BraZetsu IAB Framework & Packagist iOS Spyware Chain: OTX Pulse Analysis — Exilware Initial Access + Supply Chain Credential Theft Detection Pack

---
title: BraZetsu Python-Based IAB Malware Execution
description: Detects suspicious Python interpreter execution patterns consistent with the BraZetsu framework (Exilware), including PyInstaller-packed payloads executing reconnaissance and credential-theft commands.
author: Security Arsenal Threat Intel
id: 8f3a1c2e-braz-4e11-9f01-otxpulse0901a
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_python:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
    selection_cmd:
        CommandLine|contains:
            - 'wmic process get'
            - 'net group "Domain Admins"'
            - 'systeminfo'
            - 'ipconfig /all'
            - 'Get-ChildItem Env:'
            - 'vaultcmd'
            - 'cnab'
            - '.rem'
            - 'AppData\Local\Google\Chrome\User Data'
            - 'Login Data'
    filter_legit:
        CommandLine|contains:
            - 'site-packages'
            - 'anaconda'
    condition: selection_python and selection_cmd and not filter_legit
falsepositives:
    - Legitimate Python automation scripts by IT admins
level: high
tags:
    - attack.discovery
    - attack.credential_access
    - attack.t1059.006
    - attack.t1005
    - attack.t1555
date: 2026/09/01
---
title: BraZetsu Persistence via Registry Run Key or Scheduled Task
description: Detects persistence mechanisms consistent with BraZetsu and related LATAM IAB malware registering Python-based payloads in Run keys or scheduled tasks.
author: Security Arsenal Threat Intel
id: 8f3a1c2e-braz-4e11-9f02-otxpulse0901b
status: experimental
logsource:
    category: registry_event
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_value:
        Details|contains:
            - 'python'
            - '.pyw'
            - 'AppData\Local\Temp'
            - 'AppData\Roaming'
    condition: selection_key and selection_value
falsepositives:
    - Rare; legitimate Python auto-start updaters
level: high
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.t1053.005
date: 2026/09/01
---
title: FUNNULL / Packagist Spyware C2 Infrastructure Connection
description: Detects outbound connections to FUNNULL-laundered infrastructure and direct-IP delivery associated with the malicious Packagist theme iOS spyware campaign.
author: Security Arsenal Threat Intel
id: 8f3a1c2e-braz-4e11-9f03-otxpulse0901c
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'funnull01.vip'
            - 'im.ue8im.com'
            - 'cre-ads.com'
            - 'xemphimlau.com'
            - 'infect.online'
    selection_ip:
        DestinationIp: '23.225.52.67'
    selection_port:
        DestinationPort: 4466
    condition: selection_domain or (selection_ip and selection_port) or selection_ip
falsepositives:
    - None expected; FUNNULL is bulletproof hosting
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
date: 2026/09/01

// Hunt: BraZetsu execution + FUNNULL/Packagist C2 + IAB recon behavior
let BraZetsuHashes = dynamic(["0e00adb0a5ca285b838af623c753b6ff","1b6dd10ace5e6e9a5e52dbbbc5e45289","27167134b9c5110fb4427829eff6dbad","7a7d962cc70d1b8079fc39382ab48ae6","7f1cba40545fa069e7f82023c82f936c","1d83329a31c21880b9fa86644ad466dbf86021d8","5e20d8736e86f2ebebaa5e9aa9257a2086839e47"]);
let C2Indicators = dynamic(["infect.online","funnull01.vip","im.ue8im.com","cre-ads.com","xemphimlau.com","23.225.52.67"]);
let ReconPattern = @"(wmic|systeminfo|net group|ipconfig /all|Login Data|vaultcmd|cnab|\.rem)";
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (C2Indicators) or RemoteIP has_any (C2Indicators)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend Detection = "C2-Network";
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "python.exe" or FileName =~ "pythonw.exe" or MD5 in (BraZetsuHashes) or SHA1 in (BraZetsuHashes))
    and ProcessCommandLine matches regex ReconPattern
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, MD5, SHA1, InitiatingProcessFileName
| extend Detection = "BraZetsu-Execution";
let FileHits = DeviceFileEvents
| where TimeGenerated > ago(7d)
| where MD5 in (BraZetsuHashes) or SHA1 in (BraZetsuHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, SHA1
| extend Detection = "Hash-Match";
union NetworkHits, ProcessHits, FileHits
| sort by TimeGenerated desc

# Security Arsenal — BraZetsu / FUNNULL IOC Hunt (2026-09-01 OTX Pulses)
# Run elevated on suspected endpoints or deploy via GPO/Intune/EDR live response.

$Report = @()

# 1. File hash sweep (BraZetsu samples)
$Hashes = @(
    "0e00adb0a5ca285b838af623c753b6ff","1b6dd10ace5e6e9a5e52dbbbc5e45289",
    "27167134b9c5110fb4427829eff6dbad","7a7d962cc70d1b8079fc39382ab48ae6",
    "7f1cba40545fa069e7f82023c82f936c"
)
$SweepPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public","C:\ProgramData")
foreach ($p in $SweepPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($Hashes -contains $h.ToLower()) {
            $Report += [pscustomobject]@{Type="HashHit"; Path=$_.FullName; Detail=$h}
        }
    }
}

# 2. Registry Run key persistence referencing python/temp paths
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($k in $RunKeys) {
    Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match "python|\.pyw|AppData|Temp"
        } | ForEach-Object {
            $Report += [pscustomobject]@{Type="Persistence"; Path=$k; Detail="$($_.Name) = $($_.Value)"}
        }
    }
}

# 3. Scheduled tasks executing python payloads
Get-ScheduledTask | ForEach-Object {
    $actions = ($_.Actions | Out-String)
    if ($actions -match "python|\.pyw|AppData\\Local\\Temp") {
        $Report += [pscustomobject]@{Type="ScheduledTask"; Path=$_.TaskPath; Detail="$($_.TaskName): $actions"}
    }
}

# 4. Active network connections to C2 infrastructure
$C2IPs = @("23.225.52.67")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $C2IPs -contains $_.RemoteAddress -or $_.RemotePort -eq 4466
} | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $Report += [pscustomobject]@{Type="C2Connection"; Path="$($_.RemoteAddress):$($_.RemotePort)"; Detail="Process: $proc (PID $($_.OwningProcess))"}
}

# 5. DNS cache check for C2 domains
$Domains = @("infect.online","funnull01.vip","im.ue8im.com","cre-ads.com","xemphimlau.com")
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $Domains) {
    $dns | Where-Object { $_.Entry -like "*$d*" } | ForEach-Object {
        $Report += [pscustomobject]@{Type="DNSCache"; Path=$_.Entry; Detail=$_.Data}
    }
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path ".\brazetsu_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
    Write-Host "[!] $($Report.Count) suspicious artifacts found. Isolate host and escalate to IR." -ForegroundColor Red
} else {
    Write-Host "[+] No BraZetsu/FUNNULL indicators detected on this host." -ForegroundColor Green
}