CARBONATO Docker Botnet + PavinLoader/Amatera Stealer: OTX Pulse Analysis — Exposed Daemon Exploitation & ClickFix Credential Theft Detection Pack

---
title: Exposed Docker Daemon Remote Container Creation (CARBONATO)
id: 7c1a2f3e-9b4d-4e6a-a1c2-5d8f0b3e9a71
status: experimental
description: Detects unauthenticated Docker API activity on TCP/2375 consistent with CARBONATO botnet container deployment via exposed Docker daemons.
author: Security Arsenal Threat Intel
date: 2026/09/24
references:
  - https://www.threatdown.com/blog/carbonato/
logsource:
  category: network_connection
  product: windows
  detection:
    selection_port:
      DestinationPort: 2375
    selection_action:
      EventID: 3
    condition: selection_port and selection_action
falsepositives:
  - Legitimate internal Docker orchestration (restrict by internal subnet allowlist)
level: high
tags:
  - attack.initial_access
  - attack.t1190
---
title: ClickFix MSBuild Inline Task Execution (PavinLoader)
id: 2e8b4c1d-6f7a-4d2b-9c3e-1a5f8d0b6c42
status: experimental
description: Detects MSBuild.exe spawned by user-context shell processes or Office/browser processes, consistent with PavinLoader ClickFix infection chains abusing MSBuild inline tasks.
author: Security Arsenal Threat Intel
date: 2026/09/24
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\MSBuild.exe'
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\rundll32.exe'
  condition: selection_image and selection_parent
falsepositives:
  - Developer workstations compiling Visual Studio projects from CLI
level: high
tags:
  - attack.defense_evasion
  - attack.t1127.001
  - attack.execution
---
title: Suspicious Web3 RPC Blockchain Lookup (EtherHiding C2 Retrieval)
id: 4f9d2a7b-3c5e-4a1f-8b6d-2e7c9a0f1d53
status: experimental
description: Detects processes making outbound HTTPS requests to public blockchain RPC endpoints, consistent with PavinLoader EtherHiding technique resolving C2 domains from smart contracts.
author: Security Arsenal Threat Intel
date: 2026/09/24
logsource:
  category: proxy
detection:
  selection_domain:
    c-useragent|contains|all: []
    cs-host|contains:
      - 'bsc-dataseed.binance.org'
      - 'mainnet.infura.io'
      - 'rpc.ankr.com'
      - 'eth.llamarpc.com'
      - 'cloudflare-eth.com'
  filter_browsers:
    process|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_domain and not filter_browsers
falsepositives:
  - Legitimate crypto/Web3 enterprise applications
level: medium
tags:
  - attack.command_and_control
  - attack.t1102

// PavinLoader / Amatera Stealer & CARBONATO hunt — Microsoft Sentinel
// 1) Network IOCs from OTX pulses
let BadIPs = dynamic(["213.136.79.115","190.211.124.187","91.99.195.164"]);
let BadDomains = dynamic(["more-arpc.icu","rpcsecnoweb.pro","kelemet.shop","nexahub.lat","stellar-minds.cfd","perfectverified.com","catalyst-pro.lat","twigoamwu.cfd"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (BadIPs) or RemoteUrl in (BadDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
// 2) ClickFix behavior: powershell spawned by explorer/browser, then MSBuild child
let ClickFix = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName in~ ("explorer.exe","chrome.exe","msedge.exe","firefox.exe")
| extend PowershellDevice = DeviceName, PowershellTime = TimeGenerated
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "MSBuild.exe"
    | project MSBuildTime = TimeGenerated, DeviceName, MSBuildCmd = ProcessCommandLine, FolderPath
) on DeviceName
| where MSBuildTime between (PowershellTime .. PowershellTime + 30m)
| project PowershellTime, DeviceName, PowershellCmd = ProcessCommandLine, MSBuildCmd, FolderPath;
// 3) Exposed Docker daemon connections (TCP/2375) from non-allowlisted hosts
let Docker2375 = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort == 2375
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort;
union NetHits, ClickFix, Docker2375
| sort by TimeGenerated desc

# Security Arsenal — CARBONATO / PavinLoader / Amatera IOC Hunt
# Run elevated on suspected endpoints. Outputs findings to C:\IR\ioc_hunt.csv
$findings = @()
$outDir = "C:\IR"; New-Item -ItemType Directory -Path $outDir -Force | Out-Null

# 1) Network connections to CARBONATO C2 IPs
$badIPs = @("213.136.79.115","190.211.124.187","91.99.195.164")
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $findings += [pscustomobject]@{Type="NetIOC"; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.ProcessName)"; Host=$env:COMPUTERNAME}
}

# 2) DNS cache hits for PavinLoader lure/C2 domains
$badDomains = @("more-arpc.icu","rpcsecnoweb.pro","kelemet.shop","nexahub.lat","stellar-minds.cfd","perfectverified.com","catalyst-pro.lat","twigoamwu.cfd")
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $badDomains) {
    $dns | Where-Object { $_.Entry -like "*$d*" } | ForEach-Object {
        $findings += [pscustomobject]@{Type="DNSIOC"; Detail=$_.Entry; Host=$env:COMPUTERNAME}
    }
}

# 3) ClickFix artifacts: suspicious RunMRU entries (users pasting PowerShell from fake captcha)
$runMRU = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
if (Test-Path $runMRU) {
    (Get-ItemProperty $runMRU).PSObject.Properties | Where-Object {
        $_.Value -match "powershell|msbuild|mshta|curl|Invoke-Expression|iex"
    } | ForEach-Object {
        $findings += [pscustomobject]@{Type="ClickFix-RunMRU"; Detail="$($_.Name)=$($_.Value)"; Host=$env:COMPUTERNAME}
    }
}

# 4) Scheduled tasks launching MSBuild or PowerShell (PavinLoader persistence)
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match "msbuild|powershell|mshta" }
    if ($actions) {
        $findings += [pscustomobject]@{Type="Persistence-Task"; Detail="$($_.TaskName) -> $($actions.Execute) $($actions.Arguments)"; Host=$env:COMPUTERNAME}
    }
}

# 5) Amatera Stealer artifacts: recent access to browser credential stores by non-browser processes
$credPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data",
    "$env:APPDATA\Mozilla\Firefox\Profiles"
)
foreach ($p in $credPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
                $findings += [pscustomobject]@{Type="CredStore-Modified"; Detail=$_.FullName; Host=$env:COMPUTERNAME}
            }
    }
}

# 6) Docker exposure check (CARBONATO target): daemon listening on 2375
if (Get-NetTCPConnection -LocalPort 2375 -ErrorAction SilentlyContinue) {
    $findings += [pscustomobject]@{Type="Docker-Exposed"; Detail="Docker daemon listening on TCP/2375 — CARBONATO target"; Host=$env:COMPUTERNAME}
}

$findings | Export-Csv "$outDir\ioc_hunt.csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) findings -> $outDir\ioc_hunt.csv"