DEV#POPPER npm RAT, Flying Eagle Android Botnet & APT28 Moobot Resurgence: OTX Pulse Analysis — Multi-Platform Detection Pack

---
title: DEV#POPPER Node.js RAT - Import-Time Implant Execution from node_modules
description: Detects Node.js spawning child processes or shells from within node_modules paths, consistent with the DEV#POPPER npm import-time implant installing a 77KB RAT and executing commands via Socket.IO C2.
status: experimental
logsource:
  category: process_creation
  product: windows
Detection:
  selection_parent:
    ParentImage|endswith: '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
  selection_path:
    CommandLine|contains:
      - 'node_modules'
      - '@joyfill'
  condition: selection_parent and (selection_child or selection_path)
falsepositives:
  - Legitimate build tooling (webpack, vite) spawning shells during compilation — filter on known CI build agents
level: high
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.t1059.007
---
title: Node.js Process Outbound Connection to Blockchain RPC Endpoints
description: Detects Node.js processes resolving or connecting to public blockchain RPC API endpoints (Tron, Aptos, BNB Smart Chain), a DEV#POPPER technique using blockchain transactions as a dead-drop resolver for encrypted payload retrieval.
status: experimental
logsource:
  category: dns
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    QueryName|contains:
      - 'trongrid.io'
      - 'tronapi'
      - 'fullnode.mainnet.aptoslabs.com'
      - 'aptoslabs'
      - 'bsc-dataseed'
      - 'bnbchain'
      - 'nodereal.io'
  filter_ci:
    Computer|contains: 'BUILD'
  condition: selection and not filter_ci
falsepositives:
  - Legitimate Web3/blockchain development activity — scope exclusions to known developer projects
level: medium
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
---
title: Moobot C2 Communication to Known Botnet Infrastructure
description: Detects network connections to Moobot/StresD Pro+ C2 infrastructure exposed via open directory, including activity post-2024 court-authorized disruption. Also flags connections to the fraudulent identity verification API host.
status: experimental
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - '86.53.111.212'
      - '162.141.92.192'
      - '112.21.241.27'
      - '39.175.139.108'
  selection_dns:
    QueryName|contains:
      - 'api.cemg.xyz'
      - '110gongan.com'
  selection_port:
    DestinationPort: 8080
    DestinationIp: '86.53.111.212'
  condition: selection_ip or selection_dns or selection_port
falsepositives:
  - Threat research and sandbox detonation traffic
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.impact
  - attack.t1498

// Multi-pulse hunt: DEV#POPPER npm implant behaviors + Moobot C2 + blockchain dead-drop resolution
// Microsoft Sentinel / Defender XDR
let MoobotC2 = dynamic(["86.53.111.212", "162.141.92.192", "112.21.241.27", "39.175.139.108"]);
let BadHosts = dynamic(["api.cemg.xyz", "110gongan.com", "trongrid.io", "fullnode.mainnet.aptoslabs.com"]);
let DEVPopperHashes = dynamic([
  "2cfede38fb121a71a2f3607474aa8cd588a99f51b37e5e6f0d8cb789fa275032",
  "26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18",
  "36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c",
  "adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6",
  "8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc",
  "5f6a92006ca2ea4b464d66fb41af777edce7296939a7c6ee491e2b3cbfe09848",
  "bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17",
  "1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where Timestamp > ago(30d)
   | where RemoteIP in (MoobotC2) or RemoteUrl has_any (BadHosts)
   | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, HuntTag="Network-C2"),
  (DeviceProcessEvents
   | where Timestamp > ago(30d)
   | where SHA256 in (DEVPopperHashes)
      or (FileName =~ "node.exe" and (ProcessCommandLine has_any ("node_modules", "@joyfill")
          and InitiatingProcessCommandLine has_any ("npm", "yarn", "pnpm", "node")))
      or (InitiatingProcessFileName =~ "node.exe" and FileName has_any ("cmd.exe", "powershell.exe", "curl.exe", "certutil.exe"))
   | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, HuntTag="Process-Implant"),
  (DeviceFileEvents
   | where Timestamp > ago(30d)
   | where SHA256 in (DEVPopperHashes) or FolderPath has_any ("@joyfill")
   | project Timestamp, DeviceName, FileName, FolderPath, SHA256, HuntTag="File-IOC")
| sort by Timestamp desc

