# Notebook from rbenic-fer/security-report-generation
Path: notebooks/old/4/aitextgen-CCS-124M-4000.ipynb

#  aitextgen — Train a GPT-2 (or GPT Neo) Text-Generating Model w/ GPU

by [Max Woolf](https://minimaxir.com)

*Last updated: May 16th, 2021 (aitextgen v0.5.2)*

Retrain an advanced text generating neural network on any text dataset **for free on a GPU using Colaboratory** using `aitextgen`!

For more about `aitextgen`, you can visit [this GitHub repository](https://github.com/minimaxir/aitextgen) or [read the documentation](https://docs.aitextgen.io/).

To get started:

1. Copy this notebook to your Google Drive to keep it and save your changes. (File -> Save a Copy in Drive)
2. Run the cells below:
_____no_output_____

!pip install -q aitextgen

import logging
logging.basicConfig(
        format='%(asctime)s — %(levelname)s — %(name)s — %(message)s',
        datefmt='%m/%d/%Y %H:%M:%S',
        level=logging.INFO
    )

from aitextgen import aitextgen
from aitextgen.colab import mount_gdrive, copy_file_from_gdrive     |████████████████████████████████| 572 kB 8.2 MB/s
     |████████████████████████████████| 4.0 MB 32.8 MB/s
     |████████████████████████████████| 87 kB 5.8 MB/s
     |████████████████████████████████| 582 kB 20.5 MB/s
     |████████████████████████████████| 408 kB 12.3 MB/s
     |████████████████████████████████| 136 kB 55.8 MB/s
     |████████████████████████████████| 596 kB 60.1 MB/s
     |████████████████████████████████| 1.1 MB 48.4 MB/s
     |████████████████████████████████| 6.6 MB 51.2 MB/s
     |████████████████████████████████| 77 kB 6.7 MB/s
     |████████████████████████████████| 895 kB 60.1 MB/s
     |████████████████████████████████| 271 kB 55.8 MB/s
     |████████████████████████████████| 94 kB 3.3 MB/s
     |████████████████████████████████| 144 kB 62.1 MB/s
  Building wheel for aitextgen (setup.py) ... done
  Building wheel for fire (setup.py) ... done

## GPU

Colaboratory uses a Nvidia P4, an Nvidia T4, an Nvidia P100, or an Nvidia V100. For finetuning GPT-2 124M, any of these GPUs will be fine, but for text generation, a T4 or a P100 is ideal since they have more VRAM. **If you receive a T4 or a V100 GPU, you can enable `fp16=True` during training for faster/more memory efficient training.**

You can verify which GPU is active by running the cell below. If you want to try for a different GPU, go to **Runtime -> Factory Reset Runtime**._____no_output_____

!nvidia-smiFri Apr 15 14:38:41 2022
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 460.32.03    Driver Version: 460.32.03    CUDA Version: 11.2     |
|-------------------------------+----------------------+----------------------+
| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC |
| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. |
|                               |                      |               MIG M. |
|===============================+======================+======================|
|   0  Tesla T4            Off  | 00000000:00:04.0 Off |                    0 |
| N/A   35C    P8     9W /  70W |      0MiB / 15109MiB |      0%      Default |
|                               |                      |                  N/A |
+-------------------------------+----------------------+----------------------+

+-----------------------------------------------------------------------------+
| Processes:                                                                  |
|  GPU   GI   CI        PID   Type   Process name                  GPU Memory |
|        ID   ID                                                   Usage      |
|=============================================================================|
|  No running processes found                                                 |
+-----------------------------------------------------------------------------+

## Loading GPT-2 or GPT Neo

If you're retraining a model on new text, you need to download and load the GPT-2 model into the GPU.

There are several sizes of GPT-2:

* `124M` (default): the "small" model, 500MB on disk.
* `355M` (default): the "medium" model, 1.5GB on disk.
* `774M` (default): the "large" model, 3GB on disk.

You can also finetune a GPT Neo model instead, which is more suitable for longer texts and the base model has more recent data:

* `125M`: Analogous to the GPT-2 124M model.
* `350M`: Analogous to the GPT-2 355M model

The next cell downloads the model and saves it in the Colaboratory VM. If the model has already been downloaded, running this cell will reload it._____no_output_____

model='124M'
#model='355M'
#model='774M'

#model='gpt-neo-125M'
#model='gpt-neo-350M'_____no_output_____if model == '124M' or model == '355M' or model == '774M':
    ai = aitextgen(tf_gpt2=model, to_gpu=True)
else:
    ai = aitextgen(model='EleutherAI/' + model, to_gpu=True)04/15/2022 14:38:41 — INFO — aitextgen — Downloading the 124M GPT-2 TensorFlow weights/config from Google's servers
folder = 'trained_model_' + model_____no_output_____

## Mounting Google Drive

The best way to get input text to-be-trained into the Colaboratory VM, and to get the trained model *out* of Colaboratory, is to route it through Google Drive *first*.

Running this cell (which will only work in Colaboratory) will mount your personal Google Drive in the VM, which later cells can use to get data in/out. (it will ask for an auth code; that auth is not saved anywhere)_____no_output_____

mount_gdrive()Mounted at /content/drive

## Uploading a Text File to be Trained to Colaboratory

In the Colaboratory Notebook sidebar on the left of the screen, select *Files*. From there you can upload files:

![alt text](https://i.imgur.com/w3wvHhR.png)

Upload **any smaller text file** (for example, [a text file of Shakespeare plays](https://raw.githubusercontent.com/karpathy/char-rnn/master/data/tinyshakespeare/input.txt)) and update the file name in the cell below, then run the cell._____no_output_____

file_name = 'content2.txt'_____no_output_____

If your text file is large (>10MB), it is recommended to upload that file to Google Drive first, then copy that file from Google Drive to the Colaboratory VM.

Additionally, you may want to consider [compressing the dataset to a cache first](https://docs.aitextgen.io/dataset/) on your local computer, then uploading the resulting `dataset_cache.tar.gz` and setting the `file_name`in the previous cell to that._____no_output_____

copy_file_from_gdrive(file_name)_____no_output_____

## Finetune GPT-2

The next cell will start the actual finetuning of GPT-2 in aitextgen. It runs for `num_steps`, and a progress bar will appear to show training progress, current loss (the lower the better the model), and average loss (to give a sense on loss trajectory).

The model will be saved every `save_every` steps in `trained_model` by default, and when training completes. If you mounted your Google Drive, the model will _also_ be saved there in a unique folder.

The training might time out after 4ish hours; if you did not mount to Google Drive, make sure you end training and save the results so you don't lose them! (if this happens frequently, you may want to consider using [Colab Pro](https://colab.research.google.com/signup))

Important parameters for `train()`:

- **`line_by_line`**: Set this to `True` if the input text file is a single-column CSV, with one record per row. aitextgen will automatically process it optimally.
- **`from_cache`**: If you compressed your dataset locally (as noted in the previous section) and are using that cache file, set this to `True`.
- **`num_steps`**: Number of steps to train the model for.
- **`generate_every`**: Interval of steps to generate example text from the model; good for qualitatively validating training.
- **`save_every`**: Interval of steps to save the model: the model will be saved in the VM to `/trained_model`.
- **`save_gdrive`**: Set this to `True` to copy the model to a unique folder in your Google Drive, if you have mounted it in the earlier cells
- **`fp16`**: Enables half-precision training for faster/more memory-efficient training. Only works on a T4 or V100 GPU.

Here are other important parameters for `train()` that are useful but you likely do not need to change.

- **`learning_rate`**: Learning rate of the model training.
- **`batch_size`**: Batch size of the model training; setting it too high will cause the GPU to go OOM. (if using `fp16`, you can increase the batch size more safely)_____no_output_____

ai.train(file_name,
         line_by_line=False,
         from_cache=False,
         num_steps=4000,
         generate_every=400,
         save_every=200,
         save_gdrive=True,
         output_dir=folder,
         learning_rate=1e-3,
         fp16=False,
         batch_size=1)04/15/2022 14:39:48 — INFO — aitextgen — Loading text from content2.txt with generation length of 1024.

You're done! Feel free to go to the **Generate Text From The Trained Model** section to generate text based on your retrained model._____no_output_____
## Load a Trained Model

If you already had a trained model from this notebook, running the next cell will copy the `pytorch_model.bin` and the `config.json`file from the specified folder in Google Drive into the Colaboratory VM. (If no `from_folder` is specified, it assumes the two files are located at the root level of your Google Drive)_____no_output_____

#copy_file_from_gdrive('pytorch_model.bin', folder)
#copy_file_from_gdrive('config.json', folder)_____no_output_____

The next cell will allow you to load the retrained model + metadata necessary to generate text._____no_output_____## Generate Text From The Trained Model

After you've trained the model or loaded a retrained model from checkpoint, you can now generate text.

