India Strikes Against Pakistani Terrorism 2019

[Kiran Ks]

Ok, so did something really happen yesterday or just Twitter rumour chatter? If we announce something today around noon, it will be seen as influencing elections...my best is before April 23rd there'll be some kind of disclosure

 

[Kiran Ks]

Lol open warning!He is determined not to let the paki establishment to go to sleep even for a day!

IMO, Baba ji is certainly instructed and monitored by someone up in the ladder...last two days, his activity was on review and it ended well..no he has more freedom...not seen him tweeting this frequently

 

[Ry117]

Let's be clear on thing. IAF doesn't try to enter Pakistani airspace.

If IAF wants, IAF can enter Pakistan at any point of time and PAF can't do crap. We can bomb any installation inside Pakistan anytime when we want. Stop paying too much attention to these Pakistani trolls.

And remember this is not any X Y Z airforce. This is the Indian airforce.

Agreed, also they are trying to paint India as aggressor, to innocent NaPak, and dreaming " PAF giving Jawaab to IAF"

Btw Pakis trying best to sell tourism #PakMyHeaven...
wonder why?

 

[sorcerer]

I don't know whether @narendramodi is coming or not because it is call of people of India but I am sure We will ruin the malicious intentions of Pakistan before 23rd May. Such a gift will be remembered by the generations of Pakistan. #OperationColdWave


Just Voted for our better,secure future frnds.

#PKMKBdobara !!!

Too late for the trick..
pakis are either too early or tooo late.
Madrassa education...only.

 

[sorcerer]

Ok, so did something really happen yesterday or just Twitter rumour chatter? If we announce something today around noon, it will be seen as influencing elections...my best is before April 23rd there'll be some kind of disclosure

possible the pakis were upto some misadventure on the eve of elections..and was pushed back
The twitter handles from pakis were hyper ventilating about sightings of PAF all over and even in Karachi.

 

[Ry117]

Ok, so did something really happen yesterday or just Twitter rumour chatter? If we announce something today around noon, it will be seen as influencing elections...my best is before April 23rd there'll be some kind of disclosure

My take is that they're baiting with bs...& hoping for spreading it, to check ,who actually has sourcezzz...
while they show how they're giving Jawaab to Aggressive/Irresponsible India...
& they're innocent
(Nuclear codes bs on BBC )

Nothing unites them better than "India attack" keeping them in "Fear" ,& ultimately "Puppet" of Pak Army.

 

[captscooby81]

i have now come to conclusion all these so called tweets from pakis about CAP are pure bullshit . There is no CAP and there is also no NOTAM they are just making a good fool of the indian population in twitter and getting some mileage .

 

[patriots]

Pakistan reportedly deployed medium-range #LY80/#HQ16 air defense systems in #Kashmir to deter further Indian incursions, but analyst and former #PAF pilot Kaiser Tufail believes this may not be enough

 

[Why so serious?]

Btw Pakis trying best to sell tourism #PakMyHeaven...
wonder why?

True that.

Have you seen the number of famous food Vloggers going to Pakistan ?

Literally all of them and that too all at once, all of them praising the pakis as best host and having best food in the world.

Damn YouTube algorithms keep on suggesting me these shitty videos.

 

[Skdas]

A lateral development, readers may like to think laterally and skip few lanes...

Source: https://securelist.com/project-tajmahal/90240/

Project TajMahal – a sophisticated new APT framework
By AMR, GReAT on April 10, 2019. 3:10 am
Executive summary

‘TajMahal’ is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’. It includes backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim’s machine. We discovered up to 80 malicious modules stored in its encrypted Virtual File System, one of the highest numbers of plugins we’ve ever seen for an APT toolset.

Just to highlight its capabilities, TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue. It can also request to steal a particular file from a previously seen USB stick; next time the USB is connected to the computer, the file will be stolen.

TajMahal has been developed and used for at least the past five years. The first known ‘legit’ sample timestamp is from August 2013, and the last one is from April 2018. The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014.

More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact [email protected]).

Technical details
We have discovered two different types of TajMahal packages, self-named Tokyo and Yokohama. The targeted systems found by Kaspersky Lab were infected with both packages. This suggests that Tokyo was used as first stage infection, deploying the fully-functional Yokohama package on interesting victims, and then left in for backup purposes. The packages share the same code base, we identified the following interesting features:

• Capable of stealing documents sent to the printer queue.
• Data gathered for victim recon includes the backup list for Apple mobile devices.
• Takes screenshots when recording VoiceIP app audio.
• Steals written CD images.
• Capable of stealing files previously seen on removable drives once they are available again.
• Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies.
• If deleted from Frontend file or related registry values, it will reappear after reboot with a new name and startup type.

