---
title: Potential Android Malware Download - India Tax Campaign
id: 8b2e9c1f-4a5d-4b6e-8c7d-9f0a1b2c3d4e
status: experimental
description: Detects the download of the malicious ITD.zip file or Android APK associated with the Indian tax phishing campaign based on known hashes and filenames.
author: Security Arsenal
date: 2026/08/01
tags:
  - attack.initial_access
  - attack.credential_access
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\\ITD.zip'
      - '\\IncomeTaxDepartment.apk'
  selection_hash:
    Hashes|contains:
      - '2d85a7a16d1eb86dfd92b00f6267733d'
      - '538ad8e0ad1fec0ecc54f9e120ac6ff9'
      - 'dff2b7a23882445b4e354199bf38554f'
      - '7479fbc27320ae246db9030cca80809ec63de0e9'
  condition: 1 of selection*
falsepositives:
  - Legitimate tax software downloads (unlikely to be zip format)
level: high
---
title: Suspicious Domain Rotation - PasasteSinTAG Phishing
id: 9c3f0d2e-5b6e-4c7f-9d8e-0a1b2c3d4e5f
status: experimental
description: Detects DNS queries to domains utilizing the 'pasastesintag' typo-squatting pattern or suspicious TLDs associated with the Chilean phishing campaign.
author: Security Arsenal
date: 2026/08/01
tags:
  - attack.resource_development
  - attack.command_and_control
logsource:
  product: zeek
  category: dnsservice
detection:
  selection_keywords:
    query|contains:
      - 'pasastesintag'
      - 'parastesintago'
  selection_tlds:
    query|endswith:
      - '.cfd'
      - '.cyou'
      - '.top'
      - '.xyz'
  condition: 1 of selection*
falsepositives:
  - Legitimate traffic to similar looking domains (verify manually)
level: medium
---
title: C2 Communication - Tax Malware Infrastructure
id: 0d4e1f3a-6c7d-5e8f-0a9b-1b2c3d4e5f6a
status: experimental
description: Identifies network connections to known C2 and delivery infrastructure associated with the Indian Tax infostealer campaign.
author: Security Arsenal
date: 2026/08/01
tags:
  - attack.command_and_control
  - attack.exfiltration
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationHostname|contains:
      - 'laoshunfa.xyz'
      - 'gov-xnui.com'
      - 'gova.lat'
      - 'indiaaba.com'
  condition: selection
falsepositives:
  - None known
level: critical


kql
// Hunt for DNS queries related to PasasteSinTAG phishing infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("pasastesintag", "parastesintago") 
   or RemoteUrl matches regex @"\.(cfd|cyou|top|xyz|icu|mom|sbs)$"
| summarize Count=count() by DeviceName, RemoteUrl, ActionType
| order by Count desc


powershell
# IOC Hunt Script - Check for presence of threat indicators

# Define IOCs from the brief
$maliciousHashes = @(
    "2d85a7a16d1eb86dfd92b00f6267733d",
    "538ad8e0ad1fec0ecc54f9e120ac6ff9",
    "dff2b7a23882445b4e354199bf38554f",
    "7479fbc27320ae246db9030cca80809ec63de0e9"
)

$maliciousDomains = @(
    "laoshunfa.xyz",
    "gov-xnui.com",
    "gova.lat",
    "indiaaba.com",
    "pasastesintag.pics",
    "parastesintago.click"
)

Write-Host "[*] Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check Hosts File for malicious domain mappings
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($domain in $maliciousDomains) {
        if ($hostsContent -match $domain) {
            Write-Host "[!] ALERT: Domain $domain found in hosts file." -ForegroundColor Red
        }
    }
}

# 2. Check recent downloads for ITD.zip
$userProfile = $env:USERPROFILE
$downloadFolders = @(
    "$userProfile\Downloads",
    "$userProfile\Desktop",
    "$env:TEMP"
)

foreach ($folder in $downloadFolders) {
    if (Test-Path $folder) {
        Write-Host "[*] Scanning $folder for ITD.zip..." -ForegroundColor Gray
        Get-ChildItem -Path $folder -Filter "*.zip" -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Name -eq "ITD.zip" } | 
        ForEach-Object {
            Write-Host "[!] ALERT: ITD.zip found at $($_.FullName)" -ForegroundColor Red
            # Calculate hash to verify
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
            if ($maliciousHashes -contains $fileHash) {
                Write-Host "[!!!] CRITICAL: File matches known malicious hash." -ForegroundColor DarkRed
            }
        }
    }
}

Write-Host "[*] Hunt complete." -ForegroundColor Green


# Response Priorities