**If you just trained a model**, you'll get much faster training performance if you reload the model; the next cell will reload the model you just trained from the `trained_model` folder._____no_output_____

ai = aitextgen(model_folder=folder, to_gpu=True)04/15/2022 15:08:42 — INFO — aitextgen — Loading model from provided weights and config in /trained_model_124M.
04/15/2022 15:08:44 — INFO — aitextgen — GPT2 loaded with 124M parameters.
04/15/2022 15:08:44 — INFO — aitextgen — Using the default GPT-2 Tokenizer.

`generate()` without any parameters generates a single text from the loaded model to the console._____no_output_____

ai.generate(), and its
the rest of the RAT.

The RAT Purpose
The RAT is a DLL
component of the RAT. The RAT
component is a DLL
component of the RAT
component. A DLL
component of the RAT
component is a DLL
component that is
compiled in
the same
process.

The RAT
The RAT
component is
component

The RAT
component

the RAT
component

the DLL
component

component

the XAT
component

and the XAT
component

the XAT
component

the XAT
component

the XAT
component

discovered

the XAT
component
component

the XAT
component

component

The XAT
component

is
component

the XAT
component

component

the XAT
component

is
component

the XAT
component

app
to

the XAT
component

the XAT
component

the XAT
component

the XAT
component

component

If you're creating an API based on your model and need to pass the generated text elsewhere, you can do `text = ai.generate_one()`

You can also pass in a `prompt` to the generate function to force the text to start with a given character sequence and generate text from there (good if you add an indicator when the text starts).

You can also generate multiple texts at a time by specifing `n`. You can pass a `batch_size` to generate multiple samples in parallel, giving a massive speedup (in Colaboratory, set a maximum of 50 for `batch_size` to avoid going OOM).

Other optional-but-helpful parameters for `ai.generate()` and friends:

*  **`min length`**: The minimum length of the generated text: if the text is shorter than this value after cleanup, aitextgen will generate another one.
*  **`max_length`**: Number of tokens to generate (default 256, you can generate up to 1024 tokens with GPT-2 and 2048 with GPT Neo)
* **`temperature`**: The higher the temperature, the crazier the text (default 0.7, recommended to keep between 0.7 and 1.0)
* **`top_k`**: Limits the generated guesses to the top *k* guesses (default 0 which disables the behavior; if the generated output is super crazy, you may want to set `top_k=40`)
* **`top_p`**: Nucleus sampling: limits the generated guesses to a cumulative probability. (gets good results on a dataset with `top_p=0.9`)_____no_output_____

prompts = ['Digital Forensics Analysis Report\n',
           'This report is ',
           'The contents of ',
           'Conclusion\n',
           'It is recommended that ',
           'In the opinion of the expert, ']_____no_output_____for prompt in prompts:
    ai.generate(n=5,
                batch_size=1,
                prompt=prompt,
                max_length=1000,
                temperature=1.0,
                top_p=0.9)Digital Forensics Analysis Report
Appendix A - Malware-based Threat to
Appendix B - Malware-related Threat to
Appendix C - Malware-based Threat to
Appendix D - Malware-related Threat to
Appendix F - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix C - Malware-related Threat to
Appendix F - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix F - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix E - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix E - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix E - Malware-related Threat to
Appendix E - Malware-related Threat to
Appendix E – Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix D – Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix E - Malware-related Threat to
Appendix D - Malware-related Threat to
Appendix F - Malware-related Threat to
Appendix F - Malware-related Threat to
Appendix E - Cybercrime-related Threat to
Appendix D - Malware-related Threat to
Appendix F - An example of an attack in 2013
Appendix E - An example of an attack in 2013
Appendix D - An example of an attack in 2013
Appendix D - An example of an attack in 2013
Appendix E - An example of an attack in 2013
Appendix D - An example of an attack in 2013
Appendix D - An example of a cyber-physical-time-attack against
Appendix D - An example of an attack in 2013
Appendix D - An example of an incident in 2013
Appendix D - An example of a cyber-physical-time attack against
Appendix E - An example of a cyber-physical-time attack against
Appendix D - An example of a digital-time attack against
Appendix D - An example of a cyber-physical-time attack against
Appendix F - An example of a cyber-espionage attack against
Appendix D - An example of a cyber-physical-time attack against
Appendix D - An example of an attack in 2013
Appendix D - An example of a cyber-physical-time attack against
Appendix D - An example of an example of an attack against
Appendix E - An example of a cyber-physical-time attack against
Appendix D - An example of the attack in 2013
Appendix F - An example of an attack on the same same day
Appendix E - An example of an attack on Bit9/Bit9/Bit9/Bit9/ Bit9/ Bit9/ Bit9/ Bit9/10/10/

Appendix E - An example of a cyber-physical-time attack against Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/10/ Bit9/ Bit9/ Bit9/ Bit9/10/ Bit9/10/ Bit9/10/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit9/ Bit
==========
Digital Forensics Analysis Report
In the course of study, we found that the two major main
stage components of the RAT file
a malicious tool which was used to perform
of the RAT payload. The RAT
tool also utilized the
PASX. This tool also appeared
in the

PASX shell,
but also used the PASX

DAT
Trojans
RAT
Trojans

Trojans

Trojans
Trojans

Trojans
Trojans

Trojans

Trojans

Trojans
Trojans

Trojans

Trojans
Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans
Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans
Trojans

Trojans

Trojans
Trojans

Trojans

Trojans
Trojans
Trojans
Trojans
Trojans

Trojans
Trojans
Trojans
Trojans

Trojans
Trojans

Trojans
Trojans
Trojans
Trojans

Trojans
Trojans

Trojans
Trojans
Trojans

Trojans
Trojans
Trojans
Trojans
Trojans

Trojans
Trojans
Trojans
Trojans
Trojans

Trojans
Trojans
Trojans
Trojans

Trojans
Trojans

Trojans
Trojans
Trojans
Trojans

Trojans
Trojans
Trojans

Trojans
Trojans

Trojans

Trojans

Trojans

Trojans
Trojans
Trojans

Trojans
Trojans
Trojans

Trojans

Trojans
Trojans
Trojans

Trojans
Trojans
Trojans

Trojans
Trojans

Trojans

Trojans
Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans
Trojans

Trojans
Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans

Trojans
Trojans

Trojans

Trojans
Trojans

Trojans
Trojans
Trojans

Trojans

Trojans
Trojans
Trojans

Trojans

Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Trojans
Tro
==========
Digital Forensics Analysis Report
In the following investigation, we’ll examine the evolution and methods used by many different groups, particularly those in
the Syrian Territories, the Gaza Strip, and the Gaza Strip to determine the origins of these groups’s activities.
The first part about the group is the first part, but the fact that one group is not involved in these groups’ activities is that they have
operated independently.
Our analysis indicates that the two groups are also involved in this group.

2 of 34

TLP: GREEN

TLP: GREEN

TLP: GREEN

Figure 11:23.

TLP: GREEN

Figure 12:06.

TLP: GREEN

TLP: GREEN

Figure 13:06.

TLP: GREEN

Figure 13:06.

TLP: GREEN

Figure 13:06.

TLP: GREEN

TLP: GREEN

For more information about the group, see www.kaspersky.com.

TLP: GREEN

For more information about the group’s activity, see the chapter “Appendix” on page 36.
“Appendix” page from the “Appendix” website.
“Appendix” page from the “Appendix” page.
“Appendix” page from the “Appendix” page in the “Appendix” page.”
“Appendix” page from the “Appendix” page in the “Appendix” page,” the “Appendix” page in “Appendix” page.
“Appendix” page from the “Appendix” page in “Appendix” page (“A” page).”
“Appendix” page from the “Appendix” page in “Appendix” page,”
“Appendix” page in “Appendix” pages in “Appendix” page”
“Appendix” page from the “Appendix” page.”
“Appendix” page (“Appendix” page) in “Appendix” page (“Appendix” page)
“Appendix” page (“Appendix” page)
“Appendix” page (”B’ page (”Appendix”)

TLP: GREEN

TLP: GREEN

Figure 13:06.

TLP: GREEN

TLP: GREEN

TLP: GREEN

TLP: GREEN

TLP: GREEN

TLP: GREEN

For more information about the group’s activity, see “Appendix” on page 38.
“Appendix” page (“Appendix” page).

TLP: GREEN

TLP: GREEN

TLP: GREEN

TLP: GREEN

Clackdown’s activity, along with other indicators of compromise, may seem to be due to multiple factors and
methods that rely on an infected organization to detect and quickly. The most recent malware samples
were also found in the Syrian Territories.
The first malware used in these samples, however, contain a “Netscape” dropper. When the samples were found, the dropped
malicious batch scripts were
used to download the malware, as well as the other tools used in the attacks.

TLP: GREEN

The second malware also drops a batch script on the victim’s machine to download additional executables and/or the additional
installers. This campaign has been ongoing since and has been attributed to this group to a Lazarus group.
The second malware dropped and injected (or malware) in targeted attacks is the first stage, as the second stage is executed with
commands (C&C).” The first stage is a batch script on the victim’s computer. The second stage consists of three payloads (a payload, an installer
and a loader, an executable, an executable, a.dll, an installer, and an installer) with the following payload. The third stage of the batch script shows the contents of
a batch script:
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload
• payload

==========
Digital Forensics Analysis Report
The following table provides details of network activity activity we

Forensics Analysis
Table of Network activity identified by the X-Agent malware we have identified

Figure 21.
Table of Network activity identified by X-Agent malware

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent malware

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Figure 22.

