{"id":7626,"date":"2017-06-02T19:17:11","date_gmt":"2017-06-02T19:17:11","guid":{"rendered":"http:\/\/blog.nsfocusglobal.com\/?p=646"},"modified":"2017-06-02T19:17:11","modified_gmt":"2017-06-02T19:17:11","slug":"blackmoon-banking-trojan-overview","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/blackmoon-banking-trojan-overview\/","title":{"rendered":"Blackmoon Banking Trojan Overview"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were compromised in South Korea and the Blackmoon Trojan has been identified as the culprit. A new 2017 version has hit the financial industry and employs a new framework model primarily targeting the online banking industry.<\/p>\n

Deployment of Blackmoon consists of three separate but interconnected steps to successfully launch the malware. This new framework is completely different from the 2016 version that relied on adware and exploit kits.<\/p>\n

Palo Alto Networks Unit 42 analyzed compromised assets residing in Korean banks and named the exploit “KRBanker” or “Blackmoon”.\u00a0Blackmoon’s attack is not the same as the traditional MITB model which consists mainly in the form of “Pharming” to redirect the user to a forged website. This facilitates illegally obtaining user’s data through an impersonation page were the user provides personal account information. When a user visits a bank’s website the Trojan detects whether the site is an attack target. If yes the user is redirected to a forged site, and if no then the user is directed to the normal site. The preceding list identifies a few of the recognized websites.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

Propagation Method<\/strong><\/p>\n

\u00a0<\/strong>Previous Method<\/em><\/strong><\/p>\n

The Blackmoon samples discovered in 2016 were spread and infected with adware and exploit kit (EK) models. Additionally, Adobe Flash vulnerabilities may be exploited and used to install Blackmoon’s EK called KaiXin which facilitates the spread and installation of Trojans.\u00a0Another way to infect is through an adware program called NEWSPOT.\u00a0After the user has installed the program through the program’s update channel the Blackmoon Trojan will be downloaded onto the user’s machine and the Trojan will run and start the attack.<\/p>\n

Current Method<\/em><\/strong><\/p>\n

From late 2016 to early 2017 researchers discovered a unique three-stage framework dedicated to the deployment of the Blackmoon Bank Trojan.\u00a0The framework completes the propagation of the Blackmoon Trojan by deploying components that have different but related functions in order.\u00a0Fidelis calls this process the Blackmoon Downloader framework including the Initial Downloader, Bytecode Downloader, and the KRDownloader.<\/p>\n

The framework is closely linked and designed to run sequentially to promote multiple goals such as evasion and geolocation positioning.\u00a0The multi-level downloader is specifically designed to avoid detection because functions are distributed between these separate but related components.<\/p>\n

Sample Analysis<\/em><\/strong><\/p>\n

The BlackMoon virus file is downloaded through a new framework to the specified target machine. We have downloaded and installed the malware to introduce its attack process and function capabilities.<\/p>\n

Stage 1: Mini Downloader<\/strong><\/p>\n

Once the ‘Mini-Downloader’ is installed there is no evidence on the machine of the exploit only a lot of garbage code which interferes with the analysis. Other samples only modified the serial number when downloading but the URL does not change. Therefore, the series will download the file named file \/ ad _ ## \/ cod ## (## for the specified serial number).<\/p>\n

\"\"<\/a><\/p>\n

Stage 2: Bytecode Downloader<\/strong><\/p>\n

This phase of the sample is still a downloader but it is not a complete PE file. A binary code utilizes XOR to decrypt the downloaded URL and connect. Additionally, a download of the specified file is named as \/ad_##\/test##.jpg, and the number is the same as the number in the initial phase. Several tools exist to generate this set of attack vectors.<\/p>\n

\"\"<\/a><\/p>\n

Stage 3: disguised as a picture downloader<\/strong><\/p>\n

The second phase of the downloaded file promotes a . JPG suffix but before the implementation of the file we will use the fourth byte of the value for the entire XOR file operation with the decryption of the supported PE file.<\/p>\n

\"\"<\/a><\/p>\n

The sample also gets the native mac address, code page identifier, builds the URI string, and then decrypts it to send to the C2 address.\u00a0After the sample is downloaded the exe file and random attached overwrite data are written in% TEMP% directory * .tmp.exe file. It then deletes itself before the implementation of the program.<\/p>\n

Next, the sample executes the GetOEMCP () function on the infected machine to get the code page identifier and uses the embedded VBScript to get the MAC address. It then registers the current infected computer with the C2 server by sending the following HTTP GET request:<\/p>\n

\"\"<\/a><\/p>\n

The sample uses automatic proxy configuration (PAC), which is a legitimate function for Windows and network administrators. You can define the appropriate proxy address for each URL by writing JavaScript.<\/p>\n

The sample uses this feature to implement domain name redirection and query\u00a0the local proxy server to create the following registry key.<\/p>\n

HKEY_CURRENT_USER \\ Software \\ Microsoft \\ Windows \\ CurrentVersion \\ Internet Settings \\ AutoConfigURL = http:\/\/127.0.0.1:[random]\/[random<\/a>]<\/p>\n

