{"id":2974,"date":"2016-08-10T16:52:24","date_gmt":"2016-08-10T13:52:24","guid":{"rendered":"http:\/\/www.one-it.ro\/blog\/?p=2974"},"modified":"2016-08-10T16:52:24","modified_gmt":"2016-08-10T13:52:24","slug":"securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware","status":"publish","type":"post","link":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/","title":{"rendered":"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware"},"content":{"rendered":"\n\n
\n \n
\n \n
\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n <\/div>\n \n
\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n
\n \n\n
<\/div>\n <\/div>\n <\/div>\n<\/div>\n \n\n
\n 5\/5 - (1 vote) <\/div>\n <\/div>\n

\"Securitate<\/h4>\n

Securitate IT – o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware<\/h2>\n

Nemucod, cel mai activ troian de tip downloader din 2016 s-a \u00eentors cu o nou\u0103 campanie. \u00cen loc s\u0103 serveasc\u0103 victimelor sale ransomware, livreaz\u0103 un backdoor detectat de ESET ca Win32\/Kovter.<\/h3>\n

. \u00a0<\/span>\u00a0 \u00a0 Nemucod a fost folosit \u00een c\u00e2teva campanii mari \u00een 2016, ating\u00e2nd o cot\u0103 de 24% din rata de detec\u021bie la nivel global pe 30 martie 2016. Atacurile regionale \u00een numite \u021b\u0103ri au avut un nivel de prevalen\u021b\u0103 de peste 50% pe parcursul anului 2016. \u00cen trecut, sarcinile malware asociate Nemucod apar\u021bineau \u00een principal familiilor ransomware, cele mai frecvente fiind Locky sau TeslaCrypt. \u00cen cea mai recent\u0103 campanie detectat\u0103 de sistemul ESET, \u00eenc\u0103rc\u0103tura malware a Nemucod este un backdoor de tip ad-clicking, numit Kovter.<\/p>\n

.<\/span>\u00a0 \u00a0 \u00a0\u00cen calitate de backdoor, acest troian permite atacatorului s\u0103 controleze echipamentul afectat de la distan\u021b\u0103, f\u0103r\u0103 consim\u021b\u0103m\u00e2ntul sau cuno\u0219tin\u021ba victimei. Varianta analizat\u0103 de c\u0103tre cercet\u0103torii ESET a fost \u00eenzestrat\u0103 cu capacitatea de ad-clic, mediat\u0103 prin intermediul unui browser \u00eencorporat. Troianul poate activa p\u00e2n\u0103 la 30 de thread-uri separate, fiecare vizit\u00e2nd site-uri web \u0219i gener\u00e2nd clic-uri pe reclame. Num\u0103rul de thread-uri se poate schimba \u00een func\u021bie de comenzile primite de la atacator \u0219i pot fi modificate automat \u2013 din moment ce Kovter monitorizeaz\u0103 utilizarea procesorului. \u00cen cazul \u00een care computerul este inactiv, malware-ul poate aloca mai multe resurse pentru activit\u0103\u021bile sale p\u00e2n\u0103 c\u00e2nd este detectat\u0103 activitatea utilizatorului.
\n\u00a0. \u00a0<\/span>\u00a0 \u00cen mod standard pentru Nemucod, versiunea curent\u0103 care livreaz\u0103 Kovter se r\u0103sp\u00e2nde\u0219te sub forma unui ata\u0219ament ZIP trimis prin e-mail, deghizat ca o factur\u0103, ce con\u021bine \u00een fapt un fi\u0219ier executabil infectat de tip JavaScript. \u00cen cazul \u00een care utilizatorul cade \u00een capcan\u0103 \u0219i execut\u0103 fi\u0219ierul infectat \u2013 downloader-ul Nemucod \u2013 descarc\u0103 Kovter pe ma\u0219in\u0103 \u0219i \u00eel execut\u0103.<\/p>\n

\u00a0 \u00a0 \u00a0\u00cen leg\u0103tur\u0103 cu Nemucod, exper\u021bii \u00een securitate de la ESET recomand\u0103 s\u0103 urm\u0103m regulile generale de pruden\u021b\u0103 la navigarea pe internet \u0219i s\u0103 urm\u0103m de asemenea sfaturile specifice urm\u0103toare:<\/span><\/p>\n