Table of Network activity identified by X-Agent

Figure 23.
Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Figure 23. Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity

Figure 23. Network

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Table of Network activity identified by X-Agent

Page

Have I Got News: X-Agent and X-Agent

Page 39

Have I Got News: X-Agent and X-Agent

The X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent X-Agent
==========
Digital Forensics Analysis Report

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

APPENDIX

Table of custody

Appendix

Appendix

Appendix
Appendix
Appendix
Appendix

Appendix
Appendix
Appendix

Appendix
Appendix

Appendix
Appendix

Appendix
Appendix
Appendix
Appendix

Appendix

Appendix
Appendix

Appendix
Appendix

Appendix

Appendix

Appendix
Appendix

Appendix
Appendix

Appendix
Appendix
Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Table of custody

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Table of custody

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix
Appendix

Appendix

Appendix
Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

Appendix

App
This report is  the  same  weapon  family  of  family  used
further  known  as

feng  s  a  feng  s  b  tact

  9/10/2015 12:20 AM

==========
This report is  the  name  of  the  threat  actors  (n  identified  as  the  name  of  the  threat  actors  t  used  in  this  case  in  the  case  of  the  malware  called  CAT  —“Operation  Threat  and  the  known  name  of  the  attack  in  the  case  of  the  malware  used  by  the  malware  family  as  an  known  name  in  this  case  in  the  case  of  the  D  malware  family  of  the  family  of  the  known  as  D  as  RAT  —“Operation  Threat  and  other  known  as  Trojan  family  of  the  same  name  of  Trojans  discovered  in  the  case  of  the  malware  family  of  the  known  as  Naid  and  a  Trojan  family  of  these  family  is  as  known  as  as  as  Trojan  family  based  as  as  Trojan  family  family  that  is  known  as  as  Duranium  Trojan  family  as  a  Trojan  family  as  Trojan  family  as  a  Duranium  Trojan  family  as  Trojan  family  identified  as  Trojan  family  as  CAT  variant  family  as  the  name  of  the  known  as  Trojan  family  as  the  name  Trojan  family  called  Trojan  family  as  a  Trojan  family  as  Trojan  family  that  be  also  known  as  Back  as  Trojan  family  as  Trojan  family  as  as  Trojan  family  as  a  Trojan  family  name  Trojan  family  as  as  Trojan  family  as  Trojan  family  as  Trojan  family  as  Trojan  family  as  Trojan  family  family  as  Trojan  family  as  Trojan  fam  also  uses  a  known  as  Trojan  family  as  as  Trojan  family  as  Trojan  family  as  as  Trojan  family  (a  Trojan  family  and  a  vari  of  Trojan  family  as  Trojan  family  as  Trojan  family  as  an  family  of  Trojans  family  and  family  as  Trojan  family  of  a  Trojan  family  family  of  the  Trojan  family  as  Trojan  family  based  as  Trojan  family  in  our  research    and  our  our  investigation  to  the  CAT  family  of  the  Trojan  family  of  the  Trojan  family  family  of  Trojan  family  to
==========
  as  Trojan  family  of  these  commands  in  the  same  case  of  the  Trojan  family  that  was  identified  in  a  sample  that  has  been  identified  in  this  writing  in  a  known  case  of  Turla  family
==========
This report is  in  the  case  for  that  report  the  report  in  the  case  in  the  case  that  this  report  is  the  domain  for  our  post  from  the  n  domain  of  the  n  domain  of  of  the  domain  at  a  name  of  the  domain  that  was  for  a  domain  of  the  domain  and  the  domain  of  the  domain  to  resolve  and  this  pattern  was  a  domain  of  our  domain  and  was  also  in  the  case  of  a  registered  domain  of  an  the  domain  of  that  is  a  domain  of  the  domain  of  a  name  (this  domain  of  another  domain  of  is  a  domain  of  the  domain  of  the  domain  of  that  may  be  known  as  as  a  domain  of  a  domain  and  linked  with  the  same  domain  of  the  domain  that  was  linked  in  the  case  of  that  of  the  domain  of  the  domain  of  that  had  been  known  as  the  domain  of  an  domain  of  a  domain  in  the  case  of  the  domain  of  the  domain  of  domain  of  the  domain  in  the  case  of  the  pattern  of  of  this  domain  of  be  known  as  as  as  the  domain  of  the  Domain  and  was  the  domain  of  the  domain  known  as  “Domain  of  the  domain  as  domain  of  the  domain  of  the  domain  of  the  domain  or  the  domain  of  a  domain  of  the  domain  as  domain  of  this  domain  of  this  domain  was  known  as  the  domain  of  the  domain  of  the  domain  as  an  vari  of  the  domain  of  the  domain  of  the  domain  as  as  a  domain  of  the  domain  for  the  domain  of  this  domain  at  the  domain  of  a  domain  that  was  registered  a  domain  of  these  domain  of  the  domain  of  this  domain  of  (in  the  case  of  the  domain  to  the  domain  of  the  domain  is  the  domain  of  an  domain  of  an  domain  of  to  the  domain  of  a  domain  of  our  domain  in  this  case  the  domain  was  infected  by  using  a  campaign
==========
This report is  pictured  below  (below  )

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 23

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 23

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 23

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

In addition to these threats, the majority of the actions and actions in this field were the most common and
effective command and control (C&C) of the malware. In addition, the C&C used on these systems,
which consisted a number of “command and control (C2) of the C&C.
The malware analyzed in this case contained in this report was the first malware we analyzed ever used.

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE 2015 22

COSOFT SECURITY INTELLIGENCE REPORT, VOLUME 19, JANUARY–JUNE
The contents of ico_backdoor_targets.pdf

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

JR03-2010 Shadowserver Foundation: Analysis of the Shadowerver Foundation

A Closer Look at the ShadowNet Foundation: Analysis of the ShadowNet Foundation

Table of 31

Contents
Executive Summary
Overview
Executive Summary
Background
Abstract
Overview
Overview
Executive Summary

Abstract
Summary
The Shadowerver Foundation

Overview
In addition to the ShadowNet Foundation, we observe two distinct groups who have not been used as such as the ShadowNet Foundation,
Viruses and the ShadowNet Foundation, which in turn used another group, has been using
ShadowNet Foundation to distribute this group. The ShadowNet Foundation is also working as a network
server since 2010 and is no longer publicly available yet.

Contents
Overview

Abstract
1.1 and is responsible for the group, we observed two distinct groups working on at least three groups. Two groups
are involved.

2.2.2

3.3.4.

4.4.4

4.5.6.1

5.6.4.1

5.6.1 and will be responsible for this malware operation and provides a
functionality that will send the group commands and control of their command and control (C2) to the
victim’s machine. The operators of these groups will often have been aware of the importance of the RDP security solutions.

3.4.3 and are responsible for the activities of an actor or group with an internet-connected
server

4.4.1

5.6.1

4.6.1

5.6.3 and is responsible for activities of an adversary or group with an IPs and the IPs

5.6.2

6.5.1

4.5.1.

6.6.1

5.6.1

5.6.3.1

6.5.2

4.7.2.1

5.4.2.1

5.6.1

5.7.0.0.0

5.8.4

58 of 56

Executive Summary
This group has been operating since 2013, with two distinct groups,
also known to work as “ShadowNet” and the ShadowNet

An attack group is believed to have been operating since 2012.

The first group, known known to have been operating since 2013. In the 2013 attacks, it
has had been associated with one of the group’s tools as well as the ShadowNet
community, and was active since 2013. The group has been active since 2013
until now.

The first group in active targeting the victim organization has been active since at least 2009.

Operation Troy: Analysis of the ShadowNet Foundation

Page 1

Executive Summary
The ShadowNet Foundation is an actor engaged in espionage,
distributed by one group that has since at least 2006 to the
same group, and has been active since at least 2009. This group has been active since at least 2013.

JR03-2010 Shadowserver Foundation: Analysis of the ShadowNet Foundation

This group has been engaged in attacks that use a range of tools, including
RAT, SMRAT, and PLC. The group has consistently maintained
various tools and techniques, but most have been observed with a common approach to evade security solutions to evade this
Microsoft Windows Shell.
The following group has several techniques that have been observed in other attacks.
It is rarely used to target and defend against this group. This
group has been observed in the wild since at least 2005.
This group has been active since the beginning of 2011, suggesting that
they have been used as a secondary component of
this group has been used against several groups,
such as the group. The purpose of this group makes us believe it is an
attacker group to perform this activity.

The second group is also used to conduct these activities by various groups (e.g., the same group)
that the attackers have since been active. It’s difficult to assume these
individual
==========
  then
==========
The contents of...............................................................................................

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

The contents of.................................................................................................................................

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

The information contained in..........................................................................................................................

