{"id":2260,"date":"2016-07-19T07:57:43","date_gmt":"2016-07-19T11:57:43","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=2260"},"modified":"2019-11-15T14:59:31","modified_gmt":"2019-11-15T11:59:31","slug":"satana-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/satana-ransomware\/2260\/","title":{"rendered":"Satana: Cehennemden gelen fidye yaz\u0131l\u0131m\u0131"},"content":{"rendered":"<p>Bu sene, fidye yaz\u0131l\u0131m hakk\u0131ndaki haberler sava\u015f alan\u0131ndan durmadan gelen harekat raporlar\u0131na benziyor. Ara\u015ft\u0131rmac\u0131lar her g\u00fcn, m\u00fc\u015fterilerden ve \u015firketlerden para \u00e7almak ama\u00e7l\u0131 yap\u0131lan sald\u0131r\u0131lar\u0131 ke\u015ffediyor.  Ve g\u00fcvenlik uzmanlar\u0131 bu sorunlara \u00e7\u00f6z\u00fcm \u00fcrettik\u00e7e, sahtekarlar farkl\u0131 y\u00f6ntemlerle \u00e7al\u0131\u015fan yeni bir fidye yaz\u0131l\u0131mla kar\u015f\u0131m\u0131za \u00e7\u0131k\u0131yor. <\/p>\n<p>Son g\u00fcnlerde, karma\u015f\u0131k bir fidye yaz\u0131l\u0131m\u0131n t\u00fcr\u00fc ke\u015ffedildi. Bu k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n lakab\u0131 Satana (\u201cSatan-\u015eeytan\u201d). \u0130sminden yola \u00e7\u0131kt\u0131\u011f\u0131m\u0131zda, bu da bize yap\u0131mc\u0131lar\u0131n\u0131n Rus k\u00f6kenli oldu\u011fu hakk\u0131nda bir \u00f6ng\u00f6r\u00fc sa\u011fl\u0131yor. Trojan iki \u015feyi yap\u0131yor: Dosyalar\u0131 \u015fifrelemek ve Windows Master Boot\u2019u (MBR) bozmak. Yani Windows\u2019un bootunu engelliyor. <\/p>\n<p>MBR\u2019e bula\u015fan Trojanlar hakk\u0131nda daha \u00f6nce konu\u015fmu\u015ftuk. Hepimizin bildi\u011fi bir fidye yaz\u0131l\u0131m olan <a href=\"https:\/\/www.kaspersky.com\/blog\/petya-ransomware\/11715\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Petya<\/a> bunlardan biri. Baz\u0131 durumlarda, Satana ona benzer \u015fekilde \u00e7al\u0131\u015f\u0131yor. \u00d6rne\u011fin, MBR\u2019a kendi kodunu enjekte ediyor. Ancak, Petya Master File Table\u2019\u0131 (MFT) \u015fifrelerken, Satana MBR\u2019\u0131 \u015fifreliyor. PC dosyalar\u0131n\u0131 \u015fifrelemek i\u00e7in Petya, <a href=\"https:\/\/www.kaspersky.com\/blog\/mischa-ransomware\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Mischa<\/a> lakapl\u0131 trojan\u0131n yard\u0131m\u0131n\u0131 al\u0131yor. Satana ise her iki i\u015fi de kendi yap\u0131yor.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Petya?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Petya<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ransomware<\/a> eats your hard drives \u2013 <a href=\"https:\/\/t.co\/BSqbmRBmGf\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/BSqbmRBmGf<\/a> <a href=\"https:\/\/t.co\/WpvijrPlSP\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/WpvijrPlSP<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/715232633316384772?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 30, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>\u015eimdi, bilgisayar\u0131n i\u00e7 i\u015fleyi\u015finin nas\u0131l oldu\u011funu bilmeyenlere biraz yard\u0131m etmeyi deneyece\u011fiz. MBR, bilgisayar\u0131n hard diskindeki bir par\u00e7ad\u0131r. \u0130\u00e7inde diskin farkl\u0131 alanlar\u0131ndaki sistem dosyalar\u0131n\u0131 bar\u0131nd\u0131r\u0131r, yani i\u015fletim sisteminin dosyalar\u0131n\u0131 da bar\u0131nd\u0131r\u0131r. <\/p>\n<p>MBR bozulursa veya \u015fifrelenirse, bilgisayar kritik bilgilere ula\u015fma iznini kaybeder ve kendini ba\u015flatamaz. Satana gibi fidye yaz\u0131l\u0131m\u0131n arkas\u0131ndaki su\u00e7lular bunu kendi leyhlerine kulland\u0131 ve cryptolockerlar\u0131n, bootlocker (ba\u015flatmay\u0131 engellemek) ile geli\u015ftirdiler. Siber su\u00e7lular, MBR\u2019daki dosyalar\u0131 kendi fidye notlar\u0131yla de\u011fi\u015ftirip as\u0131l dosyalar\u0131 ba\u015fka bir yere ta\u015f\u0131yor.  <\/p>\n<p>Fidye, 0.5 bitcoin kadar (yakla\u015f\u0131k 340 dolar). Bu fidyeyi verirseniz, MBR\u2019\u0131n \u015fifresini \u00e7\u00f6z\u00fcyorlar ve \u015fifrelenmi\u015f di\u011fer dosyalar\u0131 a\u00e7mak i\u00e7in gerekli anahtar\u0131 veriyorlar. Fidye \u00f6denince, Satana\u2019n\u0131n yarat\u0131c\u0131lar\u0131 i\u015fletim sistemine ula\u015f\u0131m\u0131 size geri vereceklerini ve her \u015feyin eskisi gibi olaca\u011f\u0131n\u0131 vaad ediyorlar. En az\u0131ndan b\u00f6yle s\u00f6yl\u00fcyorlar.<\/p>\n<p>Satana bir kez sisteme girince, t\u00fcm diskleri ve network ba\u011flant\u0131lar\u0131n\u0131 tar\u0131yor ve .bak, .doc, .jpg, .jpe, .txt, .tex, .dbf, .db, .xls, .cry, .xml, .vsd, .pdf, .csv, .bmp, .tif, .1cd, .tax, .gif, .gbr, .png, .mdb, .mdf, .sdf, .dwg, .dxf, .dgn, .stl, .gho, .v2i, .3ds, .ma, .ppt, .acc, .vpd, .odt, .ods, .rar, .zip, .7z, .cpp, .pas, ve .asm uzant\u0131l\u0131 dosyalar\u0131 ar\u0131yor. Bulduklar\u0131n\u0131 da \u015fifreliyor. Ayr\u0131ca, dosya ad\u0131n\u0131n ba\u015f\u0131na bir e-mail adresi ve \u00fc\u00e7 tane alt \u00e7izgi ekliyor (\u00f6rnek olarak, test.jpg olan dosyan\u0131z\u0131n ad\u0131 Sarah_G@ausi.com___test.jpg oluyor.)<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/91\/2016\/07\/06014055\/satan_mbr_en.png\" alt=\"satan_mbr_en\" width=\"720\" height=\"400\" class=\"alignnone size-full wp-image-2263\"><\/p>\n<p>Bu e-mail kurbanlar\u0131n fidye \u00f6demek i\u00e7in ileti\u015fime ge\u00e7mesi gereken adres oluyor. Bu e-mail\u2019e sahip ki\u015fiyle ileti\u015fime ge\u00e7erek \u00f6deme yollar\u0131n\u0131 \u00f6\u011freniyorlar ve \u015fifre \u00e7\u00f6z\u00fcmleme anahtar\u0131n\u0131 al\u0131yorlar. Bu zamana kadar ara\u015ft\u0131rmac\u0131lar bu i\u015f i\u00e7in kullan\u0131lan alt\u0131 e-mail adresi buldular. <\/p>\n<p>G\u00fczel haber, kilidi k\u0131smen k\u0131rmak i\u00e7in bir yol var: Biraz yetene\u011finiz varsa MBR d\u00fczeltilebilir. Windows Club blo\u011funda uzmanlar, i\u015fletim sistemi geri y\u00fckleme \u00f6zelli\u011fini kullanarak MBR\u2019\u0131 d\u00fczeltmek i\u00e7in gerekli ad\u0131mlar\u0131 <a href=\"http:\/\/www.thewindowsclub.com\/repair-master-boot-record-mbr-windows\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">anlatt\u0131lar<\/a>. Ancak, bu \u00f6zellik komut sistemi ve bootrec.exe kullanan deneyimli kullan\u0131c\u0131lar i\u00e7in geli\u015ftirilmi\u015f. Bu \u00f6zellikleri kullanmayan kullan\u0131c\u0131lar bu zorlu ad\u0131mlar\u0131 yaparken zorluk \u00e7ekebilirler.<\/p>\n<p>K\u00f6t\u00fc haber ise, Windows\u2019un kilidi k\u0131r\u0131lsa bile \u015fifrelenen dosyalar oldu\u011fu gibi duruyor. Bu sorun i\u00e7in  hen\u00fcz bir \u00e7\u00f6z\u00fcm\u00fcm\u00fcz yok. <\/p>\n<p>Bu noktada, Satana fidye yaz\u0131l\u0131m kariyerine ba\u015flam\u0131\u015f gibi duruyor: Yayg\u0131n de\u011fil ve ara\u015ft\u0131rmac\u0131lar kodunda birka\u00e7 hata farkettiler. Buna ra\u011fmen, zamanla kendini geli\u015ftirebilir ve ciddi bir tehdit haline gelebilir. <\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">10 tips to protect your files from ransomware <a href=\"https:\/\/t.co\/o0IpUU9CHb\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/o0IpUU9CHb<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/iteducation?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iteducation<\/a> <a href=\"https:\/\/t.co\/I47sPIiWFF\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/I47sPIiWFF<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/671348678607642624?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 30, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Kullan\u0131c\u0131lar i\u00e7in \u00f6ncelikli tavsiyemiz uyan\u0131k olmalar\u0131. Basit \u00f6nerilerimizle Satana\u2019dan m\u00fcmk\u00fcn oldu\u011funca fazla korunabilirsiniz: <\/p>\n<p><strong>1.Verilerinizi d\u00fczenli olarak yedekleyin.