# Known malware locations of the PolinRider / Contagious Interview campaign (BeaverTail, InvisibleFerret,
# MicrosoftSystem64). The scan scripts report these; autofix.py can move them to quarantine.
#
# Format:  <system>  <fix>  <path>
#   system: unix (macOS + Linux) | mac | linux | windows | all
#   fix:    auto = may be quarantined automatically (name is specific to the malware)
#           ask  = always ask first (the name could, rarely, belong to something legitimate)
#   path:   ~ = your home folder; %LOCALAPPDATA% etc. are expanded on Windows
#
# Sources: Palo Alto Unit 42, eSentire, JFrog Security Research, safedep (see docs/attacks/).
# A test checks that the scan scripts and this list stay in sync.

all      auto  ~/.n2
all      auto  ~/.n3
all      auto  ~/.npl
all      auto  ~/.pyp
all      auto  ~/.sysinfo
all      auto  ~/.pcl-data
all      auto  ~/.pcl-state
all      ask   ~/.node_modules
mac      auto  ~/Library/Application Support/VSCodeUpdater
mac      auto  ~/Library/Application Support/MicrosoftSystem64
mac      auto  ~/Library/LaunchAgents/com.launchkeeper.MicrosoftSystem64.plist
mac      auto  ~/Library/LaunchAgents/com.bablu.helper.plist
mac      auto  ~/Library/LaunchAgents/com.avatar.update.wake.plist
linux    auto  ~/.local/share/MicrosoftSystem64
linux    auto  ~/.config/systemd/user/MicrosoftSystem64.service
linux    auto  ~/.config/autostart/MicrosoftSystem64.desktop
unix     ask   /tmp/0001.dat
unix     auto  /tmp/tmp7A863DD1.tmp
windows  auto  %LOCALAPPDATA%\MicrosoftSystem64
windows  auto  %LOCALAPPDATA%\MicrosoftSystem64.exe
windows  auto  %LOCALAPPDATA%\Temp\tmp7A863DD1.tmp