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP: Green

For any inquiries, please contact intelreports@kaspersky.com

TLP
==========
The contents of  these  identified  are  the  known  samples  known  as  Trojan  (or  as  Trojan  (or  Trojan  and  Trojan  s  to  other  known  as  Trojans  infect  with  Trojan  known  as  Trojan  identified  as  Trojan  a  known  Trojan  that  has  been  target  by  U  s  identified  as  Trojan  (or  family  of  Turla  discovered  as  Trojan  b  a  a  Trojan  Trojan  (or  Trojan  t  identified  as  Trojan  targets  this  Trojan  that  has  been  connected  to  custom  of  our  infecting  with  Trojan  in  a  connected  infector  of  Trojan  that  is  a  dynam  and  observed  as  Trojan  family  a  malware  known  as  Trojan  or  Trojan  called  Trojan  fhtrit  of  a  known  as  Trojan  family  Trojan  that  uses  and  a  targets  known  as  Trojan  flt  to  known  as  Trojan  flt  or  Trojan  cipher  to  the  same  mentioned  virus  family  as  Trojan  (or  Trojan  compromising  infecting  with  the  same  Trojan  as  Trojan  fam  in  the  case  of  Trojan  b  a  Trojan  flt  uses  in  a  legit  that  is  a  Trojan  called  Trojan  (or  Trojan  or  a  s  Trojan  fam  as  as  Trojan  a  vari  as  Trojan  family  used  as  a  Trojan  family  as  the  Trojan  family  of  Trojan  c2  uses  as  Trojan  dub  a  vari  to  known  as  Trojan  targets  targets  to  as  Trojan  has  been  infected  with  the  targets  of  the  Trojan  fam  as  Trojan  targets  the  Trojan  family  uses  Trojan  uses  Trojan  which  is  a  Trojan  flt  known  as  Trojan  fam  as  Trojan  flt  flt  discovered  in  the  case  of  Trojan  s  Back  Trojan  of  Trojan  the  targets  discovered  as  Trojan  s  family  to  identified  Trojan  fam  as  a  Trojan  fam  that  uses  a  Trojan  to  be  detected  as  Trojan  of  Trojan  Trojan  Flt  as  Trojan  Trojan  Flt  (or  Trojan  Trojan  fam  as  Trojan  family  a  Trojan  vari  of
==========
  Turla
Conclusion

The following

Appendix B

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix F

Appendix D

Appendix D

Appendix F

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix E

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix E

Appendix D

Appendix F
Appendix F

Appendix D

Appendix E

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix E

Appendix E

Appendix F

Appendix D

Appendix E

Appendix D

Appendix D

Appendix E

Appendix D

Appendix F
Appendix D

Appendix E

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D
Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix E

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix D

Appendix F
Appendix E
Appendix D

Appendix D

Appendix D
Appendix D

Appendix E

Appendix D
Appendix E

Appendix D

Appendix D
Appendix D

Appendix E

Appendix D

Appendix E

Appendix D

Appendix E
Appendix D
Appendix D
Appendix G
Appendix E
Appendix D
Appendix E
Appendix E
Appendix E
Appendix E
Appendix D
Appendix D
Appendix E
Appendix D
Appendix D
Appendix D
Appendix D
Appendix E
Appendix D
Appendix E
Appendix E
Appendix D
Appendix E
Appendix E
Appendix E

Appendix H
Appendix D
Appendix E
Appendix D
Appendix E
Appendix D
Appendix E
Appendix D
Appendix D
Appendix E
Appendix D
Appendix D
Appendix D
Appendix D
Appendix D
Appendix D
App
==========
Conclusion
Page 17 of 29

Rev. 2013-06-25
“njRAT” Uncovered

www.symantec.com
www.symantec.com
www.symantec.com
www.symantec.com
www.symantec.com
@symantec.com
@Symantec.com
@Symantec.com
@Symantec.com
@symantec.com
@Symantec.com
@Symantec.com
@Symantec.com

The following information has been used from the C&C server to host a password and password. The password used
by the Trojan is shown below:

Domain Name

Email address

Password password

Password password

Password password password

Password password password password

Password password password

Password password

Password password password

Password password

password password password
password password password password password

Password password
password password
password password
password password password
password password password password password password
password password
password password password password password
password password
password password
password password password password password password password
password password password password password password
password password password password password
password password password password
password password password password password password
password password password password password password password
password password password password password password password password
password password password password password password password password
password password password password password password
password password password password password password password password password
password password password password password password password password password password
 password password password password password password password password password
password password password password password password password password password password password
password password password password password
password password password password password password password password password
password password password password password password password password password password password
password password password password password password password password password password password password password
password password password password password password password password
password password password password password password password password password password password password
password password password password password password password password password password password password password password password
 password password password password password password password password password password password password
password password password password password password password password password password
password password password password password password password password password password password password password
password password password password password password password password password password password password password password password password password password password password password password password password password
password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password password
==========
Conclusion
The following screenshot illustrates the connections with this
connections:

www[.]facebook.com
[.]login[.]com
[.]login[.]com

The above screenshot shows the connections with
this domain:

The domain used for this attack in this attack is also used in
the attack.

Figure 13

In addition to these two other domains, we have also seen these
connections.

In addition to this domain, there is also the
C&C (using our Google DNS
resolutions) and is also used in
the attack.

The C&C

The domain used to register the C&C
infrastructure used to register
the C&C
infrastructure is
also used in the attack.

The domain for this attack is also used in the attack
the same attack that also leveraged in
the
attack.

Figure 13

The domains are also used in this attack are also
used by the group
which we previously described,
a similar
campaign. The domain domain also used in this attack is
also used in this attack. The name
(domain
(domain
(domain) also appears
has also been used in this attack as well as
other domains.

Operation Troy: Cyberespionage and a powerful threat actor

Operation Troy: Cyberespionage and a powerful threat actor

Operation Troy: Cyberespionage and a powerful threat actor

Figure 13

Operation Troy: Cyberespionage and a powerful threat actor

The same attack has
gone back to 2013 and this malware was also used
in the attack
before the
campaign is set in place by the group
of this group,
using the same digital signature
(md5 of this blog).
The malware was found in the same attack as the C&C
infrastructure,
which was
used by the
malicious malware to register C&C
infrastructure with the
malicious software.
The actor
(n) was
in this attack
during the
years,
the use of the following techniques,
which appear
to be
being
weaponized
as C&C (for this purpose)
of this blog
the malware
was found in the

C:\Windows\system\inf\inf\inf\bin
with the following
names:
• njRAT,
NjRAT,
NjRAT,
NjRAT,
NjRAT,
NjRAT,
NjRAT,
NjRAT,
njRAT,
NjRAT,
NjRAT,
NjRAT
NjRAT, NjRAT,
njRAT,
njRAT, NjRAT
NjRAT, NjRAT,
njRAT,
NjRAT,
NjRAT, NjRAT, NjRAT,
NjRAT, and
NjRAT.
NjRAT, NjRAT,
NjRAT,
NjRAT,
NjRAT, and
NjRAT, NjRAT,
NjRAT, and NjRAT.

Operation Troy: Cyberespionage and a powerful threat actor

The malware uses the following techniques and techniques to infect
victims by obtaining specific documents
including the following information:
• a decoy document
• an RAT
• a decoy document
• a RAT
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy file
• a decoy documents
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy
• a decoy document
• a decoy
• a decoy document
• a decoy
• a decoy document
• a decoy document
• a decoy
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy document
• a decoy content
• a decoy document
• the decoy document
• a decoy document
• a decoy
• the decoy document
• a decoy document
• a decoy document
• a decoy document
==========
Conclusion

WHITE PAPER

The malware will upload and load and execute additional executables using a single command line argument.

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

The first part of the C&C

This file is a C&C

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

The first part of the file is the C&C

The second part is the encrypted
C&C

The first part is the encrypted
C&C

Figure

The second part of the file is the encoded
C&C

Figure

Figure

Figure
Figure

The payload’s C&C

Figure

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

Figure

For any inquiries, please contact intelreports@kaspersky.com

Figure

Figure
Figure
Figure

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

These are encoded and the same C&C

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

The first part of the executable is an encrypted
C&C server, and is used
using a very common technique.