Network Rules<\/strong><\/p>\n

Because the link that is downloaded is encoded directly in the code the URL can only identify a specific sample.<\/p>\n

\"\"<\/a><\/p>\n

Threat Intelligence Information<\/strong><\/p>\n

The NSF News Center (NTI) has increased its tracking and monitoring services of the incident with a reported 95 IoC’s identified. This included the relevant IP’s , domain names, and documents.<\/p>\n

For more information visit the NSFOCUS Critical Intelligence Center (NTI) for real-time intelligence and tracking of the event:<\/p>\n

Https:\/\/nti.nsfocus.com<\/strong><\/a><\/p>\n

Detection & Prevention<\/strong><\/p>\n

The user can shield the relevant malicious domain name to prevent the Trojan from downloading and installing.<\/p>\n

Short-term service<\/em>: NSFOCUS engineers on-site Trojan horse back door cleaning services (artificial services + IPS + TAC).\u00a0To ensure that the first time to eliminate the relevant risk points within the network to control the scope of the incident and to provide an event analysis report.<\/p>\n

Medium-term service<\/em>: to provide 3-6 months of risk monitoring and inspection services (IPS + TAC + artificial services).<\/p>\n

Long-term service<\/em>: based on industry business risk solution (threat intelligence + attack traceability + professional security services)<\/p>\n

Summary<\/strong><\/p>\n

The malware consists of\u00a0a total of three downloaders. The BlackMoon Trojan can be successfully downloaded to the designated area of \u200b\u200bthe computer and is difficult to track and detect. The BlackMoon Trojan mainly targets the financial industry within the APAC region. Additionally, the Trojan acts as a browser middleman and re-directs network traffic to obtain a user’s PII. This results in a large number of personal account information disclosures causing a significant amount of issues.<\/p>\n

Reference link:<\/strong><\/p>\n

Https:\/\/www.fidelissecurity.com\/threatgeek\/2017\/05\/blackmoon-rising-banking-trojan-back-new-framework<\/strong><\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Overview The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were compromised in South Korea and the Blackmoon Trojan has been identified as the culprit. A new 2017 version has hit the financial industry and employs a new framework model primarily targeting the online banking […]<\/p>\n","protected":false},"author":1,"featured_media":7797,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[7,15],"tags":[],"class_list":["post-7626","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-events","category-research-reports"],"acf":[],"yoast_head":"\nBlackmoon Banking Trojan Overview - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Blackmoon Banking Trojan Overview - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Overview The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-02T19:17:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png\" \/>\n<meta name=\"author\" content=\"NSFOCUS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Blackmoon Banking Trojan Overview - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Overview The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"NSFOCUS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/\"},\"author\":{\"name\":\"NSFOCUS\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Blackmoon Banking Trojan Overview\",\"datePublished\":\"2017-06-02T19:17:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/\"},\"wordCount\":1021,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/06\\\/BM_LP.png\",\"articleSection\":[\"Global Events\",\"Research & Reports\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/\",\"name\":\"Blackmoon Banking Trojan Overview - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/06\\\/BM_LP.png\",\"datePublished\":\"2017-06-02T19:17:11+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/06\\\/BM_LP.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/06\\\/BM_LP.png\",\"width\":1280,\"height\":800,\"caption\":\"Moon and clouds with Blackmoon and NSFocus text.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/blackmoon-banking-trojan-overview\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blackmoon Banking Trojan Overview\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"NSFOCUS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"NSFOCUS\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Blackmoon Banking Trojan Overview - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/","og_locale":"pt_BR","og_type":"article","og_title":"Blackmoon Banking Trojan Overview - NSFOCUS","og_description":"Overview The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were","og_url":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/","og_site_name":"NSFOCUS","article_published_time":"2017-06-02T19:17:11+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","type":"","width":"","height":""}],"author":"NSFOCUS","twitter_card":"summary_large_image","twitter_title":"Blackmoon Banking Trojan Overview - NSFOCUS","twitter_description":"Overview The Blackmoon Bank Trojan that was originally identified in 2016 has since re-surfaced. Recently, more than 150,000 bank accounts were","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","twitter_misc":{"Escrito por":"NSFOCUS","Est. tempo de leitura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/"},"author":{"name":"NSFOCUS","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Blackmoon Banking Trojan Overview","datePublished":"2017-06-02T19:17:11+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/"},"wordCount":1021,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","articleSection":["Global Events","Research & Reports"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/","url":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/","name":"Blackmoon Banking Trojan Overview - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","datePublished":"2017-06-02T19:17:11+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/06\/BM_LP.png","width":1280,"height":800,"caption":"Moon and clouds with Blackmoon and NSFocus text."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/blackmoon-banking-trojan-overview\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Blackmoon Banking Trojan Overview"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"NSFOCUS","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"NSFOCUS"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=7626"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7626\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/7797"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=7626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=7626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=7626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}