DesckVB RAT, Kali365 PhaaS, and Gamaredon GammaWorm: OTX Pulse Analysis — Multi-Vector Threat Landscape

---
title: Potential DesckVB RAT PowerShell Loader
description: Detects suspicious PowerShell execution patterns often associated with DesckVB RAT loaders, specifically obfuscated commands and AMSI bypass attempts observed in the malspam campaign.
references:
  - https://www.huntress.com/blog/malspam-to-deskcvb-rat-delivery-chain-analysis
author: Security Arsenal
date: 2026/06/04
status: experimental
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059.001
  - attack.t1562.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'FromBase64String'
      - 'AMSIBypass'
      - 'System.Management.Automation.AmsiUtils'
  filter_legit:
    ParentProcessName|contains:
      - '\System32\\'
      - '\Program Files\\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Kali365 OAuth Device Code Phishing Attempt
description: Detects attempts to activate OAuth 2.0 device codes, a technique used by Kali365 operators to bypass MFA and steal tokens for Microsoft, Okta, and AWS.
references:
  - https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/
author: Security Arsenal
date: 2026/06/04
status: experimental
tags:
  - attack.credential_access
  - attack.impact
  - attack.t1528
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AppDisplayName|contains:
      - 'Microsoft Office'
      - 'Okta'
      - 'AWS'
    AuthenticationRequirement: 'singleFactorAuthentication'
    DeviceDetail|isnotnull
    Status|contains:
      'Success'
  timeframe: 1h
condition: selection
falsepositives:
  - Legitimate device code login flow for IoT or Headless devices
level: medium
---
title: Gamaredon HTML Smuggling and HTA Persistence
description: Detects the creation of HTA files in startup folders or suspicious child processes of mshta.exe, indicative of Gamaredon GammaWorm or Pteranodon deployment.
references:
  - https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/
author: Security Arsenal
date: 2026/06/04
status: experimental
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1059.005
  - attack.t1547.001
logsource:
  product: windows
  service: security
detection:
  selection_mshta:
    EventID: 4688
    NewProcessName|contains: '\mshta.exe'
  selection_hta_creation:
    EventID: 11
    TargetFilename|endswith:
      - '.hta'
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
  condition: 1 of selection_*
falsepositives:
  - Legacy administrative tools
level: high

// Hunt for DesckVB and Gamaredon Network IOCs
let IoC_Domains = pack_array(
    'xtadts.ddns.net', 'afxwd.ddns.net', 'catalogo.castrouria.com', 
    'attachedfile.com', 'greatness-marketing.top', 'securehubcloud.com',
    'quitethepastry.ru'
);
let IoC_IPs = pack_array('104.194.140.6');
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend IoC_Match = iff(RemoteUrl in (IoC_Domains), "Domain", "IP")

# IOC Hunt for DesckVB RAT and Gamaredon Payloads
$TargetHashes = @( 
    "c356aff1a01c2b0da472e584c8e3c8f875b9a24280435d42836a77b19f5a8c18",
    "c61b1941cf756eb7551f7c661743802362728b785adc22e860d269713dfb01a6",
    "d5b7247c497788cf0031ceb06e3df77a45fef59f1e49633dc7159816d64759b5",
    "f1c3ebe78bd8c38559bf3cfcc9a9fa37d221e31780774a3787e26160a61f5348",
    "1794369214b7f62e70a0485e61335c61", # MD5 Gamaredon
    "8e1624d110c090ff57d4b493a9107c66"  # MD5 Gamaredon
)

Write-Host "[+] Scanning for known malicious file hashes..."

# Check common download directories and temp folders
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\ProgramData", "$env:APPDATA")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if (-not $Hash) { 
                # Fallback to MD5 if SHA256 fails (for small files/system constraints in this script)
                $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            }
            
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] ALERT: Malicious file found: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
            }
        }
    }
}

# Check for Gamaredon Persistence (HTA in Startup)
Write-Host "[+] Checking for Gamaredon persistence mechanisms..."
$StartupPaths = @("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup", 
                   "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup")

foreach ($StartPath in $StartupPaths) {
    if (Test-Path $StartPath) {
        Get-ChildItem -Path $StartPath -Filter "*.hta" -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "[!] Suspicious HTA file in Startup: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}