Figure
TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

For any inquiries, please contact intelreports@kaspersky.com

C&C Server

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

TLP: GREEN

For any inquiries, please contact intelreports@kaspersky.com

The following information may look suspicious:
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm.
Backdoor.Pawn Storm
==========
Conclusion
  f8cdf8f2e3a0c6a7d7b9beec
  1eb4e4ca25c8dab2ecbab
  f9a8f0c6b5f1c4e
  f8c1a5b9f3e

  f8a9e9c1cbf1b
  9e4e12c17b73
  f3e3e1db1c3
  f0cf0ff1cda01e6d3
  f1ebf0e0c1f2
f6c3d1f6cda1e2a9
f4e4a9b8aa9d3c1
f5f6cdab1c20eaeacadd0
f9c4e05f3a7ed5
f22a9ef1fb9a8f
f9bacfb0f14e1b0f
f1c3b0acd5a
fbd5aaf0f5a0b3
f0a73d6ec5
f1b0a4f0c
f7b0d0f9a5b7
f5dc73fa75e0
f5b5c1b5
f68acf0a5e
f1fbe68c2f
f9cb9d5c9f9e
f5d5dc6c12d
f6aacdfc6
f9cdfb0c71
f1ebfeba0c8d9a
fcd1f64dd
f18c3e
feb0cf1
f1f7c1f
f2b
f79ed1
f
f9a6
f9
f7

f9

f20

f22
f9

f2

f1b7
f9

f2
feb
f0
f0
f2
f1e
f01
f1
f16d
f2
f64
f38
f3e14
f18
f12
f14

fcd1
f1
f8d8
f16
f18
f18
f0a6
f1
f3
f0e2
f0a6
f20
f6
f3
f0b0
f17
f14
f38
f14
f12
f8c1
f2
f18
fce
f0b7
f6
f5ffb6
f0
f7fceb0b5
fcea
f8c
f05
f23
f18
f0b7
f4
f15
f0b7
f8c4
f4
f9
f1f5f5
f9b7
f8e6
f5
f1f
fce
f1f4
f05
f13
f6b8b
f7
f3
f13
f1
f38
f1b0a
f14
f6
f1
f1
f64
f23
f4
f1
f80
f3
f9
f20
f80
f12
f1
f2
f3
f01b9
f6
f6
f23
f14
f4
f5
f4
f9
f12
f3
f4
f8
f1
f1
f15

f30
f1
f8a
fce
f38
f38
f38
f8
f7
f8
f5
f22a2
f9
f9
f20

f20
f5
f0
f6
f2
f3
f9

f2
f1
f4
f6
f9
f5
f5
f0b2
f5
f2
f13
f8
f3
f2
f7
f
It is recommended that  many  customers  targets  or  targets  the  group  (or  the  groups  deter  and  the  group  (or  the  uses  to  targets  the  group  further  be  in  the  case  that  the  these  groups  are  the  most  common  common  group  of  the  group  to  have  known  as  Poison  and  also  called  Poison  and  Trojan  (or  Poison  uses  a  Poison  and  Trojan  (or  Trojan  infected  using  a  Poison  and  Trojan  in  the  case  of  this  group  in  the  case  of  a  Poison  that  uses  a  Poison  Trojan  to  targets  to  infect  a  Trojan  in  the  case  of  Poison  the  discovered  Trojan  in  the  case  of  Poison  that  is  the  most  common  known  as  Trojan  known  as  ZPoison  Trojan  fam  family  of  the  known  Comment  Lama  that  has  been  known  as  Poison  and  a  piece  of  mal  that  uses  a  Poison  Trojan  that  uses  Trojan  to  cred  to  and  a  Trojan  infect  a  Trojan  with  a  Trojan  that  uses  a  Poison  Trojan  called  Poison  to  the  Trojan  in  the  case  of  the  Trojan  that  uses  the  Poison  Trojan  in  a  Trojan  uses  a  Poison  Trojan  to  cred  to  and  a  Trojan  that  uses  a  Poison  to  it  infect  a  Trojan  that  uses  a  Poison  Trojan  called  Trojan  in  a  Trojan  Trojan  in  the  case  of  Trojan  infections  in  the  case  of  Trojan  or  other  other  or  a  Trojan  that  uses  a  Poison  Trojan  (s  Poison  and  other  Trojan  in  the  case  of  the  Trojan  of  a  Poison  Trojan  uses  a  Poison  Trojan  to  be  infections  the  same  Trojan  (s  Poison  or  Poison  in  the  case  of  the  Poison  Trojan  containing  a  Poison  Trojan  that  is  infected  with  Trojan  configuration  based  on  the  tool  with  Poison  and  the  Trojan  uses  Trojan  as  Trojan  as  a  Trojan  infected  to  infect  a  Trojan  in  the  case  of  the
==========
It is recommended that  the  known  malware  has  been  signed  trademarks  in  Microsoft

The  malware  family  has  been  from  this  to  our  n  known  as  n  Trend
Figure  “Operation  —  Trojan  has  identified  as  as  Trojan  that  has  t  been  identified  as  Trojan  that  has  known  as  Trojan  in  Vulnerability  in  Trend
  The  buggy  infected  with  a  campaign  known  as  Trojan  families  used  by  other  Trojans  to  be  identified  as  Trojan  and  also  that  discovered  as  Trojan  in  a  known  target  known  as  Trojan  family  called  Trojan  or  known  as  Trojan  targets  as  Trojan  for  this  to  be  a  samples  called  Trojan  targets  in  Tro  in  the  known  pattern  as  Trojan  Trojan  has  been  infected  with  Trojan  re  discovered  as  as  Trojan  known  as  Trojan  Turla  (  Sucka  Trojan  targets  in  the  known  known  as  Trojan  Turla  targets  in  the  pattern  and  as  as  Trojan  s  of  the  n  infected  or  the  other  family  discovered  as  Trojan  has  been  detected  as  Trojan  as  Trojan  Turla  Trojan  of  the  known  Trojan  targets  in  the  Trojan  Turla  or  a  Trojan  a  targets  infect  or  Trojan  s  or  uses  Trojan  Turla  to  infect  a  Trojan  Trojan  containing  Trojans  and  Trojan  s  in  this  spies  to  a  Trojan  Trojan  (s  a  Trojan  to  be  infected  with  Trojan  family  in  the  same  pattern  as  Trojan  family  as  Trojans  or  Trojan  family  used  to  pre  compromise  Trojans  and  ident  as  Trojans  for  our  in  Kre  a  known  as  Trojan  Trojan  that  uses  the  techn  Trojan  as  Trojan  (Sucka  Back  Kor  Back  Back  Kor  Back  Trojan  uses  the  same  techn  as  Trojan  family  and  the  Back  Kor  Trojan  uses  the  same  approval  of  the  Trojan  as  Trojan  which  uses  the  Trojan  as  Trojan  (s  a  Trojan  used  as  Trojan  as  Trojan  s  Trojan
==========
It is recommended that  the  RAT is very generic  as  which  is  not  related  in  data  to  the  case  in  the  case  that  s  discovered  as  “L
Figure  C&C  traffic  to  the  case  of  Turla  and  s  discovered  in  Turla  and  is  known  as  Turla  “  known  as  Turla  and  used  in  Turla  infecting  Turla  also  infecting  Turla  Turla  Trojan  uses  Trojan  to  distributed  and  ident  as  Trojan  is  the  common  common  pattern  of  Turla  uses  Trojan  family  to  have  custom  discovered  as  Trojan  family  to  targets  their  known  malware  family  to  include  Trojans  and  custom  custom  s  custom  and  back  components  and  their  custom  tools  are  discovered  in  the  case  of  Turla  as  the  most  known  known  as  Turla  family  and  as  Trojan  family  of  Trojan  family  Turla  discovered  as  Trojan  family  Trojan  discovered  as  a  Trojan  family  Trojan  of  Trojan  as  Trojan  family  used  the  known  known  known  as  Trojan  family  Turla  discovered  as  Trojan  family  Trojan  as  Trojan  family  Turla  that  uses  a  malicious  malware  family  called  Trojan  that  uses  the  same  common  Turla  family  of  Turla  that  uses  a  key  of  Trojan  family  that  appears  to  be  known  as  Trojan  family  as  Trojan  or  s  as  Trojan  family  as  Trojan  family  based  as  Trojan  family  as  Trojan  uses  custom  targets  with  the  same  family  as  Trojan  that  uses  a  different  family  that  uses  the  same  as  Trojan  family  (“Turla  family  and  a  v3  domain  )  was  a  various  variant  of  Trojan  related  family  as  Trojan  family  that  targets  this  same  as  Trojan  family  of  Trojan  family  Turla  (also  family  known  as  Turla  ),  and  also  identified  as  Trojan  family  as  Trojan  family  Turla  to  c  Trojan  feng  (observed  as  Trojan  s  L  (Figure  a  Trojan  or  Trojan  family  Turla  also  a  targets  the  same  Trojan  family  family  as  Trojan  t
==========
It is recommended that.........................................................................
2.3.7.8 allows remote attackers to obtain privileges, such as “NSSH” or “NSSH” via a modified string.
3.8 allows local users to execute arbitrary commands via a long HOME field.
4.3 allows remote attackers to cause a denial of service or possibly possibly perform unauthorized commands via a malformed password.

The web interface in Cisco IOS 4.0 allows local users to execute arbitrary commands via a long command line argument.

The same vulnerability in HP X86 (formerly X86) 4.0 allows remote attackers to perform network sniffing.

The OpenSSH and 4.0 allows local users to cause a denial of service or possibly gain privileges, via a modified version of the "OpenSSH" vulnerability.

The default configuration of vpn client proxy server 3.0 and 4.0 allows local users to gain privileges via a malformed DNS packet packet.

The vpn client before 4.0 allows local users to cause a denial of service or possibly gain privileges via a malformed host name packet, via a broadcast port.