Victims
So far we have detected a single victim based on our telemetry – a diplomatic entity from a country in Central Asia.

Conclusion
The TajMahal framework is an intriguing discovery that’s of great interest, not least for its high level of technical sophistication, which is beyond any doubt. The huge amount of plugins that implement a number of features is something we have never before seen in any other APT activity. For example, it has its own indexer, emergency C2s, is capable of stealing specific files from external drives when they become available again, etc.

The question is, why go to all that trouble for just one victim? A likely hypothesis is that there are other victims we haven’t found yet. This theory is reinforced by the fact that we couldn’t see how one of the files in the VFS was used by the malware, opening the door to the possibility of additional versions of the malware that have yet to be detected.

Kaspersky Lab products detect the TajMahal APT samples as HEUR:Trojan.Multi.Chaperone.gen

Appendix I – Indicators of compromise
A full set of IOCs and Yara rules is available to customers of Kaspersky Intelligence Reporting service – contact [email protected]

Domains and IPs
104.200.30.125
50.56.240.153
rahasn.webhop.org
rahasn.akamake.net
rahasn.homewealth.biz

File Hashes
22d142f11cf2a30ea4953e1fffb0fa7e
2317d65da4639f4246de200650a70753
27612cb03c89158225ca201721ea1aad
412956675fbc3f8c51f438c1abc100eb
490a140093b5870a47edc29f33542fd2
51a7068640af42c3a7c1b94f1c11ab9d
533340c54bd25256873b3dca34d7f74e
684eca6b62d69ce899a3ec3bb04d0a5b
69a19abf5ba56ee07cdd3425b07cf8bf
6cfd131fef548fcd60fbcdb59317df8e
72dc98449b45a7f1ccdef27d51e31e91
7c733607a0932b1b9a9e27cd6ab55fe0
7d5265e814843b24fcb3787768129040
80c37e062aa4c94697f287352acf2e9d
815f1f8a7bc1e6f94cb5c416e381a110
a43d3b31575846fa4c3992b4143a06da
08e82dc7bae524884b7dc2134942aadb
7bcd736a2394fc49f3e27b3987cce640
57314359df11ffdf476f809671ec0275
b72737b464e50aa3664321e8e001ff32
ce8ce92fb6565181572dce00d69c24f8
5985087678414143d33ffc6e8863b887
84730a6e426fbd3cf6b821c59674c8a0
d5377dc1821c935302c065ad8432c0d2
d8f1356bebda9e77f480a6a60eab36bb
92f8e3f0f1f7cc49fad797a62a169acd
9003cfaac523e94d5479dc6a10575e60
df91b86189adb0a11c47ce2405878fa1
e17bd40f5b5005f4a0c61f9e79a9d8c2
c1e7850da5604e081b9647b58248d7e8
99828721ac1a0e32e4582c3f615d6e57
f559c87b4a14a4be1bd84df6553aaf56
b9c208ea8115232bfd9ec2c62f32d6b8
061089d8cb0ca58e660ce2e433a689b3
0e9afd3a870906ebf34a0b66d8b07435
9c115e9a81d25f9d88e7aaa4313d9a8f
520ee02668a1c7b7c262708e12b1ba6b
7bfba2c69bed6b160261bdbf2b826401
77a745b07d9c453650dd7f683b02b3ed
3a771efb7ba2cd0df247ab570e1408b2
0969b2b399a8d4cd2d751824d0d842b4
fc53f2cd780cd3a01a4299b8445f8511
4e39620afca6f60bb30e031ddc5a4330
bfe3f6a79cad5b9c642bb56f8037c43b
3dfebce4703f30eed713d795b90538b5
9793afcea43110610757bd3b800de517
36db24006e2b492cafb75f2663f241b2
21feb6aa15e02bb0cddbd544605aabad
21feb6aa15e02bb0cddbd544605aabad
649ef1dd4a5411d3afcf108d57ff87af
320b2f1d9551b5d1df4fb19bd9ab253a
3d75c72144d873b3c1c4977fbafe9184
b9cf4301b7b186a75e82a04e87b30fe4
b4e67706103c3b8ee148394ebee3f268
7bfbd72441e1f2ed48fbc0f33be00f24
cdb303f61a47720c7a8c5086e6b2a743
2a6f7ec77ab6bd4297e7b15ae06e2e61
8403a28e0bffa9cc085e7b662d0d5412
3ffd2915d285ad748202469d4a04e1f5
04078ef95a70a04e95bda06cc7bec3fa
235d427f94630575a4ea4bff180ecf5d
8035a8a143765551ca7db4bc5efb5dfd
cacaa3bf3b2801956318251db5e90f3c
1aadf739782afcae6d1c3e4d1f315cbd
c3e255888211d74cc6e3fb66b69bbffb
d9e9f22988d43d73d79db6ee178d70a4
16ab79fb2fd92db0b1f38bedb2f02ed8
8da15a97eaf69ff7ee184fc446f19cf1
ffc7305cb24c1955f9625e525d58aeee
c0e72eb4c9f897410c795c1b360090ef
9ad6fa6fdedb2df8055b3d30bd6f64f1
44619a88a6cff63523163c6a4cf375dd
a571660c9cf1696a2f4689b2007a12c7
81229c1e272218eeda14892fa8425883
0ac48cfa2ff8351365e99c1d26e082ad

