Lua Loader Infostealer Campaign + GoSerpent APT Backdoor: OTX Pulse Analysis — Agent Tesla, XWorm & Southeast Asia Government Targeting Detection Pack

---
title: Lua or AutoIt Loader Execution from Archive Phishing Stager
id: 7f3a1c2e-9b4d-4e1a-8c5f-20260815lualdr
status: experimental
description: Detects obfuscated JavaScript phishing stagers spawning AutoIt or LuaJIT interpreters, matching the TTF Trap campaign chain delivering Agent Tesla, Remcos, XWorm, and Snake Keylogger.
references:
    - https://www.fortinet.com/blog/threat-research/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader
author: Security Arsenal Threat Intelligence
date: 2026/08/15
tags:
    - attack.execution
    - attack.t1059.007
    - attack.t1059.005
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
    definition: 'Requires Sysmon or equivalent command-line auditing'
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    selection_child:
        Image|endswith:
            - '\autoit3.exe'
            - '\autoit3_x64.exe'
            - '\luajit.exe'
            - '\lua.exe'
            - '\lua51.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate software deployment scripts using AutoIt launched by script hosts
level: high
---
title: Agent Tesla SMTP Credential Exfiltration to Suspicious Mail Host
id: 2b8d4f6a-1c7e-4a3b-9d2e-20260815smtpex
status: experimental
description: Detects outbound SMTP connections from non-mail-server processes, consistent with Agent Tesla / Snake Keylogger SMTP exfiltration to attacker-controlled mail hosts (e.g. mail.taikei-rmc-co.biz, mail.allportcargoservice.com).
references:
    - https://www.fortinet.com/blog/threat-research/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader
author: Security Arsenal Threat Intelligence
date: 2026/08/15
tags:
    - attack.exfiltration
    - attack.t1048.003
    - attack.collection
    - attack.t1119
logsource:
    category: network_connection
    product: windows
    definition: 'Requires Sysmon Event ID 3 or equivalent network telemetry'
detection:
    selection_port:
        DestinationPort:
            - 25
            - 465
            - 587
    selection_image_exclude:
        Image|endswith:
            - '\outlook.exe'
            - '\thunderbird.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\svchost.exe'
    selection_host:
        DestinationHostname|contains:
            - 'taikei-rmc-co.biz'
            - 'allportcargoservice.com'
    condition: selection_port and not selection_image_exclude or selection_host
falsepositives:
    - Legacy line-of-business applications with hard-coded SMTP reporting
level: high
---
title: GoSerpent Post-Exploitation Credential Dumping Tool Execution
id: 5c1e9a3d-6f2b-4d8c-b7a1-20260815goserp
status: experimental
description: Detects execution of QuarksDumpLocalHash, Mimikatz variants, and Stowaway proxy tooling associated with TetrisPhantom GoSerpent intrusions, including renamed binary detection via command-line and hash indicators.
references:
    - https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/
author: Security Arsenal Threat Intelligence
date: 2026/08/15
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.t1003.002
    - attack.command_and_control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
    definition: 'Requires Sysmon or equivalent command-line auditing'
detection:
    selection_img:
        Image|contains:
            - '\QuarksPwDump'
            - '\mimikatz'
            - '\stowaway'
            - '\TmcLoader'
            - '\ThumbcacheService'
    selection_cli:
        CommandLine|contains:
            - 'sekurlsa::'
            - 'lsadump::'
            - 'QuarksDumpLocalHash'
    selection_hashes:
        Hashes|contains:
            - 'MD5=ebffd5a76aaa690bcdb922f82e0bacc5'
            - 'MD5=dc506ff7bb72735444fb3703a6bee6d8'
            - 'MD5=d6e86bf8a90e9b632add5fa495f97fbc'
            - 'MD5=cb6c4c70a3b171fa3404b8e1a3382116'
            - 'MD5=64e9d1950e42bc98486dfd9919463d1c'
            - 'MD5=cbbb6d483737ea3566726e51752dff40'
            - 'MD5=7f223ee0716ce2ad56f55d3744419449'
            - 'MD5=19f8befcb035f52bf70094e6b4f5779a'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team operations; validate against approved testing windows
level: critical

