Larva-26005 (North Korea) Xctdoor Backdoor Campaign: CRAT Lineage, DLL Side-Loading & Ngrok C2 — OTX Enterprise Detection Pack

---
title: Larva-26005 Xctdoor LNK Execution and DLL Side-Loading
id: 8f3a2b1c-26005-xctdoor-lnk-sideload
description: Detects spear-phishing LNK execution spawning script interpreters or rundll32, consistent with Xctdoor/XcLoader delivery and DLL side-loading tradecraft used by Larva-26005.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/06
references:
    - https://asec.ahnlab.com/en/94847
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_lnk_child:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    selection_lnk_cmdline:
        CommandLine|contains:
            - '.lnk'
            - 'temp\'
            - 'appdata\'
            - 'programdata\'
    condition: selection_lnk_parent and selection_lnk_child and selection_lnk_cmdline
falsepositives:
    - Legitimate shortcut-driven application launches (rare for rundll32/mshta parents)
level: high
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1574.002
---
title: Larva-26005 Xctdoor C2 Communication and Ngrok Tunneling
id: 8f3a2b1c-26005-xctdoor-c2-ngrok
description: Detects DNS or network connections to known Larva-26005 Xctdoor C2 domains or Ngrok tunnel endpoints spawned by non-browser processes, matching ThreatNeedle/Ngrok tunneling tradecraft.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/06
references:
    - https://asec.ahnlab.com/en/94847
logsource:
    category: dns
    product: windows
detection:
    selection_c2:
        query|contains:
            - 'casinolegit.info'
            - 'ntsgo.name'
            - 'ntsgo-corp.com'
            - 'fabioluciani.com'
    selection_ngrok:
        query|contains:
            - 'ngrok.io'
            - 'ngrok.com'
            - 'ngrok-free.app'
    condition: selection_c2 or selection_ngrok
falsepositives:
    - Developers legitimately using Ngrok (restrict by process context in your SIEM join)
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1572
---
title: Larva-26005 Ghostscript Exploitation CVE-2017-8291 Spawning Suspicious Child Processes
id: 8f3a2b1c-26005-ghostscript-cve-2017-8291
description: Detects Ghostscript (gswin32c/gswin64c) spawning shells or script interpreters, indicative of CVE-2017-8291 exploitation in document-processing chains used by Larva-26005.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/06
references:
    - https://asec.ahnlab.com/en/94847
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\gswin32c.exe'
            - '\gswin64c.exe'
            - '\gs.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - None expected; Ghostscript should never spawn shells in normal operation
level: critical
tags:
    - attack.execution
    - attack.t1203
    - cve.2017-8291

// Larva-26005 Xctdoor Hunt — C2 beacons, LNK/side-load execution, Ngrok abuse
// Microsoft Sentinel / Defender for Endpoint
let c2_domains = dynamic(["casinolegit.info", "ntsgo.name", "ntsgo-corp.com", "fabioluciani.com"]);
let ngrok_suffixes = dynamic(["ngrok.io", "ngrok.com", "ngrok-free.app"]);
let known_hashes = dynamic([
    "0d2e61c8a5e6280e065b61e75b848c68",
    "12391f66ee33d379108fd649a999e1a0",
    "01b58f2ff2c14feed46a0768ea46686d"]);
let suspicious_children = dynamic(["rundll32.exe", "regsvr32.exe", "mshta.exe",
    "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe"]);
union isfuzzy=true
    // 1) Network beacons to Xctdoor C2 or Ngrok tunnels from non-browser processes
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (c2_domains)
       or (RemoteUrl has_any (ngrok_suffixes)
           and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","ngrok.exe"))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteUrl, RemoteIP, ActionType, HuntSignal="C2_Beacon"),
    // 2) LNK-driven execution chain: explorer spawning script interpreters referencing .lnk
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ (suspicious_children)
    | where ProcessCommandLine has_any (".lnk", "\\temp\\", "\\appdata\\", "\\programdata\\")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, HuntSignal="LNK_Execution"),
    // 3) Hash match on known Xctdoor / XcLoader samples
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where MD5 in~ (known_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, MD5, HuntSignal="Hash_Match"),
    // 4) Ghostscript CVE-2017-8291 exploitation: gs spawning shells
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName has_any ("gswin32c", "gswin64c", "gs.exe")
    | where FileName in~ (suspicious_children)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, HuntSignal="Ghostscript_Exploit")
| sort by TimeGenerated desc

