Merge branch 'wietze:main' into main

.github/schema/schema.yml

@@ -10,7 +10,7 @@ mapping:
 
   Author:
     type: str
-    pattern: '^\w[\w\s\-'']+\w$'
+    pattern: '^\w[\w\s\-'',]+\w$'
     required: true
 
   Created:

yml/3rd_party/apple/corefoundation.yml

@@ -0,0 +1,27 @@
+---
+Name: corefoundation.dll
+Author: Matt Anderson - HuntressLabs
+Created: 2024-04-13
+Vendor: Apple
+ExpectedLocations:
+  - '%PROGRAMFILES%\Common Files\Apple\Apple Application Support'
+  - '%SYSTEM32%'
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\iTunes\ituneshelper.exe'
+    Type: Sideloading
+    SHA256:
+      - '0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda'
+  - Path: '%PROGRAMFILES%\QuickTime\QuickTimePlayer.exe'
+    Type: Sideloading
+    SHA256:
+      - 'b3a7ff97aca1201758c5295afa7d34e8d05f429b7faf707cf4d5740b8c76cb61'
+Resources:
+  - https://analyze.intezer.com/analyses/82011cc1-c3df-4c63-9945-8730b0d1cf3e
+  - https://www.virustotal.com/gui/file/ff5e56c20591a9019eb28b3cab88f5a240657c1c360bf01ad3a6d417fa10b7f5
+  - https://www.joesandbox.com/analysis/1394928/0/html
+  - https://www.virustotal.com/gui/file/0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda/details
+  - https://discussions.apple.com/thread/2732037?sortBy=best
+  - https://iosninja.io/dll/download/corefoundation-dll
+Acknowledgements:
+  - Name: Matt Anderson
+    Twitter: '@nosecurething'

yml/3rd_party/nvidia/libcef.yml

@@ -0,0 +1,19 @@
+---
+Name: libcef.dll
+Author: Matt Anderson - HuntressLabs
+Created: 2024-04-13
+Vendor: Nvidia
+ExpectedLocations:
+  - '%PROGRAMFILES%\NVIDIA Corporation\NVIDIA GeForce Experience'
+VulnerableExecutables:
+  - Path: '%Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDA Share.exe'
+    Type: Sideloading
+    SHA256:
+      - 'f1e2f82d5f21fb8169131fedee6704696451f9e28a8705fca5c0dd6dad151d64'
+Resources:
+  - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
+  - https://analyze.intezer.com/analyses/93e92d7a-9a46-4c1c-8ac0-87b4453beeb8
+  - https://www.virustotal.com/gui/file/64d0fc47fd77eb300942602a912ea9403960acd4f2ed33a8e325594bf700d65f
+Acknowledgements:
+  - Name: Matt Anderson
+    Twitter: '@nosecurething'

yml/3rd_party/qfx/keyscramblerie.yml

@@ -0,0 +1,26 @@
+---
+Name: keyscramblerie.dll
+Author: Matt Anderson - HuntressLabs, Swachchhanda Shrawan Poudel
+Created: 2024-04-15
+Vendor: QFX
+ExpectedLocations:
+  - '%PROGRAMFILES%\KeyScrambler'
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\KeyScrambler\KeyScrambler.exe'
+    Type: Sideloading
+    SHA256:
+      - 'f1575259753f52aaabbd6baad3069605d764761c1da92e402f3e781ed3cf7cea'
+      - 'fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1'
+Resources:
+  - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
+  - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
+  - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
+  - https://twitter.com/Max_Mal_/status/1775222576639291859
+  - https://twitter.com/DTCERT/status/1712785426895839339
+  - https://www.virustotal.com/gui/file/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/details
+  - https://www.virustotal.com/gui/file/9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1
+Acknowledgements:
+  - Name: Matt Anderson
+    Twitter: '@nosecurething'
+  - Name: Swachchhanda Shrawan Poudel
+    Twitter: '@_swachchhanda_'