<\/strong><br>\nBu sizin sigortan\u0131z. Bir fidye yaz\u0131l\u0131m sald\u0131r\u0131s\u0131 durumunda i\u015fletim sistemini tekrar y\u00fckleyebilir ve dosyalar\u0131n\u0131z\u0131 yedek dosyalar\u0131n\u0131z yard\u0131m\u0131yla kurtarabilirsiniz. <\/p>\n<p><strong>2.\u015e\u00fcpheli siteleri ziyaret etmeyin ve \u015f\u00fcpheli e-mail eklerini a\u00e7may\u0131n<\/strong>, e-mail veya link tan\u0131d\u0131\u011f\u0131n\u0131z birinden gelmi\u015f olsa bile. \u00c7ok dikkatli olun. Satana\u2019n\u0131n tekniklerini \u00e7ok az biliyoruz. <\/p>\n<p><strong>3. G\u00fcvenilir bir antivir\u00fcs \u00e7\u00f6z\u00fcm\u00fc kullan\u0131n<\/strong>. <a href=\"https:\/\/kas.pr\/kdkistr\" target=\"_blank\" rel=\"noopener noreferrer\">Kaspersky Internet Security<\/a>, Satana\u2019y\u0131 Trojan-Ransom.Win32.Satan olarak tan\u0131r, i\u015fletim sistemini kilitlemesini ve dosyalar\u0131 \u015fifrelemesini engeller. <\/p>\n<p><strong>4.Ve tabiki, haberlerimizi takip edin!<\/strong><br>\nFidye yaz\u0131l\u0131m\u0131n sizi gafil avlamamas\u0131 i\u00e7in her zaman sizi yeni tehditlere kar\u015f\u0131 uyar\u0131yoruz. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bu sene, fidye yaz\u0131l\u0131m hakk\u0131ndaki haberler sava\u015f alan\u0131ndan durmadan gelen harekat raporlar\u0131na benziyor. Ara\u015ft\u0131rmac\u0131lar her g\u00fcn, m\u00fc\u015fterilerden ve \u015firketlerden para \u00e7almak ama\u00e7l\u0131 yap\u0131lan sald\u0131r\u0131lar\u0131 ke\u015ffediyor. Ve g\u00fcvenlik uzmanlar\u0131 bu sorunlara<\/p>\n","protected":false},"author":2194,"featured_media":2262,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1287,1351],"tags":[590,591,447,910,537,241],"class_list":{"0":"post-2260","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-cryptolocker","10":"tag-fidye-yazilimi","11":"tag-ransomware","12":"tag-satana","13":"tag-tehditler","14":"tag-trojan"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/satana-ransomware\/2260\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/satana-ransomware\/7389\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/satana-ransomware\/7413\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/satana-ransomware\/7362\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/satana-ransomware\/8652\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/satana-ransomware\/8602\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/satana-ransomware\/12442\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/satana-ransomware\/12558\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/satana-ransomware\/5808\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/satana-ransomware\/6406\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/satana-ransomware\/5097\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/satana-ransomware\/8155\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/satana-ransomware\/11998\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/satana-ransomware\/12442\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/satana-ransomware\/12558\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/satana-ransomware\/12558\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/cryptolocker\/","name":"cryptolocker"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2194"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=2260"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2260\/revisions"}],"predecessor-version":[{"id":7172,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2260\/revisions\/7172"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/2262"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=2260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=2260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=2260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}