ASO RAT Surveillance & NKAbuse Blockchain Botnet: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential ASO RAT Android Activity
description: Detects potential C2 communication patterns associated with ASO RAT based on known hostnames and suspicious Android APK installation behavior.
status: stable
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6651a13f7918290d0b12d435
tags:
    - attack.command_and_control
    - attack.mobile_equipment
logsource:
    product: android
    definition: 'Requires Google Play Protect or Mobile EDR logs'
detection:
    selection_dns:
        query|contains:
            - 'aso.ddns.net'
    selection_package:
        packageName|contains:
            - 'com.adobe.pdf'
            - 'com.syria.gov'
    condition: 1 of selection_
falsepositives:
    - Legitimate government apps (unlikely in non-Syria regions)
    - Benign PDF readers
level: high

---
title: NKAbuse Botnet via Marimo Exploit
status: stable
description: Detects exploitation attempts of CVE-2026-39987 in marimo notebooks or suspicious Python process execution related to HuggingFace Space typosquatting.
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6651a13f7918290d0b12d436
logsource:
    category: process_creation
    product: linux
detection:
    selection_exploit:
        CommandLine|contains:
            - 'marimo'
            - 'huggingface'
    selection_malware:
        ImagePath|endswith:
            - '/python'
        CommandLine|contains:
            - 'nkn'
            - 'blockchain'
    condition: 1 of selection_
falsepositives:
    - Legitimate data science usage of marimo/huggingface
level: critical

---
title: notnullOSX macOS Stealer Execution
description: Detects execution characteristics of notnullOSX stealer, including unusual DMG mounts and Go binary execution accessing cryptocurrency wallet paths.
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6651a13f7918290d0b12d437
tags:
    - attack.credential_access
    - attack.execution
logsource:
    category: process_creation
    product: macos
detection:
    selection_dmg:
        ImagePath|contains: '/Volumes/'
        ImagePath|endswith: '.app/Contents/MacOS/'
    selection_crypto:
        CommandLine|contains:
            - 'Library/Application Support/Bitcoin'
            - 'Library/Application Support/Ethereum'
            - '.wallet'
    selection_network:
        DestinationHostname|contains:
            - 'coockie.pro'
    condition: 1 of selection_
falsepositives:
    - Legitimate wallet management software opening wallets
    - Standard DMG installations
level: high


kql
// Hunt for NKAbuse indicators and marimo exploitation activity
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "huggingface" or RemoteUrl has "marimo"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| union (DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("nkn", "blockchain", "marimo")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FileName)
| summarize count() by DeviceName, bin(Timestamp, 1h)


powershell
# IOC Hunt Script for ASO RAT (Network) and notnullOSX (macOS Artifacts)
# Note: This script is designed to run on endpoints or via an EDR tool.

Write-Host "Starting IOC Hunt for ASO RAT and notnullOSX..." -ForegroundColor Cyan

# 1. Check for ASO RAT C2 Domains in DNS Cache (Windows)
$ASO_Domains = @("aso.ddns.net")
Write-Host "Checking DNS Cache for ASO RAT C2 domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $ASO_Domains -contains $_.Entry } | Select-Object Entry, Data

# 2. macOS specific checks (Requires PS-Core or bash wrapper)
# Checking for common persistence locations used by stealers like notnullOSX
if ($IsMacOS) {
    Write-Host "macOS Detected. Checking LaunchAgents for suspicious persistence..." -ForegroundColor Yellow
    $LaunchAgentsPath = "$env:HOME/Library/LaunchAgents"
    if (Test-Path $LaunchAgentsPath) {
        Get-ChildItem -Path $LaunchAgentsPath -Filter *.plist | ForEach-Object {
            $content = Get-Content $_.FullName -Raw
            if ($content -match "coockie.pro" -or $content -match "/tmp/" -or $content -match "hidden") {
                Write-Host "Suspicious LaunchAgent found: $($_.Name)" -ForegroundColor Red
            }
        }
    }
} else {
    Write-Host "Not a macOS host. Skipping macOS specific checks." -ForegroundColor Gray
}

Write-Host "Hunt Complete." -ForegroundColor Green