Gamaredon APT, BTMOB Android RAT & Malicious VPN Extensions: OTX Pulse Analysis

title: Gamaredon Persistence via HTA in Startup Folder
id: b3f6a7d0-9c2d-4b5a-8e1f-1a2b3c4d5e6f
description: Detects the creation of HTA files in Windows Startup directories, a known persistence mechanism for Gamaredon Group (GammaWorm/GammaLoad).
status: experimental
date: 2026/07/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66846f8e8c266a7c09b8f4d5/
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 11
        TargetFilename|contains: '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\'
        TargetFilename|endswith: '.hta'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: critical

---
title: Suspicious Outbound Connection to VPN Extension C2 Infrastructure
id: c4e7b8e1-0d3e-5c6b-9f2a-2b3c4d5e6f7a
description: Detects outbound network connections to known IP addresses associated with malicious VPN browser extensions (Clipboard Stealers).
status: experimental
date: 2026/07/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66846f8e8c266a7c09b8f4d6/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: zeek
    service: conn
detection:
    selection:
        dest.ip:
            - '77.91.123.187'
            - '178.236.252.133'
            - '178.236.252.161'
    condition: selection
falsepositives:
    - Rare legitimate traffic to these specific IPs
level: high

---
title: HTML Smuggling via Browser Process Spawning MSHTA
id: d5f8c9f2-1e4f-6d7c-0a3b-3c4d5e6f7a8b
description: Detects browser processes spawning mshta.exe, indicative of HTML smuggling attacks often used by Gamaredon to deliver payloads.
status: experimental
date: 2026/07/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66846f8e8c266a7c09b8f4d5/
tags:
    - attack.initial_access
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\\chrome.exe'
            - '\firefox.exe'
            - '\\msedge.exe'
        Image|endswith: '\\mshta.exe'
    condition: selection
falsepositives:
    - Legitimate web-based applications launching HTA helpers
level: medium

// Hunt for Gamaredon C2 Infrastructure and Browser Extension C2s
let IOCs = dynamic([\"quitethepastry.ru\", \"trycloudflare.com\", \"arbsniper.com\", \"77.91.123.187\", \"178.236.252.133\", \"178.236.252.161\"]);
DeviceNetworkEvents
| where RemoteUrl has_any(IOCs) or RemoteIP has_any(IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

// Hunt for Malicious File Hashes (GammaWorm/BTMOB Samples)
let MaliciousHashes = dynamic([\"1794369214b7f62e70a0485e61335c61\", \"8e1624d110c090ff57d4b493a9107c66\", \"25e3c200de4868d754a3b4f4f09ec2bf\", \"43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56\"]);
DeviceFileEvents
| where SHA256 in MaliciousHashes or MD5 in MaliciousHashes
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessAccountName
| order by Timestamp desc

# IOC Hunt for Gamaredon Persistence and Malicious Extensions
# Requires Administrator Privileges

$SuspectHashes = @(
    \"1794369214b7f62e70a0485e61335c61\",
    \"8e1624d110c090ff57d4b493a9107c66\",
    \"25e3c200de4868d754a3b4f4f09ec2bf\",
    \"43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56\"
)

# 1. Check Startup Folders for HTA files (Gamaredon Persistence)
$StartupPaths = @(
    \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\",
    \"$env:ALLUSERSPROFILE\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\"
)

Write-Host \"[+] Scanning Startup Folders for suspicious HTA files...\"
foreach ($Path in $StartupPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter *.hta -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host \"[!] Suspicious HTA found: $($_.FullName)\"
            # Calculate Hash
            $FileHash = Get-FileHash -Path $_.FullName -Algorithm MD5
            if ($SuspectHashes -contains $FileHash.Hash) {
                Write-Host \"[CRITICAL] Known malicious hash detected: $($FileHash.Hash)\"
            }
        }
    }
}

# 2. Check Browser Extension Directories for Malicious IDs (VPN Go)
# Chrome Extensions
$ChromePaths = @(
    \"$env:LOCALAPPDATA\\Google\\Chrome\\User Data\",
    \"$env:APPDATA\\Google\\Chrome\\User Data\"
)

Write-Host \"[+] Scanning for Chrome Extensions matching VPN Go...\"
# Note: VPN Go IDs not explicitly provided in IOCs, but hunting for folder names in Profiles
foreach ($BasePath in $ChromePaths) {
    if (Test-Path $BasePath) {
        Get-ChildItem -Path $BasePath -Recurse -Directory -Filter \"Extensions\" | ForEach-Object {
            $ExtPath = $_.FullName
            # Look for recent modifications (last 7 days)
            Get-ChildItem -Path $ExtPath | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | ForEach-Object {
                Write-Host \"[!] Recently modified extension found: $($_.Name) in $ExtPath\"
            }
        }
    }
}

Write-Host \"[+] Hunt Complete.\"