Infostealer Surge & Access Broker Operations: StealC, Amadey, and Mistic Backdoor Analysis

---
title: Potential StealC or Amadey Infostealer Activity
id: 867e2d0b-8d5f-4b6a-9e0b-1a2b3c4d5e6f
status: experimental
description: Detects behavior consistent with StealC or Amadey infostealers, specifically suspicious access to browser credential stores or SQLite databases by non-browser processes.
references:
    - https://otx.alienvault.com/pulse/667b1a9b9e4b0a8f8a0b1c2d
author: Security Arsenal Research
date: 2026/06/28
modified: 2026/06/28
tags:
    - attack.credential_access
    - attack.t1555.003
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Cookies'
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Mozilla\Firefox\Profiles\'
            - '\AppData\Roaming\Opera Software\Opera Stable\Login Data'
    filter_main_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\opera.exe'
            - '\msedge.exe'
            - '\brave.exe'
    condition: selection and not filter_main_browsers
falsepositives:
    - Legitimate backup software accessing browser data
level: high
---
title: Suspicious Sideloading Behavior Linked to Woodgnat/Mistic
id: 92f3e1c4-7a6b-4d8e-9f1c-2b3c4d5e6f70
status: experimental
description: Detects potential DLL sideloading used by Mistic backdoor or similar tools, where a signed process loads a DLL from an unexpected location.
references:
    - https://otx.alienvault.com/pulse/667c2d9b9e4b0a8f8a0b1c2e
author: Security Arsenal Research
date: 2026/06/28
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection_signed:
        Signed: 'true'
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Downloads\'
            - '\Public\'
    selection_extensions:
        ImageLoaded|endswith: '.dll'
    filter_legit:
        Image|contains:
            - '\Windows\System32\'
            - '\Windows\SysWOW64\'
            - '\Program Files\'
    condition: selection_signed and selection_extensions and not filter_legit
falsepositives:
    - Legitimate software installers
level: high
---
title: JINX-0164 Cryptocurrency Dev Targeting via NPM or Script
id: 13a4b2d5-8c7e-5f9a-0g2h-3c4d5e6f7g80
status: experimental
description: Detects execution patterns associated with JINX-0164 targeting crypto devs, including npm installs from non-standard sources or script download anomalies.
references:
    - https://otx.alienvault.com/pulse/667e4f9b9e4b0a8f8a0b1c30
author: Security Arsenal Research
date: 2026/06/28
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_npm:
        Image|endswith: '\npm.cmd'
        CommandLine|contains: 'install'
    selection_suspicious_url:
        CommandLine|contains:
            - 'driver-updater.net'
            - 'live.ong'
            - 'teamicrosoft.com'
    selection_script:
        Image|endswith:
            - '\powershell.exe'
            - '\python.exe'
        CommandLine|contains:
            - 'install.sh'
            - 'troubleshoot/mac/'
    condition: 1 of selection*
falsepositives:
    - Legitimate developer npm install workflows (verify domain)
level: medium

// Hunt for StealC, Amadey, and Woodgnat C2 Infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'microsoft-telemetry.at',
    'svclsc.com',
    'goodpanelforgoodjob.com',
    'authorized-logins.net',
    'mueleer.com',
    'grande-luna.top',
    'oeannon.com',
    'thomphon.com',
    'human-check.top',
    'update-fall.com',
    'driver-updater.net',
    'teamicrosoft.com',
    'live.ong',
    'live.us.org'
) or RemoteIP in (
    '176.124.199.207',
    '176.111.174.140',
    '62.60.226.159',
    '94.154.35.25',
    '64.188.91.237',
    '196.251.107.130',
    '89.36.224.5',
    '104.200.67.46'
)
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName
| project-reorder Count, DeviceName, RemoteUrl, RemoteIP

# Hunt for Mistic/StealC Persistence and C2 Connections
Write-Host "Checking for C2 Connections associated with OTX Pulses..." -ForegroundColor Cyan

$BadIPs = @(
    "176.124.199.207", "176.111.174.140", "62.60.226.159", 
    "94.154.35.25", "64.188.91.237", "196.251.107.130", 
    "89.36.224.5", "104.200.67.46"
)

$BadDomains = @(
    "microsoft-telemetry.at", "svclsc.com", "authorized-logins.net",
    "update-fall.com", "googleoba.servequake.com"
)

# Check Active TCP Connections
$Connections = Get-NetTCPConnection -State Established | 
    Where-Object { $BadIPs -contains $_.RemoteAddress } | 
    Select-Object LocalAddress, RemoteAddress, RemotePort, OwningProcess

if ($Connections) {
    Write-Host "[!] ALERT: Found connections to malicious IPs:" -ForegroundColor Red
    $Connections | Format-Table
} else {
    Write-Host "No connections to known malicious IPs found." -ForegroundColor Green
}

# Check for Suspicious Scheduled Tasks (Common in StealC/Amadey)
Write-Host "`nChecking for Suspicious Scheduled Tasks..." -ForegroundColor Cyan
$SuspiciousTasks = Get-ScheduledTask | 
    Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } |
    Where-Object { $_.Actions.Arguments -match "http(s)?://(microsoft-telemetry|svclsc|authorized-logins)" }

if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Found suspicious scheduled tasks:" -ForegroundColor Red
    $SuspiciousTasks | Select-Object TaskName, Actions | Format-List
} else {
    Write-Host "No suspicious scheduled tasks found." -ForegroundColor Green
}

# File Hash Check for Known Malware Samples
Write-Host "`nScanning for known malware file hashes in user directories..." -ForegroundColor Cyan
$KnownHashes = @(
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea", # StealC
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", # Mistic
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", # AUDIOFIX
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470"  # KimJongRAT
)

$UserDirs = @("C:\Users\*\Downloads", "C:\Users\*\AppData\Local\Temp", "C:\Users\*\AppData\Roaming")
$FoundFiles = @()

foreach ($dir in $UserDirs) {
    if (Test-Path $dir) {
        Get-ChildItem -Path $dir -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Length -gt 0 -and $_.Length -lt 10MB) {
                $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($KnownHashes -contains $hash) {
                    $FoundFiles += $_
                }
            }
        }
    }
}

if ($FoundFiles) {
    Write-Host "[!] CRITICAL: Found known malware samples!" -ForegroundColor Red
    $FoundFiles | Select-Object FullName, Length | Format-Table
} else {
    Write-Host "No known malware files found in common directories." -ForegroundColor Green
}