// OTX Hunt: Lua Loader Infostealer Chain + GoSerpent C2 — Sentinel
// Hunt window: 90 days recommended for retro-sweep
let ExfilHosts = dynamic(["mail.taikei-rmc-co.biz", "mail.allportcargoservice.com", "newremupdate.duckdns.org"]);
let LuaLoaderHashes = dynamic(["41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be",
    "2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279",
    "417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b"]);
let GoSerpentMD5 = dynamic(["ebffd5a76aaa690bcdb922f82e0bacc5","dc506ff7bb72735444fb3703a6bee6d8",
    "d6e86bf8a90e9b632add5fa495f97fbc","cb6c4c70a3b171fa3404b8e1a3382116",
    "64e9d1950e42bc98486dfd9919463d1c","cbbb6d483737ea3566726e51752dff40",
    "7f223ee0716ce2ad56f55d3744419449","19f8befcb035f52bf70094e6b4f5779a"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl has_any (ExfilHosts)
   or (RemotePort in (25, 465, 587) and InitiatingProcessFileName !in~ ("outlook.exe","thunderbird.exe","svchost.exe","MsMpEng.exe"))
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HitType = "Network";
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where (FileName in~ ("autoit3.exe","luajit.exe","lua.exe") and InitiatingProcessFileName in~ ("wscript.exe","cscript.exe","mshta.exe"))
   or ProcessCommandLine has_any ("sekurlsa::","lsadump::","QuarksDumpLocalHash","stowaway")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, MD5
| extend HitType = "Process";
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where SHA256 in~ (LuaLoaderHashes) or MD5 in~ (GoSerpentMD5)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, MD5
| extend HitType = "HashMatch";
union NetworkHits, ProcessHits, HashHits
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, HitType, FileName, RemoteUrl, SHA256
| order by LastSeen desc

# Security Arsenal - OTX IOC Hunt: Lua Loader Infostealer + GoSerpent
# Run elevated on suspect endpoints. Outputs to $env:TEMP\otx_hunt_results.txt

$out = "$env:TEMP\otx_hunt_results.txt"
"=== OTX HUNT - $(Get-Date) - $env:COMPUTERNAME ===" | Out-File $out

# 1. Lua/AutoIt loader artifacts - suspicious Run key persistence
"`n[1] Persistence - Run Keys (AutoIt/Lua/JS stagers):" | Out-File $out -Append
$runPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
              'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
              'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($p in $runPaths) {
    if (Test-Path $p) {
        Get-ItemProperty $p | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $p).($_.Name)
            if ($val -match 'autoit|luajit|lua|wscript|cscript|\.ttf|appdata.*\.js') {
                "  [$p] $($_.Name) = $val" | Out-File $out -Append
            }
        }
    }
}

# 2. Scheduled tasks referencing script hosts or Lua/AutoIt
"`n[2] Scheduled Tasks referencing script hosts/loaders:" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'autoit|luajit|lua\.exe|wscript|cscript|mshta') {
        "  TASK: $($_.TaskName) | $($_.TaskPath) | $actions" | Out-File $out -Append
    }
}

# 3. GoSerpent artifacts - ThumbcacheService masquerade + suspicious services
"`n[3] Suspicious Services (ThumbcacheService / TmcLoader masquerade):" | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'thumbcache|tmcloader|tmcpayload' -or
    ($_.Name -match 'thumbcache' -and $_.PathName -notmatch 'system32')
} | ForEach-Object { "  SVC: $($_.Name) | $($_.PathName) | $($_.State)" | Out-File $out -Append }

# 4. Known IOC hashes on disk (common staging paths)
"`n[4] File Hash Sweep (staging paths):" | Out-File $out -Append
$md5s = @('ebffd5a76aaa690bcdb922f82e0bacc5','dc506ff7bb72735444fb3703a6bee6d8',
          'd6e86bf8a90e9b632add5fa495f97fbc','cb6c4c70a3b171fa3404b8e1a3382116',
          '64e9d1950e42bc98486dfd9919463d1c','cbbb6d483737ea3566726e51752dff40',
          '7f223ee0716ce2ad56f55d3744419449','19f8befcb035f52bf70094e6b4f5779a')
$sha256s = @('41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be',
             '2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279',
             '417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b')
$paths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:ProgramData")
foreach ($dir in $paths) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue -Depth 2 | ForEach-Object {
        try {
            $m = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
            $s = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
            if ($md5s -contains $m -or $sha256s -contains $s) {
                "  *** HIT: $($_.FullName) | MD5=$m | SHA256=$s" | Out-File $out -Append
            }
        } catch {}
    }
}

# 5. Active/recent network connections to exfil + C2 infrastructure
"`n[5] Network Connections to IOC hosts:" | Out-File $out -Append
$iocs = @('taikei-rmc-co.biz','allportcargoservice.com','newremupdate.duckdns.org')
foreach ($ioc in $iocs) {
    $resolved = Resolve-DnsName $ioc -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress }
    foreach ($r in $resolved) {
        $conn = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $r.IPAddress }
        foreach ($c in $conn) {
            $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
            "  *** CONN: $($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) [$ioc] PID=$($c.OwningProcess) ($proc)" | Out-File $out -Append
        }
    }
}

# 6. Outbound SMTP from non-mail processes (Agent Tesla exfil pattern)
"`n[6] Outbound SMTP connections (ports 25/465/587):" | Out-File $out -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 25,465,587 } | ForEach-Object {
        $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue)
        if ($proc.ProcessName -notin @('OUTLOOK','thunderbird','svchost')) {
            "  *** SMTP: $($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)" | Out-File $out -Append
        }
    }

"`n=== HUNT COMPLETE ===" | Out-File $out -Append
Write-Host "Hunt complete. Results: $out" -ForegroundColor Cyan