The VNC Server (XFS) Server 3.6 and 4.0 does not properly restrict access to the "Server 2" header which does not properly restrict access to a buffer with predictable ICMP packet header, which allows local users to cause a denial of service attacks via a long filename.

The dword in Internet Explorer 4.5 allows remote attackers to cause a denial of service attacks, possibly execute commands on multiple platforms.

Buffer overflow in web servers 5.0, 5.1 and 5.6 allows remote attackers to execute arbitrary commands via a long HTTP GET request.

Buffer overflow in Internet Explorer 4.0 allows local users to cause a denial of service via a malformed HTML document.

The default configuration of vpn server before 4.0 allows remote attackers to cause a denial of service attacks.

Buffer overflow in the XtremeDuke Web Server Server 4.0 and 4.0 allows local users to cause a denial of service attacks when they have a buffer overflow in the HTML Object (PLD) file.

A vulnerability in FreeBSD 4.0 and 4.0 allows local users to gain privileges by modifying permissions to numeric privileges.

Cross-site scripting vulnerability in FreeBSD 4.0 and 4.0 allows remote attackers to cause a denial of service or possibly execute commands via a command line argument.

The INNSS Web Server 5.2 does not properly restrict access to other web-based scripting vulnerabilities in the web server, which allows local users to modify or modify content of the document.

Buffer overflow in web server 4.0 through 4.0 allows remote attackers to cause a denial of service via an HTTP GET request, or possibly execute commands.

Buffer overflow in Microsoft Web Server 4.0 and 4.0 does not properly restrict access to source code, which allows remote attackers to execute arbitrary commands via a malformed URL, which could allow an authenticated authenticated authenticated user to modify source code.

The HTML vulnerability in the Web Server 4.0 through 4.0 allows local users to gain privileges via a malformed HTTP GET request that does not properly authenticate with certain ICMP packets, which allows a local attacker to cause a denial of service or possibly execute commands.

Buffer overflow in Internet Explorer 4.0 through 4.0, 4.0 and 5.0 allows remote attackers to cause a denial of service via a long host name conversion vulnerability.

Buffer overflow in web interface before 4.0 and 5.0 allows remote attackers to cause a denial of service via a long HTTP GET request, which causes a denial of service attacks on a server with an HTTP GET request.

The default configuration of the OpenSSH 1.0 configuration of OpenSSH 2.0 before 4.0 allows remote attackers to cause a denial of service by sending an HTTP GET request to a URI request containing a long key, which causes the same "GET request", which causes a GET request to exist in a 200 OK" command.

The default configuration of e-mails for OpenSSH 1.0 does not properly restrict access to passwords to access, which allows local users to access session sessions without authentication.

The default configuration of c-mails for OpenSSH 1.0 allows local users to hijack authentication via a certain method, which could allow a local attacker to cause a denial of service attacks and possibly execute commands via a long user password.

Buffer overflow in Adobe Flash Player 0.1 allows local users to cause a denial of service (crash) via a long HTTP GET request.

The default configuration of the OpenSSH 1.0 and 4.0
==========
It is recommended that  it  is  related  to  other  other  malware  (v.  See  The  case  of  Elderwood  of  the  Elderwood  of  the  Elderwood  of  that  is  common  to  be  known  as  Krebs  of  the  family  of  known  as  Back  as  Serel  (n  Elderwood  has  in  the  most  known  as  Yerel  of  Elderwood  is  known  as  the  Naid  of  the  Las  Lang  of  our  known  as  as  Back  Dang  or  s  a  known  as  Back  Kang  and  Krebs  of  the  known  as  Back  Kong  (and  Back  Kong  of  the  Back  Kong  of  Kong  of  the  same  known  as  Back  Kong  of  these  attacks  in  the  Lang  known  as  Back  Kong  the  Chinese  language  Trojong  family  to  the  same  as  Back  Kong  to  the  Back  Kong  and  Back  the  Lang  based  (s  in  Lang  Sang  Vang  and  Lang  in  the  Kong  Lang  and  Yerel  of  the  Elderwood  of  the  known  Back  Kong  family  has  the  known  known  as  Back  Kong  Trojong  family  as  Trojan  (in  as  Back  Kong  Trojan  Back  Trojan  as  Back  and  Back  Trojan  (n  Back  Kong  Trojan  Back  Back  Kong  and  Back  to  the  Back  Kong  of  Trojan  Back  Kong  to  the  Back  Trojan  (n  Back  Kong  and  Back  Trojan  Back  Trojan  Back  Back  to  the  Back  Kong  of  the  Back  Kong  Turla  Back  that  uses  in  the  Back  Kong  Turla  Trojan  (n  Back  Kong  or  Back  to  Trojan  Back  the  Back  Kong  Turla  Back  to  the  Back  Kong  Turla  Back  Trojan  Back  to  the  Back  Kong  Turla  Back  to  a  Back  Kong  Trojan  Back  that  Back  Kong  Back  Trojan  Back  Trojan  Back  to  the  Back  Kong  Turla  Back  Trojan  Back  that  Back  Trojan  Back  Back  to  the  Back  Kong  Turla  Back  Trojan  Back  to  a  Back  Kong  Trojan  Back  Trojan  Back  to  the  Back  Trojan  Back  (n  Back
In the opinion of the expert,  said  the  hijihi  was  known  as  a  Lama  known  as  Lama  as  a  X  domain  as  domain  as  as  “X  domain  has  been  a  registered  domain  as  a  new  domain  in  the  Domain  res  to  be  infected  using
http  and  the  name  as  the  name  of  the  domain  has  been  triggered  from  the  domain  as  the  domain  has  also  been  connected  to  a  known  known  as  X  domain  family  in  the  domain  has  been  linked  to  a  a  known  as  C2  domain  called  X  Domain  (MD5  identified  as  a  new  malicious  malicious  malicious  malware  with  the  C2  domain  as  C2  domain  with  the  domain  is  the  most  known  known  known  as  Trojan  family  known  as  Trojan  family  as  Trojan  family  family  in  that  was  known  as  Trojan  family  Trojan  in  as  disc  as  as  Trojan  family  as  Trojan  (SHA5  number  for  the  follow  names  that  were  used  for  the  first  known  known  as  Trojan  family  as  Trojan  family  as  Trojan  family  in  a  the  common  known  known  as  Trojan  family  (SHA5  as  Trojan  family  as  Trojan  family  in  the  use  of  this  malware  as  Trojan  family  to  a  variant  in  the  a  malware  family  as  Trojan  family  known  as  Trojan  known  as  Trojan  family  as  Trojan  that  has  been  identified  as  Trojan  family  in  this  family  as  Trojan  family  as  a  Trojan  family  of  Trojan  family  as  Trojan  family  in  as  Trojan  family  as  a  Trojan  family  that  has  been  known  as  Trojan  family  as  as  Trojan  family  of  Turla  family  known  as  Trojan  family  in  our  known  as  as  Trojan  family  of  Trojan  family  as  Turla  family  also  family  known  as  Trojan  family  as  Trojan  family  of  Trojan  family  known  as  Trojan  family  as  Trojan  family  t  a  family  of  the  Trojan  family  of  Trojan  family  in  known  as  Trojan  family  Trojan  family  (SHA5  as  a
==========
In the opinion of the expert,  and  a  strong  known  known  known  as  the  C&C  server  (s)  is  the  same  known  known  as  Trojan  (s)  family  of  discovered  as  C  family  (s)  that  has  been  observed  in  the  recent  pattern  of  that  was  known  as  Trojan  (s)  s  in  a  known  known  as  Trojan  (s)  (s)  was  found  in  this  case  (s)  in  the  most  known  known  as  Trojan  (s)  family  (s)  containing  a  Trojan  (s)  that  is  connected  to  the  C  domain  resolved  to  the  C  domain  (s)  in  the  case  in  a  a  infected  connection  to  the  Trojan  (s)  in  the  case  of  infected  and  the  connection  to  the  compromised  domain  (s)  of  infected  trapped  network  of  the  C  domain  (s)  (s)  to  encrypt  traffic  traffic  trapped  trapped  trapped  traffic  trapped  traffic  trapped  trapped  traff  traff  trapped  traff  traffic  trapped  trapped  trapped  traff  trapped  traff  trapped  traff  traff  traff  trapped  traff  trapped  traff  trapped  traff  trapped  traff  trapped  trapped  trapped  traff  trapped  traffic  trapped  trapped  traff  traffic  trapped  traff  traffic  trapped  traffic  trapped  traff  traffic  trapped  traff  traff  trapped  trapped  traff  traff  trapped  trapped  traff  trapped  traff  traff  trapped  traffic  trapped  trapped  traff  trapped  traff  trapped  traff  traff  trapped  traffic  trapped  traff  trapped  traff  trapped  traff  trapped  trapped  traff  traff  trapped  traff  trapped  traff  trapped  traff  traff  trapped  traff  trapped  traff  trapped  traff  traff  trapped  traff  trapped  trapped  traff  trapped  trapped  traff  trapped  traff  trapped  traff  trapped  trapped  traff  trapped  trapped  traff  traff  trapped  trapped  traff  traff  trapped  traff  trapped  traff  trapped  traff  trapped  traff  trapped  traff  trapped  trapped  traff  traff  trapped  traff  traffic  trapped  traff  trapped  traff  traff  trapped
==========
In the opinion of the expert,  said it was at fault to stop or stop, but a possible compromise, and that the person
(s) had had a no impact on the material in a forensic
research into the nature of the evidence on their back-end systems, as well as the information on
the forensic analysis of this attack is ongoing.
However, with a new forensic framework, it could not be immediately analyzed
in whole whole and without reasonable
observed in full of the forensic and reverse-engineering phase, in which
a person is directly tasked, as well as it does. This means that, when
investigated, a skilled adversary is able to obtain a full
basic knowledge, a skilled attacker could use it in multiple stages
of the forensic and reverse engineering phase of a forensic
research process.