Appendix II – Additional technical details
The following table provides the full list of files stored in the VFS with a short description describing what the plugins do:

nn Name Short description
00
01 cs64.dll
cs32.dll C2 communication and command processing. WatchPoints document stealer.
02
03 li64.dll
li32.dll LocalInfo. Collects a large amount of information, titled “TAJ MAHAL”
04
06 ad64.dll
ad32.dll AudioRecorder. Microphone, Voice IP applications.
07
08 le64.dll
le32.dll Open source-based LAME mp3 encoder (“Mar 27 2014”) used by AudioRecorder plugins (adXX.dll).
09 dd.m MP3 file is sent by AudioRecorder (adXX.dll) when cache is cleared.
10
11 me64.dll
me32.dll AudioRecorder for Windows Metro applications.
Injects ma32.dll into “wwahost.exe” or “audacity.exe”.
12 ma32.dll AudioRecorder for Windows COM.
Hooks IAudioClient, IAudioRenderClient, IMMDevice.
13
14 ams_api64.dll
ams_api32.dll Handy wrapper around API of exXX.dll, pdXX.dll, sgXX.dll.
15
16 ex64.dll
ex32.dll Orchestrator. Update/install/uninstall, selects target processes and loads plugins.
17
18 fe64.dll
fe32.dll Template of “Yokohama” Frontend module; is used for reinstalling.
19
20 pd64.dll
pd32.dll Provides API to access configuration settings, working files, egress queue.
21
22 libpng64.dll
libpng32.dll Open source “libpng” library version 1.5.8 (February 1, 2012). Used by Screenshoter plugin (ssXX.dll).
23
24 rs64.dll
rs32.dll Reinstaller/Injector.
25
26 ix32.dll
ix64.dll LoadLibrary call template dll is used by Reinstaller/Injector plugin (rsXX.dll) for injecting LoadLibrary call into running processes.
05
27
28 obj32.bin
obj32.bin
obj64.bin Shellcode template is used by Reinstaller/Injector (rsXX.dll) and AudioRecorder4MetroApp (meXX.dll) for injecting into running processes. Both versions of “obj32.bin” are the same; it seems to be stored twice by mistake.
29
30 sc64.dll
sc32.dll Utility library. Provides API for cryptography, file, registry, memory management operations and so on.
31
32 sg64.dll
sg32.dll Library for managing egress queue (files and messages prepared to send to CC).
33
34 st64.dll
st32.dll SuicideWatcher. Watches uninstall time, checks time diff (local time vs internet time).
35
36 zip64.dll
zip32.dll Open source “XZip/XUnzip” library by Info-Zip + Lucian Wischik + Hans Dietrich. Is used by Indexer (inXX.dll) and C2 communication (csXX.dll) plugins.
37
38 zlib64.dll
zlib32.dll Open source “zlib” version 1.2.3 used by libpngXX.dll for compressing screenshots (ssXX.dll).
39 il32.dll IM-Stealer. Steals conversation content from chat windows of instant messaging applications.
40
55 in32.dll
in64.dll Indexer. Indexes files on victim drives, user profiles, removable drives.
Built index files are zipped (by zipXX.dll) and put in send queue.
41
42
43
44
46
47
48
49
50
51
52
53
56 isys9core_64.dll
isyspdf6_64.dll
isyspdfl_64.dll
isysdc_64.dll
isys9.key
isys.cwd
isys.elx
isys9_32.dll
isys9core_32.dll
isyspdf6_32.dll
isyspdfl_32.dll
isysdc_32.dll
isys9_64.dll Proprietary “ISYS Search Software” components are used by Indexer plugin.
Licensee_ID1 “Q5GXU H5W67 23B4W SCQFD 4G7HV 9GSLW”
Licensee_ID2 “objectviewer.exe”
45
54 sqlite3_64.dll
sqlite3_32.dll Open source “sqlite” library. Used by “ISYS Search”.
57
58 tn32.dll
tn64.dll Thumbnailer. Makes and prepares to send thumbnails of found picture files.
59
60
61
62 freeimage_32.dll
freeimageplus_32.dll
freeimage_64.dll
freeimageplus_64.dll FreeImage open source library supports popular graphics image formats (ver 3.15.4 2012-10-27) (http://freeimage.sourceforge.net). Is used by Thumbnailer (tnXX.dll) plugin.
63
64 ku64.dll
ku32.dll Keylogger & clipboard monitor.
65
66 pm64.dll
pm32.dll Steals printed documents from spooler queue.
This is done by enabling the “KeepPrintedJobs” attribute for each configured printer stored in Windows Registry:
key: “SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers”
value: “Attributes”
67
68 rc64.dll
rc32.dll EgressSender. Sends files from output queue to C2.
69
70 rn64.dll
rn32.dll Daily “ClientRecon” (ComputerName, OS information, MacAddress, WirelessNetwork keys, connected Apple devices, Apple mobile devices backups list, IE version, SecurityCenterInfo (AV, Firewalls and AntiSpyware products), Hardware info, Installed soft including Metro Apps, Users, Autoruns).
Check and send to C2 if something changed.
71
72 ss64.dll
ss32.dll Screenshoter. Periodic low resolution screenshots. High resolution screenshots of specified process windows and when recording VoiceIP application audio. See “ss_pr” & “ss_wt_nm” cfg vars.
73
74 vm32.dll
vm64.dll Steal documents from fixed and removable drives. Watch CDBurnArea and steals written CD images.
75
76 wc64.dll
wc32.dll Periodically makes webcamera snapshots.
77 default.cfg Default configuration settings file.
78 runin.bin List of processes names and associated plugins should be run inside these processes.
79 morph.dat Configuration file stores path of work folders and registry keys.

