AsyncRAT, APT37 NarwhalRAT & OnyxC2: OTX Pulse Analysis of Active RAT & Stealer Campaigns

---
title: Potential AsyncRAT AI-Themed LNK Execution
id: 8a3e2c1d-5f4a-4b2e-9c1d-8f7a6b5c4d3e
description: Detects execution of LNK files from compressed archives that launch PowerShell, a technique observed in AsyncRAT campaigns using AI-themed lures.
status: stable
author: Security Arsenal
date: 2026/06/16
references:
    - https://otx.alienvault.com/pulse/6677d795f0f9a43793a657d5
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk:
        ParentImage|endswith: \explorer.exe
        Image|endswith: \cmd.exe
        CommandLine|contains: '.lnk'
    selection_powershell:
        Image|endswith: \powershell.exe
        CommandLine|contains:
            - 'FromBase64String'
            - 'IEX'
            - 'DownloadString'
    selection_keywords:
        CommandLine|contains:
            - 'AI'
            - 'GPT'
            - 'Prompt'
            - 'Library'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: APT37 NarwhalRAT Python Process Execution
id: 7b2f1e0a-4e3d-4c1b-8b2f-7e6c5d4b3a2e
description: Detects suspicious Python process execution spawning from a cmd or batch script, potentially indicating NarwhalRAT activity following LNK obfuscation.
status: stable
author: Security Arsenal
date: 2026/06/16
references:
    - https://otx.alienvault.com/pulse/6677d7f5f0f9a43793a657e6
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - \cmd.exe
            - \powershell.exe
    selection_python:
        Image|endswith: \python.exe
        CommandLine|contains: '.py'
    selection_suspicious_paths:
        CurrentDirectory|contains:
            - \AppData\Local\Temp
            - \AppData\Roaming
    condition: all of selection_*
falsepositives:
    - Legitimate Python development
level: medium
---
title: OnyxC2 Stealer Direct Syscalls and Assembly Pattern
id: 6c1e0d9c-3d2c-4b0a-7a1e-6d5c4b3a2e1f
description: Detects processes attempting to allocate memory with execute permissions indicative of reflective loading or direct syscalls used by OnyxC2 and similar stealers.
status: stable
author: Security Arsenal
date: 2026/06/16
references:
    - https://otx.alienvault.com/pulse/6677d835f0f9a43793a657f5
logsource:
    category: process_access
    product: windows
detection:
    selection:
        GrantedAccess: '0x143A' # PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
        CallTrace|contains:
            - 'ntdll.dll'
    filter_legit:
        SourceImage|endswith:
            - \sihost.exe
            - \svchost.exe
            - \explorer.exe
    condition: selection and not filter_legit
falsepositives:
    - Low
level: high

// Hunt for AsyncRAT, APT37, and OnyxC2 Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    "shampobiskworld.nl", 
    "shampoolagtto.com", 
    "shamppocosmaticso.com",
    "crwellfood.com",
    "fe01.co.kr",
    "akmuniverstall.top"
) 
or RemoteIP in ("211.239.157.126", "218.150.78.198")
| extend FullUrl = iff(RemoteUrl != "", RemoteUrl, RemoteIP)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, FullUrl
| order by Timestamp desc

# IOC Hunter for AsyncRAT, NarwhalRAT, and OnyxC2
# Requires Admin privileges for full disk access

$MaliciousHashes = @(
    # AsyncRAT SHA256
    "61b7fa5a7186cbf73dbc1f03e6e6f6819f5eb1e630a001059d381114bda2f974",
    "7d6ee3c6ff8f70b1817aaec82aff1d2babe0b62cafef3975262644743afc0cb8",
    "96b486bd7308ef3d6771360800f4c9b48b10697bd4cb69a8589b97b039377ecb",
    # OnyxC2 SHA256
    "78945c844fc23dd3446cf17987edeeb6cc21986820c92df82a126af24a5a38d1",
    "d89bb4b23a67814ef511e4e9dda7ad36fa519a322fa7c25ea451c7dd7ef61e54",
    "41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2",
    # APT37 / NarwhalRAT MD5
    "3715092aa00f380cefe8b4d2eddb7d08",
    "7cef19f9c4480adac0cd4702ff98f46c",
    "7eb9cee1f696727752169f25cf79a338",
    "b6b0602310bb2d4360c52685119aac1b",
    # OnyxC2 MD5
    "b5b603ff57142a454c3b0fb12eb8a4eb",
    "cf64c7e2e3897ae5fce3d5414e3d1d27"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

$DrivesToScan = @("C:") # Extend as needed

foreach ($Drive in $DrivesToScan) {
    Write-Host "Scanning $Drive..."
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $File = $_
        try {
            $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($File.FullName)" -ForegroundColor Red
            }
            # Check MD5 for APT37 indicators if not found via SHA256
            $HashMD5 = (Get-FileHash -Path $File.FullName -Algorithm MD5 -ErrorAction Stop).Hash
            if ($MaliciousHashes -contains $HashMD5) {
                Write-Host "[!] MALICIOUS FILE FOUND (MD5): $($File.FullName)" -ForegroundColor Red
            }
        } catch {
            # Ignore errors (e.g., locked files)
        }
    }
}

# Check for suspicious Scheduled Tasks (AsyncRAT persistence)
Write-Host "`n[+] Checking for suspicious Scheduled Tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } | ForEach-Object {
    $Task = $_
    $Action = $Task.Actions.Execute
    $Arg = $Task.Actions.Arguments
    if ($Action -match "powershell" -and $Arg -match "-enc" -or $Arg -match "-w hidden") {
        Write-Host "[!] Suspicious Scheduled Task: $($Task.TaskName)" -ForegroundColor Yellow
        Write-Host "    Action: $Action $Arg"
    }
}