    \n
  • \u00cen cazul \u00een care clientul de e-mail sau serverul ofer\u0103 ofer\u0103 op\u021biunea de blocare a ata\u0219amentelor \u00een func\u021bie extensie, merit\u0103 luat\u0103 \u00een considerare op\u021biunea de blocare a ata\u0219amentelor trimise cu extensiile .EXE, *.BAT, *.cmd, *.SCR \u0219i *.js.<\/span><\/li>\n
  • Este indicat s\u0103 se verifice dac\u0103 sistemul de operare afi\u0219eaz\u0103 extensiile fi\u0219ierelor. Acest lucru ajut\u0103 la identificarea real\u0103 a tipului unui fi\u0219ier \u00een cazul unei extensii duble (de exemplu, ca nu cumva \u201cFACTURA.PDF.EXE\u201d este afi\u0219at ca \u201cFACTURA.PDF\u201d).<\/span><\/li>\n
  • \u00cen cazul \u00een care primi\u021bi \u00een mod frecvent \u0219i \u00een mod legitim acest tip de fi\u0219iere, verifica\u021bi cu aten\u021bie cine este expeditorul \u0219i dac\u0103 exist\u0103 ceva suspect, scana\u021bi mesajul \u0219i anexele sale cu o solu\u021bie de securitate fiabil\u0103.<\/span><\/li>\n<\/ul>\n