 

[Joker]

True that.

Have you seen the number of famous food Vloggers going to Pakistan ?

Literally all of them and that too all at once, all of them praising the pakis as best host and having best food in the world.

Damn YouTube algorithms keep on suggesting me these shitty videos.

Best way would be to unsubscribe and dislike the videos. The food itself is "yeeew" unhygienic and loaded with saturated fats, wonder how many vloggers were fed dog/donkey meat. And the best part is, one of the vloggers suggested that pakis don't accept money for food...thanks ISI

 

[Why so serious?]

Best way would be to unsubscribe and dislike the videos. The food itself is "yeeew" unhygienic and loaded with saturated fats, wonder how many vloggers were fed dog/donkey meat. And the best part is, one of the vloggers suggested that pakis don't accept money for food...thanks ISI

I had never subscribed to anyone of them and I have not watched a single of their Pakistan vlogs.

Maybe because I did watch some of their India episodes, I am getting these in my suggestions.

 

[Ry117]

True that.

Have you seen the number of famous food Vloggers going to Pakistan ?

Literally all of them and that too all at once, all of them praising the pakis as best host and having best food in the world.

Damn YouTube algorithms keep on suggesting me these shitty videos.

Tourism = Foreign currency

Only if they didn't have Armed Militia(Jihadi) & dreams of gazwa-e...

Read about their inferiority complex (demand to be treated same as India, Respect is not demanded but Earned).

 

[sorcerer]

Pakistan army is obsessed with India because it justifies its indispensability

https://www.wionews.com/opinions/pa...ause-it-justifies-its-indispensability-209455

 

[Roshan]

Finally, someone got it..i wanted to say it for long time. Anil is cleverly playing with our mindsets and gradually want to dilute the efforts and progress made by BJP government.

We have One Example In another thread. one article of livemint is there, in which writer is cleverly saying that in last decade everything has changed. she gave the example of passport services in which she mildly added that "passport services were taking lot of time a decade ago" and everything changed in last decade, but the truth is this BJP government totally simplified the process of passport and now it takes only 15 days to 1 one month to get a passport and you can track the whole process. 5 years ago it was nigh mare to get a passport but she changed it and added a decade, so that one can think that it was started in previous govts only. It is called the diluting the work which has done by others and taking the credit of others and gradually changing the mindset of common people. Like our history is changed so much that lot of people think that nehru and gandhi was the gods of freedom movement and no one else did that much of work as much as duo did.

try 1 day for a passport. Yea, i know.

 

[Sehwag123]

True that.

Have you seen the number of famous food Vloggers going to Pakistan ?

Literally all of them and that too all at once, all of them praising the pakis as best host and having best food in the world.

Damn YouTube algorithms keep on suggesting me these shitty videos.