# DEV#POPPER + Moobot Enterprise Hunt Script
# Checks: trojanized npm packages, suspicious node child processes, Moobot C2 connections, persistence artifacts
# Run elevated on developer workstations and build agents; output JSON for SIEM ingestion

$findings = @()

# 1. Trojanized @joyfill npm packages in node_modules / lockfiles
$npmPaths = @("$env:USERPROFILE", "C:\Repos", "D:\Projects", "C:\BuildAgent\work")
foreach ($base in $npmPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Include "package-lock.json","yarn.lock","pnpm-lock.yaml" -ErrorAction SilentlyContinue -Depth 5 |
            Select-String -Pattern '@joyfill' -List | ForEach-Object {
                $findings += [pscustomobject]@{Check='NPM-Lockfile'; Path=$_.Path; Detail='@joyfill reference found'; Severity='High'}
            }
        Get-ChildItem -Path $base -Recurse -Directory -Filter '@joyfill' -ErrorAction SilentlyContinue -Depth 6 | ForEach-Object {
            $findings += [pscustomobject]@{Check='NPM-node_modules'; Path=$_.FullName; Detail='@joyfill package installed'; Severity='Critical'}
        }
    }
}

# 2. Known DEV#POPPER SHA256 hashes staged on disk
$badHashes = @(
    '2cfede38fb121a71a2f3607474aa8cd588a99f51b37e5e6f0d8cb789fa275032',
    '26351aed0397158d3a3b8cc8fd3047d4c015d264c9895f10f20f1521b974ed18',
    '36ff00b45e67baa7e3674b0c80f48e88737264c61e5c6b3b091200972de8157c',
    'adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6',
    '8e8b90dedd456ded0c5748119836e1ca1066112bc569c1b41ca70eb931d1d4dc',
    '5f6a92006ca2ea4b464d66fb41af777edce7296939a7c6ee491e2b3cbfe09848',
    'bcc93dc55bc7daedf4ca57254f0e7a7f1c40e09851eab98fe10cde801982db17',
    '1352ad22c99983d91e600348b7cbf58235131b1ee34cea9f09623206d5b7dea7'
)
foreach ($ext in @('*.js','*.exe','*.node','*.dll')) {
    Get-ChildItem -Path "$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA\Programs" -Recurse -Include $ext -ErrorAction SilentlyContinue -Depth 4 | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) {
            $findings += [pscustomobject]@{Check='HashMatch'; Path=$_.FullName; Detail=$h; Severity='Critical'}
        }
    }
}

# 3. Active/historical connections to Moobot C2 infrastructure
$moobotIPs = @('86.53.111.212','162.141.92.192','112.21.241.27','39.175.139.108')
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $moobotIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $findings += [pscustomobject]@{Check='Moobot-C2-Live'; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) [$($_.State)]"; Severity='Critical'}
}

# 4. Node.exe spawning shells (DEV#POPPER command execution behavior)
Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -match '^(cmd|powershell|pwsh|curl|certutil)\.exe$'
} | ForEach-Object {
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
    if ($parent.Name -match '^node\.exe$') {
        $findings += [pscustomobject]@{Check='Node-Spawns-Shell'; Path=$_.ExecutablePath; Detail="Parent: $($parent.CommandLine)"; Severity='High'}
    }
}

# 5. Persistence artifacts referencing node/npm payloads
$regRun = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
foreach ($key in $regRun) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'node\.exe|node_modules|@joyfill' } | ForEach-Object {
            $findings += [pscustomobject]@{Check='Registry-RunKey'; Path="$key\$($_.Name)"; Detail=$_.Value; Severity='High'}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match 'node\.exe') -or ($_.Actions.Arguments -match 'node_modules|@joyfill')
} | ForEach-Object {
    $findings += [pscustomobject]@{Check='ScheduledTask'; Path=$_.TaskName; Detail=$_.Actions.Execute; Severity='High'}
}

# 6. DNS cache check for blockchain dead-drop resolution endpoints
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match 'trongrid|aptoslabs|bsc-dataseed|cemg\.xyz|110gongan'
} | ForEach-Object {
    $findings += [pscustomobject]@{Check='DNS-Cache'; Path=$_.Entry; Detail=$_.Data; Severity='Medium'}
}

$findings | ConvertTo-Json -Depth 4
if (-not $findings) { Write-Output '{"status":"clean","checks":6}' }