     <\/p>\n

    (credit foto:\u00a0www.shutterstock.com)<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Securitate IT – o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware Nemucod, cel mai activ troian de tip downloader din 2016 s-a \u00eentors cu o nou\u0103 campanie. \u00cen loc s\u0103 serveasc\u0103 victimelor sale ransomware, livreaz\u0103 un backdoor detectat de ESET ca Win32\/Kovter. . \u00a0\u00a0 \u00a0 Nemucod a fost folosit \u00een c\u00e2teva campanii […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[5,1],"tags":[114,234],"yoast_head":"\nSecuritate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"ro_RO\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog\" \/>\n<meta property=\"og:description\" content=\"Securitate IT – o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware Nemucod, cel mai activ troian de tip downloader din 2016 s-a \u00eentors cu o nou\u0103 campanie. \u00cen loc s\u0103 serveasc\u0103 victimelor sale ransomware, livreaz\u0103 un backdoor detectat de ESET ca Win32\/Kovter. . \u00a0\u00a0 \u00a0 Nemucod a fost folosit \u00een c\u00e2teva campanii […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"One-IT blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/OneIT\" \/>\n<meta property=\"article:published_time\" content=\"2016-08-10T13:52:24+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2016\/08\/shutterstock_120400876.jpg\" \/>\n<meta name=\"author\" content=\"One-IT\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@oneitro\" \/>\n<meta name=\"twitter:site\" content=\"@oneitro\" \/>\n<meta name=\"twitter:label1\" content=\"Scris de\" \/>\n\t<meta name=\"twitter:data1\" content=\"One-IT\" \/>\n\t<meta name=\"twitter:label2\" content=\"Timp estimat pentru citire\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\"},\"author\":{\"name\":\"One-IT\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/22bc65c3ffb17647f9457adc941ab683\"},\"headline\":\"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware\",\"datePublished\":\"2016-08-10T13:52:24+00:00\",\"dateModified\":\"2016-08-10T13:52:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\"},\"wordCount\":500,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/#organization\"},\"keywords\":[\"business\",\"Securitate IT\"],\"articleSection\":[\"Diverse\",\"Stiri\"],\"inLanguage\":\"ro-RO\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\",\"url\":\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\",\"name\":\"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/#website\"},\"datePublished\":\"2016-08-10T13:52:24+00:00\",\"dateModified\":\"2016-08-10T13:52:24+00:00\",\"inLanguage\":\"ro-RO\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#website\",\"url\":\"https:\/\/www.one-it.ro\/blog\/\",\"name\":\"One-IT blog\",\"description\":\"Mai mult dec\u00e2t un expert, un prieten!\",\"publisher\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.one-it.ro\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"ro-RO\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#organization\",\"name\":\"ONE-IT\",\"url\":\"https:\/\/www.one-it.ro\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ro-RO\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2019\/10\/logo_OneIT.png\",\"contentUrl\":\"https:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2019\/10\/logo_OneIT.png\",\"width\":255,\"height\":230,\"caption\":\"ONE-IT\"},\"image\":{\"@id\":\"https:\/\/www.one-it.ro\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/OneIT\",\"https:\/\/twitter.com\/oneitro\",\"https:\/\/www.instagram.com\/oneit.ro\/\",\"https:\/\/www.linkedin.com\/company\/oneit\/\",\"https:\/\/www.youtube.com\/oneit\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/22bc65c3ffb17647f9457adc941ab683\",\"name\":\"One-IT\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ro-RO\",\"@id\":\"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/719951a327fa9ba9d20500d1492b2dfe?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/719951a327fa9ba9d20500d1492b2dfe?s=96&d=mm&r=g\",\"caption\":\"One-IT\"},\"description\":\"ONE-IT - Smart technologies, Cyber Security, Cloud, integrated IT solutions for business productivity. Detalii despre noi: echipa One-IT\",\"sameAs\":[\"http:\/\/www.one-it.ro\"],\"url\":\"https:\/\/www.one-it.ro\/blog\/author\/one-it\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/","og_locale":"ro_RO","og_type":"article","og_title":"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog","og_description":"Securitate IT – o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware Nemucod, cel mai activ troian de tip downloader din 2016 s-a \u00eentors cu o nou\u0103 campanie. \u00cen loc s\u0103 serveasc\u0103 victimelor sale ransomware, livreaz\u0103 un backdoor detectat de ESET ca Win32\/Kovter. . \u00a0\u00a0 \u00a0 Nemucod a fost folosit \u00een c\u00e2teva campanii […]","og_url":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/","og_site_name":"One-IT blog","article_publisher":"https:\/\/www.facebook.com\/OneIT","article_published_time":"2016-08-10T13:52:24+00:00","og_image":[{"url":"http:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2016\/08\/shutterstock_120400876.jpg"}],"author":"One-IT","twitter_card":"summary_large_image","twitter_creator":"@oneitro","twitter_site":"@oneitro","twitter_misc":{"Scris de":"One-IT","Timp estimat pentru citire":"2 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/"},"author":{"name":"One-IT","@id":"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/22bc65c3ffb17647f9457adc941ab683"},"headline":"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware","datePublished":"2016-08-10T13:52:24+00:00","dateModified":"2016-08-10T13:52:24+00:00","mainEntityOfPage":{"@id":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/"},"wordCount":500,"commentCount":0,"publisher":{"@id":"https:\/\/www.one-it.ro\/blog\/#organization"},"keywords":["business","Securitate IT"],"articleSection":["Diverse","Stiri"],"inLanguage":"ro-RO","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/","url":"https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/","name":"Securitate IT \u2013 o nou\u0103 campanie care r\u0103sp\u00e2nde\u0219te un backdoor, \u00een loc de ransomware - One-IT blog","isPartOf":{"@id":"https:\/\/www.one-it.ro\/blog\/#website"},"datePublished":"2016-08-10T13:52:24+00:00","dateModified":"2016-08-10T13:52:24+00:00","inLanguage":"ro-RO","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.one-it.ro\/blog\/securitate-o-noua-campanie-care-raspandeste-un-backdoor-loc-de-ransomware\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.one-it.ro\/blog\/#website","url":"https:\/\/www.one-it.ro\/blog\/","name":"One-IT blog","description":"Mai mult dec\u00e2t un expert, un prieten!","publisher":{"@id":"https:\/\/www.one-it.ro\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.one-it.ro\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"ro-RO"},{"@type":"Organization","@id":"https:\/\/www.one-it.ro\/blog\/#organization","name":"ONE-IT","url":"https:\/\/www.one-it.ro\/blog\/","logo":{"@type":"ImageObject","inLanguage":"ro-RO","@id":"https:\/\/www.one-it.ro\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2019\/10\/logo_OneIT.png","contentUrl":"https:\/\/www.one-it.ro\/blog\/wp-content\/uploads\/2019\/10\/logo_OneIT.png","width":255,"height":230,"caption":"ONE-IT"},"image":{"@id":"https:\/\/www.one-it.ro\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/OneIT","https:\/\/twitter.com\/oneitro","https:\/\/www.instagram.com\/oneit.ro\/","https:\/\/www.linkedin.com\/company\/oneit\/","https:\/\/www.youtube.com\/oneit"]},{"@type":"Person","@id":"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/22bc65c3ffb17647f9457adc941ab683","name":"One-IT","image":{"@type":"ImageObject","inLanguage":"ro-RO","@id":"https:\/\/www.one-it.ro\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/719951a327fa9ba9d20500d1492b2dfe?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/719951a327fa9ba9d20500d1492b2dfe?s=96&d=mm&r=g","caption":"One-IT"},"description":"ONE-IT - Smart technologies, Cyber Security, Cloud, integrated IT solutions for business productivity. Detalii despre noi: echipa One-IT","sameAs":["http:\/\/www.one-it.ro"],"url":"https:\/\/www.one-it.ro\/blog\/author\/one-it\/"}]}},"_links":{"self":[{"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/posts\/2974"}],"collection":[{"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/comments?post=2974"}],"version-history":[{"count":1,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/posts\/2974\/revisions"}],"predecessor-version":[{"id":2975,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/posts\/2974\/revisions\/2975"}],"wp:attachment":[{"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/media?parent=2974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/categories?post=2974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.one-it.ro\/blog\/wp-json\/wp\/v2\/tags?post=2974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}