# Larva-26005 / Xctdoor IOC Hunt Script
# Checks hosts for C2 connections, persistence artifacts, and known malware hashes
# Run elevated; suitable for remote sweep via Invoke-Command

$C2Domains   = @("casinolegit.info","ntsgo.name","ntsgo-corp.com","www.fabioluciani.com")
$KnownHashes = @("0d2e61c8a5e6280e065b61e75b848c68",
                 "12391f66ee33d379108fd649a999e1a0",
                 "01b58f2ff2c14feed46a0768ea46686d")
$SuspectDirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData")
$findings = @()

Write-Host "[*] Larva-26005 Xctdoor Hunt - $(Get-Date -Format o)`n" -ForegroundColor Cyan

# --- 1) Active network connections resolving to C2 / ngrok ---
Write-Host "[1] Checking DNS cache and active connections for C2 artifacts..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $C2Domains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $findings += "DNS cache hit for C2 domain: $d" }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $rdns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
        if ($C2Domains | Where-Object { $rdns -like "*$_*" } -or $rdns -like "*ngrok*") {
            $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
            $findings += "Suspicious connection: $($_.RemoteAddress) ($rdns) PID $($_.OwningProcess) [$proc]"
        }
    } catch {}
}

# --- 2) Persistence: Run keys with side-loading-style paths ---
Write-Host "[2] Auditing Run keys and scheduled tasks..." -ForegroundColor Yellow
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
            if ($val -match "(?i)(temp|appdata|programdata|rundll32|regsvr32|\.dll)") {
                $findings += "Suspicious Run key: $key\$($_.Name) = $val"
            }
        }
    }
}
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match "(?i)(rundll32|regsvr32|mshta|powershell)" -and
    $_.Actions.Arguments -match "(?i)(temp|appdata|programdata|\.dll|http)"
} | ForEach-Object { $findings += "Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

# --- 3) Hash sweep in suspect directories ---
Write-Host "[3] Hashing binaries in TEMP/APPDATA/PROGRAMDATA (this may take a while)..." -ForegroundColor Yellow
foreach ($dir in $SuspectDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
            $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($KnownHashes -contains $md5.ToLower()) {
                $findings += "MALWARE HASH MATCH: $($_.FullName) [$md5]"
            }
        }
    }
}

# --- 4) Orphaned DLLs next to legitimate binaries (side-load staging) ---
Write-Host "[4] Checking for recently modified DLLs outside System32 (side-load staging)..." -ForegroundColor Yellow
Get-ChildItem $SuspectDirs -Recurse -Include *.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) -and
                   -not (Get-AuthenticodeSignature $_.FullName -ErrorAction SilentlyContinue).Status -eq "Valid" } |
    ForEach-Object { $findings += "Unsigned recent DLL (possible side-load payload): $($_.FullName)" }

# --- Report ---
Write-Host "`n=== HUNT RESULTS ===" -ForegroundColor Cyan
if ($findings.Count -eq 0) {
    Write-Host "[+] No Larva-26005 / Xctdoor artifacts detected on $env:COMPUTERNAME" -ForegroundColor Green
} else {
    $findings | ForEach-Object { Write-Host "[!] $_" -ForegroundColor Red }
    $findings | Out-File "$env:TEMP\xctdoor_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).log"
    Write-Host "`nFindings logged to $env:TEMP. ISOLATE THIS HOST and escalate to IR." -ForegroundColor Red
}