GlassWorm, EtherRAT & Rebex RAT: Blockchain-C2 and Multi-Stage Supply Chain Attacks

title: Suspicious Node.js Process Connecting to Ethereum RPC - EtherRAT
id: 5e0b2d8a-1a3b-4c5d-9e6f-1a2b3c4d5e6f
description: Detects Node.js processes establishing network connections to Ethereum RPC endpoints or known EtherRAT infrastructure domains, indicative of EtherHiding or EtherRAT activity.
references:
  - https://otx.alienvault.com/pulse/642712345678/
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    Initiated: 'true'
    DestinationPort:
      - 8545
      - 8546
  filter_legit_rpc:
    DestinationHostname|contains:
      - 'localhost'
      - '127.0.0.1'
  selection_domains:
    DestinationHostname|contains:
      - 'o-parana.com'
      - 'rpc.payload.de'
      - 'jariosos.com'
      - 'hayesmed.com'
      - 'regancontrols.com'
      - 'salinasrent.com'
      - 'justtalken.com'
      - 'mebeliotmasiv.com'
  condition: 1 of selection*
falsepositives:
  - Legitimate developer Web3 blockchain applications
level: high
---
title: Trojanized CHM File Spawning Python - Rebex Telegram RAT
id: f1e2d3c4-b5a6-4789-9012-3a4b5c6d7e8f
description: Detects HTML Help executable (hh.exe) spawning a Python interpreter, a common technique used in the Rebex-based Telegram RAT campaign to execute payloads embedded in CHM files.
references:
  - https://otx.alienvault.com/pulse/642798765432/
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\hh.exe'
    Image|endswith:
      - '\python.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Legitimate documentation requiring embedded scripts (rare)
level: high
---
title: Potential GlassWorm Browser Extension Tampering
id: a1b2c3d4-e5f6-47a8-9b0c-1d2e3f4a5b6c
description: Detects suspicious modifications to browser extension directories or registry keys, indicative of GlassWorm installing a fake surveillance extension.
references:
  - https://otx.alienvault.com/pulse/642712345678/
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Google\Chrome\Extensions\'
      - '\Software\Microsoft\Edge\Extensions\'
      - '\Software\Mozilla\Firefox\Extensions\'
    Details|contains:
      - 'update_url'
      - 'background'
  filter:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate software installing browser extensions
level: medium

// Hunt for EtherRAT network indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "o-parana.com", 
    "rpc.payload.de", 
    "jariosos.com", 
    "hayesmed.com", 
    "regancontrols.com", 
    "salinasrent.com", 
    "justtalken.com", 
    "mebeliotmasiv.com"
)
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteUrl
| order by Count desc
;
// Hunt for Rebex RAT File Hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "ced7fe9c5ec508216e6dd9a59d2d5193a58bdbac5f41a38ea97dd5c7fceef7a5",
    "1323278360d41a74ab09d310f08902087ff2798d1eda99be65d07c1b1123a25c",
    "67b51a73c72f39b9cf41dd35eb22b369713ab2e576641b40b9089ebc9d4a1fb2",
    "6db64b44305ff125f729713d7ff516e84e4ca38504a2ab0571eb19597f49feee"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName

<#
.SYNOPSIS
    IOC Hunt for GlassWorm, Rebex RAT, and EtherRAT
.DESCRIPTION
    Checks for the presence of specific file hashes (Rebex), 
    suspicious scheduled tasks (Rebex/EtherRAT persistence), and 
    network connections to blockchain RPCs (GlassWorm/EtherRAT).
#>

# Rebex RAT File Hashes
$RebexHashes = @(
    "ced7fe9c5ec508216e6dd9a59d2d5193a58bdbac5f41a38ea97dd5c7fceef7a5",
    "1323278360d41a74ab09d310f08902087ff2798d1eda99be65d07c1b1123a25c",
    "67b51a73c72f39b9cf41dd35eb22b369713ab2e576641b40b9089ebc9d4a1fb2",
    "6db64b44305ff125f729713d7ff516e84e4ca38504a2ab0571eb19597f49feee"
)

# EtherRAT Domains
$EtherRatDomains = @(
    "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com", 
    "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com"
)

Write-Host "[*] Scanning for Rebex RAT File Hashes..." -ForegroundColor Cyan
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($Drive in $Drives) {
    try {
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Length -gt 0 } | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($RebexHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (SHA256: $hash)" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[*] Checking DNS Cache for EtherRAT Domains..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $EtherRatDomains -contains $_.Entry } | 
    Select-Object Entry, Data, TimeToLive | 
    Format-Table -AutoSize

Write-Host "[*] Checking Scheduled Tasks for suspicious Shell hijacking or Node.js payloads..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*node*" -or 
    $_.Actions.Execute -like "*cmd*" -or 
    $_.Actions.Execute -like "*powershell*" 
} | Select-Object TaskName, TaskPath, State | Format-Table -AutoSize

Write-Host "[*] Checking for Browser Extension Modifications (Chrome/Edge)..." -ForegroundColor Cyan
$ExtPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"
)
# Basic check for recent modifications
foreach ($Path in $ExtPaths) {
    if (Test-Path $Path) {
        Get-ChildItem $Path -Recurse -Directory | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
        Select-Object FullName, LastWriteTime
    }
}