InterlockRAT, Rhysida Ransomware, and Procurement AiTM Phishing: OTX Pulse Analysis

---
title: Potential InterlockRAT or Trojanized Installer Execution
id: 8f3a1b2c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects execution of suspicious installers like ChromeSetup.exe from untrusted paths or specific hashes associated with the Hive0163 Interlock campaign.
references:
    - https://otx.alienvault.com/pulse/66510234/
author: Security Arsenal
date: 2026/08/03
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\ChromeSetup.exe'
            - '\update.exe'
        ParentImage|contains:
            - '\Downloads'
            - '\Temp'
    condition: selection
falsepositives:
    - Legitimate software updates initiated by users
level: high
---
title: AiTM Phishing Domain Connection
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network connections to known domains associated with the global procurement-themed AiTM phishing campaign targeting credentials.
references:
    - https://otx.alienvault.com/pulse/66510235/
author: Security Arsenal
date: 2026/08/03
tags:
    - attack.command_and_control
    - attack.1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Suspicious SystemBC Proxy Activity
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects potential execution patterns of SystemBC, a proxy tool often used by Rhysida and Interlock actors for C2 communication.
references:
    - https://otx.alienvault.com/pulse/66510234/
author: Security Arsenal
date: 2026/08/03
tags:
    - attack.defense_evasion
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains: '\Temp'
        Image|endswith: '.exe'
    selection_cmd:
        CommandLine|contains:
            - '-proxy'
            - '-connect'
    condition: all of selection_*
falsepositives:
    - Legitimate proxy utilities
level: medium


kql
// Hunt for specific file hashes from Pulse 1 (Interlock/Rhysida)
DeviceProcessEvents
| where FolderPath endswith ".exe" 
| where SHA256 in (
    "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983", 
    "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f",
    "43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2"
)
| project Timestamp, DeviceName, AccountName, FolderPath, SHA256

// Hunt for connections to AiTM Phishing Domains (Pulse 2)
DeviceNetworkEvents
| where RemoteUrl in (
    "sohantraders.com", "satoriestate.com", "dueminital.uk", 
    "assessmentevaluationreport.com", "barifurniture.net"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP


powershell
# IOC Hunt Script for Interlock/Rhysida Artifacts
# Checks for presence of file hashes listed in OTX Pulse 1 and common persistence locations

$maliciousHashes = @(
    "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983",
    "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f",
    "43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2",
    "edbf152ed9ac79e5d9e0111d1071af48"
)

Write-Host "Scanning for known malicious hashes..."

# Scan common user directories and temp folders
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA")

foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue -File | ForEach-Object {
            try {
                $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($maliciousHashes -contains $fileHash) {
                    Write-Host "[!] MALICIOUS FILE DETECTED: $($_.FullName) (Hash: $fileHash)" -ForegroundColor Red
                }
            } catch {
                # Ignore errors for locked files or access denied
            }
        }
    }
}

# Check for Scheduled Tasks often used by SystemBC/Interlock for persistence
Write-Host "Checking Scheduled Tasks for suspicious activity..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*rundll32*" -or $_.Actions.Execute -like "*powershell*" -and $_.TaskPath -notlike "\Microsoft*" } | Select-Object TaskName, TaskPath, Actions