ClickFix, Argamal, CloudZ, and UAT-8302: OTX Pulse Analysis — Multi-Vector Credential Theft & APT Detection Pack

title: Suspicious finger.exe Execution (ClickFix Loader)
id: 7d8c9f2a-1b3c-4d5e-8f9a-1b2c3d4e5f6a
description: Detects the execution of finger.exe, which is abused by ClickFix campaigns to retrieve malicious payloads. Status: Experimental.
status: experimental
date: 2026/06/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/663d8f1b5e7e8b0c4a1b2c3d
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    filter_legit:
        ParentImage|contains: 
            - '\System32\'
            - '\SysWOW64\'
    condition: selection and not filter_legit
falsepositives:
    - Rare legitimate use of finger client
level: high
---
title: Argamal COM Hijacking Persistence via WCS
description: Detects registry modifications associated with Argamal malware persistence via Windows Color System (mscms.dll) COM hijacking.
id: 9e0f1g2h-3i4j-5k6l-7m8n-9o0p1q2r3s4t
status: experimental
date: 2026/06/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/663d8f1b5e7e8b0c4a1b2c4e
tags:
    - attack.persistence
    - attack.t1546.015
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\CLSID\'
        TargetObject|contains: '\InprocServer32'
        TargetObject|contains: 'mscms.dll'
        Details|contains: 
            - '%APPDATA%'
            - '%TEMP%'
    condition: selection
falsepositives:
    - Unlikely, rare legitimate COM hijacking for this DLL
level: critical
---
title: UAT-8302 CloudSorcerer Exploit Attempt
description: Detects potential exploitation of CVE-2025-0994 or similar vulnerabilities associated with UAT-8302 CloudSorcerer activity.
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
date: 2026/06/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/663d8f1b5e7e8b0c4a1b2c5f
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
        IpAddress|startswith:
            - '194.150.220.'
            - '217.156.122.'
    condition: selection
falsepositives:
    - Legitimate traffic from these specific IPs if whitelisted
level: high

// Hunt for ClickFix finger.exe execution and Argamal Persistence
// Check for Process Creation
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("finger.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any ("finger", "castle", "argamal", "termixia") 
   or InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "firefox.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

// Hunt for Network connections to known IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("trindastal.com", "poronto.com", "guiformat.com", "forestoaker.com", "giovettiadv.com")
   or RemoteIP in ("194.150.220.218", "217.156.122.75")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort

// Check for specific File Hashes
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92", 
    "5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321",
    "fb6cebadd49d202c8c7b5cdd641bd16aac8258429e8face365a94bd32e253b00"
)
| project Timestamp, DeviceName, FolderPath, SHA256

# IOC Hunt Script for Argamal and ClickFix Artifacts
# Requires Admin Privileges

Write-Host "[*] Hunting for Argamal COM Hijack Persistence..." -ForegroundColor Cyan

# Argamal Persistence Check (Registry)
$clsidPath = "HKCU:\Software\Classes\CLSID"
if (Test-Path $clsidPath) {
    $guids = Get-ChildItem $clsidPath
    foreach ($guid in $guids) {
        $inprocPath = Join-Path $guid.PSPath "InprocServer32"
        if (Test-Path $inprocPath) {
            $defaultVal = (Get-ItemProperty $inprocPath -ErrorAction SilentlyContinue)."(default)"
            if ($defaultVal -match "mscms.dll") {
                # Check if the default value points outside system32 (suspicious)
                if ($defaultVal -notmatch "C:\\Windows\\System32") {
                    Write-Host "[!] Suspicious COM Hijack found for GUID: $($guid.PSChildName)" -ForegroundColor Red
                    Write-Host "    Path: $defaultVal" -ForegroundColor Yellow
                }
            }
        }
    }
}

Write-Host "[*] Checking for ClickFix related process execution (finger.exe)..." -ForegroundColor Cyan
$process = Get-Process finger -ErrorAction SilentlyContinue
if ($process) {
    Write-Host "[!] finger.exe process is currently running (Potential ClickFix Activity)." -ForegroundColor Red
    $process | Select-Object Id, ProcessName, Path, StartTime
} else {
    Write-Host "[-] No suspicious finger.exe process found." -ForegroundColor Green
}

Write-Host "[*] Scanning for specific CloudZ/UAT-8302 File Hashes..." -ForegroundColor Cyan
$targetHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321",
    "fb6cebadd49d202c8c7b5cdd641bd16aac8258429e8face365a94bd32e253b00"
)

# Quick scan of user profile directories and temp
$pathsToScan = @("$env:USERPROFILE", "$env:TEMP")
foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Length -gt 0 -and $_.Extension -ne ".tmp") {
                $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($hash -in $targetHashes) {
                    Write-Host "[!] Malicious file found: $($_.FullName)" -ForegroundColor Red
                    Write-Host "    Hash: $hash" -ForegroundColor Yellow
                }
            }
        }
    }
}