืœืึธื–ืŸ ืก ืคืึทืจื’ืœื™ื™ึทื›ืŸ ื“ื™ ื™ื ืงืจื™ืคึผื˜ื™ื“ ืื•ืŸ ื“ืขืงืจื™ืคึผื˜ื™ื“ ื ืขืžืขืŸ ืื™ืŸ ื”ืขืงืกืึทื“ืขืกื™ืžืึทืœ ืคืึทืจื˜ืจืขื˜ื•ื ื’.

ืกื˜ืจื•ืงื˜ื•ืจ ืคื•ืŸ ื“ืขืงืจื™ืคึผื˜ื™ื“ ื“ืึทื˜ืŸ:

  • 78 B9 B8 2E - ืžื™ืกื˜ ื‘ืืฉืืคืŸ ื“ื•ืจืš ื“ื™ ื ื•ืฆืŸ (4 ื‘ื™ื˜ืขืก);
  • 0ะก 00 00 00 - ืœืขื ื’ ืคื•ืŸ ื“ื™ ื“ืขืงืจื™ืคึผื˜ื™ื“ ื ืึธืžืขืŸ (12 ื‘ื™ื˜ืขืก);
  • ื•ื•ื™ื™ึทื˜ืขืจ ืงื•ืžื˜ ื“ื™ ืคืึทืงื˜ื™ืฉ ื˜ืขืงืข ื ืึธืžืขืŸ ืื•ืŸ ื•ื•ืึทื˜ืŸ ืžื™ื˜ ื–ืขืจืึธืก ืฆื• ื“ื™ ืคืืจืœืื ื’ื˜ ื‘ืœืึธืง ืœืขื ื’ (ื•ื•ืึทื˜ืŸ).

Wulfric Ransomware - ืึท ืจืึทื ืกืึธืžื•ื•ืึทืจืข ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ ืขืงืกื™ืกื˜ื™ืจืŸ
ืจื™ื™ืก. 11. IMG_4114 ืงื•ืงื˜ ืคื™ืœ ื‘ืขืกืขืจ.

III. ืžืกืงื ื ืื•ืŸ ืžืกืงื ื

ืฆื•ืจื™ืง ืฆื• ื“ืขืจ ืึธื ื”ื™ื™ื‘. ืžื™ืจ ื˜ืึธืŸ ื ื™ื˜ ื•ื•ื™ืกืŸ ื•ื•ืึธืก ืžืึธื•ื˜ืึทื•ื•ื™ื™ื˜ืึทื“ ื“ืขืจ ืžื—ื‘ืจ ืคื•ืŸ Wulfric.Ransomware ืื•ืŸ ื•ื•ืึธืก ืฆื™ืœ ืขืจ ืคึผืขืจืกื•ื“. ืคื•ืŸ ืงื•ืจืก, ืคึฟืึทืจ ื“ื™ ื“ื•ืจื›ืฉื ื™ื˜ืœืขืš ื‘ืึทื ื™ืฆืขืจ, ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ื™ ืึทืจื‘ืขื˜ ืคื•ืŸ ืืคื™ืœื• ืึทื–ืึท ืึท ืขื ืงืจื™ืคึผื˜ืขืจ ื•ื•ืขื˜ ื•ื™ืกืงื•ืžืขืŸ ื•ื•ื™ ืึท ื’ืจื•ื™ืก ื•ืžื’ืœื™ืง. ื˜ืขืงืขืก ื˜ืึธืŸ ื ื™ื˜ ืขืคืขื ืขืŸ. ืึทืœืข ื ืขืžืขืŸ ื–ืขื ืขืŸ ื ื™ื˜ืึธ. ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ื“ื™ ื’ืขื•ื•ื™ื™ื ื˜ืœืขืš ื‘ื™ืœื“, ืขืก ืื™ื– ืึท ื•ื•ืึธืœืฃ ืื•ื™ืฃ ื“ืขื ืขืงืจืึทืŸ. ื–ื™ื™ ืฆื•ื•ื™ื ื’ืขืŸ ืื™ืจ ืฆื• ืœื™ื™ืขื ืขืŸ ื•ื•ืขื’ืŸ ื‘ื™ื˜ืงืึธื™ื ืก.

ืืžืช, ื“ืึธืก ืžืึธืœ, ืื•ื ื˜ืขืจ ื“ื™ ืคืึทืจืฉื˜ืขืœื•ื ื’ ืคื•ืŸ ืึท "ืฉืจืขืงืœืขืš ืขื ืงืึธื“ืขืจ," ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืคืึทืจื‘ืึธืจื’ืŸ ืึทื–ืึท ืึท ืœืขื›ืขืจืœืขืš ืื•ืŸ ื ืึทืจื™ืฉ ืคึผืจื•ื•ื•ืŸ ืคื•ืŸ ื™ืงืกื˜ืึธืจืฉืึทืŸ, ื•ื•ื• ื“ืขืจ ืึทื˜ืึทืงืขืจ ื ื™ืฆื˜ ืคืึทืจื˜ื™ืง ืžื’ื™ืœื” ืื•ืŸ ืœืึธื–ืŸ ื“ื™ ืฉืœื™ืกืœืขืŸ ืจืขื›ื˜ ื‘ื™ื™ึท ื“ื™ ืคืึทืจื‘ืจืขื›ืŸ ืกืฆืขื ืข.

ื“ื•ืจืš ื“ืขื ื•ื•ืขื’, ื•ื•ืขื’ืŸ ื“ื™ ืฉืœื™ืกืœืขืŸ. ืžื™ืจ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื”ืึธื‘ืŸ ืึท ื‘ื™ื™ื–ืข ืฉืจื™ืคื˜ ืึธื“ืขืจ ื˜ืจืึธื“ื–ืฉืึทืŸ ื•ื•ืึธืก ืงืขืŸ ื”ืขืœืคึฟืŸ ืื•ื ื“ื– ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื•ื•ื™ ื“ืึธืก ื’ืขื˜ืจืืคืŸ. ืคืึธืจืŸ.ืฉืœื™ืกืœ - ื“ื™ ืžืขืงืึทื ื™ื–ืึทื ื“ื•ืจืš ื•ื•ืึธืก ื“ื™ ื˜ืขืงืข ืื™ื– ืืจื•ื™ืก ืื•ื™ืฃ ืึท ื™ื ืคืขืงื˜ืึทื“ ืคึผื™ืกื™ ืื™ื– ืื•ืžื‘ืึทืงืึทื ื˜. ืึธื‘ืขืจ, ืื™ืš ื’ืขื“ืขื ืง, ืื™ืŸ ื–ื™ื™ืŸ ื‘ืึทืžืขืจืงื•ื ื’ ื“ืขืจ ืžื—ื‘ืจ ื“ืขืจืžืื ื˜ ื“ื™ ืื™ื™ื’ื ืืจื˜ื™ืงื™ื™ื˜ ืคื•ืŸ ื“ื™ ืคึผืึทืจืึธืœ. ืึทื–ื•ื™, ื“ื™ ืงืึธื“ ื•ื•ืึธืจื˜ ืคึฟืึทืจ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืื™ื– ื•ื•ื™ ื™ื™ื ืฆื™ืง ื•ื•ื™ ื“ื™ ื ืืžืขืŸ ืฉืึธื˜ืŸ ื•ื•ืึธืœืฃ ืื™ื– ื™ื™ื ืฆื™ืง :)

ืื•ืŸ ื ืึธืš, ืฉืึธื˜ืŸ ื•ื•ืึธืœืฃ, ื•ื•ืึธืก ืื•ืŸ ื•ื•ืึธืก?

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’