For further insight, see the Appendix.

The research and analysis of this attack becomes available from the Appendix.

The research and analysis team at University of Minnesota, and
“I’ll be preparing to meet this process,” the “B” Group, which is responsible for the analysis and the
methodology that will communicate with the organization of the
malware.
The research also revealed that the “B” Group’s malware is responsible for
each activity, as well as a malware called “B” Group that will install this backdoor as a persistence tool.

The malware will then invoke its backdoor to
run its “B” (or a “b” command, which
may have been compiled on the target system to perform the
operate. This will be applied to the following commands:
“/” command /cmd /”
“cmd /c “/” /c
“/” /c“/” /c “/” (2) /” /c “/”
“/” /c “/” /c “/”

“cmd /”
“/” /c “/”
“/”

“/” (3) /c “/”
“/”
“/”
“/”/”

“cmd /c “/” (4) /c “/”
“/” /c “/” /c “/”
“/”
“/”
/”

/”

“/”

”/”

”/”

”/”/”

“/”
”/”/”

“/”
/”
/”/”/”/”/”

The analysis of this activity reveals that the
Lamoon APT group is involved in this activity.

As far back as a week, we have identified this group as
a back door backdoor (although not identical) as the
malware is responsible for the activity outlined in this report).

A more detailed analysis reveals that the actors also appear to have
used a different tool and the tools
that are responsible for collecting and decrypting the victim´s computer.

The name s is a set of tools that provide a convenient list of
those tools used in the same campaign and
a simple obfuscation technique to hide the same
same code. The group behind this
group is still responsible for the activity of this group.

It is unclear whether this group is involved in this case, that the group is part of a
significant number of tools used by the groups in the wild in these
attacks, either by sending a special
attachment or an a decoy document, or by creating an executable (RAT) that
is designed to be written in a virtual machine in a
network. In the first two
most commonly used tool that we have seen from this group, a
portion of these tools is also known as
“Tak”. The first
known version of this group has
identified one distinct version of these tools, one
component that’s
a backdoor shell, two RAT files and an XOR key.
• Pak’s main backdoor
(or a
back door) is capable of registering the
same backdoor and creating
the same backdoor, and
components.
• Pak’s main backdoor

• Pak’s
==========
In the opinion of the expert,  the research team, and a team.
“We work with several high-level targets, including:  Kumar and  Lurker,”  “Lurker”  said  “We had a team of over the course of
our analysis, and to  customer  and  ident  those  in  a  large  approach  in  their  work  in  to  ident  these  attacks  in  a  large  and  ident  in  our  investigation  has  been  our  t  linked  to  the  same  attacks  in  various  attacks  and  the  known  targets  in  our  investigation  to  ident  identified  these  attacks  in  the  case  of  these  attacks  were  infections  or  infections  from  infections  infections  or  through  target  infections  in  a  case  of  the  known  fraud  as  Trojan  family  (based  on  its  infections  and  that  is  also  known  as  Trojan  family  (the  infections  were  also  identified  in  the  case  of  a  Trojan  that  discovered  as  Trojan  family  (which  uses  a  malicious  as  Trojan  family  of  as  Trojan  family  for  and  in  the  case  of  a  Trojan  family  of  Trojan  family  that  had  been  identified  in  the  case  of  the  Trojan  family  a  Trojan  family  based  called  Trojan  that  used  a  Trojan  family  called  Trojan  family  (md5  a  Trojan  family  that  used  a  Trojan  family  as  a  Trojan  family  called  Trojan  family  that  uses  a  Trojan  family  as  Trojan  family  known  as  Trojan  targets  in  the  case  of  Trojan  family  of  the  discovered  as  Trojan  family  in  as  an  known  known  as  Trojan  family  of  a  Trojan  family  also  known  as  Trojan  family  as  Trojan  Trojan  (Lurker  family  or  a  Trojan  family  called  Trojan  family  in  this  case  of  Trojan  family  to  target  the  Internet  Internet  Internet  Internet  Internet  and  Internet  and  Internet  refer  to  as  Trojan  (s  Trojan  family  to  the  malicious  Trojan  family  also  as  a  Trojan  family  of  Trojan  family  that  has  been  discovered  as  as  Trojan  family  as  Trojan  family  (s  and  as  Back  known  as  Trojan  family  in  as  Back  as  Trojan  family  or
==========
In the opinion of the expert,  the cybercriminal operation  of  the  Cyber  state  was  infected  on  a  targeted  with  a  infected  with  infected  trajan  uses  of  Trojan  that  is  known  as  Trojan  as  Trojan  in  the  targeted  malware  family  of  targets  (Cobra  and  Turla  (2  for  the  Cobra  Turla  Turla  s  and  Trojan  family  of  targets  called  Turla  uses  to  establish  Turla  in  a  targeted  infector  a  victim  that  identified  as  Trojan  targets  of  Trojan  as  a  targeted  malware  or  family  of  Trojan  as  a  custom  of  Trojan  known  as  Turla  used  in  a  targeted  mal  malware  in  a  targeted  malicious  malware  (cobra  a  Trojan  and  Trojan  uses  a  Trojan  to  be  as  infected  with  Trojan  infected  using  Trojan  in  the  infected  malware  in  a  Trojan  s  the  infected  with  Trojan  targets  of  Trojan  target  the  Trojan  uses  a  Trojan  to  ret  download  a  Trojan  (i  known  as  Trojan  as  Trojan  Lurker  a  targeted  as  Trojan  targets  infections  to  infections  that  were  a  Trojan  that  then  appears  to  the  infections  to  the  infections  of  the  Trojan  uses  to  infect  with  the  Trojan  uses  Trojan  (aka  as  Trojan  Trojan  family  of  Trojan  targets  to  infect  infections  or  as  Trojan  uses  to  discovered  as  Trojan  targets  the  targets  of  Trojan  infections  as  Trojan  family  of  Trojan  (3  for  Trojan  a  Trojan  infector  a  Trojan  s  infected  Trojan  called  Trojan  (dubally  known  as  Trojan  a  Trojan  family  as  Trojan  french  and  the  Trojan  uses  the  Trojan  to  successfully  st  target  a  targeted  variety  of  Trojan  as  a  Trojan  known  as  Trojan  (cobra  family  known  as  Trojan  or  a  Trojan  targets  a  targeted  in  the  most  known  known  known  as  Trojan  (RATs  and  a  Trojan  s  a  targeted  malware  targeted  in  a  Trojan  s  infections

For bulk generation, you can generate a large amount of texts to a file and sort out the samples locally on your computer. The next cell will generate `num_files` files, each with `n` texts and whatever other parameters you would pass to `generate()`. The files can then be downloaded from the Files sidebar!

You can rerun the cells as many times as you want for even more generated texts!_____no_output_____

num_files = 0

for prompt in prompts:
    for _ in range(num_files):
        ai.generate_to_file(n=200,
                            batch_size=1,
                            prompt=prompt,
                            max_length=2000,
                            temperature=1.0,
                            top_p=0.9)_____no_output_____

# LICENSE

MIT License

Copyright (c) 2020-2021 Max Woolf

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE._____no_output_____


# Notebook from maximcondon/Project_MovieRecommender
Path: 04_NonNegativeMatrixFunctions.ipynb

# NMF - Non-Negative Matrix Functions

- Non-negative matrix factorization is another unsupervised learning algorithm that aims to extract useful features, by decomposing data to find latent factors which can be described by matrices.

![image.png](attachment:image.png)_____no_output_____### Concepts

- user-item-matrix - a (usually very big) matrix R containing input data
- decomposition - R is decomposed into two matrices P and Q
- components - the extra dimension of P and Q that defines model complexity
- reconstruction - the product of P and Q approximates R
- sparsity - most values in the matrix are empty

### What is it used for?

- recommender systems
- customer segmentation
- topic modeling (e.g. on a bag of words)
- dimensionality reduction
- imputation of missing values

### The Idea

In a recommendation system like Netflix or MovieLens there is a set of users and a set of items (movies). Each user has rated some items in the system. We want to predict how users would rate items that they have not yet rated, so that we can make recommendations to users.