All these trips are sponsored by Pak govt . Rarely any foreigner visits Pak . As soon as any foreigner visits Pak, he finds it difficult to get Visa of any other country.
UNWTO doesn't even record number of foreigners visiting Pakistan . You can check their 2018 report. According to that report India's tourism receipt from foreign country in 2017 was around 27.5 billion dollar and Pakistan's receipt was 350 million dollar i.e. 80 times

 

[Mikesingh]

Indian Army troops to remain on high alert in wake of Indo-Pak tensions

The action by the Indian Army forced the Pakistani Army to admit that three of its soldiers were killed, a rare case because it (Pakistani Army) is notoriously infamous for hiding its casualties. (ANI)

https://www.aninews.in/news/nationa...t-in-wake-of-indo-pak-tensions20190410190132/

In this op, 8 Porkis were confirmed killed according to SIGINT and double that number injured. Also 8 Paki post blasted to rubble. Unfortunately a couple of them were evacuated before the fire assault. Most likely these were the posts from where they used their snipers and thus knew they were going to get plastered in a befitting response from own troops and withdrew temporarily. But now they have to rebuild their flattened posts......so no more infiltration or sniper fire from here for at least 10 days!! :biggrin2:

 

[Enquirer]

In this op, 8 Porkis were confirmed killed according to SIGINT and double that number injured. Also 8 Paki post blasted to rubble. Unfortunately a couple of them were evacuated before the fire assault. Most likely these were the posts from where they used their snipers and thus knew they were going to get plastered in a befitting response from own troops and withdrew temporarily. But now they have to rebuild their flattened posts......so no more infiltration or sniper fire from here for at least 10 days!! :biggrin2:

Undeclared conflict is a great way to use up all the 'about to expire' ammo!!!
A victory with literally zero cost

 

[HariPrasad-1]

Hi guys
Just spoke to some very senior leaders in the congress.
They plan to undo all that prime minister modi has done with pak. They want to stop the pre emptive army attacks and the aggressive posturing at the loc. They also want to initiate talks with imran and make them uninterruptible.
When I asked what about the land IA, has taken over recently.
They said they would give it back as a confidence building measure.

Guys the nation is in danger.
We are at war with an adversary who wants to destroy us with chinese assistance.

Please exercise your right to vote, and vote for Modi JI
Else we may not even have a country left

Jai Hind

Until this party with Traitor , Anti national and anti India DNA is finished, it will continue to cause danger for the Nation. We must finish this most corrupt and anti national party soon as possible to remove Hazards from the country. Few smart political move will finish this party. Congress is shrinking geographically. The main take away of this election is the congress becoming irreverent in few more states. Congress is now down to 4th position WB from where it can not emerge once again. Congress has become irrelevant in Andhra and Telangana which bought congress to power in 2009 and in 2014. Orissa is one more state where congress had dropped down to third place. So theoretically speaking, Congress is dead in many state like Tamilnadu, Andhra, West Bengal, UP, Bihar, Delhi and few small states of North East This mean that congress congress is absent in more than half of the India. RIse of BJP in Tamilnadu, Kerala , Andhra and Telangan will make BJP undfeatable for for many years in National Politics. The biggest mistake which BJP did was to allow AAP to fall. BJP should have strengthen AAP in states like Gujarat, Rajasthan, Madhyapradesh etc. This would have killed congress and made it irrelevant form Indian politics for ever.

 

[prasadr14]

Until this party with Traitor , Anti national and anti India DNA is finished, it will continue to cause danger for the Nation. We must finish this most corrupt and anti national party soon as possible to remove Hazards from the country. Few smart political move will finish this party. Congress is shrinking geographically. The main take away of this election is the congress becoming irreverent in few more states. Congress is now down to 4th position WB from where it can not emerge once again. Congress has become irrelevant in Andhra and Telangana which bought congress to power in 2009 and in 2014. Orissa is one more state where congress had dropped down to third place. So theoretically speaking, Congress is dead in many state like Tamilnadu, Andhra, West Bengal, UP, Bihar, Delhi and few small states of North East This mean that congress congress is absent in more than half of the India. RIse of BJP in Tamilnadu, Kerala , Andhra and Telangan will make BJP undfeatable for for many years in National Politics. The biggest mistake which BJP did was to allow AAP to fall. BJP should have strengthen AAP in states like Gujarat, Rajasthan, Madhyapradesh etc. This would have killed congress and made it irrelevant form Indian politics for ever.

Agree with all except AAP.

I detest Congress but parties like AAP & Commies make me vomit.
BJP must build regional parties that are like Cong but with nationalism imbued, meaning, that party must be secular with strong nationalist tendencies, something like Captain in Punjab.