The information we have on existing ratings can be represented as a matrix. Suppose we have 4 users and 5 movies, and the ratings are integers from 1 to 5, the matrix may look like this:

|   User   | u1 | u2 | u3 | u4 |
|----------|----|----|----|----|
|Titanic   | 5  | 3  | 0  | 1  |
|Tiffany   | 4  | 2  | 0  | 1  |
|Terminator| 1  | 1  | 0  | 5  |
|Star Trek | 1  | 0  | 0  | 4  |
|Star Wars | 0  | 1  | 5  | 4  |

We want to describe our ratings R by a number of hidden features K. Our task is to find two matrices P and Q such that their product apprioximates R:

\begin{align}
\mathbf{R}\approx \mathbf{P}\times \mathbf{Q}^T =\hat{\mathbf{R}}
\end{align}

The intuition behind using matrix factorization to solve this problem is that there should be some latent features (e.g. a mapping of movie genres to user profiles) that determine how a user rates an item.

### Exercise

1. What movie recommendations could you generate for Steve?

2. How could you make the reconstucted matrix more similar to the original?

Change the genres to Romance and SciFi instead of Drama and Scifi!

NMF advantage - We can distribute this on many machines

This whole operation uses gradient descent to calculate!

We can use GradientBoosting to optimise this

3. Would it help to have more genres? DEFINITELY!

4. Are the genres created by the procedure really genres? What other proerties of movies or users could these hidden features represent?

    - We don't know what we will get as hidden features - this is a disadvantage! We will get some segmentation

5. Would the method suffer if some of your users are 'grumpy'?

    - If grumpy - might want to add an extra coefficient that will calibrate our model and take into account consistent bias!_____no_output_____### The maths
Our model has the following variables:

| variable | description |
|----------|-------------|
| U | a set of users |
| D | a set of items |
| R | a U x D matrix containing all ratings |
| K | number of latent features |
| P | a U x K matrix |
| Q | a D x K matrix |

Each row of P represents the strength of the associations between a user and the features. Similarly, each row of Q represents the strength of the associations between an item and the features.

To get the prediction of a rating of an item d(j) by user u(i), we can calculate the dot product of their vectors:

\begin{align}
\hat{r}_{ij}=p_i^T \cdot q_j=\sum_{k=1}^K p_{ik} \cdot q_{kj}
\end{align}

### Error function
Usually there is a difference between the real and the calculated rating matrix:

\begin{align}
\mathbf{R} \approx \hat{\mathbf{R}}
\end{align}

This difference called the error between the estimated rating and the real rating, can be calculated for each user-item pair:

\begin{align}
e^2_{ij}=\left(r_{ij}-\hat{r}_{ij}\right)^2= \left(r_{ij}- \sum_{k=1}^K p_{ik}q_{kj}\right)^2
\end{align}

We consider the squared error because the estimated rating can be either higher or lower than the real rating.

### Error gradient
To minimize the error, we have to know in which direction we have to modify the values of p(ik) and q(jk). In other words, we need to know the gradient at the current values, and therefore we differentiate the above equation with respect to these two variables separately:

\begin{align}
\frac{\partial}{\partial p_{ik}} e^2_{ij}= -2\left(r_{ij}-\hat{r}_{ij}\right)(q_{kj})   =-2 e_{ij} q_{kj}
\end{align}

\begin{align}
\frac{\partial}{\partial q_{ik}} e^2_{ij}= -2\left(r_{ij}-\hat{r}_{ij}\right)(p_{ik})   =-2 e_{ij} p_{ik}
\end{align}

Having obtained the gradient, we can now formulate the update rules for both p(ik) and q(kj):

\begin{align}
p'_{ik}=p_{ik}+ \alpha \frac{\partial}{\partial p_{ik}} e^2_{ij}=p_{ik}+ 2\alpha  e_{ij} q_{kj} \\
q'_{kj}=q_{kj}+ \alpha \frac{\partial}{\partial q_{kj}} e^2_{ij}=q_{kj}+ 2 \alpha  e_{ij} q_{kj}
\end{align}

Where alpha is the learning rate.

For a given training set T we want to minimize our prediction error.

Using our update rule we can set E as stop parameter for a given tolerance.

\begin{align}
\mathbf{E}=\sum_{u_i,d_j,r_{ij} \in \mathbf{T}}e_{ij}= \sum_{u_i,d_j,r_{ij} \in \mathbf{T}} \left(r_{ij}- \sum_{k=1}^K p_{ik}q_{kj}\right)^2
\end{align}

### Regularization
We want to introduce a regularization method to avoid overfitting. This can be done by adding a parameter beta to the squared error term:

\begin{align}
e^2_{ij} = \left(r_{ij}-\hat{r}_{ij}\right)^2 = \left(r_{ij}- \sum_{k=1}^K p_{ik}q_{kj}\right)^2 +\frac{\beta}{2}\sum_{k=1}^K \left(||\mathbf{P}||^2+||\mathbf{Q}||^2\right)
\end{align}

This **regularization term** controls the magnitude of the user-features and item-features such that P and Q give a good approximation of R. So our new update rule could be

\begin{align}
p'_{ik}=p_{ik}+ \alpha \frac{\partial}{\partial p_{ik}} e^2_{ij}=p_{ik}+ \alpha\left( 2 e_{ij} q_{kj}-\beta p_{ik}\right)
\end{align}

\begin{align}
q'_{kj}=q_{kj}+ \alpha \frac{\partial}{\partial q_{kj}} e^2_{ij}=q_{kj}+ \alpha\left( 2 e_{ij} p_{ik}-\beta q_{kj}\right)
\end{align}

### Adding Biases
When the ratings are generated we also have to consider that some users might rate a movie generally higher than very sceptical users. These factors are called biases. So every users may have his or her bias b.

\begin{align}
\hat{r}_{ij}=b+b u_i+ bd_j + \sum_{k=1}^K p_{ik}q_{kj}
\end{align}

where b is the gobal bias, b u(i) is the bias of user i and bd(j) is the bias of item j.

Plugging this into our model would mean:

\begin{align}
b u'_i &= b u_i +\alpha \cdot\left(e_{ij}-\beta bu_i\right)
\end{align}

\begin{align}
b d'_j &= bd_j  +\alpha \cdot\left(e_{ij}-\beta bd_j\right)
\end{align}

the facorization converges faster when biases are applied._____no_output_____### Algorithm
To find the optimal matrices P and Q, the approach is roughly:

1. Set the number of components
2. Set initial values for P and Q (e.g. randomly)
3. Reconstruct R by multiplying P and Q
4. Calculate the reconstruction error by comparing with the real data
5. Calculate the gradient of the reconstruction error
6. Modify P and Q accordingly
7. Iterate until P and Q converge

The algorithm is called Coordinate Descent and very closely related to gradient descent._____no_output_____**Challenges Today:**

1. Run the code example in NMF exercise 2 and understand the code
2. Adapt the code example for movie data from your database
3. Implement NMF from scratch_____no_output_____

<code>
import numpy as np
from sklearn.decomposition import NMF
import pandas as pd

# movie, ratings by users
data = [
    [5, 4, 1, 1, 3],
    [3, 2, 1, 3, 1],
    [3, 3, 3, 3, 5],
    [1, 1, 5, 4, 4],
]
columns = ['Titanic', 'Tiffany', 'Terminator', 'Star Trek', 'Star Wars'] #movies
index = ['Ada', 'Bob', 'Steve', 'Margaret'] #users

#need a dataframe for this
R = pd.DataFrame(data, index=index, columns=columns)
R_____no_output_____R = pd.DataFrame(data, index=index, columns=columns).values
R_____no_output_____#create a model and set the hyperparameters
# model assumes R ~ PQ'

model = NMF(n_components=2, init='random', random_state=10)

model.fit(R)

Q = model.components_  # movie-genre matrix

P = model.transform(R)  # user-genre matrix

print(f'Reconstruction Error E is {model.reconstruction_err_}') #reconstruction error
print()

nR = np.dot(P, Q)

print(nR) ## The reconstructed matrix!
print()

# predict the hidden features for a new data point
query = [[1, 2, 5, 4, 5]]

#in this case, a new user providing ratings for the 5 movies.
print(model.transform(query))

hidden_profile = model.transform(query)Reconstruction Error E is 2.319822011025

[[4.98574011 3.98089613 0.69817861 1.52507923 2.84430572]
 [2.61580597 2.15486368 1.23495386 1.51110529 2.19736573]
 [3.35829506 2.89944467 3.32824145 3.36641177 4.23566511]
 [0.85105386 1.03300314 4.75334969 4.0532461  4.24705685]]

[[2.68231475 0.45631224]]
final_recommendations = np.dot(hidden_profile,Q)_____no_output_____final_recommendations_____no_output_____new_user_query = [[1, 3, 3, 3, 5]]_____no_output_____new_hidden_profile = model.transform(new_user_query)_____no_output_____new_recommendation = np.dot(new_hidden_profile,Q)
new_recommendation = new_recommendation[0]
new_recommendation_____no_output_____list(zip(columns, new_recommendation))_____no_output_____
</code>